Meta’s $18B Kids Deal Forever Shields Data Used to Spot Under-13s

Meta’s multistate child-safety settlement, valued at up to $18 billion and announced August 26, 2026, requires the company to build and begin testing a model that spots users under 13 within one year. In the same document the settling attorneys general permanently release Meta from past, present or future COPPA claims and analogous state-law claims over children’s personal information used solely for that detection work.

The money and the visible features (two-hour daily caps, overnight blocks, school-hour notification mutes) dominate the headlines. The data pass sits deeper in the agreement and changes how future privacy fights against the company can proceed.

The Forever Release Buried in the Consent Judgment

The settlement agreement, filed in the Northern District of California as part of the consent judgment, states that each Settling State’s Attorney General agrees to the fullest extent permitted by law to have fully finally and forever released any COPPA claims, the COPPA Rule, or any analogous state law against Meta arising out of the continued or future maintenance or use of a child’s personal information for the sole purpose of enhancing Meta’s efforts to detect and remove U13s from its platforms.

That release and covenant not to sue is expressly limited. The data cannot be used for ads targeting and delivery, marketing, or algorithmic optimization. It must also meet the agreement’s data-minimization and security rules. Still, the bar is permanent for the covered purpose.

In consideration of the monetary provisions and commitments contained in this Agreement… each Settling State’s Attorney General agrees… to have fully, finally, and forever released any past, present, or future claims… and covenants not to sue or bring an action pursuant to the Children’s Online Privacy Protection Act… against Meta arising out of… the continued or future maintenance or continued or future use of a child’s personal information for the sole purpose of enhancing Meta’s efforts to detect and remove U13s…

Meta and State Attorneys General Consent Judgment and Settlement Agreement, Section II.A.6.b.iv

Joshua Wurtzel, a partner at Schlam Stone & Dolan, told TechCrunch that if Meta uses the data outside those lines the release does not apply. Peter Jackson of Greenberg Glusker said the carve-out could disincentivize future enforcement actions and that the age-assurance measures bear the hallmarks of a heavy and perhaps hasty negotiation.

What the U13 Age Model Must Deliver

Within one year of the effective date Meta must develop, train and conduct initial testing of a prototype age-assurance model designed to predict whether users are under 13. It reports progress and test outcomes, including effectiveness versus prior methods, to an independent auditor.

Later years set enforcement-volume targets that the auditor reviews for reasonableness. By year two and three the model is applied across accounts to help hit those targets. Soft-matching of linked accounts, simplified reporting tools and friend-network reviews after deletions already form part of the baseline U13 process that expands under the deal.

Third-party testing providers must certify performance under real-world conditions, demographic coverage and anti-circumvention controls. Meta’s proprietary methods do not receive the same presumption of compliance that certified commercial tools enjoy.

• Six-month baseline: technical soft-matching, post/comment age-indicia review, simplified in-app reporting, friend-network sweeps after U13 deletions.
• One-year: prototype U13 Age Model trained and initially tested; report to auditor.
• Two- and three-year: model deployed at scale against auditor-vetted enforcement targets; explanations required if targets missed.
• Ongoing: annual certification of enforced U13 numbers audited independently.

Meta already uses AI-powered age tools. The agreement does not mandate that the new model be AI-based, yet the training data needs and the FTC policy context make that path the practical one.

Data Isolation Rules and the Auditor

U13 data retained for the model must be held only to the extent required for developing, training, testing and measuring performance. Personally identifiable information receives Meta’s highest privacy and security standards. Data stays at the coarsest viable granularity. Anything no longer needed for the listed purposes is deleted; retainable metadata for integrity and circumvention detection has a 90-day outer clock once its purpose ends.

An independent auditor monitors compliance with the entire settlement, including these isolation rules. That structure is meant to reduce reliance on Meta’s own assurances. Still, company systems are interconnected. Signals or derived insights can migrate over time in ways that create factual disputes later.

Philip N. Yannella, co-chair of Blank Rome’s privacy practice, called such minimization guardrails typical for privacy compliance work such as deletion-request verification. He noted the important caveat that COPPA is primarily an FTC-enforced federal statute and the FTC is not a party to this settlement.

How the FTC Policy Statement Fits

The settlement expressly conditions Meta’s U13 model obligations on the continued application of the FTC’s February 2026 COPPA Enforcement Policy Statement Promoting the Adoption of Age-Verification Technology. That statement says the Commission will not bring an enforcement action under the COPPA Rule against certain general-audience and mixed-audience operators that collect personal information solely to determine a user’s age, provided they meet narrow conditions.

Those conditions track the settlement’s own limits: sole purpose, prompt deletion after the age determination, limited third-party disclosure with assurances, clear notice, reasonable security, and reasonable steps to ensure accuracy. The policy remains in force until final COPPA Rule amendments or withdrawal. The states had notified the FTC of their original action under the statute’s state-enforcement provisions.

Nothing in the settlement or the policy statement prevents the FTC from acting if Meta’s practices fall outside the sole-purpose box. The states’ own forever release simply removes one set of plaintiffs for the covered conduct.

Why Future Suits Become Messier

If questions later arise about whether behavioral signals, model weights or derived insights leaked into recommendation systems, ad delivery or other optimization, the fight turns on the settlement’s precise terms rather than an open COPPA claim. Courts would first have to decide whether the use stayed inside the “sole purpose” lane and the data-minimization rules.

That fact-intensive gate raises the cost and complexity of any new case. Jackson’s observation that the carve-out could disincentivize enforcement captures the practical effect: AGs who already settled once may hesitate to re-litigate boundary questions, especially when an auditor is already in place and public attention has moved on.

The broader settlement itself is framed by multiple AGs as the largest Big Tech settlement in history outside the tobacco deals. Base payments run roughly $12.1-12.7 billion over ten years to the coalition, with the remainder contingent on rivals such as YouTube, TikTok and Snapchat adopting comparable time limits and paying matching sums. Time-management features (two-hour hard caps with productive pauses, midnight-to-6 a.m. blocks, school-hour notification defaults) last five years or longer if industry-wide adoption occurs. Florida rejected the deal as inadequate; New Mexico had already won a separate case.

The Same Tension Now Runs Through the AI Industry

Age-assurance models need examples of how under-13 users actually behave on the platforms if they are to improve. The same pattern appears wherever AI systems are asked to perform protective tasks: agents that manage calendars, shopping or content filters often require deep personal data to function well. Meta’s settlement makes the trade-off explicit and permanent for one high-stakes use case.

Crowd reaction on X picked up the irony quickly. One engineer summarized it as the remedy for hooking kids running on kids’ data. Privacy-focused accounts called the provision a loophole that converts a privacy law into a training license. Official AG statements stayed on the payout size and the visible time limits. Few dwell on the forever language.

Enforcement of the isolation rules will depend on the auditor’s access, technical forensic ability and the willingness of states to litigate gray areas. The settlement does not detail exactly which behavioral signals Meta may retain, how long the training sets live beyond the minimum, or how model updates will be reviewed years from now.

What the Agreement Leaves Unresolved

The document is silent on several operational points that matter for long-term oversight. It does not specify the precise features or volume of behavioral data that may enter the U13 Age Model training set. It does not lock a maximum retention window beyond the “minimum required” and 90-day clocks for certain metadata. Future model architectures or multi-modal inputs are left to Meta’s best efforts under the auditor’s eye.

Those gaps sit beside clear prohibitions: no ad use, no marketing use, no algorithmic optimization use. They also sit beside the FTC’s parallel non-enforcement posture for qualifying age-verification activity. Together they create a narrow but durable corridor in which children’s data can be kept and processed for detection purposes without triggering the usual COPPA consent machinery that the Children’s Online Privacy Protection Rule requirements otherwise impose.

Parents and teens will notice the time caps and night blocks first. The data arrangements that power the under-13 dragnet will surface only if the auditor flags a problem or a later dispute forces the sealed details into the open. Until then the settlement’s most durable legal change may be the one least discussed on announcement day.

Frequently Asked Questions

What exactly does the COPPA release in Meta’s settlement cover?

It covers past, present and future claims under COPPA, the COPPA Rule and analogous state laws that arise from Meta’s maintenance or use of a child’s personal information solely to detect and remove under-13 users. It does not cover any use of that data for advertising, marketing or algorithmic optimization, and it does not bind the FTC.

Can Meta keep children’s data forever under the deal?

No. Retention is limited to the minimum period required for developing, training, testing and measuring the U13 Age Model, after which data is deleted. Certain integrity metadata has a 90-day deletion clock once no longer needed. Personally identifiable information must meet Meta’s highest security standards and stay at coarse granularity.

Does the FTC agree to the same kids-data pass?

The FTC is not a party to the settlement. Its separate February 2026 policy statement independently declines to enforce the COPPA Rule against qualifying age-verification data uses that meet sole-purpose, deletion, notice, security and accuracy conditions. The settlement conditions Meta’s model obligations on that policy remaining in effect.

Who checks whether Meta stays inside the data limits?

An independent auditor reviews Meta’s compliance with the settlement, including U13 enforcement numbers, model progress reports, false-positive certifications and the data-minimization rules. The auditor reports to the settling states.

What other child-safety changes does the $18 billion deal require?

Default two-hour daily time limits across Facebook and Instagram for under-18 users (with mandatory pauses), overnight access blocks from midnight to 6 a.m., muted notifications during school hours, options to turn off personalized feeds, and stricter age-assurance frameworks with published false-positive targets. Many features last five years and can extend if major rivals adopt similar terms.

Disclaimer: This article is news reporting and analysis of a public legal settlement and related regulatory statements. It is provided for informational purposes only and does not constitute legal advice, privacy-compliance guidance, or any recommendation about platform use or litigation strategy. Readers with questions about children’s online privacy rights, COPPA obligations, or the settlement’s effect on specific claims should consult a qualified attorney licensed in the relevant jurisdiction. All figures, deadlines and terms reflect the publicly filed agreement and contemporaneous statements as of late August 2026 and may be modified by court order, further negotiation or later regulatory action.