---
title: "For Lawmakers"
description: "The evidence base, the regulatory landscape, and the levers open to legislators — what each one does today, and what is argued about it."
url: https://attentionmachine.org/en/for-you/lawmakers/
lang: en
updated: 2026-10-25
license: "CC BY-NC-SA 4.0 (https://creativecommons.org/licenses/by-nc-sa/4.0/)"
---

# For Lawmakers

The evidence base, the regulatory landscape, and the levers open to legislators. This page is not partisan, and it does not recommend a policy. The documented harms apply across political affiliations.

## The evidence — what is well-established

Most of the harms documented on this site are not contested at the level of whether they exist; they are contested at the level of causal weight and policy response. The exception is adolescent mental health: whether social media causes the decline, or accompanies it, is a live scientific dispute. The following rest on peer-reviewed research, official investigations, or primary documents, and say where a finding rests on one study:

Engagement-optimised algorithms amplify emotionally provocative content — including misinformation, hate speech, and politically extreme content — because this content spreads further than measured alternatives[^src-brady-2017]. Facebook's own internal research[^src-hagey-2021] documented this. One peer-reviewed study of survey data from the US and Italy (Germano, Gómez & Sobbrio, 2026[^src-germano-2026]) finds that the 2018 algorithm update contributed to increased political polarisation in both countries; the evidence is observational. The largest experiments on the question, run with Meta's data around the 2020 US election, found no measurable change in polarisation from three months of a chronological feed[^src-guess-2023], so how much any one ranking change moves polarisation is not settled.

Heavier social media use correlates with worse mental health outcomes in adolescents, with a large UK cohort study finding the association with depressive symptoms stronger for girls[^src-kelly-2018]; whether passive scrolling is the harmful part is contested: experiments with adults found that it lowered mood[^src-verduyn-2015], but a review of 40 survey studies found that most did not bear the link out[^src-valkenburg-2022]. Facebook's own research[^src-facebook-files-2021] found that, among teenage girls who already felt bad about their bodies, one in three said Instagram made them feel worse. The causality debate is ongoing; the correlation is not in dispute.

Real-time bidding (RTB) broadcasts a person's profile to dozens of companies at a time — 376 times a day for the average EU user, 747 for a US user, by the ICCL's 2022 estimate from industry data[^src-iccl]. The Belgian DPA[^src-dpa] found the industry's consent framework for it in breach of the GDPR (2022); the CJEU[^src-court-justice-2024], on questions referred by a Belgian court, confirmed key parts of that reasoning (2024).

> **Real-time bidding (RTB)**
>
> The system that auctions each ad slot in the moment a page loads. To run the auction, a "bid request" describing the user — location, inferred interests, identifiers — is broadcast to many potential bidders at once. The privacy problem is structural: the data is shared with every participant in the auction, not only the winner, hundreds of times a day per person. The CJEU's IAB Europe ruling (Case C-604/22) held that the TC String, the consent string at the heart of that framework, is personal data.
>
> **Sources**
>
> - [ICCL](https://www.iccl.ie/news/iccl-report-on-the-scale-of-real-time-bidding-data-broadcasts-in-the-u-s-and-europe/) — RTB research.
> - Belgian DPA Decision 21/2022 on IAB Europe's TCF — [Belgian Data Protection Authority](https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr).
> - Court of Justice of the European Union (7 March 2024), [_IAB Europe_, Case C-604/22](https://curia.europa.eu/juris/liste.jsf?num=C-604/22) — a TC String is personal data.

## What the intelligence agencies say

Several European intelligence agencies now say publicly that much of today's radicalisation happens online. That is narrower than this site's argument about engagement ranking — the agencies describe where it happens, not what ranks it — but they say it on the record. AIVD Jaarverslag 2025 (April 2026)[^src-aivd-2025]: as it was published, Director-General Smit was quoted by NOS describing a threat picture without precedent in the service's eighty years[^src-nos-2026]; the report finds young people now a third of its jihadist caseload, with jihadist ideas widely available on social-media platforms. MI5 (October 2025)[^src-mi5-2025]: terrorism now "breeds in squalid corners of the internet"; Home Office figures[^src-home-office-2025] show that 43 of the 232 terrorism arrests in Great Britain in the year to March 2025 — nearly one in five — were of children aged 17 or under. BfV Verfassungsschutzbericht 2024[^src-bfv-verfassungsschutzbericht-2024]: 57,701 extremism crimes, up 46% on 2023, with online chat groups named as "catalysts" for radicalisation.

## Dutch regulatory evidence

The Commissariaat voor de Media (CvdM)[^src-commissariaat-media-2026] concluded in May 2026 that algorithmic feeds are "demonstrably risky for our democracy" (aantoonbaar riskant voor onze democratie) and called for better enforcement of existing European legislation. The CvdM's youth research (2,010 respondents aged 16–24, fieldwork by Ipsos I\&O in March 2024, published October 2024) found that social media and search engines now form the primary gateway to news for most young people, with the assumption that news interest increases with age described as no longer guaranteed.

## The levers, and who argues what

Five levers come up in almost every discussion of platform regulation. For each one: what a law or a regulator can do, what is being done with it now, and where the disagreement sits. This page does not say which to pull.

**Algorithmic transparency and independent audits.** The lever is access — to how a recommender system behaves, to advertising records, and to data for researchers outside the company. The EU has already pulled it: the [Digital Services Act](https://attentionmachine.org/en/laws/dsa/) obliges the largest platforms to undergo independent audits[^src-regulation-2022] and to open data to vetted researchers, and the Centre for Future Generations[^src-dsa] tracks how far enforcement has actually gone. The case for widening it rests on the information asymmetry: the platform knows how its system behaves, and everyone outside it is estimating. The argument against is that broad access to systems and data exposes trade secrets and users' own data. What outside access can produce is already on the record — the pre-registered audit by Milli and colleagues[^src-milli-2025] found that Twitter's engagement ranking amplified emotionally charged, out-group-hostile content, and that users did not prefer it.

> **Independent algorithmic audit**
>
> External examination of how a recommender system actually behaves — what it amplifies, to whom, with what effects — by parties who do not work for the platform. It requires genuine access to data and systems, not the platform's own summary reports. The recurring obstacle is the information asymmetry: the platform knows everything about its system and external researchers know comparatively little, which makes independent verification of any safety claim difficult. Closing that gap is what the DSA's audit and data-access provisions set out to do.
>
> **Sources**
>
> - European Union, [_Regulation (EU) 2022/2065 (Digital Services Act)_](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2065) — Article 37, independent audits; Article 40, data access for vetted researchers.
> - [European Commission — Digital Services Act package](https://digital-strategy.ec.europa.eu/en/policies/digital-services-act-package).

**Liability for harmful design.** Courts can already reach design choices: the March 2026 Los Angeles verdict[^src-cnbc-2026] against Meta and Google's YouTube found platforms liable for design, not only for content. It is under appeal, so the principle is not settled, and the New Mexico verdict[^src-new-mexico-2026] against Meta turned on consumer-protection law instead. In August 2026 Meta settled with 51 US attorneys general for up to $17.1 billion[^src-state-california-2026], accepting default time limits and overnight blocks for under-18s — terms agreed between the parties, binding on one company. That is the argument for writing a design duty into statute: litigation binds the parties to a case, one case at a time. The argument against is that "harmful design" is hard to define in advance without a legislature deciding which choices count, which is the question the trials are working through in public.

**Age verification that does not build a surveillance system.** A legislature can set an age limit; whether the limit holds depends on a method, and how to verify age without building that infrastructure for adult users too is [still an open technical question](https://attentionmachine.org/en/laws/age-restrictions/). That is where the argument sits: most of today's minimums are self-declared and largely unenforceable, which is the case for verification, while a check strong enough to work would document adults as well, which is the case civil-liberties organisations make against it. One drafting response separates the duty from the mechanism, so the obligation does not rest on a technology that is not yet there. Neither side has an evaluation to point to yet: as far as this site has found, no rule has been in force long enough to produce one.

**Impact assessments before deployment.** The model is familiar from environmental and data-protection law: assess a system's foreseeable effects before it ships, and record the assessment where a regulator can read it. The DSA works this way for the largest platforms[^src-regulation-2022], which assess and mitigate systemic risks to civic discourse, elections and public health. The argument for it is timing — before deployment is the point at which a design choice is still cheap to change. The argument against is verification: a duty written around outcomes is hard to check, and a compliance document is not the same thing as a changed system.

**Platform funding for independent research.** The precedent usually cited is tobacco[^src-national-association-1998], where the industry was made to fund public-health work it did not control. Applied here, a levy or a settlement fund would pay for work the platforms neither commission nor review. The argument for it is that the data and the money sit on the same side of the table as the subject of the research. The argument against is that the source of funding is not the same as independence: a fund a company pays into is only as independent as the rules that keep the two apart.

**Deeper — reading this evidence base: confirmed, contested, and what that means for legislating**

For policy purposes the evidence here sorts into three tiers, and conflating them weakens any resulting law. **Confirmed** (peer-reviewed, official investigation, or primary document): that engagement-ranked systems amplify provocative content[^src-milli-2025]; the RTB data-broadcast figures[^src-iccl]; the intelligence-agency assessments[^src-aivd-2025]; the March 2026 Los Angeles design-liability verdict[^src-cnbc-2026] and the August 2026 Meta–states settlement[^src-state-california-2026]. **Contested**: whether, and how far, social media causes the youth mental-health decline; how much engagement ranking contributes to polarisation (one study finds that the 2018 Facebook change contributed to it in two countries[^src-germano-2026], from survey data; the 2020 election experiments found no measurable change in three months[^src-guess-2023]). **Genuinely unknown**: the long-term developmental effects, and the impact of generative AI on elections.

**Why the distinction matters for drafting.** A statute that rests its case on "social media causes the mental-health crisis" can be litigated to a standstill on the science, because the causal weight is exactly what is contested. One that rests on "these systems are opaque, their design choices are the company's own conduct, and independent verification is currently difficult" stands on ground the science does not decide. That is the argument drafters make for aiming at the asymmetry and the design rather than at the contested effect size — and the argument against it is that a law aimed at process can leave the harm it was passed for untouched.

## Sources

[^src-germano-2026]: Germano, F., Gómez, V. & Sobbrio, F. (2026), [_Ranking for Engagement_](https://bse.eu/research/working-papers/ranking-for-engagement-how-social-media-algorithms-fuel-misinformation-and-polarization), Journal of Public Economics 255 (open-access working-paper version, Barcelona School of Economics) — empirical study of Facebook’s 2018 algorithm update.

[^src-guess-2023]: Guess, A.M. et al. (2023), [_How do social media feed algorithms affect attitudes and behavior in an election campaign?_](https://doi.org/10.1126/science.abp9364), Science 381(6656), 398–404 — 2020 US election experiment run with Meta: three months of a chronological feed on Facebook and Instagram "did not significantly alter levels of issue polarization, affective polarization, political knowledge, or other key attitudes".

[^src-iccl]: [ICCL](https://www.iccl.ie/news/iccl-report-on-the-scale-of-real-time-bidding-data-broadcasts-in-the-u-s-and-europe/) — RTB research (2022): estimates of daily RTB broadcasts per person, from industry data.

[^src-aivd-2025]: [AIVD Jaarverslag 2025](https://www.aivd.nl/documenten/2026/04/23/jaarverslag-2025).

[^src-nos-2026]: NOS (23 April 2026), [_Rusland, China, terroristen: AIVD zag 'in 80 jaar niet meer dreiging dan nu'_](https://nos.nl/l/2611683) — "In de tachtig jaar dat de AIVD en zijn voorlopers bestaan, was er niet eerder een dreigingsbeeld zoals nu".

[^src-commissariaat-media-2026]: [Commissariaat voor de Media](https://www.cvdm.nl/nieuws/nieuw-rapport-commissariaat-naar-democratisch-gezonde-feeds/) — [_Naar democratisch gezonde feeds_](https://www.cvdm.nl/documents/3858/Naar_democratisch_gezonde_feeds.pdf) (May 2026) and [_Jongeren, nieuws en sociale media_](https://www.cvdm.nl/documents/3124/Rapport-Jongeren-nieuws-en-sociale-media.pdf) (October 2024).

[^src-dsa]: [DSA enforcement tracker](https://cfg.eu/enforcement-initiative/) — Centre for Future Generations.

[^src-milli-2025]: Milli, S., Carroll, M., Wang, Y., Pandey, S., Zhao, S. & Dragan, A.D. (2025), [_Engagement, user satisfaction, and the amplification of divisive content on social media_](https://doi.org/10.1093/pnasnexus/pgaf062), PNAS Nexus 4(3) — pre-registered audit: Twitter's engagement ranking amplified emotionally charged, out-group-hostile content relative to a chronological feed, and users did not prefer it.

[^src-brady-2017]: Brady, W\.J., Wills, J.A., Jost, J.T., Tucker, J.A. & Van Bavel, J.J. (2017), [_Emotion shapes the diffusion of moralized content in social networks_](https://doi.org/10.1073/pnas.1618923114), PNAS 114(28) — each moral-emotional word raised a message's spread by about 20%.

[^src-state-california-2026]: State of California et al. v. Meta Platforms, Inc. et al. (N.D. Cal., No. 4:23-cv-05448-YGR, in MDL 3047), [_Consent judgment and settlement agreement_](https://oag.ca.gov/system/files/attachments/press-docs/23-05448-ecf-572-1-exhibit-1-mdl-consent-judgment-final-settlment-agreement-fully-executed.pdf), entered 26 August 2026; New Jersey Attorney General (26 August 2026), [_Historic $17 billion settlement with Meta_](https://www.njoag.gov/attorney-general-davenport-announces-historic-17-billion-settlement-with-meta/) — "a minimum of $12.1 billion, and up to $17.1 billion", 51 attorneys general, the court's approval that day; Hunton (August 2026), [_Court approves Meta settlement with 29 states_](https://www.hunton.com/privacy-and-cybersecurity-law-blog/court-approves-meta-settlement-with-29-states-over-alleged-harms-to-children-and-teens) — the trial halted before its fifth day; Meta "did not admit liability or wrongdoing".

[^src-new-mexico-2026]: New Mexico Department of Justice (August 2026), [_Court Orders Meta to Pay $942 Million and Overhaul Protections for Children on Facebook and Instagram_](https://nmdoj.gov/press-release/court-orders-meta-to-pay-942-million-and-overhaul-protections-for-children-on-facebook-and-instagram-in-landmark-new-mexico-ruling/) — $375 million in civil penalties (jury, March 2026) plus a $567 million abatement fund (court, August 2026). Meta has said it will appeal; _Santa Fe New Mexican_, [_Meta asks New Mexico court to stay enforcement of $942 million judgment pending appeal_](https://www.santafenewmexican.com/news/local_news/meta-asks-new-mexico-court-to-stay-enforcement-of-942-million-judgment-pending-appeal/article_40aca50f-aee2-4b7a-8c23-d80c21d0c543.html).

[^src-cnbc-2026]: CNBC (10 June 2026), [_Google and Meta denied new trial in youth social media addiction case_](https://www.cnbc.com/2026/06/10/google-and-meta-denied-new-trial-in-youth-social-media-addiction-case.html); Fortune (15 July 2026), [_YouTube appeals verdict, argues it isn't a social media platform_](https://fortune.com/2026/07/15/youtube-appeals-social-media-addiction-verdict/) — Meta filed its notice of appeal days earlier.

[^src-hagey-2021]: Hagey, K. & Horwitz, J. (15 September 2021), [_Facebook Tried to Make Its Platform a Healthier Place. It Got Angrier Instead_](https://www.wsj.com/articles/facebook-algorithm-change-zuckerberg-11631654215), Wall Street Journal (The Facebook Files) — internal memos in which publishers and political parties report shifting to more negative, divisive posts after the 2018 ranking change.

[^src-facebook-files-2021]: [The Facebook Files](https://www.wsj.com/articles/the-facebook-files-11631713039) (Wall Street Journal, 2021).

[^src-kelly-2018]: Kelly, Y., Zilanawala, A., Booker, C. & Sacker, A. (2018), [_Social Media Use and Adolescent Mental Health: Findings From the UK Millennium Cohort Study_](https://doi.org/10.1016/j.eclinm.2018.12.005), EClinicalMedicine 6 — 10,904 14-year-olds; the association with depressive symptoms was larger for girls than for boys.

[^src-verduyn-2015]: Verduyn, P. et al. (2015), [_Passive Facebook usage undermines affective well-being_](https://doi.org/10.1037/xge0000057), Journal of Experimental Psychology: General 144(2).

[^src-valkenburg-2022]: Valkenburg, P. M., van Driel, I. I. & Beyens, I. (2022), [_The associations of active and passive social media use with well-being: A critical scoping review_](https://doi.org/10.1177/14614448211065425), New Media & Society 24(2) — 40 survey studies; most did not support the passive/active split.

[^src-dpa]: Belgian DPA Decision 21/2022 on IAB Europe's TCF — [Belgian Data Protection Authority](https://www.dataprotectionauthority.be/citizen/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr).

[^src-court-justice-2024]: Court of Justice of the European Union (7 March 2024), [_IAB Europe_, Case C-604/22](https://curia.europa.eu/juris/liste.jsf?num=C-604/22) — a TC String is personal data and IAB Europe a joint controller.

[^src-mi5-2025]: [MI5 — Director General Sir Ken McCallum, threat update](https://www.mi5.gov.uk/director-general-sir-ken-mccallum-gives-threat-update) (16 October 2025) — “one in five of the 232 terrorism arrests last year were of children under 17”; “Terrorism breeds in squalid corners of the internet”. The count is the Home Office’s, for the year to March 2025, where the same figure appears as 43 arrests (19%) of people aged 17 and under.

[^src-home-office-2025]: UK Home Office (12 June 2025), [_Operation of police powers under the Terrorism Act 2000 and subsequent legislation: arrests, outcomes, and stop and search, Great Britain, quarterly update to March 2025_](https://www.gov.uk/government/statistics/operation-of-police-powers-under-tact-2000-to-march-2025/operation-of-police-powers-under-the-terrorism-act-2000-and-subsequent-legislation-arrests-outcomes-and-stop-and-search-great-britain-quarterly-u) — 232 arrests in the year ending 31 March 2025, 43 of them (19%) of people aged 17 and under.

[^src-bfv-verfassungsschutzbericht-2024]: [BfV Verfassungsschutzbericht 2024](https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/verfassungsschutzberichte/2025-06-10-verfassungsschutzbericht-2024.html) (June 2025).

[^src-regulation-2022]: [Regulation (EU) 2022/2065 (Digital Services Act)](https://eur-lex.europa.eu/eli/reg/2022/2065/oj), Articles 34–35, 37, 38 and 40 — systemic-risk assessment and mitigation, independent audits, the non-profiling recommender option, and data access for vetted researchers.

[^src-national-association-1998]: National Association of Attorneys General (1998), [_The Master Settlement Agreement_](https://www.naag.org/our-work/naag-center-for-tobacco-and-public-health/the-master-settlement-agreement/).

[Laws & Regulation — the full regulatory landscape →](https://attentionmachine.org/en/laws/)\
[What to Do →](https://attentionmachine.org/en/educate/what-to-do/)\
[Where to get help →](https://attentionmachine.org/en/educate/get-help/)\
[Yes, but… →](https://attentionmachine.org/en/objections/)

---

Some content on this site was created with the assistance of AI tools and may contain errors. [How we use AI →](https://attentionmachine.org/en/about/how-we-use-ai/)