Meta's landmark settlement with nearly every US state promises curfews and time limits for teens on Instagram and Facebook -- but rests on age and parent checks nobody has figured out how to make work.
The deal, which ended a federal trial in Oakland, California, on Wednesday, gives Meta one year to identify which of its users are 13 to 17 years old.
Those accounts will have curfews and time limits switched on by default, and only parents will be allowed to loosen them.
How that gets enforced is unclear -- and any system Meta builds risks angering privacy advocates, who warn it hands platforms and governments yet another way to identify users, infringing on civil liberty.
For the new regime to work, Meta must determine the age of every user in the participating states and territories, adults included.
Methods could include identification documents, mandatory selfies, or analysis of user activity. Any account not verified within 14 days will face the same constraints as a teenager's.
These approaches have already faltered elsewhere.
Eight months after social networks were banned for under-16s in Australia, teen usage has climbed back almost to previous levels, thanks to virtual private networks, or VPNs, that conceal a user's real identity and location.
As for parents, the agreement offers no way to establish that a supervising adult is who they claim to be.
What would stop an older sibling from passing themselves off as a guardian, Judge Yvonne Gonzalez Rogers asked Wednesday as she weighed Meta's plans.
"There is some fluidity, very intentionally," said Nicklas Akers, a California prosecutor, who added that there was no plan to require a birth certificate or identification from the parent.
- Margin of error -
With no reliable way of verifying ages and parents, curfews and time limits remain theoretical.
"Teens are notorious for finding workarounds to these types of rules, and parents can also override some of the most stringent ones," said social media industry expert Jasmine Enberg.
"Looking ahead, that could take some of the responsibility away from Meta and put it on parents, with the goal of helping insulate the company from similar cases in the future," she added.
In France, where a ban on under-15s was just struck down by the Constitutional Council, many children get around the rules with their parents' help, according to the communications regulator Arcom.
If Meta cannot verify a user with identification, such as a driver's license or passport, it will estimate age by analyzing that user's activity -- collecting still more data in the process.
"This enshrines Meta's harmful surveillance into law, and it will compromise users' privacy and anonymity while increasing their exposure to data breaches and government data requests," the digital rights group Electronic Frontier Foundation said in a statement.
The settlement does include safeguards, limiting data collection to what age estimation requires and letting adults wrongly classified as minors appeal.
It is "the most significant intervention in children's online safety we have seen," said Iain Corby, head of the AVPA, an industry association for age-verification providers.
Identification documents carry their own risks. In October, a breach at a third-party age-verification company potentially exposed the government IDs of 70,000 Discord users.
- Improvising -
With no reliable or trusted methods available, everyone is improvising.
OpenAI applies a restricted version of ChatGPT to minors by guessing a person's age from their usage patterns, an approach Meta's settlement allows.
In the European Union, where the tracking of minors is tightly constrained, it has delayed the rollout for months.
France has sketched out a different path, in which a trusted third party verifies ages using the "double-blind system" already in place for adult sites.
The verifier does not know which site is asking, and the site gets only a binary answer: allowed or not.
Nothing like that exists in the United States, where Meta will run the checks itself -- and keep the data.
