Alessandro 'kLeZ' Accardo personal website

The personal website of an Italian developer. /nick kLeZ, since forever.

Social media considered harmful. Maybe... (2/5): Who's stopping them, or trying to

Posted on • by

On 25 March 2026, in Los Angeles, twelve ordinary people locked in a room did what years of Congressional hearings had failed to do: they took a good hard look at Instagram and YouTube and decided, ten votes to two, that they had been negligently designed, that the companies had warned nobody of the risks, and that the design had been a substantial factor in the harm suffered by someone who is now around twenty. Six million dollars, and one of the first real cracks in a wall that looked like reinforced concrete.

Last week I told you that they knew. This time I want to tell you about the people who tried to stop them, because they deserve it: governments, judges, parliaments, regulators, and a handful of people who refused to give up. Spoiler: in front of a jury, when they get that far, the platforms always lose, and in front of a law they almost never do.

§Who tried a ban

The country that showed the most nerve is Australia. Since 10 December 2025, anyone under 16 cannot have an account, and platforms that don’t comply face fines of up to 109 million Australian dollars.

Three months later the Australian authorities measured the effect and, rarer than it ought to be, had the honesty to publish it even though the numbers weren’t exactly triumphant. Kids aged 10 to 15 with at least one account went from 52.4 to 42.1%, so something moved. Among those who kept their account, though, half say the platform never asked them how old they were. And wellbeing, sleep and self-esteem stayed more or less where they were.

I remain convinced that for minors a ban is the most effective measure, exactly as it was for cigarettes, and those numbers don’t change my mind. What they do tell me is where the system leaks: the tap was left in the hands of the platforms, that is, the very people who profit from every kid the age-checking algorithm forgets, from every leak. It’s like putting the barman who gets a cut on the cocktails in charge of checking IDs at the club door.

§In front of a jury, they lost

In the United States, where almost all these companies are based, history was written by two juries within twenty-four hours of each other.

The first came on 24 March in Santa Fe, where a jury found that Meta had misled the public about the risks to minors’ mental health and about sexual exploitation. The plaintiff was the state of New Mexico, which won 375 million dollars, calculated on the maximum allowed per violation (the state was asking for more than two billion). On 6 August Judge Bryan Biedscheid went further and declared the platforms a public nuisance, the legal category usually used to shut down a factory poisoning the local river. Another 567 million for an abatement fund and, far more important than the money, a set of specific obligations: limits on use by teenagers, restrictions on notifications, controls on contact between adults and minors, and reports to the court every six months.

The next day came the Los Angeles verdict, the first of thousands of individual cases. The plaintiff, identified in the filings only by the initials KGM, had sued four companies, and two of them preferred not to see it through: Snap settled the week before the trial began, TikTok on the eve of opening statements. Meta and Google, on the other hand, chose to go all the way to a verdict, and lost: three million in compensation, 70% of it on Meta, and another three in punitive damages. Judge Carolyn Kuhl then rejected their motions to set aside the verdict, and in July the two companies appealed. Meta’s line of defence is that teenage mental health is “profoundly complex” and can’t be pinned on a single app. True, it is complex. But complexity is also the argument with which, from tobacco onwards, anyone who needed to buy time has always closed the conversation.

Six million, for Meta, is less than half an hour’s revenue, and the bill itself doesn’t worry it. That verdict matters for another reason: a jury treated a social network the way you treat a car with faulty brakes. It judged the design, and left alone the content flowing over it, which has always been the shield these companies hid behind.

Two trials that made it to a verdict, two defeats.

§When they see a trial coming, they pay

The rest of the litigation tells the other half of the strategy, less spectacular and far more effective.

In the big federal proceeding bundling thousands of cases, the first trial brought by a school district, that of Breathitt County, Kentucky, was due to start in mid-June. It never started, because the four companies paid up first: 27 million in total, admitting nothing and without changing a single line of the product. The schools of a rural American county got their money, and their kids, the next day, opened the exact same apps.

Then came the big settlement. On 18 August the trial brought against Meta by dozens of state attorneys general opened in Oakland, and after eight days of hearings Meta signed: up to 17 billion dollars over ten years, about 5 of which are tied to other platforms adopting similar measures. Here, though, unlike Kentucky, the product is inside the deal, and that’s the part I really care about. For minors there will be a two-hour daily limit as the default, which only a parent can remove, a night-time lockout from midnight to six, notifications off at night and during school hours, like counts hidden, no filters simulating cosmetic surgery, and the option of a non-personalised feed. On top of that, an independent monitor with broad access to information, and a ban on making misleading claims about safety.

In the text of the settlement Meta denies every allegation and all liability. It’s the standard formula, and legally it matters.

I read it differently. Whoever signs for 17 billion after just eight days of trial has, in my view, taken a good look at the jurors in Santa Fe and Los Angeles, done the maths, and realised it would end badly in Oakland too.

Then there’s a detail that ties back to last week’s instalment. Among the measures wrung out by the attorneys general is hiding like counts from minors, that is Project Daisy, the very feature Meta’s researchers had already tested and which, according to internal documents, hadn’t improved anyone’s wellbeing. The company had launched it as window dressing, an option to switch on to look good, and now it has to turn it on because it’s obliged to.

§American law protects the mechanism itself

If juries are needed in the United States, it’s because the law over there is on the other side, and has been for thirty years.

The rule is called Section 230, it dates from 1996, and it says a platform is not liable for what its users post. It was designed for the forums of the early internet, and today it shields companies worth more than the GDP of entire countries. In November 2023 federal judge Yvonne Gonzalez Rogers opened a breach, ruling that design defect claims can proceed, because they concern the product and not the content. In the same order, however, the law forced her to leave out precisely the claims about the infinite feed and engagement-maximising algorithms, that is, the heart of the little machine I described last week. It’s one of those situations where a judge can only half agree with you, because the legislature has tied the other hand behind their back.

Congress, meanwhile, is debating, as it has for years. The Kids Online Safety Act passed the Senate in 2024 by 91 votes to 3, a majority almost never seen in Washington, and then ran aground in the House. This year the House approved its own version, but stripped out the duty of care on platforms, which for the bill’s Senate sponsors was the heart of the law. As far as I know, to date neither version is law.

And when a regulator really did strike, this is how it went. In 2019 the Federal Trade Commission hit Facebook with a 5 billion dollar fine over privacy, with an obligation to be monitored by an independent assessor. In 2023 the same Commission accused the company of not fully complying with the order, citing the assessor itself, who had found “several gaps and weaknesses”. Meta’s response was to sue to stop the case being reopened.

§Europe has the law

Over here the situation is reversed, and for once we can even be a little proud of it. Here the law exists, it’s called the Digital Services Act, and it’s the reason someone occasionally tells you, with a knowing air, that in Europe the problem is solved.

To be fair, the Commission is using it to look exactly where it should. On 6 February it sent TikTok its preliminary findings: the app’s design is addictive and breaches the regulation. On 10 July it did the same with Instagram and Facebook, in words I frankly never expected to read in a Brussels press release:

[These features] fuel the user’s urge to keep scrolling and shift the brain into “autopilot mode”, contributing to unhealthy habits and compulsive use.

And the remedies it asks for are design remedies, which is the right thing: autoplay and infinite scroll off by default, real breaks, an algorithm less obsessed with engagement. The Commission adds that parental controls aren’t enough, because they offload the work onto parents.

The problem is that these are preliminary findings, and as far as I know there’s no final decision to date. The only fine handed to a social network under the regulation so far is the one against X, 120 million euros in December 2025, and it was about the misleading blue tick and data access for researchers: nothing to do with addiction.

Then there’s the part that touches my own job, and that makes me angriest. The regulation requires large platforms to be audited every year by an independent auditor, and so far so good. The auditor, however, is chosen and paid by the platform. The first round of audits closed at the end of 2024 and, according to an analysis by the University of Amsterdam’s observatory, for Facebook the articles left outside the audit included, among others, those on deceptive interfaces, protection of minors, assessment of systemic risks and measures to mitigate them. The stated reason is that the Commission was already investigating those points, and it’s an understandable reason.

The result, though, is that the annual audit stayed silent precisely on the articles that deal with the harm.

As a software architect I know full well what an audit of this kind looks at: it checks that procedures exist, that the minutes are in order, that the people responsible have been appointed. To find out what a recommender system actually does, you need a technical team, access to the code and the data, and months of work. And you need auditors who don’t have to hope that the people they’re auditing will renew their contract next year. “The legislation is there” is a weak argument if those who have to enforce it check the paperwork and never open the bonnet.

I’m a software architect by trade, as I said. And among my various duties I deal with regulation and certification; above all, my job is to make sure that the architectures I design and the software produced under my supervision and responsibility can be certified against the various standards (ISO 27001 and NIS2 mostly, but others too, more sporadically, for particular clients). I’ve also done, and still do, the other job, the one on the other side (more or less, I’m not an auditor), meaning I go and do technical assessments and check whether, and how far, the systems I analyse comply with the regulations, and in general what the quality of the software put in front of me is.

Well, auditors, and I know this because I am and have been on both sides, can be very zealous indeed (and sometimes they are), but if the regulation requires the paperwork to be in order and the assessment to take no more than one person-week, it’s obvious the check is purely bureaucratic, and it’s just a pile of paperwork that, in reality, certifies nothing.

Far be it from me to suggest that auditors and regulatory auditing are useless. What I’m saying is that they’re only useful if the software is analysed and assessed, with all the resources and all the time it takes. As long as it’s the paperwork being assessed, it’ll be pointless. Like Meta having itself assessed by its own contractors.

On the business model, which for me is the root of everything, the regulation steps in at only two points: it bans targeted advertising based on sensitive data and targeted advertising aimed at minors. Everything else, namely an industry paid in proportion to how long it manages to keep you glued to the screen, nobody touches.

The most recent proposal dates from 17 September and is called the Kids Act: no social media under 13, a “mini account” with one hour a day between 13 and 15, and above all a reversal of the burden of proof, so it would be up to the platform to prove it’s safe. That last idea is the exact opposite of doubt is our product, and I sign up to it wholeheartedly. The rest convinces me less. It’s a rule built entirely around age, as if the problem magically vanished on your birthday, and it leaves the business model exactly where it is. And it’s still a proposal, which has to get through Parliament and the Council.

In France, meanwhile, the under-15 ban passed in July was struck down on 14 August by the Conseil constitutionnel, because it hit all services in the same way without distinguishing those with a proven risk. Put like that it sounds like a defeat, but the Court left the door open to a ban targeted at services shown to be harmful by the way they’re built, which is precisely a rule that looks at the product.

Switzerland isn’t in the Union, but it’s reaching the same conclusions (and rules) on its own. On 14 October the Federal Council closed the consultation on its law for platforms and search engines, and asked the relevant department for the text for Parliament by the end of June 2027. “Very large” platforms, which according to the Swiss press are those used by at least a tenth of the population, will have to assess and mitigate risks to minors, and won’t be allowed to show them targeted advertising. There’s no minimum age in the law: Federal Councillor Rösti, asked by journalists, said the government is open to the idea but first wants to wait for answers to some still-pending postulates and an expert report. On the infinite feed and autoplay, not a single word in the press release. It’s the European recipe a few years late: risk assessment, no targeted ads for minors, a tiny bit of the business model touched and everything else left where it was.

§Between the law and those who write it, there are the lobbyists

On 10 October George Hotz, a hacker and entrepreneur by trade, published a monologue of a few lines in which he tries to explain American lobbying to a foreigner, with a sarcasm that makes you laugh through gritted teeth. The money goes to election campaigns, the politicians pass whatever the donors ask for, and at the end of their careers a well-paid consultancy with those same donors awaits them. He signs off like this:

You just don’t get it cause you aren’t American, lobbying is definitely not bribery.

Antonin Carette replied, as a European, without beating about the bush: I understand the concept perfectly well, I just call it corruption. The practice is the same; the only difference is that over there it’s legal.

On the American system I agree with both of them. We Europeans, though, would do well not to feel too sheltered. In Brussels there are no cheques to election campaigns, but lobbying is legal and registered, and it works through meetings and careers. According to a report by Corporate Europe Observatory and LobbyControl, based on data from the EU Transparency Register, the digital industry spends around 151 million euros a year in Brussels. It was 113 in 2023 and 97 in 2021, so the curve is going up, and fast. Top of the list is Meta, with about 10 million. (The two organisations aren’t neutral, but the numbers come from the official register.) In the United States, in 2025, Meta declared about 26 million dollars of federal lobbying, more than any other company in the country.

To explain a timid law you don’t need to drag in any conspiracy. 151 million a year, patiently spent, will do.

As for careers, there’s one case that can be told with dates alone. Aura Salla worked at the European Commission, from 2020 to 2023 was Meta’s head of EU affairs, and in 2024 was elected to the European Parliament. Since February 2026 she has been rapporteur for the Digital Omnibus, the package meant to “simplify” EU data rules, GDPR included. Transparency International EU, together with other organisations, has asked for her to be removed from the role. She has always defended moving between public and private as normal, indeed something to be encouraged. I found no news of a decision by Parliament on that request.

Let’s be clear, it’s all above board. But it’s equally above board that EU data rules pass through the hands of someone who, until three years ago, was looking after Meta’s interests in Brussels, and to me that looks like a problem with the rule, even before it’s a problem with the people.

§In Italy, we wait

Back home, meanwhile, we have a bill signed by nearly every parliamentary group, no. 1136, which sets the minimum age at 15 and has been gathering dust in a Senate committee since 16 June, despite getting agreement from parties that agree on nothing else. We have a competition authority that in 2024 fined TikTok 10 million euros, the maximum the law allows it, over a challenge that according to the Authority was self-harming and that the app’s algorithm had helped spread: ten million was the ceiling, and that alone tells you how low the ceiling is. We have a class action brought by Moige against Meta and TikTok at the Court of Milan, with the final hearing set for 19 November. And we have a public that wants the ban: 70% according to YouGov, nearly 79% according to Eurispes (which, however, doesn’t publish its methodology in that note).

And here, let me say this. Moige is the same lot that over the years went after The Simpsons and South Park, and that went as far as reporting Lino Banfi’s “porca puttena” in a TIM advert to the advertising standards body. If, to rein in the platforms’ overwhelming power and save our mental health, we have to cling to them, we’re in a right bloody mess.

§The sceptics are right about one thing

I promised you them. They’re serious researchers, and it pays to listen to them even when they don’t say what we’d like to hear.

Amy Orben and Andrew Przybylski, in 2019, analysed data on 355,358 adolescents and found that technology use explains at most 0.4% of the variation in wellbeing. Candice Odgers, in 2024, wrote in Nature that the evidence for an epidemic of mental illness caused by social media isn’t there. The US National Academies of Sciences concluded that the literature doesn’t show population-wide effects. And many researchers, including those interviewed when the Los Angeles trial began, prefer to talk about “problematic use” and consider the word addiction premature.

On one point they’re right, and I’ll concede it without hedging: solid causal evidence, valid for all adolescents, doesn’t exist today.

An average, though, is still an average, and inside an average there’s always someone much worse off than everyone else. 0.4% calculated across 355,000 kids is compatible with a product that’s harmless for most and heavy going for a minority, which is exactly what Meta’s internal slides said: the effect is concentrated on those already struggling. Among gamblers, too, the vast majority never develop any disorder, and yet the disorder is in the psychiatrists’ manual and slot machines are regulated, because that minority exists.

Then there’s the fact that the sceptics themselves don’t let the product off the hook at all. Odgers, in the same article, writes that the platforms need “considerable reforms”. And the US academies, while denying a mass effect, acknowledge that it can do harm.

And finally there’s the question of who holds the data, which for me settles it. As long as the active ingredient can only be studied by the people selling it, “there isn’t sufficient evidence” tells us where the research stands far more than it tells us about the product. In Europe, since October 2025, there’s been a rule forcing large platforms to open their data to accredited researchers. We’ll see what comes of it. In the meantime, the right question remains the one from the Kids Act: whose job is it to prove it’s safe?

Line up all these stories and they have one thing in common. Parliaments argue about the age at which you’re allowed in. Juries, the Commission in its preliminary findings and even the Conseil constitutionnel look at how the place you walk into is built. And nobody, so far, has had the nerve to lay a finger on why it’s built that way, that is, on how that place makes its money.

Meanwhile social media are what they are, and you and your kids have them in your pockets. In the next instalment I’ll give you a survival guide.

§Sources