US states extract $18bn Meta settlement while EU enforcement lags

The contrast is stark. On Wednesday, 47 US state attorneys general announced an $18 billion settlement with Meta that compels the company to rewrite how Instagram and Facebook treat teenagers. The agreement binds Meta to 12 specific changes over the next decade: default daily time limits for minors, rigorous age verification, the removal of cosmetic filters for teens, and a suite of parental controls. In Brussels, the European Commission has spent more than two years investigating the same platforms for the same harms under the Digital Services Act (DSA) and has yet to extract a single binding commitment or impose a penalty.

A settlement that exposes the enforcement gap

The US settlement is the largest consumer protection agreement of its kind. It covers Facebook and Instagram, the two Meta properties most used by European teenagers. The measures include disabling algorithmic recommendations for users under 18 unless a parent consents, restricting notifications during school hours and sleep time, and giving parents visibility over whom their children message. Meta must also build a system to detect and block accounts created by children under 13. The company has ten years to implement the changes, with a court-appointed monitor overseeing compliance.

From the Commission's perspective, the settlement is both validation and embarrassment. The DSA, which entered into force in November 2022 and applied fully from February 2024, already requires very large online platforms to assess and mitigate systemic risks to minors, to provide effective age verification, and to avoid design choices that exploit children's inexperience. Nine of the twelve US measures map directly onto DSA obligations, according to Thierry Breton, who negotiated the regulation as Internal Market Commissioner until 2024. "U.S. courts are going faster than the EU Commission," he wrote on X. "We must ENFORCE DSA NOW!"

Two investigations, no conclusions

The Commission opened formal proceedings against Meta in April 2024 over the company's failure to keep children under 13 off its platforms. A second investigation followed in July 2024, targeting what the Commission calls "addictive design", infinite scroll, autoplay video, algorithmic feeds optimised for engagement, and notification strategies that pull users back. Both investigations remain open. The DSA allows the Commission to impose fines of up to 6% of global annual turnover for non-compliance. On Meta's 2025 revenue, that ceiling sits around $12 billion, notably below the $18 billion the US states secured.

Meta disputes the Commission's preliminary findings in both cases. A company spokesperson said Meta has invested heavily in age assurance, parental supervision tools, and time management features. The Commission's spokesperson, Thomas Regnier, told POLITICO the executive remains "in continuous dialogue with Meta, who still has the possibility to offer commitments in the EU." That formulation, an invitation to propose voluntary commitments rather than a demand for compliance, irritates MEPs across political groups.

Political pressure mounts in Brussels

Andreas Schwab, a centre-right German MEP who helped draft the Digital Markets Act, put it bluntly: Meta in the United States "has even to go beyond what it offers to the European consumers." He called for the company's policies in the two jurisdictions to be aligned. Laura Ballarín Cereza, a Spanish centre-left MEP, submitted a written question to the Commission asking how it will "ensure that EU citizens are not left with weaker protections than those in the US." The question reflects a growing frustration that the EU's flagship digital rulebook is being outpaced by a patchwork of US state litigation.

The frustration is not merely procedural. The DSA was designed to move beyond the Whac-A-Mole of national enforcement by giving the Commission direct supervisory power over the largest platforms. Yet the Meta investigations have proceeded at a pace that allows the company to treat the EU process as a negotiation rather than a deadline. In the US, the threat of discovery, jury trials, and reputational damage across 47 jurisdictions forced a comprehensive settlement in roughly three years. The EU's centralised mechanism has, so far, produced only preliminary findings.

Different theories of harm

The substance of the two approaches diverges in ways that matter for children. The US settlement focuses on limiting access: time caps, bedtime blackouts, age gates, and parental overrides. In many cases, a teenager or a parent can switch off the protections. The Commission's July statement of objections goes further. It challenges the "engagement-maximising architecture" itself, the infinite scroll, the autoplay, the hyper-personalised feed that learns a child's vulnerabilities and exploits them. The Commission wants these features either redesigned or turned off by default for minors, not merely made optional.

Jessica Galissaire, a senior policy researcher at the think tank Interface, described the US settlement as "business as usual." The Commission, she said, is asking for "more far-reaching changes to the addictive design of the service, rather than just curtailing access to it." Francesca Pisanu of Eurochild drew a similar distinction: "The U.S. settlement establishes a combination of strong defaults, usage restrictions and parental controls, while the Commission's preliminary approach more explicitly challenges the underlying engagement-maximising architecture of the platforms themselves." Leanda Barrington-Leach of the 5Rights Foundation was sharper: "Changes which focus on limiting children's access will not prevent continued exploitation and harm to children."

The default problem

Senior Commission officials have previously dismissed Meta's existing parental controls as too complex for most families to use effectively. The US settlement relies heavily on those same controls: parents must set up supervision accounts, approve settings, and monitor dashboards. Research from the UK's Ofcom and the EU's Better Internet for Kids network consistently shows that fewer than one in five parents activate such tools. A default-off architecture, where the protective setting applies unless a positive choice is made to weaken it, shifts the burden from families to the platform. That is the direction the Commission's objections point, but the US settlement does not require it.

Meta's response to the Commission's July findings illustrates the gap. The company argued that its "Take a Break" reminders, daily limit tools, and notification controls satisfy the DSA's requirement to mitigate addictive design. The Commission's preliminary view is that they do not, because they leave the core engagement loops intact and place the onus on the child or parent to resist them. The US settlement accepts Meta's framing: it adds default time limits but allows opt-outs. The EU process could yet demand more.

Global rollout remains optional

Meta has not committed to extending the US settlement terms to users outside the United States. The company said it will "monitor how these changes are working in the U.S. and continue to engage with other governments." That stance has drawn explicit demands from the UK, South Korea, and Australia. Pat McFadden, the UK's Secretary of State for Work and Pensions, told Sky News he expected Meta to apply the changes in Britain, saying the government did not want "a situation where young people in America have got a higher rate of protection than young people in the U.K." The UK's Online Safety Act, which entered force in 2023, gives Ofcom powers comparable to the DSA, but Ofcom's codes of practice for children's safety are still being finalised.

South Korea's communications regulator has also asked Meta to match the US protections. In Australia, the eSafety Commissioner has signalled that the US settlement sets a new benchmark. Meta's reluctance to globalise the changes suggests the company calculates that a fragmented regulatory landscape serves it better than a single high standard. If the Commission accepts commitments that fall short of the US settlement, that calculation is rewarded.

What the Commission decides next

The Commission can accept Meta's commitments, making them legally binding under the DSA. It can reject them and issue a non-compliance decision, triggering the fine procedure. Or it can continue the dialogue. The first path risks locking in a lower standard than the US settlement. The second invites years of litigation in the General Court and the Court of Justice, during which Meta's current designs remain live. The third preserves the status quo. None is politically comfortable.