Beyond the Under-16 ban: Making social media safer by design — Rachel Gong

September 7 — In the past month, technology giant Meta reached an agreement with 48 US states to settle allegations that its social media platforms, Facebook and Instagram, violated federal and state child privacy laws. Although Meta did not admit to any wrongdoing, the company agreed to pay up to US$18 billion to settle the claims and promised to implement various changes aimed at enhancing online safety for younger users.

These changes include defaulting daily usage limits to two hours for users under 18, limiting notifications during specific hours, and hiding likes for teenage users, although these settings can still be overridden by the users. These modifications will begin implementation within six months, while enhanced age verification measures for teenage users in the US will follow in the next year.

While platform companies may resist implementing these design features that generate prolonged engagement and profits, the settlement demonstrates that users can collectively exert pressure to compel significant changes. Meanwhile, in Malaysia, the under-16 social media ban has been in effect since 1 June 2026, but its impact has been minimal due to a six-month grace period given to platforms to set up age verification protocols and remove underage accounts.

Personal data privacy concerns have been addressed by asserting that platforms will verify ages and subsequently delete the information. However, Australian evidence indicates teenagers are developing methods to circumvent age restrictions. The Meta settlement reignites the debate surrounding the feasibility and effectiveness of age-based bans, shifting the focus to safety by design, a principle already incorporated in the Online Safety Act 2025.

The settlement implies that Big Tech companies can be held accountable for design elements that put users at risk, such as infinite scrolling and social reward mechanisms. While the settlement benefits Meta by avoiding a costly trial, it also highlights that technology policy experts have long advocated for product design decisions and safeguards to improve online safety.

The Child Protection Code of the Online Safety Act emphasizes age-appropriate protections like limiting exposure to harmful content and exploitative actions, while the Risk Mitigation Code includes advertiser verification and labelling of AI-generated or manipulated content. However, the design measures Meta has agreed to implement in the US settlement, such as customised feeds and infinite scroll, suggest that the platform itself can be regulated as a product.

Regulating platforms necessitates policymakers expanding their focus from content to code, addressing both what is on the platform and how it is designed. Two design features notably absent from Meta's proposed safety measures are customised feeds and infinite scroll. Customised feeds use algorithms to tailor content, potentially leading to echo chambers and reinforcing misinformation or radicalisation.

Infinite scroll, meanwhile, provides an endless stream of content that drives prolonged engagement and addictive behaviour. Despite being relatively recent innovations, these features are designed to maximize engagement and profits. Although platform providers may resist curtailing these features, the Meta settlement demonstrates that collective action driven by evidence can pressure companies to effect change.

Malaysia's existing online safety legislation allows regulators to demand greater accountability from platforms. Policymakers seeking to enhance online safety should consider this development. Rachel Gong, an Associate Director of Research at the Khazanah Research Institute, focuses on digital policy, technology and society.