Twenty-nine state attorneys general went into an Oakland, California courtroom this month seeking roughly $200 billion from Meta over claims of teen addiction. Their case ended in its second week, with a settlement agreement that requires Meta to pay up to $17 billion across 10 years and make several product changes, such as a midnight-to-6 a.m. blackout, a two-hour daily cap, and an optional chronological feed. While some of these requirements are steps in the right direction, the settlement gives the company too many ways to avoid making meaningful, lasting changes to their products. The agreement is time-limited, relies on Meta's definitions of critical terms, and doesn't require detailed disclosure to the public.

What makes this settlement worthy of attention is the deal's requirement for an independent auditor, which is the first time anyone examining Meta's product design will be chosen by someone other than the company. Independent regulators, such as the Federal Communications Commission, are a proven (if imperfect) way to protect the public interest, and social media platforms are now at least as important to our lives (and our children's lives) as the broadcast and telecom industries that the FCC regulates.

Under the agreement, an independent auditor will have access to Meta's internal data and engineers, a mandate to report annually on whether the company is doing what it promised, and an obligation to make a summary of each report public.

Mariana Olaizola Rosenblat is a policy advisor on technology and law at the New York University Stern Center for Business and Human Rights. Her work focuses on governance of online gaming, social media, encrypted messaging, and 3D immersive ("metaverse") technologies. Prior to joining the Center, Mariana taught at the University of Chicago Law School and consulted for several international human rights organizations. She has a J.D. from Yale University and a B.A. from Princeton University.

Jonathan Bellack is the author of Platformocracy, a free weekly newsletter that advocates for democratic governance of online platforms. He is in his fourth decade as an Internet professional, including 15 years as a senior product leader in ads and online safety at Google, and was the founding director of the Applied Social Media Lab at Harvard’s Berkman Klein Center for Internet and Society. Jonathan has a B.A. from Yale University and an M.B.A. from the New York University Stern School of Business.

On the surface, this is good news. But look a little deeper and it becomes clear the auditor's power is too limited. First, the agreement repeatedly defers to Meta's current business practices, rather than defining new standards based on the public interest. For example, Age Appropriate Experiences are defined as "content captured in Meta's applicable Ages 13+ content setting." Harmful Experiences are defined as "behaviors that violate Meta's Community Standards," and age verification data must only be protected "using Meta's highest data privacy and security standards." This creates myriad openings for clever Meta employees to meet the letter of the agreement while avoiding real change.

Second, the auditor's public report will be heavily redacted. The summary will describe the status of Meta's implementation of the agreement for the period, and whether Meta adopted or agreed to adopt the auditor's recommendations. But it allows Meta to exclude information that it deems "nonpublic, proprietary, or Confidential." Given that one of the core issues of this case was Meta burying unfavorable data, this is deeply concerning.

This limited public disclosure is insufficient for external researchers and the public interest. Meta says in its public announcement of the settlement that the agreement includes the establishment of "an independent social media research foundation" with which "Meta will share consented user data… to advance independent research into teen well-being" — but we could find no mention of this foundation as an obligation in the settlement.

Finally, the requirement for an independent auditor expires in as little as five years (the agreement itself expires after 10 years). This creates an incentive for Meta to run down the clock until it can return to business as usual, rather than making permanent changes.

We do not mean to suggest this agreement is not a positive step. Its weaknesses are not failures of negotiation, but rather a reflection of the limits of a legal settlement: a bargain with one company, for a fixed period, based on specific legal claims at the time of agreement.

That's why legislators urgently need to act now. A new law, preferably at the federal level, should convert the independent auditor into a strong, permanent regulatory oversight body, funded with annual fees on big tech companies in proportion to the size of their business and impact on society.

A permanent regulator could also go beyond one-time agreements on specific Meta features, and build an ongoing body of research and practice around safety best practices. This would allow society to develop its own definitions and standard of care that could apply internet-wide. A more comprehensive approach to regulating social media, looking beyond issues of child safety on specific platforms, is needed.

There's a particular need for the public to have more insight and control over how social media feeds are constructed. The agreement requires Meta to offer teens the option of choosing a non-personalized (and thus presumably less addictive) "home" feed, but doesn’t make this the default, and still lets teens continue to use the personalized feed. Since research has shown most people dislike chronological feeds, this requirement will probably have limited real-world impact.

Further, the provisions establish that the non-personalized feed will consist of "content [that] is populated by accounts the Teen User follows or has friended, displayed in chronological order." This assumes that a chronological feed is the best alternative to Meta's curated feed. There is an argument that well-designed algorithms could actually contribute to improved mental health if optimized to deprioritize toxic posts and misinformation, while aligning with users' preferences as to what gives them long-term value.

We also urgently need independent, rigorous audit standards for privacy and security of online identity data. Trusting the same company that gave us the Cambridge Analytica scandal to grade their own homework on this front is a bad bet.

We hope that this settlement agreement will become a baseline, not a high water mark, for more thoughtful regulation of internet platforms. This case, and the many other pending lawsuits in state and federal courts, are useful in providing evidentiary material, political attention, and specific concessions. But they are not substitutes for the durable rules and institutions that only Congress and state legislatures can provide.

Editor's Note: This opinion piece was jointly published on Friday Aug. 28 in Jonathan Bellack's free weekly newsletter, Platformocracy, which advocates for more democracy in our online lives.

Opinion on Live Science gives you insight on the most important issues in science that affect you and the world around you today, written by experts and leading scientists in their field.