ICO says US Meta ruling reinforces child-centred platform design after a New Mexico court imposed substantial penalties and five years of reforms on Facebook and Instagram.
The Information Commissioner’s Office (ICO) has said it is contacting Meta following the outcome of a landmark US case concerning risks to children on Facebook and Instagram. The UK regulator linked the result to its own priorities on children’s privacy, age-appropriate design and the use of young people’s personal information in recommender systems. Although the New Mexico proceedings were brought under US consumer protection and public nuisance law, the ICO’s response gives UK online services a clear compliance message: protecting children must be embedded in product design, data use and senior-level governance.
The New Mexico judgment combines major financial penalties with five years of platform reforms.
The proceedings were brought by the New Mexico Department of Justice following an investigation into child safety risks on Meta’s platforms. In March 2026, a jury found Meta liable for misleading consumers about the safety of Facebook and Instagram and for conduct that endangered children. The jury imposed civil penalties of $375 million for 75,000 violations of New Mexico’s Unfair Practices Act.
The second phase addressed the state’s public nuisance claim and the measures required to respond to the harms identified at trial. In August 2026, the First Judicial District Court ordered Meta to pay a further $567 million towards addressing the youth mental health crisis and imposed court-supervised reforms for five years. The two awards brought Meta’s total financial exposure in New Mexico to $942 million.
The ordered reforms reach into the design and operation of Facebook and Instagram.
The court-ordered measures include more rigorous age verification for New Mexico users, strengthened Teen Account protections and enhanced safeguards against sextortion and child sexual exploitation. Meta must also introduce default privacy protections for minors, hide public like counts, restrict overnight push notifications, impose time-use limits and provide clearer disclosures about platform risks.
Meta is also required to file public compliance reports with the court twice a year. This combination of financial consequences, mandatory product changes and continuing oversight is significant for businesses because it treats platform architecture and user experience as central parts of accountability, rather than leaving child safety to policies or parental controls alone.
The ICO is connecting the US outcome with the UK Children’s Code.
In its statement, the ICO said children should be able to benefit from the online world while being protected from practices that may put their privacy, wellbeing or safety at risk. It emphasised that children’s privacy remains a regulatory priority and that the Children’s Code requires online services to design products with children’s best interests in mind.
The ICO’s intervention does not import the New Mexico judgment into UK law. It does, however, show that the regulator sees the US outcome as relevant to the same practical questions addressed by UK data protection regulation: how services identify young users, configure privacy defaults, explain data practices and prevent data-driven features from exposing children to foreseeable harm.
Recommender systems remain a particular area of regulatory attention.
The ICO specifically referred to its ongoing work examining how social media and video-sharing platforms use children’s personal information in recommender systems. These systems can determine which content is prioritised, how long users remain engaged and whether harmful material is repeatedly promoted. Their operation may involve extensive profiling and the continuous use of behavioural data.
For DPOs, this makes the data protection analysis inseparable from product design. Organisations should be able to explain what personal information feeds a recommender system, why each category of data is necessary, how outputs are tested for risks to children and which safeguards apply by default. Where processing is likely to result in a high risk to children, a data protection impact assessment should influence design decisions before deployment and remain under review as the system changes.
Age assurance must be effective without creating unnecessary privacy risks.
The New Mexico reforms place renewed attention on age verification, while the ICO’s Children’s Code expects services likely to be accessed by children to take a risk-based approach to recognising their users’ ages. Simply asking users to enter a date of birth may provide little assurance where access to adult-style settings or data-intensive features depends on the answer.
At the same time, stronger age assurance can itself involve sensitive or intrusive processing. Organisations should select methods proportionate to the risks, minimise the information collected, define short retention periods and scrutinise external providers. DPOs should also test whether the service can protect children through privacy-preserving defaults and data minimisation rather than making access dependent on excessive identity collection.
Senior management should treat children’s privacy as a product governance responsibility.
The ICO’s decision to contact Meta reinforces that children’s privacy is an active enforcement priority. Businesses offering online services likely to be accessed by children should not wait for a complaint or investigation before reviewing their controls. Boards and senior management should understand how commercial objectives, engagement metrics and automated systems affect young users, and ensure that teams have the authority and resources to address identified risks.
A defensible governance programme should connect the DPO, product, engineering, safety, security and commercial functions. It should document decisions about age assurance, profiling, default settings, transparency and children’s rights, with measurable evidence that safeguards work in practice. Organisations should also monitor developments beyond their immediate jurisdiction: the legal basis of the New Mexico case differs from UK data protection law, but the underlying expectations around child-centred design and corporate accountability are increasingly convergent.
Discover how Aphaia helps organisations operationalise children’s privacy and platform accountability.
Aphaia helps organisations assess online products through the GDPR, UK GDPR, Children’s Code and wider digital regulation. Through DPIAs, privacy-by-design reviews, AI and recommender-system governance and practical compliance programmes, Aphaia supports businesses in translating children’s best interests into documented product requirements, effective safeguards and accountable decision-making.
