Meta's $18B settlement with 29 states shields it from COPPA suits over kids' data

The clause tucked into a record payout

According to TechCrunch, Meta's settlement with attorneys general from 29 states — up to $18 billion in payments plus new child safety measures — contains a provision that has drawn far less attention than the headline figure: the states have agreed not to sue Meta under existing child privacy laws over how it retains and uses children's data.

The release is scoped to a specific purpose, training and testing Meta's age-assurance model, and it comes with guardrails. But as TechCrunch observes, granting that permission in a case centred on child safety is a curious policy choice, and one that could prove difficult to police.

What Meta must build

The agreement requires Meta to develop, train and begin testing a model that detects which users across its platforms are under 13, and to do so within a year of the document taking effect. The settlement does not mandate that the system be AI-based, though TechCrunch notes Meta's existing age-detection tools already run on AI.

COPPA, the U.S. Children's Online Privacy Protection Act, generally obliges websites and apps to limit how they collect and retain children's personal information. The settlement states that Meta should not have to breach COPPA in order to train or deploy its age-assurance model — which is precisely why the legal release exists. In exchange, Meta is barred from using data from under-13 users for advertising, marketing or algorithmic optimisation.

TechCrunch reports that the attorneys general committed, in the agreement's words, "fully, finally, and forever" not to bring past, present or future COPPA claims — or claims under comparable state statutes — tied to Meta's use of children's data.

A federal law, a state deal

Philip N. Yannella, a partner at Blank Rome who co-chairs the firm's privacy, security and data protection practice, told TechCrunch that data-minimisation conditions of this sort are routine in privacy compliance, comparing them to verifying deletion requests. His caveat is significant: COPPA is a federal statute enforced primarily by the FTC, and the FTC is not a party to this settlement, so it remains unclear whether the agency has accepted the same arrangement.

Who checks the boundaries

The deal effectively asks Meta to quarantine what it learns about children's behaviour and to use that knowledge solely to detect and remove under-13 accounts. TechCrunch points out that keeping such data technically and organisationally isolated from the rest of a company's systems is genuinely hard, though an independent auditor will monitor compliance rather than leaving it to Meta's assurances.

Several questions remain open, per the report: what data Meta will hold for training, how much behavioural information that encompasses, how long it will be retained, and how the models might shift as Meta works toward the settlement's terms.

Lawyers TechCrunch consulted said the release narrows states' options without closing them entirely. Joshua Wurtzel, a partner at Schlam Stone & Dolan, argued that if Meta uses the data beyond the agreed lines, the release and covenant not to sue simply do not apply — but any resulting dispute would turn on whether a particular use fell inside the settlement's terms. Peter Jackson, a data and IP attorney at Greenberg Glusker, was more sceptical, suggesting the release acts as a hurdle that may discourage future enforcement actions altogether.

Why it matters

A settlement of this size sets a template. Here, 29 states have traded away their ability to bring child privacy claims — including future ones — in exchange for a compliance programme whose boundaries are only partly defined. If other companies can extract similar releases, state-level enforcement of COPPA could erode one case at a time.

The deal also collides with a question now running through the AI industry: modern systems, from age-assurance models to consumer AI agents, need deep access to personal data to work well, while privacy laws like COPPA are built to minimise collection. Whether the FTC respects this carve-out, and how rigorously the independent auditor probes Meta's data isolation, will signal whether such exemptions become a standard bargaining chip — or remain a one-off.