In August, Meta settled a social media addiction case with Attorneys General (AGs) in 47 states, the District of Columbia, and US territories. That settlement is poised to provide an influx of cash into notoriously strapped state efforts toward strengthening and supporting enforcement efforts against the largest companies in the world. Each year for the next ten years, states will receive a minimum of $1.2 billion from Meta. In total, plaintiffs could receive up to $16.7 billion.

The settlement funds are intended to “be used for any lawful purpose consistent with the Settling State’s Attorney General’s authority” for “remedial or restitutive purposes,” but the terms contemplate things like investing in “digital wellness public education” and “digital literacy.” Based on our experience trying to enforce the law in a thinly resourced state AG’s office and as former federal enforcers who have seen how Meta treats court orders, we have some other suggestions for how to achieve said “remedial and restitutive” ends.

The ideas below focus on strengthening and supporting enforcement capacity, more ambitious remediation options, and forward-looking, open approaches with flexible applications that can be tailored to different agency structures and resource levels.

1. Hire technologists within offices of state attorneys general

States need in-house technologists for many reasons, not least of which because they can read raw data, challenge metrics, write dispute notices, review code, and reject sampling in favor of full sets of data. Every state should at bare minimum have a chief technologist as part of agency leadership making tough decisions, and at baseline build a real interdisciplinary team of people who can look under the hood at any conduct in question. The ultimate goal would be for the public to not have to wait for harm to be fully deployed then litigated to be able to detect and address that harm.

The meta settlement dictates that an auditor’s work plan, methodologies, and metrics are negotiated between Meta and a subcommittee of some states. It is essential that the committee includes technologists who can interrogate the terms of that oversight.

Without the capacity and expertise technologists bring, the reports most plaintiffs will receive are a weak form of oversight. To put this in perspective, Cambridge Analytica happened while Facebook was under order with the Federal Trade Commission, and an agency full of very smart lawyers was getting regular reports from an auditor.

2. Build open-source, shared complaint infrastructure

Meta is up front that anyone offering help when you run into a problem with Meta is likely a scammer. In the settlement, however, Meta agreed to design their systems to answer teens’ reports. What happens when those answers never come, are wrong, or are late? What happens when there are emergent issues not contemplated by the settlement?

States should use the money to work together to build open source, shared complaint infrastructure. Everything from form design to routing logic and open data are things that states could collectively invest in to both examine Meta’s performance on the settlement terms and also allow emergent issues to be addressed before harm proliferates.

For context, researchers recently discovered leaked secret instructions from Meta to its own chatbots, instructing the chatbots to “not recommend contacting any Data Protection Authority, regulator, or supervisory authority,” even though people may need to do exactly that.

While it seems that Meta may not want the public to contact regulators, they should at minimum be incentivized to make it easier and faster to get a straight answer from the company itself before people get so frustrated they turn to the AGs for help (and maybe alert them to settlement violations). Meta keeping their own house in order would save a lot of money, time, and grief for the public and for enforcers.

3. Invest in technical partnerships with harmed communities

New York City recently dedicated $4.3 million of its $131.5 million DoorDash settlement to partners who built software letting workers share their data directly with the agency. From the city:

“Worker-driven Data Collection: Workers Justice Project and the Workers’ Algorithm Observatory will develop software that allows workers to capture the information DoorDash presents to them about their trips and pay and share that information with City government. Workers Justice Project will conduct outreach to workers about the technology and their rights under City law.”

A similar partnership with youth-led groups, government-backing, and public interest researchers would give states a line of evidence that doesn’t run through Meta or its auditor. Parents and families could opt in to a data co-op as part of enforcement; call it “Parental Controls” for Meta.

From the same city press release: “DoorDash is prohibited from preventing or penalizing workers for using the tool.”

Protecting against research retaliation is essential. Meta has taken action to curtail researcher access, and it ultimately required intervention from the FTC and Congress.

4. Build — and share — investigative labs

States should have access to their own labs with test devices, controlled accounts, biometric and sensor tools, synthetic identities, and chain of custody infrastructure such that they can produce evidence that holds up in a dispute or before a judge. States should invest in building their own labs, or sign interagency agreements with other states, the FTC, the US Department of Justice, or state bureaus of investigation. It should be the case that any state has access to the tech and infrastructure they need to look into how systems work.Certain provisions of the Meta order are only verifiable by watching the products themselves. For example:

• The midnight to 6 a.m. lockout,
• The 10 p.m. to 7 a.m. and school-hours notification limit,
• The cap across linked accounts, and
• The 14-day default teen treatment for new accounts.

These features — and others like them — should be something that an AG’s office can easily check without waiting for an auditor.

5. Build in-house AI auditing teams

The technical core of the order is about AI models, including models focused on false-positive ceilings for kids under 18, content classifiers, and more. Meta certifies its own performance rates and enjoys a presumption of compliance for vendor tools if, among other conditions, the settings used in testing match what is applied to users. Only people who can run evaluations can check that.

The to-be-named auditor’s access only covers “non-privileged,” redacted material.

States’ understanding of how well Meta is upholding its end of the deal should not be limited to what can be gleaned through non-privileged slices of filtered information. States should have the capacity to audit AI in house, alongside the ability to compel access to data, records, and sworn testimony from insiders as they deem appropriate.

Consider the most “viral” AI audit to date, the METR overview of OpenAI’s Hugging Face attack. They describe their limitations starkly. They had to accept $400,000 in free tokens from OpenAI; negotiate data access, site visits, employee access, and more; and accept limits on the scope of the investigation. There’s an argument to be made that these limitations illustrate that the government has the best set of legal tools and incentives to independently look into potentially illegal conduct carried out with AI systems.

6. Create co-enforcement bounty programs

Build reward programs where the public can submit potential violations of the order or other laws, and the state routes credible evidence through the dispute process, and where appropriate, the AGs assess civil penalties or contempt-of-court findings against Meta. A portion of the civil penalty — other similar bounty programs can offer 25 percent of assessed penalties — would be awarded to the person who submitted the evidence.

As an example, imagine that a DC parent and teen agreed that the teen could sign up for an Instagram account, but that teen received prohibited notifications in the middle of the night. The parent then collects screenshot evidence of late night notifications on the account and reports the issue to the DC Attorney General, who initiates a dispute process which finds Meta in violation of the settlement. If the AG assesses a $5,000 civil penalty for a first time violation of the agreement, that parent could receive a $1,250 bounty for catching and reporting that violation — hopefully before more children were targeted.

Part of this work can be partnering with community groups to help them understand how these companies work, how to understand their rights, and how to spot a potential violation.

7. Fund a public Meta evidence library and obligations tracker

States could award a grant to a university or research consortium to build a public evidence library — it could include all public filings, unsealed exhibits, public statements, earnings call transcripts, depositions, and more. It could also include annotations or clinic-style contributions from law schools. Think Wikipedia meets a digital law library meets a social media law clinic.

This will help the public and AGs across the country because unfortunately, Meta is so notorious for making it difficult to find even basic information that a federal judge formally sanctioned the company for such conduct, writing that “[t]his case is an example of a wealthy client (Facebook) and its high-powered law firm (Gibson Dunn) using delay, misdirection, and frivolous arguments to make litigation unfairly difficult and expensive for their opponents.”

In this settlement, Meta estimates that it cost the states roughly $75 million to sue Meta. A publicly funded evidence library could dramatically cut costs for any future litigation and increase efficiency for other enforcers who may need to take action.

Additionally, the library could include a live tracker of the court-ordered deadlines to which Meta is subject.

8. Create a remedies lab

For the product changes, Meta itself gets to assess effectiveness, “retains discretion,” and is presumptively compliant if it documents its own process. Meaning: Meta is largely grading its own homework.

States could fund independent human-computer-interaction and user research at universities, and could include teens, parents and youth as co-designers. The published results could inform auditor recommendations and modifications of the judgments. Other ways to use this expertise would be to do a regular lookback at remedy effectiveness with regard to general deterrence, to develop fellowships for remedy R&D work, and host working sessions where interdisciplinary experts could collaborate with agency attorneys.

Right now, much government-funded “consumer advice” around tech shames and puts the burden on kids and parents rather than holding the companies with all the power, and all the incentives to hook them to tech, to account. This is a chance to research what really works, with IRB oversight, independence from industry, predictable funding, and potentially with teeth. It’s a chance to get the companies to change rather than putting the burden on the kids and families who are being monetized. It also fits the remedial categories contemplated by the order.

9. Fund R&D into the tech we want

The order’s definitions are fundamentally a design spec. They include things like banning infinite scroll and offering up chronological, non-personalized feeds limited to accounts kids followed on purpose.

In addition to forcing a company to make its tech less harmful, we could invest in making the kind of tech that’s only possible with public funding. There’s a long history of breakthroughs that have been fueled with federal funding, and more than a century of leadership by states like Massachusetts in funding workhorse innovation that has social returns but won’t necessarily maximize profits for a private investor. There are a huge number of models, from an In-Q-Tel 501c3 venture capital approach, to university lab funding, to creating a YCombinator-like incubator for teachers-cum-techies who want to make their dream tools without relying on profits from monetizing children’s data.

Every teacher in America should have access to options for video players or quiz software — or whatever tools they need — that don't rely on surveillance as a business model. What if kids could have a retrofitted or refurbished music player that reduced screentime? What if a bunch of smart people were funded to work on things like this all day? And what if the things they made were open source?

10. Examine the full stack: Data centers and beyond

States should build investigatory teams that are looking into the full stack, not just the websites, app interfaces, or notifications that were the end point of the harm (and already most visible to non-technical audiences).

That could include building and funding teams looking into the following:

• Data centers. Including but not limited to:
  • Energy and grid costs, power purchase agreements, and who pays for transmission;
  • Any non-disclosure agreements, confidential filings, and tax incentives related to sites or permits;
  • Environmental impacts, including water use and quality, air pollution, and construction runoff.
• AI and model layer. While Meta’s chatbots and other AI features are excluded from the settlement, there may be patterns of conduct of interest to AGs under existing state and federal laws.
• Training and sensor data. Enforcers should review whether training data used by Meta or AI products used by Meta contain ill-gotten data, such as CSAM, data in violation of COPPA, biometric information that should not have been collected, or data in violation of state law, has been baked into their AI work products.
• Third parties. Age verification vendors, app stores, cloud and ad partners, and the data brokers or ad systems that touch or have touched teen data should be scrutinized for compliance with existing law and court orders.
• Messaging. While messaging services are carved out of the settlement, this is a product area where kids may be at heightened risk and Meta may only face scrutiny from parties with subpoena power.

Investing in critical enforcement capacity

This settlement creates a rare opportunity to build state capacity to hold one of the most powerful technology companies in the world accountable — but it’s not a given that they can pull it off. In many states, AG staffers who work on cases like these will need to convince not only their political leadership, but also the people who actually control state agency budgets and appropriations. The people who authorize spending on things like infrastructure considering options like these, which state governments have historically gone without, might mistake these as optional one-offs rather than sound investments. A government-salaried technologist, AI auditor, or lab may look expensive on the front end, but that investment is almost certainly much, much cheaper than the alternatives: allowing preventable harms to compound, paying outside firms in a crisis, and trying to enforce a complex technology settlement without anyone on staff who can tell whether the company is complying.

The cost of not building that capacity will ultimately be paid by the public, and in this case, by children. States should take the opportunity to build the expertise and infrastructure they need to move accountability from promise to reality — and to be ready for the next big case.