Meta settles state addiction claims for up to $17.1 billion

Meta agreed on 26 August 2026 to settle claims from 47 states that it designed Facebook and Instagram to be addictive to children. The deal is worth up to $17.1 billion and ended a trial already underway in federal court in Oakland, California, according to Education Week. The money is the headline, but the product changes are the part that sets a precedent other companies will be measured against.

The states also accused Meta of breaking a federal privacy law. CBS News reports the claims included violating COPPA, the Children's Online Privacy Protection Act, by collecting personal data from children under 13 without a parent's consent. Education Week reports the case began with 29 states suing in 2023, led by a bipartisan group of eight attorneys general.

What Meta pays, and what is conditional

The total is not one payment. CBS News reports $12.1 billion goes to the coalition states over 10 years. A further $5 billion is conditional on rival platforms agreeing to similar terms. SFist reports Meta also settled separately with Texas for roughly $1 billion.

For scale, Education Week notes Meta's 2025 revenue was $201 billion. The same report says Meta told the court it faced potential damages of $1.4 trillion at verdict. Against that number, a settlement of this size reads as risk reduction rather than punishment.

What changes in the product

These are the concrete requirements reported across the three sources.

Change	Detail
Daily time cap	2-hour default for accounts under 18
Nightly lockout	No access between midnight and 6 a.m.
School-hours notifications	Push notifications muted on weekday school hours
Age assurance	Stronger verification for users under 18
Parental controls	Expanded controls for parents
Social comparison	"Like" counts removed for minors
Filters	Cosmetic surgery filters eliminated

SFist also reports a response requirement: 90% of teen reports must get a response within six hours. California Attorney General Rob Bonta said "Meta has agreed to make massive transformations that will reduce the risk of harm."

Meta framed it as industry-wide. A company spokesperson said Meta "just announced an agreement with a bipartisan group of 52 Attorneys General... to set a new industry standard." The 52 figure counts the District of Columbia and territories alongside the 47 states.

Where the sources disagree

Two details are not consistent across reports, and both are worth knowing before citing a figure.

California's share is given as at least $1.5 billion by CBS News and as $2 billion by SFist. The reports also differ on which companies trigger the conditional payment: CBS News names YouTube and TikTok, while SFist names YouTube, TikTok, and Snap. Other state figures are consistent. CBS News lists New Jersey at $525 million, Massachusetts at $366 million, and Virginia at $353 million. Education Week reports the Virginia figure too.

What this means for developers

If you build anything a minor can sign up for, treat this settlement as the specification you will be held to next. Regulators now have a concrete list of accepted controls. Arguing that a default cap or a nightly lockout is technically unreasonable gets much harder once a company the size of Meta has agreed to implement both.

Age assurance is the hardest item on that list, and the one to start on. Note the wording is assurance, not verification by document upload. That means signal-based estimation with a review path, which needs a decision log you can defend later. Build the audit trail at the same time as the check, because a control you cannot evidence is a control you did not implement.

The six-hour response requirement is an operations problem disguised as a legal one. A 90% response rate within six hours on teen reports means staffing, escalation paths, and measurement. If your current moderation queue has no clock on it, that is a gap to close before someone else sets your deadline.

Expect your engagement metrics to move, and plan the measurement now. Default-on time caps, muted school-hours notifications, and removed like counts all reduce session counts by design. If your team's targets assume current engagement patterns, separate compliance effects from genuine product regressions before the numbers land. Otherwise you will spend a quarter debugging a change you chose to make.

One narrower lesson sits in the COPPA claim. The allegation was collecting data from under-13s without parental consent, which is a data-handling failure, not a design one. Knowing a user's age band and gating collection accordingly is ordinary engineering. It is also the kind of detail that turns into the most expensive count in a complaint.