EFF: Meta's $17B Settlement Is a Bad Deal for Teens

TL;DR: The Electronic Frontier Foundation published a line-by-line critique of Meta's $17 billion settlement with 52 state attorneys general, announced August 26, 2026. EFF Senior Counsel David Greene argues the deal forces age estimation on every Instagram and Facebook user, hard-codes time limits and content restrictions on Teen Users, requires Meta to "proactively monitor adult accounts" for possible misclassification, and gives the attorneys general no new limits on their ability to subpoena the resulting data. The settlement runs for ten years. Florida, New Mexico, and Texas are not parties ^[1]^[2]^[3].

What the Deal Actually Says

Tech Policy Press, in its August 26, 2026 breakdown of the announcement, characterized the settlement as "up to $17.1 billion," split between "$12 billion in guaranteed payments" and a contingent balance tied to competitors ^[2]. EFF's walkthrough of the same settlement lays out the compensation as "over $11 billion" in annual payments across a ten-year life, plus an additional $5 billion if Meta competitors adopt comparable measures ^[1]. The $12 billion guaranteed is the floor, the $11 billion is the back-loaded schedule, and the contingent $5 billion kicks in if TikTok, YouTube, or Snap settle into the same framework ^[1]^[2]. All U.S. states are parties except Florida, New Mexico, and Texas; the settlement also covers D.C., American Samoa, Guam, the Northern Mariana Islands, and Puerto Rico ^[1].

Age Estimation Goes Mandatory on Every Account

The settlement's most quoted provision is the Age Assurance Framework in Section II.A.1: "Within one (1) year of the Effective Date, Meta will adopt an age assurance framework." That framework sorts every Instagram and Facebook user into one of three buckets: 18 and older, 13 to 17 (a "Teen User"), or under 13 ^[1]. Section II.A.10.b closes the opt-out route: "Fourteen (14) days or more after creating a Meta SMP account, Meta SMP users who have not yet had their age assessed... shall be treated as Teen Users... regardless of their stated age" ^[1]. EFF reads this as a forced choice: submit to age estimation or accept the teen restrictions, even if you self-attested at 25 ^[1].

The accuracy floor sits in Section II.A.6. Within two years, false-positive rates for commercially available age assurance must be "10% for minors aged 16-17 and 3% for minors aged 13-15." Meta-developed ("proprietary") methods get a slower ramp: 14% for ages 16-17 and 7% for ages 13-15 in Year 1, dropping to 10% and 5% in Year 2 ^[1]. The settlement sets no ceiling on false negatives, which is the rate at which adult users get wrongly classified as minors. The only recourse is an appeal under Section II.A.9, with decisions communicated "in a timely manner and communicated to the user along with a basis for the decision" ^[1].

A Teen Time Lockdown, by Default

Section II.B imposes "Night Access Mode" with no access except messaging from Midnight to 6 AM, blocks push notifications from 10 PM to 7 AM, and adds a "school mode" that blocks push notifications from 8 AM to 3 PM on weekdays between August 15 and June 15. The settlement caps total daily time on Instagram and Facebook at two hours, exempts video and audio content at least 22 minutes long, and inserts "productive pauses" at 60 and 90 minutes of cumulative use, with notices every 15 minutes of continuous use. Greene writes that "the right to play is among young people's human rights" and that the better setting would be tools teens control themselves ^[1].

Within four months of the Effective Date, Meta must offer Teen Users a chronological, non-personalized feed and the option to disable autoplay; likes and reaction counts also disappear from teen posts by default. Section II.E locks in Meta's existing content restrictions, including "Restricted Goods & Services," which EFF notes has been used by Meta to remove posts about abortion medication ^[1].

Why EFF Calls This Surveillance

Greene's August 26 statement is blunt: "the settlement also embeds age assurance into every product, mandating the collection of even more personal information from users of all ages; this enshrines Meta's harmful surveillance into law, and it will compromise users' privacy and anonymity while increasing their exposure to data breaches and government data requests" ^[3]. The surveillance surface EFF flags is built in. Section II.A.7.c requires Meta to run a "proactive monitoring system" that watches adult accounts for signs the user is actually a teen, and treats them as a teen if they refuse to reverify. Section II.B.6.a requires Meta to "utilize and improve its existing 'soft matching models' that track signals such as device IDs, phone numbers, and email addresses" to find duplicate accounts ^[1].

Section II.A.8 contains the data minimization language, which EFF reads as full of holes. Deletion is "enqueued" rather than immediate; the "reasonable period of time" before deletion is undefined; a category called "Retainable Data" can stay on Meta's servers for 90 days. The settlement requires "industry-standard data security measures," which EFF notes does not eliminate breach risk. Greene's closing argument: "Nowhere in the Settlement do the 52 attorneys general pledge to not try to access all of the data the Settlement requires Meta to collect and retain" ^[1].

The Contingent $5 Billion and the Next Three Targets

Tech Policy Press identifies the contingent $5.02 billion as the lever the settlement puts in the states' hands to push TikTok, YouTube, and Snap into matching Meta's framework. Three routes trigger the payment: a settlement or consent decree, an equivalent law, or "verified" voluntary compliance. A new entrant is captured when it reaches "at least 5 million teen users... at least 30 minutes daily, for... four consecutive months" ^[2]. Meta's own open letter asked rivals to fall in line: "We want to ensure teens benefit from this new industry standard, but we cannot do it alone" ^[2]. If a rival is captured, Meta must extend its Night Access block and tighten its daily cap further ^[2].

What to Watch

The Year 2 thresholds and the auditor. Proprietary age assurance methods are allowed 14% false-positive for ages 16-17 and 7% for ages 13-15 in Year 1, dropping to 10% and 5% in Year 2. Section III.E gives the Independent Auditor access to "raw data; aggregated data; information; internal documents and communications," but Tech Policy Press notes auditor reports "will have to be treated as confidential by the states," limiting public visibility ^[1]^[2]. Watch the first auditor filing for a read on whether Meta is hitting its false-positive ceilings.

The contingent trigger. The $5.02 billion fires when TikTok, YouTube, or Snap are bound to "substantially equivalent obligations." The three non-party states (Florida, New Mexico, Texas) are large teen markets too, so watch state-level litigation and bills aimed at both groups ^[1]^[2].

The data-breach surface. Greene's August 26 warning on data-breach exposure and government data requests is the long-tail risk ^[3]. Watch the first public breach disclosure from any of Meta's age-assurance vendors.