The number is enormous – up to US$16.68 billion. But the real significance of Meta’s settlement with American states lies not in the size of the cheque. It lies in what the case asks society to confront: when a digital platform is used by children, can it continue to design its products to maximise attention, engagement and data extraction and then place the burden of safety on children and their parents? Meta, which owns Facebook and Instagram, agreed to settle claims brought by 29 US states during a federal trial in California. The states alleged that Meta designed its platforms in ways that made them addictive for young users, misled the public about the risks to children and improperly collected personal data from children under 13. The allegations also included the claimed use of such data to train machine-learning and generative-AI models. Meta denied wrongdoing. That distinction matters: this is a settlement, not a final judicial finding of liability. Yet a settlement of this magnitude, accompanied by commitments to alter the use of its products by teenagers, is itself a powerful acknowledgement that the “parents must simply monitor their children better” answer is no longer sustainable. The settlement reportedly requires daily usage limits, nighttime restrictions, stronger age checks and expanded parental-control tools for teenage users. The monetary component is intended, in substantial part, to support state youth online-safety initiatives. The message is clear: when potential harm stems from the architecture of a product, the remedy must include a redesign of that architecture, not simply a fine paid years after the damage has occurred.
The real case is about design
For too long, debates about children and social media have focused only on “bad content”: sexual material, bullying, hate speech, misinformation or self-harm content. These are serious concerns. But the Meta litigation points to an even deeper issue – the business and behavioural design of the platform itself. No individual feature is necessarily unlawful. The legal and ethical question is whether the cumulative design is calibrated to keep a young user online for as long as possible, despite foreseeable risks to sleep, self-esteem, concentration, privacy and mental wellbeing. That is why this is not merely a content-moderation case. It is an emerging duty of-care-by-design case. A child is not simply a smaller adult consumer. Children and adolescents are still developing judgment, impulse control and resilience against peer pressure. A platform backed by behavioural data, algorithmic optimisation, real-time experimentation and sophisticated product teams cannot honestly pretend that it stands on equal terms with a child holding a smartphone.
A global accountability moment
The Meta case is no longer an isolated dispute in one country. From state enforcement and court proceedings in New Mexico and California, to legislative action in Australia, France and New Zealand, and regulatory scrutiny in the European Union, the same basic question is being asked: can a platform genuinely claim to protect children if its design, age-assurance systems and recommender mechanisms expose them to foreseeable harm?
India cannot wait
India already has an important legislative foundation. Section 9 of the Digital Personal Data Protection Act, 2023 (enforceable May 2027) requires a data fiduciary to obtain verifiable parental consent before processing the personal data of a child. It also prohibits processing likely to cause detrimental effects on the wellbeing of a child, as well as tracking, behavioural monitoring and targeted advertising directed at children. These are important statutory protections. But a law is only as strong as its operational enforcement. The question now is whether India will permit compliance to become a paperwork exercise. A platform should not be able to display a checkbox asking, “Are you above 13?” or “Are you above 18?”, accept any answer supplied by a child and then claim that it has discharged its duty. The European Commission’s preliminary finding against Meta is an important warning: self-declared age is not meaningful age assurance. India needs a child-safety regime that makes platforms prove absolute safety, rather than leaving children and families to prove harm after the event.
Five measures India needs to adopt
The central principle is simple: a platform must not be allowed to claim compliance because it installed an age-check tool. The legal test must be whether it actually prevents foreseeable child access, avoids profiling children, stops repeat circumvention and designs the service to protect – not retain – young users. End self-declared ages: A child must not access a platform simply by entering a false date of birth. Require privacy-preserving, independently tested age assurance— not a checkbox. The EU’s preliminary findings against Meta specifically questioned age self-declaration as an effective safeguard. Stop repeat accounts: Removing one underage account is pointless if the child can create another in minutes. Platforms must detect and prevent re-registration and repeated attempts to bypass age checks. No outsourcing of liability: Meta may use third-party age-verification vendors, but it must remain responsible for the system’s accuracy, privacy, data security and failures. A vendor cannot become a legal shield. Make platforms child-safe by default: For minors: no behavioural profiling or targeted ads, private accounts by default, restricted adult messaging, no late-night notifications, and safer recommendations – not addictive feeds. Audit, disclose, penalise: Require independent annual audits, public reporting on underage accounts and age-check failures, regulator access to records, and turnover-linked penalties for repeat non-compliance.
Childhood is not a business model
None of this means technology is the enemy. Digital platforms can help children learn, create, communicate, discover communities and access opportunities that earlier generations could scarcely imagine. The choice is not between a connected childhood and no childhood online. The choice is between a digital environment designed around a child’s best interests and one designed principally around extraction of attention and data. We must not demand that children be stronger than systems specifically engineered to capture their attention. We must not expect every parent to understand opaque algorithms, behavioural profiling and product experimentation. And we must not let companies describe safeguards as optional “features” when they should be legal duties. Children are not engagement metrics. Their sleep is not a growth strategy. Their insecurity is not advertising inventory. Their data is not raw material for commercial or AI systems. India should act before its courts are forced to ask, after years of avoidable harm, why the law allowed platforms to treat childhood as a market.
*(Khushbu Jain is a practicing advocate in the Supreme Court of India and founding partner of Ark Legal, specializing in privacy law and data protection. Can be contacted khushbu@ arklegal.in )
