On August 26, Meta brought a federal trial to an end after barely one week. Nearly every U.S. state accused it of designing Instagram and Facebook to create dependency among minors, misleading the public and collecting data from children under 13 without parental authorization.
Meta agreed to pay up to $18 billion over the next decade—and broke its own record. About $12.7 billion is guaranteed; another $5 billion will depend on TikTok, YouTube and Snapchat accepting similar protections. The company denied any wrongdoing. The trial ended before the jury decided the merits of the case and before Mark Zuckerberg testified.
So the news sounds like a monumental defeat, but legally it is a civil settlement that allowed Meta to avoid a verdict that might have been much harsher—and to keep operating.
A huge figure… except for Meta
During 2025, the company that controls Facebook, Instagram and WhatsApp reported $200.966 billion in revenue and $60.458 billion in net income. The maximum payment equals three or four months of profit and will be spread across ten years. But take note: on the day of the settlement, its shares closed 1.1% higher.
In other words, the market understood the figure: it does not threaten the continuity of the business. It is worth remembering that in 2019 the Federal Trade Commission had already imposed a record $5 billion fine on Facebook for privacy violations and for breaching a 2012 order. Even so, it carried on.
How many record fines can a company pay before the word record loses all meaning? If a penalty is absorbed into operating costs and does not change incentives, it becomes the delayed price of profitable conduct.
What changes on Instagram and Facebook
People under 18 will, by default, have a combined maximum of two hours a day. There will be breaks during continuous use, blocking between midnight and six in the morning, fewer notifications during school hours, audited age checks and new content restrictions.
These are important changes, but they also demonstrate something largely overlooked in general media coverage: the technical tools to moderate children’s social media use already existed. In this context, one feeling keeps returning: while Meta was doing everything it did not admit, but preferred to pay for, were there no regulators acting?
The settlement Zuckerberg reached does not eliminate personalized recommendations or targeted advertising, the center of the business model. Disabling autoplay or choosing a chronological feed will still, in several cases, be an option that the user or the user’s parents must activate. In addition, the protections will apply only in the United States and many will last only five or ten years.
What will be done with the fine money
The funds will be distributed among the states that sued. No national system of direct compensation for families was created. New York announced mental-health services and school programs; Connecticut will devote at least half of what it receives to repairing harms linked to social media; Massachusetts committed its funds to similar purposes. In California, the political authorities will have to decide the destination of a significant portion. Other states may deposit the money into general accounts.
A portion will serve prevention and treatment, but there is no uniform remedy, since no recovery plan begins with acknowledgment of the harm generated by these digital hypodermic needles. Families and school districts seeking compensation must continue their own lawsuits. The fine reaches the state; the victim retains the burden of proving what happened.
The absent controls
The joint investigation by state attorneys general began in 2021, when internal documents and whistleblowers made visible that Facebook knew the effects Instagram could have on vulnerable teenagers. The lawsuits became public in 2023, and the trial began in 2026.
During that time, Congress held hearings and debated bills, but it still did not complete a comprehensive federal law. So, in the five years between the start of the investigation and the $18 million settlement, what were regulators doing? They were investigating with rules built for another era of the internet. But institutional time also produces consequences: Meta continued collecting data, selling advertising and refining its recommendations.
Democratic responsibility should extend to those who delayed laws, weakened oversight or allowed child protection to depend on the will of the platforms. Otherwise, politics appears at the end to collect a fine for harm it previously tolerated.
Innovation with almost no regulation: the American model
There is no single federal office that oversees Big Tech. The Federal Trade Commission—the FTC—pursues unfair or deceptive commercial practices, privacy violations and conduct that affects competition. It also enforces COPPA, which requires parental consent before collecting certain data from children under 13. The Department of Justice intervenes in possible monopoly cases. The Federal Communications Commission regulates networks, spectrum and telecommunications, not the overall design of Instagram.
That map also includes Congress, which creates legal powers; the courts, which review decisions; and state attorneys general. The latter began the joint investigation into Meta in 2021, sued in 2023 and reached trial in 2026. Fragmentation does not mean an absence of power: it means each authority may act only within a defined jurisdiction.
The system is not entirely reactive, either. COPPA imposes obligations before children’s data is collected, and the FTC can seek an injunction when it believes a company is violating, or is about to violate, a law under its jurisdiction. Merger review can also block an acquisition. What does not exist is prior federal safety certification for every new social-media feature, like that required for a drug or an airplane.
A new app feature can therefore reach millions of phones without first demonstrating that it does not create dependency. To stop it, an authority must connect it to a specific prohibition, gather evidence, overcome defenses and obtain an order. The five years in this case included investigation, lawsuits, discovery and trial preparation. Throughout that process, the product kept operating.
Meta also invoked legal limits. Section 230 protects platforms from some liability for third-party content, but in April 2026 a Massachusetts court held that it does not automatically cover product-design claims. The U.S. Supreme Court, in turn, recognized constitutional protection for certain editorial decisions involving feeds. That is not general immunity, but it requires the state to specify the conduct it regulates.
In February 2026, the Government Accountability Office still listed its recommendation for a comprehensive federal privacy law as pending. That fact describes an institutional decision without proving crimes or secret agreements: agencies investigated with the tools available, and Congress had not established either a complete national standard or a safety authority for social-media design.
Why there are no criminal convictions in the Meta case
This proceeding addressed civil violations of consumer-protection and children’s-privacy laws. The settlement does not release Meta from possible criminal liability, but so far no criminal charge has been brought in this case.
Knowing about a risk and designing a product to increase use does not automatically amount to criminal intent to cause harm. A prosecutor must identify a specific crime and prove it beyond a reasonable doubt. The corporation is not immune: it may be prosecuted for acts by employees carried out within the scope of their duties and for the company’s benefit.
Criminal law can reach Meta. The question is why the evidence gathered produced civil settlements rather than an investigation into personal responsibility.
Europe tries to intervene earlier
Europe built a different architecture. The Digital Services Act—the DSA—requires Instagram and Facebook, because of their size, to identify systemic risks to children’s rights, public health and wellbeing; adopt measures to reduce them; and undergo an independent annual audit. The assessment must also be completed before deploying a new feature that could have a critical impact.
The European Commission can request information and access to data, order changes, impose fines of up to 6% of worldwide revenue and, in exceptional circumstances, seek the temporary suspension of a service. The DSA does not, however, automatically ban infinite scrolling or nighttime notifications. It requires companies to assess and mitigate the risk they create.
The Commission reached the preliminary conclusion in July that Meta might have breached that obligation. It pointed to infinite scrolling, autoplay, notifications and personalized recommendations. It must still complete the proceeding, and its decision can be reviewed by European courts. Europe tries to intervene earlier, but it also investigates and litigates.
The Digital Markets Act—the DMA—addresses a different problem: the power of companies designated as gatekeepers. It imposes obligations in advance, fines of up to 10% of worldwide revenue—20% for repeat infringements—and, in cases of systematic noncompliance, behavioral or structural remedies. It combats concentration; it is not the main legal basis for the child-dependency case.
The Artificial Intelligence Act also classifies systems by risk, prohibits a limited group of uses and requires prior controls for high-risk systems. It is another preventive example, but it does not automatically turn Instagram’s recommender into a prohibited system or replace the DSA in this case.
The difference is not between a United States that never prevents and a Europe that always arrives first. Both systems investigate and litigate. The European Union, however, imposed continuous assessment, mitigation and auditing duties on the largest platforms. The United States retains a sectoral framework: it can stop a defined violation, but it does not require a safety assessment for every feature capable of multiplying time spent on a service.
The effectiveness of a penalty can be measured not only by the number of zeroes, but also by the verifiable destination of the money, the design changes it produces and whether it prevents the same conduct from becoming profitable again. By that standard, the $18 billion is an extraordinary response, but it does not by itself solve the problem it exposed.