When the product becomes the evidence

What is established — and what remains alleged

The attorneys general of California, Colorado, Kentucky and New Jersey are litigating in the US District Court for the Northern District of California. Trial began on 18 August 2026 after Meta was denied summary judgment.

The complaint alleges that Meta designed features of Facebook and Instagram to drive excessive use by minors, collected or used data from children under 13, and downplayed risks. These are contested allegations, not judicial findings.

Denying summary judgment allowed the case to proceed to trial. It did not decide liability or damages. When the ranking was frozen, the jury had not returned a verdict.

A complaint sets out what one side says it can prove. A verdict may later establish what the law accepts as fact. Between them, law provides an adversarial process; a press release is not a judgment.

A default, recommendation, notification, exit sequence or age check has an author, a purpose, success metrics and ordinarily an audit trail. A “continue” button can have a much longer résumé than its two syllables suggest.

Law is looking at the architect’s plan

The case spans COPPA, consumer law and design choices. In Europe, the GDPR and Digital Services Act lead to a related question: does the service protect the minor, or make the child bear the full burden of protecting themselves?

Self-declared age, defaults, recommendations, exit friction and advertising are product choices. They can become matters of governance, evidence and, sometimes, liability.

COPPA protects the data of children under thirteen and, where it applies, requires measures including notice to parents and verifiable parental consent. The revised Rule also strengthens provisions concerning advertising, retention and security.

European guidance translates Article 28 DSA into product choices: private defaults, recommendations less likely to create content spirals, excessive-use features off by default, effective blocking and proportionate age assurance. The guidance is non-binding and does not automatically guarantee compliance.

A child should not have to understand a platform’s business model before being able to protect themselves. Protection lives in the order of screens, the ease of saying no, quiet notifications and a genuine exit.

What the settlement actually says

On 21 August, the Department of Justice announced a settlement with TikTok and ByteDance over allegations involving data of children under 13 and compliance with COPPA.

The structure is precise: $300 million is payable; a further $100 million would follow if the court grants TikTok’s request to vacate the earlier Musical.ly injunction. Writing only “$400 million fine” would erase that condition.

The release also describes controls TikTok says it has already improved. They should not be recast as new undertakings imposed by the settlement. There is no determination of liability.

The payment structure belongs ahead of the headline: $300 million is immediately payable. The remaining $100 million becomes payable only when a court vacates the earlier injunction against Musical.ly.

The complaint alleged that children could create regular accounts, data was collected or retained without adequate notice and parental consent, and some deletion requests were mishandled. TikTok disputed the claims; settlement avoids a judicial determination.

Why Europe should watch

COPPA is US law. The design problem is not. The GDPR gives children special protection; the Digital Services Act adds safety duties and restricts, among other things, certain profiling-based advertising to minors.

Age assurance must be proportionate: strong enough to protect and restrained enough not to build a fresh surveillance database.

A date-of-birth field is not a barrier; it is a door with a sign on it. Age assurance should match the risk without becoming a reason to collect everyone’s identity.

The EDPB emphasises necessity, proportionality, data minimisation, purpose limitation, security and effective redress. Protecting minors does not justify building a new database about every user.

What the regulator decided

More than 170 French drivers complained to the CNIL through the French Human Rights League. The Dutch DPA handled the case as lead authority.

On 21 August, it announced a fine of €824,990,000. It considered certain temporary or permanent account suspensions triggered by suspected fraud or low ratings to be fully automated decisions with a significant effect on income.

The regulator also found that the claimed human involvement was not meaningful enough and that information to drivers was insufficient. Uber rejects those findings and announced an appeal. No appellate ruling was available on 25 August.

The figure commands attention, but the core question is shorter: who may decide that someone cannot work tomorrow morning? According to the regulator, a closed account meant no rides and therefore no income through the platform.

Uber disputes the findings and announced an appeal. That belongs in the story: the authority has decided while judicial review remains open.

The decisive word: intervention

Article 22 of the GDPR protects against decisions based solely on automated processing that produce legal effects or similarly significantly affect a person. Where an exception applies, the person must be able to obtain human intervention, express their point of view and contest the decision.

A human who confirms a score without understanding the file or having power to change the outcome is not necessarily meaningful intervention.

Not every algorithm meets Article 22. There must be a solely automated decision with legal or similarly significant effects. Losing access to the tool through which someone earns a living is not an awkward film recommendation.

In SCHUFA, a score may itself be a decision where a third party gives it a determining role. In Dun & Bradstreet Austria, the Court requires a concise, intelligible explanation of the procedure and principles actually applied to the individual case.

Meaningful human involvement requires expertise, time and authority to change the result. Without all three, the human is scenery.