For years Meta answered concern about teenagers on its platforms with optional tools that parents rarely found and teens rarely kept on. The settlement of a US lawsuit over social-media addiction changes the approach: the limits will be on by default, and some cannot be switched off by the teenager at all. The rules phase in over six months, with age-verification changes taking up to a year.
The new defaults for under-18s
- Two hours a day across Instagram and Facebook. Parents can grant more through parental controls; the teen cannot.
- A night lockout from midnight to 6am, when the apps will not open.
- No notifications from 8am to 3pm — school hours — so the phone in the bag stays quiet.
- Time warnings when a session runs long.
- Limited contact with unknown adults, tightening rules already partly introduced.
Why "by default" is the whole story
Meta has offered most of these as settings for years, and almost nobody used them. The change is not the existence of a two-hour cap; it is which way the switch points when nobody touches it.
That matters because defaults are not suggestions, they are policy. A permission that must be switched on is switched on rarely; a limit that must be switched off is switched off rarely. The behaviour that determines what happens to most users is the behaviour of people who never open settings at all — which is most people, including most parents who fully intended to look into it.
Making a protection optional and then reporting low uptake as evidence that families do not want it is a well-worn move. On-by-default removes that argument, and that is the change.
The feed changes go deeper
The time limits will get the headlines; the content rules change how the products work.
Teens will see a general feed rather than one built from analysis of their interests and behaviour. The distinction is larger than it sounds. A recommendation system optimised for engagement learns what holds a particular person's attention and supplies more of it — which is unobjectionable when the answer is football and dangerous when the answer is content about appearance, self-harm or eating. The criticism is not that such systems are malicious; it is that an optimiser with no concept of what it is optimising toward will find whatever works, and for a vulnerable teenager what works can be the worst possible thing.
Like counts will be hidden, removing the public scoreboard researchers associate with anxiety. Instagram tested hiding likes years ago and ultimately made it an option, which almost nobody enabled. Making it mandatory for teens is a materially different decision from making it available.
Access to some appearance-altering filters will also be restricted — a smaller change aimed at the same mechanism.
The age check is the binding constraint
Every rule above applies to accounts the platform believes belong to a teenager. That belief is the weak point, and it is where the real difficulty lies.
There are roughly four ways to establish age, and each trades accuracy against intrusion.
Self-declaration is what exists now: a birth year typed at sign-up. It costs nothing, protects nobody, and is why a large share of under-18 accounts are registered as adults — frequently entered by a child who wanted the service and sometimes by a parent who helped.
Identity documents are accurate and expensive in a different currency. Requiring an ID to use a social network means collecting identity documents from the entire user base, including every adult, which creates a database that is both a privacy liability and a target. It also excludes people without documents, who are disproportionately the people least able to argue about it.
Facial age estimation — a model guessing age from a selfie — avoids holding documents but requires sending a face image, performs unevenly across different populations, and is a probabilistic answer being used for a binary decision.
Behavioural inference guesses from signals the platform already has: who you interact with, what you search, the ages of your friends. It is invisible and needs no new data from the user, and it means the platform is building an age profile of everyone, including adults, from surveillance it already performs.
The uncomfortable conclusion is that stronger age assurance is bought with more identity data from the whole population to protect a subset of it. There is no version where only teenagers are checked, because determining who is a teenager is the task. Anyone arguing for strict age verification is arguing for that trade, and the honest version of the argument says so.
Why now
None of this is voluntary. The changes are the price of settling litigation in the United States that accused Meta of building products it knew were addictive to minors, and they arrive as Australia, the UK and several US states impose or debate legal age limits.
That distinction is worth keeping. Rules agreed in a courtroom have a compliance deadline and a counterparty who can return to court. Rules promised in a press release have neither, and the record of voluntary platform commitments is not encouraging.
The limits of the limits
Two hours on Instagram and Facebook is two hours on Instagram and Facebook. A teenager with five apps has five budgets, and the most likely effect of a cap on two of them is a shift of attention to the three without one. Platform-level limits do not solve a problem that lives at the level of the device, which is why operating-system screen-time controls — imperfect as they are — cover something these rules cannot.
Will they apply outside the US?
Meta has not said. Historically the company has rolled such protections out globally, partly because maintaining two versions of a product is expensive and partly because regulators elsewhere ask why their children get less.
In markets with millions of under-18 users, a large share of whom registered with a false birth year, the age-verification piece matters far more than the two-hour cap — because a limit only works on an account the platform knows belongs to a teenager.
Which makes the practical move for a parent the same as it was before, and more useful than waiting for the rollout: set up supervision in the app now, and correct the child's real date of birth in the account, so that whatever protections arrive actually apply to them.
