Meta Must Age-Check Every Account, Not Just Teens

If you use Facebook or Instagram in most U.S. states, Meta now has a court-backed deadline to figure out your age, not just your kids’. A Center for Democracy and Technology (CDT) analysis of the August settlement says every user gets an age check within a year, and if you skip it for 14 days after signing up you are treated as a teen. Meanwhile, grocery apps for Food Lion, Stop & Shop, and Albert Heijn went dark after Ahold Delhaize took systems offline to contain a cyber incident.

Age Checks for Adults, Not Just Kids

Age assurance is any method a platform uses to decide whether you are a child, a teen, or an adult. That can be a government ID upload, a face scan that estimates age, a behavioral score, or a signal from Apple or Google that your device account is already restricted.

The fight over kids online is real.

The mechanism that usually arrives with it is a gate that collects identity data from everyone so the company can claim it sorted the under-18s from the adults.

What moved for you is the CDT brief published 13 October on Meta’s settlement with 52 attorneys general (New Mexico and Florida stayed out).

Within one year, Meta must apply an age-assurance method to every Facebook and Instagram user in the settling states and classify them as under 13, ages 13 through 17, or 18 and over. The agreement expressly permits government-ID verification and facial age estimation, and it requires Meta to use reliable age signals from Apple and Google operating systems and app stores.

If a new account is not assessed within 14 days, Meta must treat that person as a Teen User. Teen Users get a default combined two-hour daily limit across Instagram and Facebook, content restrictions, and notification limits. Accounts tagged under 13 are removed, and Meta will review those users’ friend networks to find more under-13 accounts.

Adults wrongly flagged as teens must appeal while the teen limits stay on. The settlement sets error ceilings for minors wrongly called adults. It does not set a matching ceiling for adults wrongly called minors (CDT; ABC News).

I treat this adult-gatekeeping as the household line. A two-hour teen limit is a family product rule, not something the government should enforce. A requirement that every adult prove or estimate age to keep the adult feed is a FUNDAMENTAL speech and privacy architecture change. CDT notes Meta can retain under-13 data to train age models and can keep metadata to hunt for circumvention. Age data collected for that purpose is supposed to be deleted after “a reasonable period,” but data Meta already holds for other reasons can still be used to infer age. CDT also points to the IDScan breach that exposed about 153 million driver’s licenses as the kind of pile this regime creates.

Status now: Meta has roughly a year to age-check every Facebook and Instagram user in the settling states; 14-day silence equals teen limits; New Mexico and Florida are outside this deal.

What it means for you: Expect a prompt to prove or estimate age. Prefer an over/under flag from the app store over uploading a government ID or a face scan when that choice exists.

Your Grocery App Went Offline

Supermarket apps are not just convenience. For many households they are the order list, the delivery slot, the price tag, and the only way to reach customer service. When those systems go down, you still need food, while phishing messages about “refunds” and “account security” spike to catch the unwary.

Ahold Delhaize, the Dutch parent of Food Lion, Stop & Shop, Giant Food, Hannaford, Albert Heijn, and Delhaize, reported a cybersecurity incident beginning 12 October. The company took some systems offline as a precaution. An update dated 14 October says a controlled re-launch of certain systems is under way, that stores remain open, and that it has “no evidence at this moment” customer, associate, or partner data was taken (Ahold Delhaize).

Impact varied by brand. In the United States, Food Lion and Stop & Shop websites, apps, and online ordering were disrupted. In the Netherlands, Albert Heijn, Etos, and Gall & Gall saw apps, sites, and customer service fail, deliveries suspended, and electronic shelf labels showing outdated promotions. In Belgium, Delhaize blocked new online orders. The company suffered a separate 2024 breach that later exposed data for more than 2.2 million people (The Record).

I see this outage as a reminder that a single retail login is also a single point of failure for your food logistics. Patch Tuesday landed the same week:

In other news, Microsoft fixed more than 1,400 flaws, including an already-exploited Windows Shell bug (CVE-2026-96951), and extended free Windows 10 security updates to October 2027 (Krebs on Security).

Status now: Ahold systems are still partially offline under a controlled restore; no confirmed customer-data theft in this incident yet; Windows users have a zero-day patch to install.

What it means for you: Keep a paper or offline grocery list and a cash or card fallback for the next outage. Do not click “refund” links that arrive by SMS or email during (or shortly after) the disruption.

Summary

Yesterday’s Digital lead was Mexico’s prepaid phone identity clock. Today rotates to the same identity-at-the-gate pattern on Facebook and Instagram, where a settlement turns “protect teens” into “age-check adults.” The Ahold outage shows the other half of digital dependence: When the app fails, your pantry still has to work.

Outlook

(analysis, not certainty) Base case: Meta ships a mix of app-store signals plus ID or face fallback, and other platforms copy the adult-gate language. I cannot predict which vendor Meta picks, how long it keeps age-verification media, or whether Ahold’s investigation later finds stolen data. Watch the age prompt text and retention language, not the safety slogans.

What You Should Do Now

On Facebook and Instagram: Use the least identifying age option when the prompt arrives. Prefer an Apple or Google age signal over a passport, driver’s license, or face scan uploaded to Facebook.
If you refuse ID and get teen limits: Document the screen and use the appeal path. Do not upload more documents than the appeal requires.
Keep one non-Meta channel for family and politics. Signal, email, Gab, or a forum you control still works when a gate fails.
Grocery shoppers at Food Lion, Stop & Shop, Albert Heijn, or Delhaize: Keep a printed list and a store-only payment method. Ignore “account restored” or “refund pending” phishing messages and emails.
Patch Windows this week, especially for CVE-2026-96951. Windows 10 still gets free security updates through October 2027.
If your Mexican prepaid phone number ends in 4: Link it to your Clave Única de Registro de Población (CURP) today through the carrier.

If you don’t feel like doing that, there are other ways to get around the ID-clampdown. We’ll cover those publicly in the next few days.

What Moved Since Yesterday

Mexico prepaid ending-4 (yesterday’s Digital lead): Deadline is tomorrow, 15 October; CRT reports 93,945,821 lines linked nationwide as of 12 October (78% of expected); postpaid exempt (El Economista). Status for you: Last full day to link ending-4 lines before the 72-hour suspension window.
Sharonville Flock misuse: Lt. Walter Cordes indicted on a fifth-degree felony for 29 personal plate searches. Status for you: Misuse can become a criminal case, not just a policy memo.
Overland Park ALPR policy: Tighter bans on speech, religion, tax, and immigration queries; 100-foot buffer near worship, polls, and clinics. Status for you: Bring that language to your next council packet.
EFF San Jose appeal: EFF and ACLU of Northern California will appeal the dismissal of SIREN v. San Jose. Tulsa’s U.S. v. Kyle appeal window still runs to about 31 October; Fairfax reviews 20 October. Status for you: Courts are split; local contracts still decide your commute trail.
Turkey / Greece age gates: Turkey’s e-Government token still starts 1 November for new accounts; Greece vote still 22 October. Status for you: Ask who stores the age check before you travel or open a new account.

Post on X