Everyone is calling Meta’s $18 billion settlement with a coalition of state attorneys general social media’s Big Tobacco moment. How apt that comparison ends up being, only time will tell. But the risk and compliance lessons from the settlement extend far beyond social media, legal and industry experts told CCI’s Jennifer L. Gaskin.
Time limits. Notification blackout periods. Age verification. Hidden engagement data. Despite agreeing to redesign Facebook and Instagram around a raft of child safety-related changes, Meta has not admitted its platforms harm children. But in settling a lawsuit brought by dozens of states over children’s privacy and consumer product safety claims, Meta leaned into protections for teens and children and sidestepped broader consumer safety claims. In the Big Tobacco context, this means teens can still smoke — just not as much.
For corporate leaders, regardless of whether or not they make a social media-style product, the lessons are clear: If the technology you market affects the public — and young people in particular — compliance, risk and legal perspectives must be involved from the beginning, Charlie Germano, counsel and chief technologist at BBB National Programs, told CCI.
“Waiting for the product to be built and then adding compliance features at the end will not mitigate the risk of enforcement in this increasingly active regulatory environment, especially for child- and teen-focused technology products,” Germano said.
The size of the settlement — as much as $18 billion over 10 years — is relatively small for a company like Meta, but for smaller organizations, child-facing technology without these types of safety features may become a liability, Labaton attorney Carol Villegas told CCI.
“Think about the effect that this is going to have on companies that aren’t as big as Meta. The fear and risk that they would face: ‘Even a fraction of $17 billion could bankrupt us,’” she said.
Approved by Judge Yvonne Gonzalez Rogers, the settlement in a federal court in Oakland, California, ended the bellwether federal trial of a case in which the attorneys general of California, Colorado, Kentucky and New Jersey, on behalf of a 29-state coalition, had originally sought about $200 billion, claiming that Meta’s products harm kids. The settlement came after barely a week of testimony and follows a pair of cases the company lost earlier this year.
Meta vs. Big Tobacco
It’s easy to look at this settlement and compare it with the master settlement agreement (MSA) tobacco companies signed in the late 1990s: both involved bipartisan coalitions of state attorneys general, both ended with billions of dollars in settlement money, both mandated changes in corporate behavior and, critically, both involved internal documents showing the companies knew far more than they let on publicly about the harm their products can cause.
In both eras, the documents that proved particularly damning were the ones showing employees had raised concerns internally and been ignored, or at least in the case of Big Tobacco, worse. For corporate integrity leaders across industries, that may be among the most actionable lessons, Armstrong Teasdale attorney Monte Mann told CCI.
“Problems arise when the documents show that employees recognized a risk, discussed it among themselves and then allowed the issue to disappear without a meaningful response,” Mann said. “If those same documents also suggest that revenue or engagement concerns influenced the decision, they can be very difficult to explain to a jury years later.”
In other words: A strong speak-up culture isn’t simply the ethical thing to do; it’s also just good risk management.
Similarly, while Meta says it will change how Facebook and Instagram work — and hopes to force changes at other social media platforms, along with hoping to compel them to pay up, too — its products will remain on the shelf, so to speak, just as cigarettes did a generation ago. And one of the features most under attack by the AGs who alleged the product is addictive is infinite scroll, which the settlement leaves intact, though other changes are aimed at limiting how deeply teens can fall into said scroll:
- Default two-hour daily time limit across Facebook and Instagram, cumulative across multiple accounts, removable only by parent.
- Block on app access between midnight and 6 a.m.
- Muted notifications during school hours, 8 a.m. to 3 p.m.
- Usage prompts after every 15 minutes of continuous scrolling.
- The option of a non-algorithmic feed.
- Hidden like counts by default.
- Blocks on cosmetic surgery and extreme makeup filters.
- Strengthened age detection for under-13 accounts.
Notably absent from that list? Direct messages, which by default won’t be subject to the notification block, and which the separate, earlier New Mexico case identified as a primary vector for adult contact with minors.
Also, by settling, Meta avoided what Stanford law professor Nora Freeman Engstrom had warned a loss would produce: a blueprint that could hand states, schools and private plaintiffs a roadmap for future litigation. The central product question — whether engineering an algorithmically compelling platform while concealing known harms constitutes a defective product under consumer protection law — remains unanswered. That’s good for Meta’s stock price, but it leaves companies in adjacent industries or with similarly engagement-driven products (like, say, AI) without a definitive answer they might wish to have.
And it does not answer the question only time can: Will this lead to meaningful improvements in corporate behavior at Meta and other platforms?
Or will history repeat itself in more ways than one? When the tobacco industry entered into the MSA in 1998, it agreed to give states $246 billion, money that was widely expected to help fund public health programs and anti-smoking initiatives. Instead, researchers say, states used the money to plug holes in their budgets, build roads and cover general expenses. Little of it has gone directly to public health, and Meta’s settlement announcement includes similarly vague language about “youth online safety initiatives, among other state priorities.”
$375M Meta Verdict Shows States Don’t Need to Make a Federal Case to Have an Impact
State AGs are elected officials with constituents to answer to; that shapes which consumer protection cases they pursue and how hard they push
Read moreDetailsNot all self-regulation is created equal
Facebook began its life as TheFacebook.com, a rather crude networking platform for students at Harvard, though it quickly expanded to other colleges and universities, initially requiring a .edu email address to start an account. Almost exactly 20 years ago, it expanded access to all users, with a de facto minimum age limit of 13 thanks to the Children’s Online Privacy Protection Act (COPPA), one of the laws at issue in the bellwether case the company settled.
For most of the two decades that followed, Meta, now the name of the parent company of both Facebook and Instagram, didn’t talk much about child safety until it became advantageous to do so.
To publicize its new teen accounts feature a few years ago, the company launched a massive advertising campaign. That campaign ramped up significantly as Meta headed into back-to-back trials — the first was a personal injury case in Los Angeles (which the company lost, along with co-defendant Google) and the bellwether federal trial it just settled.
“When Meta started making changes and you started seeing those commercials about teenagers and ‘We care,’ that happened after the lawsuits got filed,” Villegas said.
That’s perhaps not surprising; absent government regulation, lawsuits are the language of the American corporation, Villegas said: “We live in a world where litigation is almost tantamount to regulation because we don’t have a Congress that will regulate.”
Tobacco’s legal reckoning produced something Meta’s settlement might but hasn’t yet: a genuinely independent watchdog. In 1999, funds from the MSA launched the American Legacy Foundation, later named the Truth Initiative. The nonprofit organization is perhaps the most lasting legacy of the MSA, claiming credit for preventing millions of teenagers from smoking and vaping through advertising and advocacy campaigns.
Meta’s settlement envisions something similar: an independent research foundation with access to user data and a third-party auditor charged with verifying compliance with the settlement’s product changes annually for five years. Whether those mechanisms will function as genuine oversight or as mere window dressing remains to be seen. The governance structures, including who selects the auditor, what they can access and what happens when they find noncompliance, are not yet publicly defined.
“Let us not confuse independent self-regulation with industry self-regulation,” said Dona Fraser, senior vice president of privacy initiatives at BBB National Programs, which operates the nation’s first FTC-approved children’s privacy safe harbor. “The latter is simply self-policing; the results of that are clearly on display.
“A settlement can tell a company what it must do today,” Fraser said. “Independent self-regulation can help create the culture and systems that determine how a company makes decisions tomorrow. We need both, but we shouldn’t wait for a multibillion-dollar lawsuit before independent accountability begins.”
Alexandra Ryabova, head of operations at Wizz App, which has had its own controversies related to child safety, agreed — when companies are their own cops, compliance is often a casualty.
“The historical pattern across industries is pretty consistent: voluntary self-policing coalitions without external teeth or independent access tend to have a mixed record,” Ryabova said. “That’s less a verdict on any one company and more just what tends to happen when accountability stays voluntary. For smaller organizations, compliance will require real costs tied to the product, which will be needed to adjust investment and how it is redistributed across the business stack and development priorities.”
Meanwhile, litigation in this area is far from over. Meta itself is still facing lawsuits from individuals and school districts, and some of those are scheduled for trial later this year. TikTok and YouTube, which Meta wants to join its settlement, have not done so, but if they do, it would trigger both stronger protections and an additional $5 billion in conditional payments.
For companies outside social media, the most adjacent immediate frontier is AI. Villegas, who has litigated against Meta and is watching the next wave of cases take shape, sees the social media playbook being adapted for AI chatbots, which are also often designed to maximize engagement, have demonstrated appeal to vulnerable young users and which are accumulating a trove of human behavioral data that could prove as damaging in discovery as Meta’s internal documents proved in Oakland.
“I think we’re going to see some COPPA lawsuits coming from that,” Villegas said, acknowledging that even if companies don’t make their own AI, they’re still taking on risk. Some organizations already have tried to pass the buck when it comes to AI liability, and so far, neither courts nor regulators are buying it.
The lesson of Meta’s settlement — and it’s one companies should have learned by now — is that if what you say privately and what you say publicly are in conflict, you may be in big trouble, especially when the stakes are high.
“The best time to conduct that review,” Mann said, “is before a regulator or plaintiffs’ lawyer conducts it for you.”
Jennifer L. Gaskin is editorial director of Corporate Compliance Insights. A newsroom-forged journalist, she began her career in community newspapers. Her first assignment was covering a county council meeting where the main agenda item was whether the clerk's office needed a new printer (it did). Starting with her early days at small local papers, Jennifer has worked as a reporter, photographer, copy editor, page designer, manager and more. She joined the staff of Corporate Compliance Insights in 2021 and also hosts the CCI-produced podcast "Queering Compliance." 
