THE
PERMISSIONED
WEB

The settling attorneys general release certain COPPA-related claims tied to continued or future use of children's personal information solely to detect and remove under-13 users.

Meta may retain U13 data to develop, train, test, and measure its U13 model. That data cannot be used for advertising, marketing, or algorithmic optimization.

Age-assurance metadata may remain as long as needed to detect circumvention. The agreement's deletion terms do not cover a user's stated birth date, stated age, or teen/adult classification.

Meta may classify an adult account as Potentially Suspicious based on interactions with other accounts; searches for, likes, saves, or other engagement with violating content; or membership in a community Meta removed for policy violations.

Meta must maintain measures designed to limit discoverability and prevent interactions between teen users and Potentially Suspicious Accounts. If a message thread is established, Meta must warn the teen.

The agreement requires advanced anti-spoofing, resistance to bypass, account linking, proactive behavior monitoring, vendor coordination, and investigation of circumvention. It never mentions VPNs, Tor, WireGuard, ASN blocking, or DPI.

WireGuard encrypts encapsulated packets and sends its protocol packets over UDP. The protocol itself does not determine how a tunnel endpoint routes or translates the inner packet toward Meta.

MaxMind's GeoIP Anonymous IP database exposes flags for anonymous VPNs, hosting providers, public proxies, Tor exit nodes, and other anonymous networks.

In a UK study of 11- to 17-year-olds commissioned by DSIT, 22 percent of child VPN users cited access to age-restricted services. The study did not test this settlement or US behavior.

The obligations are formally limited to settling jurisdictions and disclaim a standard of care or precedent elsewhere. Yet compliance requires Meta to decide who is in those jurisdictions.

Stronger product terms and additional state payments are triggered if Snap, TikTok, YouTube, and qualifying entrants adopt substantively equivalent obligations. Meta calls the agreement a new industry standard.

Meta and a state committee of up to six attorney-general offices mutually select the auditor, and Meta pays. The auditor is entitled to reasonably relevant and sufficient nonprivileged data, systems, records, personnel, and internal communications.

Drafts, final reports, and related audit materials are treated as confidential to the extent permitted by law. Public executive summaries exclude nonpublic, proprietary, and confidential information; Meta and the state committee may review and comment on a draft.

The auditor's mandate covers implementation of the agreement's injunctive provisions; it excludes historical conduct and matters outside those provisions.

Compliance requires age inference for every covered user, cross-account matching, annual third-party testing, demographic performance checks, OS and app-store age signals, appeals, and a five-year audit.

The agreement names Snap, TikTok, and YouTube as Core Industry Members. It defines a New SMP Entrant as a product that, for four consecutive months, has at least five million monthly active US teens and at least 30 minutes of average daily teen use. Meta must notify the states before a third-party product can be treated as an entrant.

Most substantive obligations last ten years. The auditor's term ends 120 days after the fifth final report, with reports covering annual periods.

Courts retain jurisdiction and the settling attorneys general retain enforcement power. The decree separately requires annual third-party testing of every age-assurance method throughout the agreement term, so that testing outlasts the auditor.

The decree sets numeric targets for one direction of age-classification error and for U13 removals. In at least 90 percent of qualifying English- and Spanish-language Potentially Harmful Reported Content cases, Meta must respond within six hours with its decision. Meta must also give the auditor data on what users do after productive-pause notices.

Other provisions require only “best efforts,” “continuous improvement,” recurring evaluation, or a design intended to reduce harm. For productive pauses, Meta is presumptively compliant if it runs and documents the required assessment, even when it explains why no recommended change was made.

The settlement creates no private right of action. Enforcement belongs to the government parties and courts. Independent private and class claims are preserved.

Meta and the settling states waive their own constitutional challenges. Users were not parties and did not waive theirs.

The cited cases protect specific interests: McIntyre protects anonymous political pamphleteering; NAACP protects membership privacy; Brown recognizes minors' First Amendment rights; and Packingham invalidated a broad state ban on social-media access. Paxton upheld age verification for sites dominated by material legally unavailable to minors; ordinary social media was outside that holding.