\n<\/p>\n
In addition to paying out up to $18 billion<\/a> and adding child safety measures<\/a>, Meta\u2019s settlement agreement with attorneys general from 29 states includes an interesting provision: The states have agreed not to sue Meta under existing child safety laws over its retention and use of children\u2019s data.<\/p>\n That permission is being granted for the limited purpose of training and testing Meta\u2019s age-assurance model and includes guardrails, but it\u2019s a curious policy decision to make in a case centered on child safety, and one that could be difficult to properly enforce.<\/p>\n As specified in the settlement agreement, Meta must develop, train, and begin testing a model designed to detect which users on Meta\u2019s platforms are under the age of 13. This must be done within a year of the document\u2019s effective date. (While the agreement doesn\u2019t specify that the model has to be AI-based, Meta\u2019s current age-detection tools are powered by AI technology.)<\/p>\n Under U.S. child safety law, COPPA (Children\u2019s Online Privacy Protection Act) typically requires that websites and apps limit the collection and retention of children\u2019s personal information. Meta\u2019s settlement agreement says that Meta shouldn\u2019t need to violate COPPA to train or implement its age-assurance models. However, the agreement also says that the state AGs have agreed \u201cfully, finally, and forever\u201d not to bring any past, present, or future COPPA claims \u2014 or claims under similar state laws \u2014 related to Meta\u2019s use of children\u2019s data.<\/p>\n The agreement makes clear that Meta can\u2019t use data from users under age 13 for ad targeting, marketing, or algorithmic optimization.<\/p>\n Meta\u2019s request for legal protection, and the state AGs\u2019 willingness to grant it, isn\u2019t unreasonable, says Philip N. Yannella<\/a>,<\/a> a partner at law firm Blank Rome and co-chair of its Privacy, Security & Data Protection practice. \u201cThese kinds of data minimization guardrails are pretty typical for privacy compliance: e.g., verifying compliance with deletion requests,\u201d he said, though he noted a caveat: COPPA is a federal law primarily enforced by the FTC, not the states, so it\u2019s unclear whether the FTC, which isn\u2019t a party to this settlement, has separately agreed to the same compromise.<\/p>\n It can be difficult for companies to keep data technically and organizationally isolated from the rest of their systems. Yet Meta is being asked to do just that \u2014 to isolate its understanding of children\u2019s behavior signals and other data and use it solely for detecting and removing under-13 users. Fortunately, an independent auditor will be involved in monitoring Meta\u2019s compliance with the settlement so we don\u2019t only have to rely on Meta\u2019s word.<\/p>\n Policing this limitation could be complicated. The data could hypothetically feed into other Meta systems over time, or could raise questions over whether the data, signals, or insights derived from it are being used elsewhere within the company. What\u2019s not clear from the agreement is what data Meta will retain for training the model, how much behavioral information that may include, or how long it will retain the data. We also don\u2019t know how these models will change in the future as Meta meets the settlement\u2019s terms.<\/p>\n Barring state AGs from raising COPPA or similar state-law claims over this use of children\u2019s data in the future could complicate the legal avenues states can pursue if questions arise around how Meta is using the data. <\/p>\n That doesn\u2019t prevent them from pursuing legal claims, notes Joshua Wurtzel<\/a>, a partner at Schlam Stone & Dolan LLP. \u201cIf Meta uses the data outside those lines, the release and covenant not to sue don\u2019t apply,\u201d he said. But those legal disputes could still be complicated, since they\u2019d hinge on whether Meta\u2019s use of the data fell within the settlement\u2019s terms.<\/p>\n Peter Jackson, a Data & IP attorney at Greenberg Glusker LLP, agrees, saying the carve-out here could \u201cdisincentivize future enforcement actions.\u201d <\/p>\n \u201cThe Settlement Agreement\u2019s age-assurance measures bear all the hallmarks of a heavy, and perhaps hasty, negotiation,\u201d he says. <\/p>\n The decision also touches on a broader question that\u2019s been coming up across the AI industry lately, especially as more AI agents are being developed to help consumers with various tasks. The systems often require significant access to users\u2019 personal data<\/a> to work well. Similarly, Meta may need deep insight into children\u2019s use of social media in order to identify which accounts belong to young people.<\/p>\n<\/div>\n When you purchase through links in our articles, we may earn a small commission<\/a>. This doesn\u2019t affect our editorial independence.<\/em><\/p>\n