The ICO has said that it is contacting Meta following the company’s settlement of US claims concerning the design of Facebook and Instagram and their effects on children.
Court papers indicate that Meta agreed to pay up to $16.68 billion and make significant changes to its platforms. The US states alleged that Meta designed the services to encourage addictive use by children, misrepresented their safety and improperly collected children’s personal information. The settlement does not amount to a judicial finding on those allegations.
The ICO noted the steps Meta has agreed to take but emphasised that children should be protected from practices that may put their privacy, wellbeing or safety at risk. It reiterated that children’s privacy is one of its regulatory priorities and referred expressly to the Children’s Code requirement to design services with children’s best interests in mind.
The regulator is already examining how social media and video-sharing platforms use children’s personal information in recommender systems. Its decision to contact Meta suggests that the US proceedings may inform its assessment of whether comparable design and data use practices affect children in the UK.
The development is relevant beyond social media companies. Services likely to be accessed by children should be able to show how children’s interests influenced decisions about recommendations, notifications, engagement prompts, default settings and profiling.
Controls should address the characteristics of the service itself, rather than placing the principal burden on children and parents to manage risks after the product has been launched. Optional time limits, parental dashboards and privacy settings may be useful, but they do not necessarily remedy risks created by the underlying design.
Organisations should also retain evidence of the testing and decision-making behind engagement features. Data Protection Impact Assessments and Children’s Code assessments should examine foreseeable behavioural effects, the information used to personalise content and whether commercial objectives conflict with children’s interests.
The settlement may not create a binding precedent for UK organisations, but the ICO’s response makes its domestic significance clear. Providers should monitor any resulting correspondence or action and review whether their own governance addresses recommender systems and potentially compulsive design features explicitly.
For more information, see our course on Children’s Data – Practical Compliance for Organisations.
