The Meta settlement is a start, but it's not enough to create real change — that's what we need to focus on now

Twenty-nine state attorneys general went into an Oakland, California courtroom this month seeking roughly $200 billion from Meta over claims of teen addiction.

Their case ended in its second week, with a settlement agreement that requires Meta to pay up to $17 billion across 10 years and make several product changes, such as a midnight-to-6 a.m. blackout, a two-hour daily cap, and an optional chronological feed.

While some of these requirements are steps in the right direction, the settlement gives the company too many ways to avoid making meaningful, lasting changes to their products.

The agreement is time-limited, relies on Meta's definitions of critical terms, and doesn't require detailed disclosure to the public.

What makes this settlement worthy of attention is the deal's requirement for an independent auditor, which is the first time anyone examining Meta's product design will be chosen by someone other than the company.

Independent regulators, such as the Federal Communications Commission, are a proven (if imperfect) way to protect the public interest, and social media platforms are now at least as important to our lives (and our children's lives) as the broadcast and telecom industries that the FCC regulates.

Under the agreement, an independent auditor will have access to Meta's internal data and engineers, a mandate to report annually on whether the company is doing what it promised, and an obligation to make a summary of each report public.

On the surface, this is good news.

But look a little deeper and it becomes clear the auditor's power is too limited.

First, the agreement repeatedly defers to Meta's current business practices, rather than defining new standards based on the public interest.

For example, Age Appropriate Experiences are defined as "content captured in Meta's applicable Ages 13+ content setting." Harmful Experiences are defined as "behaviors that violate Meta's Community Standards," and age verification data must only be protected "using Meta's highest data privacy and security standards." This creates myriad openings for clever Meta employees to meet the letter of the agreement while avoiding real change.

Second, the auditor's public report will be heavily redacted.

The summary will describe the status of Meta's implementation of the agreement for the period, and whether Meta adopted or agreed to adopt the auditor's recommendations.

But it allows Meta to exclude information that it deems "nonpublic, proprietary, or Confidential." Given that one of the core issues of this case was Meta burying unfavorable data, this is deeply concerning.