Meta reports to Canberra days before its design goes on trial in Oakland.
Curated by Roger Hanney · Throughline Advisory · Sydney · Monday 17 August 2026
This issue is about one question: who answers for what a system is designed to do? I chose it because the same question is being put to one company in three rooms this week, and because in 115 days it gets put to you. Watch the answer change shape as it travels. It is a compliance count in Canberra, a damages figure in Santa Fe, a jury question in Oakland, and by December, a clause in your own privacy policy.
Meta defends the same design in three jurisdictions at once.
Meta's Thursday update to the eSafety Commissioner and Tuesday's Oakland opening are the same argument, run in opposite directions.
In Canberra, Meta's case is diligence: 756,000 under-16 accounts removed to 30 June, caught by AI reading contextual clues in posts and bios. Read the company's own disclosure closely, though, and over 500,000 of those removals happened in the lead-up to the ban commencing rather than under it. Meta compliance update, 13 Aug 2026 · Mi3, 14 Aug 2026.
The regulator's own evaluation says the outcome is not yet compliance, and its most telling number is a gap. Account ownership among under-16s fell hard, from 52.4% to 42.1%. Actual use barely moved: 81.5% still accessing, down from 85.9%. Children are losing accounts and staying on the platforms, and eSafety attributes that gap primarily to ineffective age assurance. eSafety three-month evaluation, 31 Jul 2026.
In Oakland, the argument inverts. There, 29 states allege the design choices behind those accounts are themselves the harm. AP via U.S. News, 12 Aug 2026.
Seven dates link the ban, the verdicts and the December deadline.
Three months of the ban moved under-16 usage 4.4 points.
Hold the question. The next deadline that asks it is yours.
OAIC guidance lands about ten weeks before the December disclosure deadline.
From 10 December 2026, entities covered by the Australian Privacy Principles must update their privacy policies. They must disclose the kinds of personal information used in substantially automated decisions that significantly affect people, and the kinds of decisions made. The obligation entered law in the Privacy and Other Legislation Amendment Act 2024 (Bird & Bird tracker, accessed 17 Aug 2026).
The OAIC consulted on transparency guidance from 18 May to 15 June, and formal guidance is expected around September. SafeAI-Aus legislative summary, accessed 17 Aug 2026. That leaves roughly ten weeks between guidance and commencement.
The deliverable is an automated-decision register: every decision your systems make about people, the information each uses, and its significance. It satisfies the APP 1 disclosure, and it doubles as a procurement asset, because enterprise and government buyers are already asking suppliers for exactly this. Throughline Advisory builds the register, drafts the disclosure, and stands up the governance around it, from a practitioner who has run commercial operations at scale rather than from a template vendor. Start at throughlineadvisory.au.
Singapore ties AI confidence to regulatory clarity while New Zealand offers neither.
At the IAPP Asia Forum in Singapore last month, Personal Data Protection Commissioner Denise Wong put the region's operating theory in one line: clarity in rules produces confidence in use. Singapore backs the words with frameworks, testing methodologies and assurance tooling. IAPP, Jul 2026.
The same piece lands the New Zealand contrast: no standalone AI law, no dedicated regulator, and mostly voluntary guidance, leaving NZ organisations to define responsible governance themselves. For trans-Tasman operators, that means the Australian obligations are the binding ones, and the NZ side inherits whatever discipline the Australian side builds.
Oakland tests whether New Mexico's $942 million verdict scales to 29 states.
Santa Fe answered the design question twice, in two different currencies. March's jury verdict produced civil penalties for concealment and harm. August's order is remediation: money the court directs at addressing youth harms rather than punishing the conduct. Different instruments, same finding underneath. AP, 12 Aug 2026.
Two court orders in five months total $942 million.
Oakland raises the stakes on that finding rather than repeating it. The federal case adds a claim Santa Fe never tried: that Meta routinely collects data on children under 13 without parental consent, in breach of federal law. The states' complaint says the platforms were built to "entice, engage, and ultimately ensnare youth and teens", and Judge Yvonne Gonzalez Rogers spent Wednesday screening jurors for their own social media habits. It is not the ceiling either. Eight further states, including Tennessee where a trial is already under way, sued in their own courts. AP, 12 Aug 2026.
Every one of these venues is testing design accountability rather than content moderation. That is the thesis of this issue, and Oakland is where it either scales or stalls.
The ban is failing on specification, and Meta is the wrong villain for that.
Here is the good-faith case for Meta's position. The removal numbers above were reported voluntarily and publicly. And eSafety's own review attributes the shortfall primarily to age-assurance implementation across the whole industry, with large shares of children never asked to verify at all. eSafety evaluation, 31 Jul 2026.
On that reading the persistent shortfall is a verdict on the law's drafting. Parliament mandated an outcome without mandating a verification standard. It is now doubling penalties for missing a bar it never defined. The US litigation is also unresolved: verdicts and orders to date are first-instance and appealable, and Meta disputes them.
"...where a person has a legal entitlement to reasons for a decision, this entitlement exists regardless of how the decision is made."
Build an automated-decision inventory in one afternoon.
Use case. The register described above starts as a working inventory, and the inventory is a one-afternoon job. The same document then feeds buyer due-diligence questionnaires and board papers on AI risk.
Tips. Walk each customer-facing and staff-facing process and ask one question: does software decide, or materially shape, an outcome for a person? Record the decision, the personal information it uses, the system, and whether a human can intervene. Significance test: would the person care about the outcome? If unsure, include it.
Learn more, free, no paywall: OAIC guidance for organisations · SafeAI-Aus, a maintained map of every live Australian obligation.
Put the register on this week's agenda instead of December's.
My read on the question this issue opened: nobody in any of those three rooms gets to say "the system did it", and from December neither do you. Commission the automated-decision inventory now, before the OAIC's guidance lands. Arriving at that guidance with a draft register means ten weeks of refining rather than a scramble of discovery. If you want it built with you rather than by you, that is the engagement Throughline Advisory runs: throughlineadvisory.au.