The Homework App and the Midnight Feed: How to Design Personalization for Young Users After the Meta Settlement

The biggest child safety settlement in U.S. history was about a design choice. When Meta agreed in August 2026 to pay at least $12.1 billion, and up to $17.1 billion, to resolve claims by 47 states, the District of Columbia and several territories, the states’ core allegation was that Instagram and Facebook’s recommendation systems were built to keep teenagers hooked. Meta did not admit those allegations by settling. Georgia Attorney General Chris Carr’s announcement called it the largest state consumer protection settlement outside the tobacco cases of the 1990s. The safety terms it accepted, though, read like a rulebook for personalization: daily time caps, nighttime blocks on feeds, quiet hours for notifications, and limits on features such as visible like counts.

That settlement, two jury verdicts against online services earlier this year, and bills moving in Congress have put personalized feeds at the center of youth privacy policy. Holly Hawkins, youth policy director at the Future of Privacy Forum, argued in a recent op-ed that the hardest part is telling two kinds of personalization apart. A homework app that offers a simpler explanation because a student struggled with fractions last week is personalization. So is a feed that has learned exactly what keeps a teenager scrolling at midnight. Both use data about a young person to decide what to show next. They differ in what data they use and what they are trying to achieve.

For companies that build products young people use, the practical question is how to design and document personalization so it lands on the right side of that line.

What the Meta settlement actually requires

According to the District of Columbia Attorney General’s announcement of August 26, 2026, Meta will pay at least $12.1 billion over ten years, with another $5 billion contingent on other major platforms adopting similar protections. The required safety features include:

• A combined two-hour daily time limit for children across Instagram and Facebook, with mandatory pauses after 15 minutes of continuous use and again at 60 and 90 minutes, for five years. If Snapchat, TikTok and YouTube adopt comparable terms, the cap drops to 60 minutes per platform for ten years.
• Nighttime blocks on children’s access to feeds from midnight to 6 a.m., and silenced notifications from 10 p.m. to 7 a.m.
• No push notifications on school-year weekdays from 8 a.m. to 3 p.m.
• Stronger age assurance, parental controls and content safeguards around bullying, eating disorders, suicide and self-harm.
• Limits on social comparison features such as beauty filters and visible like counts.
• Regular review by an independent auditor, overseen by the settling states.

None of these terms bans personalization. They put limits on the times, the volume and the features that the states connected to compulsive use. That is the same distinction the policy debate is now trying to draw in law.

Laws are already targeting the feed

California and New York already restrict personalized feeds for minors without parental consent. New York’s rules, covered in our report on the finalized SAFE for Kids Act rules, take effect in 2027 and pair feed restrictions with age assurance. In Congress, proposals would give minors more control over recommendation systems and limit design features tied to compulsive use, as described in our coverage of the Senate Commerce Committee advancing KOSA and children’s AI bills. Other states, such as Connecticut and Arkansas, have their own approaches. Australia has gone further and banned social media accounts for children under 16, and regulators abroad are opening their own inquiries, such as Turkey’s investigation into social media companies’ handling of children’s data.

The approaches range from opt-out controls to outright bans. An on-off switch is the bluntest tool, and Hawkins’ point is that it also switches off the useful kind of personalization: the adaptive learning tool that is a student’s only one-to-one instruction, or the accessibility features that let a young person with a disability take part at all.

Functional versus higher-impact personalization

The Future of Privacy Forum’s recent report on youth personalization splits personalization into two broad groups. Teams can use the same split when they review their own products.

• Functional personalization uses basic data, such as device type, IP address, approximate location or age, to localize the experience, adapt the interface, or apply age-appropriate safety settings.
• Higher-impact personalization uses much more data, such as browsing history, watch time and usage patterns, to shape content for engagement or monetization rather than for function or safety.

The difference is not only technical. Higher-impact systems need more data collection, longer retention, and often cross-platform tracking or detailed profiles. Each of those adds privacy risk on top of the wellbeing concerns about filter bubbles and rabbit holes that researchers and child safety advocates have documented.

A five-step review for youth-facing personalization

1. List every personalization feature. Include recommendations, autoplay, notifications, search ranking, adaptive difficulty, ads and AI-generated suggestions. Teams often count only the main feed.
2. Record the data each one uses. For each feature, note which signals feed it, where they come from, who receives them, and how long they are kept. A recommendation model trained on watch time is different from a setting that uses only age band and language.
3. State the purpose in one sentence. “Helps students practice skills they got wrong” is a function. “Increases daily sessions” is an engagement goal. If the honest sentence is about engagement, the feature belongs in the higher-impact group.
4. Match controls to impact. Functional features may only need clear notice. Higher-impact features call for defaults that are off for minors, parental controls where the law requires them, time and notification limits, and no cross-platform tracking.
5. Test what users actually get. A setting in a policy document is not proof that the feed changed. Check with test accounts in each age band that the defaults, time limits and notification quiet hours behave as documented.

AI features need the same review. As our piece on why asking kids to opt out of AI is already too late argues, defaults matter more than opt-outs for young users.

Where Captain Compliance fits

Captain Compliance’s assessment and data mapping tools help teams record what data each feature uses, why, and who receives it, and its consent management and hosted privacy notices help present those choices clearly. Those records support a risk-based design review. They do not decide on their own whether a feed is lawful for minors in a given state, and they do not replace age assurance or product changes.

Frequently asked questions

Did Meta admit its platforms were addictive?

No. The settlement resolves allegations made by the states. Settling is not an admission of liability. The settlement does require specific product changes and independent audits.

Is all personalization for minors restricted?

No. Current laws and the settlement focus on personalized feeds, compulsive-use features and notifications. Functional personalization, such as adapting an interface or applying safety settings, is generally treated differently, though each law defines its scope.

What counts as “higher-impact” personalization?

In the Future of Privacy Forum’s framing, it is personalization that relies on extensive data such as browsing history, watch time and usage patterns to drive engagement or monetization.

How should an education technology company respond?

Document what each adaptive feature uses and why, avoid cross-platform tracking and ad profiling, and keep learning personalization separate from any engagement features. Then check the state laws that apply to your users.

Does the settlement bind TikTok, Snapchat or YouTube?

No. It binds Meta. Part of the payment and stricter time limits depend on whether those platforms adopt comparable terms.

The dial is harder to build than the switch

Lawmakers can write an on-off rule in a paragraph. Building a dial means knowing, feature by feature, what data goes in and what the system is optimizing for. Most companies have never written that down. The ones that do will be able to show a regulator, or a jury, that their homework app is a homework app. The ones that don’t may find that the law treats everything they personalize as the midnight feed.