From Big Tobacco to Big Tech: What Meta’s $17 Billion Reckoning Says About Corporate Risk

• Meta’s agreement with 47 US states to pay up to $17 billion and make sweeping changes to Facebook and Instagram marks a striking shift in how corporate misconduct can be punished. The tobacco battles of the 1990s offer an uncomfortable lesson for business leaders: legal exposure often becomes enormous only after years of warnings have been ignored.

Meta has agreed to pay up to $17 billion to settle claims that Facebook and Instagram were designed in ways that contributed to youth addiction and harm. The settlement also forces changes to the products. The tobacco industry faced a similar reckoning in the 1990s. The lesson for companies is uncomfortable: ignoring known risks can become vastly more expensive than fixing them.

Analysis

The number is almost difficult to process. Up to $17 billion. That is what Meta has agreed to pay under a settlement with 47 US states, the District of Columbia and US territories over allegations concerning children’s use of Facebook and Instagram. The agreement also requires significant changes to the products, including restrictions on teenage usage, stronger age verification, limits on notifications and other safeguards. Meta has not admitted wrongdoing.

The case matters for more than its size. It is another example of regulators and prosecutors moving beyond the question of whether a product is technically legal and asking a much harder question: what did the company know about the consequences of the way it designed, marketed and operated that product?

That question has an old precedent. The tobacco industry learned it the hard way. In 1998, 46 US states, the District of Columbia and five territories reached the Master Settlement Agreement with the major tobacco companies. The agreement resolved litigation seeking recovery of healthcare costs associated with smoking and imposed major restrictions on tobacco marketing and industry practices. The companies agreed to payments projected at more than $200 billion over the first 25 years.

The striking similarity is not that cigarettes and social media are the same thing. They are not. The similarity is the legal pattern.

A powerful industry grows around a product. Concerns about harm accumulate. Regulators investigate. Researchers produce evidence. Critics become louder. Companies defend their products and dispute aspects of the evidence. Eventually, litigation begins to connect internal knowledge, product decisions and public claims.

At that point, the argument changes. It is no longer simply about whether harm exists. It becomes about what the company knew, when it knew it and what it chose to do about it.

The tobacco warning for today’s boardrooms….

The tobacco litigation of the 1990s demonstrated how damaging it can be when corporate records become part of a legal battle.

Internal documents became central to understanding what tobacco companies knew about smoking, nicotine and health risks. The legal and political pressure eventually became impossible for the industry to contain through individual lawsuits.

That should matter to modern boards.

Every company has internal research. Product teams produce risk assessments. Engineers identify problems. Compliance officers raise concerns. Customer complaints accumulate. Legal departments advise management.

The dangerous assumption is that a problem becomes a serious legal risk only when a regulator sends a letter.

It can happen much earlier.

Meta’s current settlement follows allegations that the company knew about potential risks to young users while continuing to operate products in ways that prosecutors said contributed to those harms. The states also alleged violations involving children’s data and consumer protection.

The settlement does not establish those allegations as judicial findings against Meta. But the size and structure of the agreement show how expensive the dispute became.

The real cost is not the cheque…

For business leaders, focusing only on the $17 billion would miss the more important part. The settlement changes the product.

Under the agreement, Meta is expected to introduce measures including a default daily usage limit for teenagers, overnight restrictions, reduced notifications during school hours, stronger age verification and changes to certain engagement features. Meta will also face requirements concerning responses to reports of harmful content.

That is a very different form of enforcement from a fine. A fine takes money from the company.

A product mandate changes how the company makes money. This is where the tobacco comparison becomes useful.

The tobacco settlement did not simply impose a cheque on cigarette manufacturers. It changed marketing practices, restricted certain forms of promotion and created continuing obligations. The settlement became part of the structure within which the industry operated.

Modern companies should pay attention to that distinction. Regulatory enforcement is increasingly moving towards remediation, not merely punishment.

The compliance lesson

For compliance officers, the Meta case raises an awkward question. What happens when the commercial objective of a product conflicts with the interests of the people using it?

For a social media company, more engagement can be commercially valuable. More time spent on a platform can mean more advertising opportunities.

But if internal evidence suggests that particular design features create unacceptable risks for children, the compliance problem is no longer confined to the legal department.

It becomes a boardroom problem. The same principle applies in financial services, gambling, pharmaceuticals, artificial intelligence, fintech and consumer technology.

A company cannot reasonably say that a risk is somebody else’s problem simply because it sits between departments.

Compliance sees the risk, product sees the commercial opportunity, legal sees the litigation exposure, marketing sees the growth opportunity. The board has to see all four at once.

What companies should learn from the 1990s

The first lesson is that regulatory risk can compound quietly. A small unresolved issue can become a major liability when multiplied across millions of customers.

The second is that documentation matters. Internal research, emails, board papers, customer complaints and risk assessments can later become evidence of what management knew.

The third is that corporate statements need to match internal knowledge. A company does not necessarily need to accept every criticism of its product. But dismissing a known risk while internal evidence points in the opposite direction creates a dangerous record.

The fourth is that remediation should happen before litigation forces it.

That may mean redesigning a product, changing incentives, introducing stronger controls or accepting slower growth.

For some executives, that can look like an unnecessary cost.

The tobacco experience suggests otherwise.

The uncomfortable question for business leaders

The most important lesson from both industries is not that technology companies are the new tobacco companies. That comparison is too simplistic.

The lesson is about corporate memory and institutional responsibility.

When a business has evidence that a product may cause serious harm, the question eventually becomes whether the organisation responded responsibly.

Waiting for the regulator to arrive is rarely a sound risk strategy.

Meta’s settlement demonstrates how that calculation can change when dozens of states act together. The settlement involves at least $12 billion in guaranteed payments over ten years, with additional payments linked to whether other major platforms adopt comparable measures. Meta’s separate settlement with Texas brings the overall figure to roughly $18 billion, according to reports.

The tobacco industry discovered in the 1990s that legal exposure could eventually reshape an entire business model.

Meta’s experience suggests that the same broad lesson is still relevant.

The most expensive compliance problem is often not the risk a company failed to see. It is the risk it saw, discussed and decided to leave alone.