The default toggle is now a compliance problem

Two things happened to Meta in one week, and they rhyme. The EU said Facebook and Instagram's engagement features break the law. Meta shipped an AI tool that turned public Instagram photos into raw material without asking, then yanked it after three days. Both are design choices that used to sit safely under "growth." Both are now legal and PR liabilities. Let me catch you up on what changed and what you should check before someone checks it for you.

Engagement mechanics are now on the record as illegal

The European Commission put a name on the patterns your team probably calls "best practice." Autoplay, infinite scroll, push notifications, and personalized recommendations were all cited as breaking the Digital Services Act. The Commission's language is blunt: these features shift the brain into "autopilot mode" and fuel compulsive use.

The fine is up to 6 percent of global annual turnover. That is the headline number, but the sharper detail is what the Commission called out about fixes that look good and do nothing. It said Instagram's time-management tools, including ones on by default for teens, "can be easily dismissed" and do not actually cut usage. A safety feature that is trivial to swipe past no longer counts as a safety feature. Regulators are grading the outcome now, not the toggle.

The consent-free default that lasted three days

Meta launched Muse Image and let anyone generate pictures using a public Instagram account by @-mentioning it. No alert to the person whose face got used. Every public profile was opted in automatically, with the opt-out buried in account settings. Google shipped a similar feature, but limited it to the user themselves and put an approval step in front. Meta skipped both guardrails.

The backlash was fast. Public Citizen called it "an egregious invasion of user privacy" and said Meta "chose the creepiest possible path." Talent agencies including CAA got involved. Within three days, Meta pulled the feature and admitted it "missed the mark." That is a whole launch cycle, from ship to retreat, in less time than your next sprint review.

The opt-out was the tell

Strip out the AI part and look at the shape of the Muse decision. Meta had a choice: ask people if their photos could feed the tool, or default them in and hide the switch. It picked the default. The setting to stop it sits three menus deep, under "Sharing and Reuse," behind two separate toggles for Posts and Reels.

That pattern is the same one the EU flagged in the addictive-design case: put the thing that helps the business on by default, make the thing that protects the user a chore to find. When your consent flow and your dark pattern are built from the same move, one bad week can light up both. The lesson is not "AI is risky." It is that a buried opt-out reads as bad faith now, and it travels fast.

The slow shift underneath the fines

There is a bigger current here that a fine does not capture. Armon Dadgar, writing about what he calls the "WALL-E economy," makes the point that convenience-first design has a running tab: the average American spends 2.5 hours a day on social media, and Gen Z hits five. His comparison worth sitting with is cigarettes. Aggressive marketing, hidden harms, then a slow turn in public opinion, then regulation with teeth.

We are somewhere in that turn now. Australia and the UK are moving to ban social media for kids. The US case against Meta is real money, with four states seeking $1.4 trillion in penalties over addictive design claims. The mood has moved from "clever growth" to "harm you have to defend."

The deep cut

Here is the part that changes your Monday. The EU did not fine Meta for having a time-limit tool. It faulted Meta for shipping one that users could dismiss without effect. So the audit question is not "do we have consent settings and screen-time controls." It is "do ours actually change behavior, or do they exist to be pointed at."

Go pull your defaults. Every place your product opts a user into something that helps you and makes the exit hard to find, write it down. For each one, answer two questions: would you be comfortable if a reporter described that default in one sentence, and does your protective setting hold up when someone tries to use it? Meta's teen tools failed the second test, and its Muse opt-out failed the first. You have time to fix yours quietly before either failure becomes your story.

Three questions for your team

1. Which of our defaults help the business while making the opt-out hard to find, and could we defend each one in a single sentence a regulator would read?
2. Do our safety and consent controls actually reduce the behavior they claim to, or are they easy to dismiss like Meta's teen timers?
3. If we shipped an AI feature that used customer data by default, how many days would it survive public scrutiny, and who on our team is allowed to pull it fast?