No Smoke, Just Pixels

In 1998, America's four biggest tobacco manufacturers agreed to pay $206 billion to 46 states to settle the lawsuits brought against them — after internal data leaked showing that the companies had deliberately manipulated nicotine levels to deepen addiction. Today's Big Tech companies are pursuing the same strategy: internal research documents the harm, the companies bury the findings, and profit comes before public health. Australia has already acted, barring under-16s from social media from December 2025. But does the tobacco model work in the digital age? This part examines what regulation can do — and where its limits lie.

1. The tobacco parallel — the same game on a different pitch

The similarities between Big Tech and the tobacco industry of the twentieth century are no coincidence: the two follow the same basic pattern. For decades, the tobacco companies denied that smoking was addictive or damaging to health. Their own internal research had demonstrated the harm from the 1960s onwards — and that research was deliberately kept from the public. It took a whistleblower, Jeffrey Wigand (head of research at Brown & Williamson), to leak the documents in the 1990s — and that set the litigation in motion.

The result was the Master Settlement Agreement (MSA) of 1998, in which the four largest manufacturers — Philip Morris, R.J. Reynolds, Brown & Williamson and Lorillard — committed to paying $206 billion to 46 American states over 25 years, as compensation for smoking-related health-care costs. The agreement also restricted tobacco advertising, banned marketing aimed at children, and required warning labels on packaging.

Big Tech is following a similar path. Meta's internal research — leaked in 2021 by the whistleblower Frances Haugen — showed that Instagram was particularly damaging to teenage girls' body image and mental health. The leaked documents revealed the findings of Meta's own researchers: "32% of teen girls said that when they felt bad about their bodies, Instagram made them feel worse." The company nonetheless went on as before, making no substantive changes to the platform.

2. The European Union's weapon — the Digital Services Act

Through the Digital Services Act (DSA), the European Union has built the world's strictest framework for digital regulation. The DSA took effect in February 2024 and imposes demanding transparency, content-moderation and risk-management obligations directly on the platforms it designates as Very Large Online Platforms (VLOPs) — those with more than 45 million monthly active users in the EU.

The DSA's main enforcement tool is its power to impose fines: platforms that fail to comply can be penalised by up to 6% of their global annual turnover. That is a painful sum even for the biggest of the tech giants. The first substantial fine came in December 2025, when X (formerly Twitter) was fined €120 million for failing to meet the transparency requirements — for, among other things, the deceptive "blue tick", an opaque advertising repository, and blocking researchers' access to the platform's public data.

The DSA also requires platforms to produce risk assessments that cover their impact on minors. TikTok and Meta have already published theirs, and the European Commission actively monitors compliance. The DSA, in other words, does not merely punish; it demands structural change in how the platforms operate.

Its specific requirements include the swift removal of prohibited content, transparency in advertising (paid promotional content must be clearly labelled as such), and measures to protect minors. The large platforms — TikTok, Instagram, Facebook and YouTube among them — must produce a risk assessment of how their platforms affect minors. Those assessments are public, and the European Commission checks them regularly. The results of the first round are mixed: Meta and TikTok have filed their assessments, but experts find them often generic and thin on concrete measures.

The key to the DSA's effectiveness is consistent enforcement. A law changes behaviour only if those who breach it can expect to be punished. In the case of the tobacco MSA, $206 billion was large enough to force the companies to rebuild their business model. Despite statutory penalties of up to 6% of global annual turnover, DSA enforcement has yet to reach the critical threshold that would force the platforms to change their basic business model. X's €120 million fine, for instance, is a fraction of the company's annual turnover, and the owner's response — publicly attacking the fine and challenging the decision — suggests that the tech giants do not yet see regulation as a serious threat.

Another difficulty is enforcing the DSA across borders. Big Tech operates globally, and a European regulation, however significant, cannot by itself change how global platforms operate. TikTok is obliged to comply with the DSA within the EU, but the platform's global algorithms and content-moderation practices will not necessarily change because of assessments tailored to the EU. Real change would require global coordination rather than jurisdiction-by-jurisdiction action — and coordinating digital regulation globally is still in its infancy.

3. Australia's radical step — banning the under-16s

In November 2024, the Australian parliament passed the Online Safety Amendment (Social Media Minimum Age) Act 2024, which bars anyone under 16 from using social media platforms. The ban takes effect on 10 December 2025 and covers the following platforms: TikTok, Instagram, Facebook (Meta), Snapchat, X (formerly Twitter), Reddit and YouTube.

Under the Act, platforms must put an age-verification system in place. The technical solution is still being worked out, but expected methods include identity-document checks, bank-card verification and biometrics such as facial recognition. An important privacy safeguard is that the Act requires platforms to destroy the personal documents and biometric data used for age verification once the check is complete — they may not retain that information for profiling or advertising. Companies that break the law face fines of up to A$49.5 million.

The measure is contested. The Australian government and parents' organisations support it, arguing that protecting the mental health of minors justifies a drastic intervention. Opponents — digital rights groups and the platforms themselves among them — argue that the ban is unworkable in practice (VPNs and false information get round it easily) and that it deprives young people of the benefits of digital communication and access to information.

4. Age verification — the technology and the doubts

Restricting social media access for under-16s works only if there is a reliable way to verify a user's age. Three main technological approaches exist at present.

Document-based verification requires an identity card or passport to be uploaded. It is the most reliable method, but it raises privacy concerns: platforms have to store personal documents, which increases the risk of a data breach. In addition, young people can easily use a parent's or an older sibling's documents.

Biometric verification — facial recognition, for example — is technically advanced but ethically fraught. Facial-recognition systems are less accurate on young faces, and storing biometric data carries serious privacy risks.

Third-party verification — bank-card checks, say, or a connection to government databases — is technically feasible, but it needs a complicated legal framework, and not every country has the infrastructure it requires.

5. Blind spots and open questions

Attempts at regulation — whether the EU's DSA or Australia's restriction — are important steps, but they face clear limits.

First, how easily the restrictions can be circumvented. VPNs, false dates of birth, the use of a parent's account and the move to unregulated platforms all allow young people to get round the restrictions. How well Australia's ban works depends heavily on how effectively the platforms can enforce age verification.

Second, how far national jurisdiction actually reaches. Big Tech operates globally, and national regulation can constrain it only so far. No single country — not even Australia — can change Meta's or TikTok's global business model on its own. Real change would require international coordination rather than national action.

Third, how much faster technology moves than regulation. The tobacco MSA came more than 40 years after the first scientific evidence of harm. Digital technology moves far faster: ChatGPT appeared at the end of 2022 and reshaped the labour market within two years. Regulatory machinery simply cannot keep pace with technological change.

In summary: the tobacco precedent shows that regulating Big Tech is possible, but what exists today is nowhere near the scale of the MSA. The EU's DSA and Australia's restriction are important first steps, yet the ease with which the restrictions can be circumvented, the limits of national jurisdiction and the slow pace of regulation are serious obstacles. For Generation Z, the question is not whether regulation will come — but whether it arrives in time, and whether it is strong enough to make a real difference. In the closing part of the series, we turn to the faces of Generation Z and the ways in which it resists — and to what the rest of us might learn from them.

"The parallel between the tobacco industry and Big Tech is not a metaphor — structurally it is the same game. The difference is that you cannot stub the internet out the way you stub out a cigarette."

— Ákos Pöltl, family-safety specialist, on "Digital Predators", an episode of the Hungarian public-television talk show Ridikül

"The DSA's fines can run to 6% of global annual turnover. That is already a painful sum — but is it strong enough to change the platforms' business model?"

— European Commission, DSA implementation report (2025)