Learn how the settlement Meta reached with 52 attorneys general could set a standard that impacts your business.

The United States has no federal artificial intelligence statute. There is no American equivalent of the EU AI Act, no agency that certifies AI models, and no registry of high-risk systems. And yet, on August 26, 2026, Meta — the parent company of Facebook, Instagram and WhatsApp, among others — agreed to subject Instagram and Facebook to an algorithmic governance regime with mandatory error thresholds, annual third-party testing, and an independent auditor who reports to state attorneys general.

It did not take a federal AI law to get there. Instead, it required the political will of a bipartisan coalition of state attorneys general determined to litigate against Meta, and that litigation produced a settlement agreement whose effects will be felt across every state and territory, Puerto Rico included.

That is the point worth absorbing for anyone working in AI governance: while we waited for comprehensive federal legislation, algorithmic regulation in the United States arrived through consumer protection litigation.

What was the case that led to this outcome?

The settlement was reached inside a consolidated proceeding, In re Social Media Adolescent Addiction/Personal Injury Products Liability Litigation (MDL 3047, Northern District of California), which consolidated several state lawsuits against Meta on 2 legal theories:

1. Unfair and deceptive practices, under what are known as state “UDAP” statutes (Unfair and Deceptive Acts or Practices). The states alleged that Meta designed its platforms to maximize the time adolescents would spend on them — through notification mechanics, infinite scrolling, and social rewards — while publicly representing that its products were safe and that its protective tools worked as advertised.
2. COPPA violations. COPPA is the federal privacy statute protecting children under 13, and the states alleged Meta collected children’s data without verifiable parental consent, among other failures.

Meta denied all liability, and the agreement signed last week contains no admission of wrongdoing. Nevertheless, Meta will pay a guaranteed minimum of roughly $12.7 billion to what may be 48 states, the District of Columbia and 3 territories — Puerto Rico among them — distributed over the next 10 years. That figure could rise, according to Meta, to approximately $18 billion if other platforms meet certain conditions.

Five pieces of AI governance hidden inside a consumer protection settlement

Beyond a payment of a magnitude that would be catastrophic for the vast majority of companies worldwide, the more significant fact may be this: under the agreement, Meta committed — potentially for the next decade — to what is arguably the first AI governance framework established inside a legal proceeding. This agreement will need to be studied by every business, and particularly by those that market to minors or that know their websites and apps are used by minors.

The governance framework the agreement establishes:

1. A model with a written error threshold.

Meta is required to deploy age estimation methods — trained classifiers, not sign-up forms — and to meet maximum false positive rates: roughly 10% for minors aged 16 and 17, and 3% for the 13-to-15 group, with wider tolerances during the first year for proprietary methods. The agreement also requires Meta to build and test a dedicated model to detect users under 13, with annual detection targets.

This is remarkable. An American judicial settlement is fixing the minimum statistical performance of a machine learning model, by age group, in concrete numbers — leaving none of the ambiguity that “reasonable” or “commercially appropriate” criteria would have allowed.

2. Annual algorithmic audit by an independent third party.

An independent auditor will verify, on an annual basis, the false positive rates, the volumes of underage account detection, the effectiveness of the account-linking models, and the efficacy of the usage pauses, and will report to the states. In practice, this is an algorithmic system audit analogous to the one Article 37 of the European Digital Services Act (“DSA”) requires annually of very large platforms — with the difference that, in the United States, the requirement did not arrive through legislation but embedded in a consent judgment.

3. Purpose limitation on the model’s data.

Data collected to estimate age must be deleted immediately after the age determination is made, protected under the company’s highest standards, and may not be used for advertising, marketing, or to optimize recommendation models.

4. A right to contest an automated decision.

If the system misclassifies your age, Meta must offer a clear and conspicuous mechanism to appeal that determination, and must resolve it within a reasonable time.

5. The recommendation system becomes a regulated object.

Meta must offer a chronological feed — with no algorithmic personalization — on a reasonably accessible basis, present it actively to new teen accounts within the first 10 days, and remind users every 90 days. Supervising parents can lock that feed as the default. Add to this that teens will, by default, be unable to see how many likes or reactions posts receive; the pauses at 60 and 90 minutes of use; the overnight block; and the silencing of notifications during school hours.

The agreement does not treat the recommendation algorithm as an untouchable trade secret, but as a product feature that a regulator can order switched off where it is found to be defective, deceptive or abusive.

The global view: Europe reached a similar determination first, but through a different legal route

If these terms sound familiar to anyone who works with European regulation, that is because they are. On April 29, 2026, the European Commission preliminarily found that Meta had breached the Digital Services Act precisely for failing to identify, assess or mitigate the risk of children under 13 accessing Instagram and Facebook. The Commission estimated that between 10% and 12% of children under 13 in the EU use those platforms, and criticized a reporting tool for underage accounts that required up to seven clicks. Fines under the DSA can reach 6% of a company’s total worldwide annual turnover.

The European instruments worth remembering for these matters include:

• DSA. Article 28 requires privacy, safety and security measures for minors and bars advertising based on profiling directed at minors; Articles 34 and 35 require assessment and mitigation of systemic risks, including effects on the physical and mental well-being of minors; Article 37 imposes annual independent audits; and Article 38 requires very large platforms to offer at least one recommender option not based on profiling. In other words: the chronological feed the states extracted from Meta by settlement is already a legal obligation in Europe.
• GDPR. Article 8 governs children’s consent; Article 5(1)(b) and (c), purpose limitation and data minimisation; Article 22 and Recital 71, automated decision-making, which “should not concern a child”; Article 25, data protection by design and by default; and Article 35, impact assessments. In February 2025,the European Data Protection Board issued a statement on age assurance setting out 10 principles that anticipate, almost point for point, what the Meta settlement now requires: proportionality, minimisation, demonstrable effectiveness, safeguards against automated decision-making, and the warning that age assurance “should not provide additional means for service providers to identify, locate, profile or track natural persons.”
• AI Act. Less applicable than one would expect, and it is worth understanding why. Article 5 — in force since February 2, 2025 — prohibits AI systems that exploit vulnerabilities arising from age in order to materially distort behaviour and cause significant harm, which describes the states’ theory about Meta’s addictive design. But the high-risk obligations under Annex III — the ones that bring risk management, data governance, technical documentation, human oversight and accuracy requirements — were deferred by the Digital Omnibus agreed in 2026, and now begin on December 2, 2027.

So, as things stand, the European instrument designed expressly to govern AI does not yet fully apply to these systems, while an American court settlement, negotiated under consumer protection laws dating to the 1970s, is already formally setting error thresholds and audits. Consequently, AI governance did not arrive through the creation of a purpose-built legal framework, as everyone assumed it would.

Why should this matter to me?

1. Because you do not need an AI law for someone to demand AI governance from you. Any deceptive practices statute — Puerto Rico’s included — can be used to ask whether your model does what you said it does. If your company claims its system “detects fraud with 99% accuracy” or that its algorithm “does not discriminate,” that is a legally enforceable representation, and the burden of proving it is yours.
2. Because the evidentiary standard in these cases has shifted. Meta did not lose because of what it did. Its legal exposure came because of the distance between its public representations and its own internal documents. In algorithmic governance cases, you generate the adverse evidence yourself: your evaluation metrics, your risk memos, the service tickets and complaints nobody inside the company ever addressed.
3. Because numerical obligations are now being normalized. Once a public settlement establishes that an age classifier must operate at a 3% false positive rate for the 13-to-15 age group, that number becomes the reference point for the next case, the next contract, and the next negotiation with an enterprise customer.
4. Because transatlantic convergence is becoming real. This settlement and the European regulatory framework point at the same approach — one that looks at the defects, risks and harms a product causes, and imposes nearly identical remedies. If you build for both markets, designing twice will increasingly be seen as wasted money: to be safe and to limit liability, you will have to operate to the most demanding standard.

How can I comply?

1. Inventory your automated systems. Not just what you call “AI.” Include your scoring models, classifiers, recommendation engines and segmentation rules, among others. You cannot govern what you have not counted.
2. Define the metrics before you deploy, not after. What is the acceptable error rate? For which subgroups? Who measures it, and how often? Write it down before a regulator or a court writes it for you.
3. Build purpose limitation into your data pipeline. Data collected for compliance — verification, security, fraud prevention — must not be recycled for training, marketing or profiling. Beyond writing policies to that effect, create technical documentation that substantiates it.
4. Build a mechanism to respond to individual complaints. Every automated decision affecting a person needs a visible route of appeal and a human being to handle it. This is already required in Europe under the GDPR, and it will increasingly be expected in the states.
5. Prepare for an audit you cannot control. Assume that at some point a third party will ask for your evaluation documentation, your decision logs and your model change history. If that does not exist today, we recommend you build it within the next three months.
6. Review your model vendors. If your classifier is built or maintained by a third party, their error rates are your error rates. Ask for certifications and keep them.
7. If you are in Puerto Rico, start now — do not wait for a local AI statute. We already have Act 163 of 2026, which amended the Right to One’s Own Image Act to expressly cover representations generated, cloned or simulated by artificial intelligence, commonly known as deepfakes. And, if your business offers services to people in the European Union, the GDPR and the DSA apply to you even if your office is in San Juan, Aguadilla or Ponce.

Conclusion

For years, the conversation about AI governance in the United States circled around a single question: when will a federal AI law arrive? The Meta settlement suggests that this was the wrong question.

Algorithmic regulation arrived with no AI statute, no specialized agency and no legislative process. It arrived as a negotiated remedy inside a case, with numbers, deadlines and an auditor. And it arrived with a principle that applies to any organization deploying models, whether it has 50 employees or 50,000: if you cannot measure your system, you cannot defend it.

Europe built this order through regulations. The United States just wrote it into a consent judgment. The result, for whoever builds the products, is very nearly the same.

Want to know whether your business’s automated systems can withstand this kind of scrutiny? You can book a consultation with us today. We are here to help.

About the Author

Jaime Farrant is an attorney admitted to practice in Puerto Rico, New York, Maryland and the District of Columbia, with an LL.M. in International Law, focused on privacy, cybersecurity and artificial intelligence regulation for businesses and healthcare providers.

ATTORNEY ADVERTISING. This article constitutes advertising as defined under the rules of professional conduct in force in New York (22 NYCRR 1200.7.1 and 1200.7.3), Maryland (Rule 19-307.1 and 19-307.2) and the District of Columbia (D.C. Rules of Professional Conduct 7.1), as well as the Puerto Rico Rules of Professional Conduct (Rules 7.1-7.3). It does not constitute solicitation of known potential clients in need of legal services in a particular matter. Rather, it is general information directed to the public about the practice of law and the legal services available. No attorney-client relationship is created by reading this article or by contacting the author.