The strongest case for regulating social media is not that the platforms are evil. It is that their business model rewards precisely the behaviour that damages children and coarsens public life, and no company willingly changes a model that prints money. If the model is going to change, the law has to change it. I think the law now has to.
The argument is no longer theoretical. In August 2026 a group of United States state attorneys general took Meta to a federal court in Oakland, before Judge Yvonne Gonzalez Rogers, accusing it of designing Facebook and Instagram to be addictive to children while telling the public its platforms were safe. Four states are leading, California, Colorado, Kentucky and New Jersey, on behalf of a much larger coalition. The penalties floated run as high as 1.4 trillion dollars, close to Meta's entire market value, and California's attorney general has pointed to the company's roughly 200 billion dollars of annual revenue as a starting point for the sum. California's deputy attorney general, Megan O'Neill, put the charge in one sentence at the opening: Meta said it prioritised safety over profits, but when the decision actually had to be made, time and again profits won.
A trial that is really about a model
Read the remedies and you see what the case is actually about. The states are not asking only for a fine and an apology. They want the design changed: an end to infinite scroll, and changes to the push notifications and the overnight pull that keep young users on the platform after everyone sensible has gone to sleep. Connecticut's attorney general, William Tong, one of the many bringing the action, compresses the whole complaint into four verbs. The strategy, he says, is to hook, hold, harvest and hide: hook the child, hold them for hours, harvest their data, and hide what the company knows. He goes further, saying the designers of infinite scroll themselves described it as behavioural cocaine. I cannot independently verify that the phrase came from the feature's inventors, so I treat it as his characterisation rather than as settled fact. Meta denies all of it, points to the teen protections it has built, including a one-hour timer on Instagram, and calls the numbers wild. Mark Zuckerberg is expected to testify. The trial is set to run about six weeks.
Whatever the jury decides about damages, the interesting thing has already happened. Serious public authorities have concluded that the problem is not misuse of a neutral tool. The problem is the tool doing exactly what it was built to do.
Why the harm sits in the design, not the user
This is where the economics matters, because it explains why goodwill and better parenting were never going to be enough. Herbert Simon saw the shape of it back in 1971: a wealth of information creates a poverty of attention. On these platforms the product being sold is attention, the customer is the advertiser, and the user is the inventory. That single fact organises everything else. When the metric that pays is time-on-app, infinite scroll and the two in the morning notification are not accidents to be apologised for. They are the optimisation working.
Two well understood market failures then do the damage. The first is a negative externality, the mechanism Arthur Pigou described a century ago. The platform books the advertising revenue, while the family, the school and the health system carry the cost of the lost sleep, the anxiety and the comparison spiral. The person generating the profit is not the person paying the bill, and a child cannot price that trade or meaningfully consent to it. The second is information asymmetry, the problem George Akerlof set out in 1970: the company runs internal research it does not publish, so neither users nor the market can discipline what they cannot see. A market with an unpriced harm and hidden information does not correct itself. Regulation is the textbook answer to that, not the ideological one.
I want to be fair to the other side of the ledger, because a one-sided read is a poor read. These platforms create real value. A tradesman finds customers he could never have reached, a diaspora stays close to home, a small cause finds a voice it would never have been given. The aim is not to break any of that. The aim is to make the platform carry the cost it currently offloads, so that the good survives on cleaner terms.
Children are where the argument stops being abstract
With adults you can argue about autonomy. With children you cannot, and this is where regulation is least controversial and most overdue. The instruments are already well mapped. The European Commission wrote most of them down in its guidelines on protecting minors under the Digital Services Act, published on 14 July 2025: minors' accounts private by default, the addictive features such as autoplay, streaks and push notifications turned off by default for young users, recommender systems that lower the risk of a child being pulled into harmful loops, and genuine age assurance. None of that stops a teenager talking to friends. It stops the machine optimising against them while they do.
Tong reaches for the tobacco comparison, and it is worth taking seriously. The 1998 master settlement did not ban cigarettes; it changed the terms, funded the counter-message, and adult smoking roughly halved over the following two decades. The lesson is that large settlements and design rules can move a whole population's behaviour. The limit of the analogy is just as important. Tobacco is a substance you can tax out of a hand. A feed is a relationship a child lives inside. You cannot price it away, which is exactly why design rules and defaults matter more here than damages ever will.
The end of hiding
Now the part of my position that is more contested, and where I expect disagreement. Anonymity was the early internet's gift, and it has quietly become its shield. Fraud, grooming, coordinated harassment and the sock-puppet armies that poison public debate all depend on one thing: not being seen. I think accountability requires that platforms actually know their users are real people, and that people carry the weight of what they say and do in public.
The honest objection is strong and I will not pretend otherwise. Anonymity also protects the whistleblower, the abuse survivor rebuilding a life, the dissident under a hostile government, and the teenager quietly working out who they are. A crude real-name mandate hands that person's safety to a corporate database, and every identity store ever built is a breach waiting to happen. That is a real cost, not a debating point, and any serious proposal has to answer it.
It can be answered, because verified is not the same as public. The workable design is identity and age assurance held once, privately, ideally on the user's own device, which is the direction the European Union is already taking with its age-verification blueprint and the coming EU Digital Identity Wallet. A platform can then confirm that a user is a real, age-appropriate person without ever holding their passport, and a court can pierce a pseudonym only when the law and a warrant require it. Accountability by design, exposure only by due process. Malta's own European commissioner, Glenn Micallef, has been pushing member states to roll out exactly this kind of privacy-preserving age check by the end of 2026. That is the balance to aim for: no more hiding from responsibility, without forcing anyone to strip in public to use the internet.
A business and a person are not the same account
There is a second separation the law should draw, and it is overdue. A business, an advertiser, a political campaign or a media operation trades in the public square for commercial or political ends. It should be registered, disclosed and transparent about who funds it, in the same way a company already sits on a public register at Companies House in the United Kingdom or the Malta Business Registry. An individual deserves the opposite: privacy, and real control. Control of the feed, including a genuine chronological option, control of the data, and the plain right not to be optimised against.
Right now those two things wear the same clothes, which is precisely how a coordinated operation can pass itself off as a thousand ordinary citizens. Splitting business accounts from personal accounts, with different duties attached to each, is not censorship. It is the same distinction the physical world has always drawn between a shopfront and a front door. Put the positive use first and the control with the individual, and you get a public square where you can see who is selling to you and who is simply speaking.
The rest of the world has stopped waiting
Malta and the wider debate are not starting from nothing, because three different models are already being tested in real time. It helps to name them.
The United Kingdom has taken the safety-by-design route. Under the Online Safety Act, highly effective age checks have been mandatory since 25 July 2025, policed by Ofcom, which can levy fines up to eighteen million pounds or ten per cent of a company's global turnover, whichever is higher. Ofcom's chief executive, Dame Melanie Dawes, framed the shift bluntly: prioritising clicks and engagement over children's safety will no longer be tolerated in the United Kingdom.
The European Union is building the same instinct into shared infrastructure. The Digital Services Act sets the duties, the July 2025 minors guidelines set the expectations on default settings and addictive design, and the age-verification blueprint plus the identity wallet are meant to give every member state a common, privacy-preserving way to check age without harvesting data. That is the framework a small state like Malta will implement whether or not it writes its own.
Australia went furthest of all. From 10 December 2025 it became the first country to ban under-sixteens outright from the major platforms, including Facebook, Instagram, TikTok, Snapchat, Reddit, X and YouTube, backed by fines up to about forty-nine and a half million Australian dollars, with reports of several million underage accounts removed in the first weeks. It is the boldest experiment and also the most uncertain. Critics make a fair point: a determined fifteen-year-old will route around a ban with a borrowed birthday or a virtual private network, and a blunt exclusion does nothing about the adult feed, the fraud or the anonymity that carry most of the public harm. A ban answers the child question loudly and leaves the harder questions untouched.
Malta, for its part, is consulting. The government published a Green Paper on social media reform in December 2025 and ran a public consultation that closed on 27 February 2026, with a technical committee announced on 9 October 2025. It asks the right questions plainly: whether the usual minimum age of thirteen is enough, and whether there should be a mandatory age-verification system, alongside time limits, usage warnings and stronger reporting routes. The honest note for a small state is this: it can either help shape the European rule it will import anyway, or wait and receive it. Consultation is the moment to shape it.
So change the model
Strip the noise away and there are only three real options, which is the way I prefer to hold a decision like this.
The first is the status quo dressed as self-regulation: trust the platforms to fix themselves. The information asymmetry is the reason it fails. A company that studied the harm and did not act on what it found is not the company that voluntarily rebuilds its own revenue engine. The whole Oakland case is an argument against this option.
The second is prohibition, the Australian path. It is honest about children and it has the courage of a clear line. But it is blunt. It offloads the problem onto exclusion, invites the workarounds, and leaves the adult ecosystem, where much of the fraud and the coordinated abuse actually lives, exactly as it was.
The third is a legislated redesign, and it is the one I favour. Internalise the externality so the platform pays for the harm it creates. Mandate safety by design and switch the damaging defaults off for minors. Do identity and age assurance privately, on the device, so accountability rises without privacy collapsing. Separate business accounts from personal ones, with transparency attached to the commercial and political actors and control handed to the individual. This does require the business model to change. It means less revenue from pure engagement-maximisation and more from advertising, subscription and verified services that do not depend on hijacking a fourteen-year-old's sleep. That is a genuine cost to the incumbents. It is a far smaller cost than the one families and health systems are already absorbing on their behalf, and it can be borne while the platforms stay profitable. Done in balance, every stakeholder is better off: children are protected, users regain control, advertisers buy attention that was honestly given, and the platforms trade a toxic dependency for a durable one.
We ran an uncontrolled experiment on a generation of children, using a design the companies had studied and the public never got to see. The court in Oakland will decide what Meta owes. It will not decide the thing that actually matters, which is whether we are willing to change the terms of the deal before the next cohort grows up inside it.