The proposed settlement between Meta and 51 U.S. state attorneys general, filed last week and still subject to court approval, ranks among the biggest developments in technology litigation in years, featuring both big money and big design changes. The settlement is limited to the participating states, but it is likely to have significant implications for Canadian users and for legislative initiatives such as Bill C-34. Whether Meta extends the measures voluntarily, in response to similar Canadian lawsuits, or as part of a legislated duty to act responsibly in Bill C-34, changes are likely to make their way into Canada. This post highlights key provisions of the settlement and reviews the implications for three Canadian policy concerns: legislation vs. litigation, age verification or age assurance, and privacy.

The settlement headlines point to a US$17.1 billion payment, though the fine print states that US$11.7 billion is guaranteed over 10 years, and the remaining $5 billion is contingent on Snap, TikTok, and YouTube accepting comparable obligations. This is real money, though Meta obviously feared that even bigger payouts were possible if the litigation continued. More notable are the design changes, which go some way toward addressing longstanding demands for changes to the services themselves rather than to who may use them. Backed by an age assurance framework, teens aged 13 to 17 can still use Instagram and Facebook, but subject to new conditions that include a default cumulative limit of two hours per day across both services, a block on most features between midnight and 6 a.m., muting most push notifications during school hours, like counts hidden by default, a notice after fifteen minutes of continuous use and mandatory pauses at 60 and 90 minutes of daily use, restrictions on cosmetic procedure filters, and optional protective settings, including autoplay restrictions, that parents can enable. Children under 13 are already barred under Meta’s terms of service, but the settlement requires more effective identification and removal.

The Canadian implications begin with the emphasis on design regulation rather than on social media bans. As I noted when the defective design verdict was released in April, regulating how platforms are designed, rather than who may use them, is the better approach. The Bill C-34 legislative approach to implementing similar changes offers a more sustainable mechanism than settlements obtained through litigation. Despite its detail, the settlement is limited to Meta services for ten years (some of the core protections reportedly last only five unless Snap, TikTok, and YouTube adopt equivalent restrictions) and includes a clause providing that nothing in the agreement shall “establish a standard of care for, or serve as precedent in any non-participating U.S. state or any international jurisdiction whatsoever.”

The bill could easily be used to achieve the same thing by leveraging the duty to act responsibly, digital safety plan requirements, and the regulatory powers of the Digital Safety Commission to create a framework that applies to all social media platforms captured by the law. Canadian Heritage’s own response to the settlement, telling Global News that it expects platforms to ensure their products are “safe by design, for children and for all users,” is a case for exactly these provisions rather than for the ban.

The age-assurance aspects of the settlement are critical, given the prospect that this will emerge as the de facto standard. In the settlement, Meta agreed to an age assurance framework applying commercially available or proprietary methods “to each Meta SMP user in the Settling States,” grouping users into those under 13, who are removed, those aged 13 to 17, who receive the design protections, and adults, with users who have not completed assurance treated as teens by default after fourteen days. The settlement goes further than any legislation in specifying acceptable error:

Any Commercially Available Age Assurance Methods deployed by Meta for any new and existing users in the Settling States shall meet or fall below the following U18 False Positive Rates excluding method circumvention within one year of the Effective Date: 10% for minors aged 16-17 and 3% for minors aged 13-15.

Methods must be certified annually against international standards. Yet note that the thresholds measure only minors misclassified as adults with no limits on adults misclassified as minors. Adults who are mistakenly classified can file an appeal and continue to use the service in teen settings. That would not be the case under Bill C-34’s ban, where the same error would block the user altogether. The blocking of lawful content for adults heightens the constitutional vulnerability I have described and played a key role in the French constitutional court’s ruling striking down its proposed under-15 ban as unconstitutional.

Moreover, the settlement contemplates commercial age assurance vendors and age signals supplied by Apple and Google. Assuming the same infrastructure is used to verify Canadians, the identity documents and biometric data for millions of Canadian users could be sent to non-Canadian providers, since there is no requirement that verification be performed in Canada or by Canadian providers. As digital sovereignty becomes an increasingly important consideration, the age-verification system arising from Bill C-34 could represent one of the biggest risks to domestic control over Canadian identity information.

The privacy implications of the settlement also warrant closer scrutiny, given the clear prioritization of consumer protection over privacy. There are some privacy safeguards, including requiring that age assurance data be held only as long as needed, queued for deletion, encrypted, and walled off from advertising and algorithmic uses. However, the settlement also contains some significant exceptions, notably that data used to train Meta’s under-13 detection model and integrity metadata are carved out and the settlement imposes no new limits on Meta’s collection of teen data. Most of the settling states have no comprehensive privacy law to provide safeguards beyond those found in the settlement.

Meta must surely view the settlement as a privacy win, since it can continue to capture user data of all ages, and every settling state commits not to sue under children’s privacy laws regarding Meta’s retention of children’s personal information for the purpose of identifying and removing under-13 users. Canada is better positioned by its national privacy laws and by the privacy criteria in Section 27(2) of Bill C-34, which limit the collection and use of personal information to age-verification purposes and require its destruction once verification is complete. Yet those criteria are assessed by a Commission that under the government’s plan will not exist when the ban takes effect, and nothing in them addresses where verification occurs or who performs it.

The takeaway is that the settlement confirms the importance of focusing on design changes to social media, but on its own, it is insufficient to address social media concerns. Bill C-34 offers a better model, but only with some important reforms, including rethinking the constitutionally vulnerable social media ban and emphasizing the need to incorporate strong privacy and digital sovereignty safeguards into the legislation.