Why can't Bangladesh hold Meta accountable for harming children?

Illustration: TBS

Meta recently agreed to pay up to $18 billion over 10 years to settle a lawsuit in the US which claimed Facebook and Instagram were deliberately designed to keep children scrolling, even when that design damaged their mental health. 

Earlier in August, a New Mexico court separately ordered Meta to pay $942 million, including a $567 million fund addressing harm to young people.

But there is a geographic contrast. A teenager in California and a teenager in Cumilla may be under similar risks. Yet one now benefits from court-enforced safeguards, independent audits and billions in public remediation. The other receives Meta's community standards and the familiar instruction to report a problem. 

So why can a platform capable of detecting a teenager's shopping preferences not acknowledge harm to Bangladeshi children?

Moving from advice to platform liability

Across the world, governments are moving from asking children to protect themselves towards requiring technology companies to prove that their products are safe.

The European Union has fined Instagram €405 million over children's privacy failures. Under the Digital Services Act, major platforms must assess systemic risks and may face penalties of up to 6% of global turnover. 

Britain now requires services to prevent children from encountering content involving pornography, suicide, self-harm and eating disorders, using effective age-assurance measures rather than a box asking whether the user is over 13. 

Australia has prohibited children under 16 from maintaining social-media accounts and placed responsibility for enforcement on platforms. 

Brazil's Digital Statute of the Child and Adolescent requires platforms to prevent and mitigate risks through age assurance, parental supervision and safer product design. Brazil also converted its National Data Protection Authority into a regulatory agency with enforcement responsibility. 

India's data-protection framework prohibits behavioural tracking and targeted advertising involving children and requires verifiable parental consent.

We have a data law, not a platform-safety regime

Bangladesh's Personal Data Protection Act, passed on 10 April 2026, declares personal data to be owned by the individual and establishes rights relating to access, correction, erasure and portability. It imposes responsibilities on data fiduciaries, recognises sensitive information and requires action following a data breach. 

But a law governing personal data does not automatically answer whether Instagram may recommend self-harm content to a child, use infinite scrolling to prolong compulsive engagement, promote extreme appearance filters, or fail to remove Bangla-language abuse for hours.

Those are questions of platform design, risk assessment, moderation and liability.

Shahzeb Mahmood, head of research at Tech Global Institute and a specialist in internet and technology law, said Bangladesh possesses several laws that may touch different parts of the problem, but none comprehensively defines what a platform owes its users.

"That does not mean Bangladesh cannot hold Meta accountable under its existing laws. It can, but the framework is not strong enough. What is fundamentally missing is legislation that clearly defines the responsibilities and liabilities of online platforms," he said.

A government may order content removed under one law, investigate a data breach under another or prosecute an individual offender under the Penal Code. But who investigates whether the recommendation system itself exposed thousands of children to predictable harm? What records must Meta retain? How quickly must it respond? Who can inspect its system? Where can a family seek compensation?

At present, the answers are scattered or absent.

"Bangladesh's Personal Data Protection Ordinance 2025 contained a provision in Section 9 prohibiting data controllers from tracking, monitoring, profiling or conducting targeted advertising towards children," said Asif Shahriar Shusmit Policy Analyst, Ministry of Posts Telecommunications and IT. "That provision is absent from the enacted 2026 Act, where Section 9 now deals with guardian consent."

The omission goes to the heart of the Meta litigation.

"The American case was not simply about consent. It was about what the product does to a child who is already using it. The Data Governance Authority, which is supposed to provide oversight, has also not yet been formed," Sushmit added.

If the substantive gap is clear, the fix is less so. Miraj Ahmed Chowdhury, founder and managing director of Digitally Right, said the new law could supply a framework, but cautioned against moving too quickly to copy others.

"Our new Data Protection Act could provide a framework for addressing this issue. However, there is a concern about enforcement," he said. "Australia has introduced legislation on child protection, but there are still questions about how effectively such laws are being implemented. Before introducing similar measures here, there needs to be extensive consultation and, importantly, evidence about what works and what does not."

Any obligations, he added, should be built on that evidence rather than introduced hastily.

Harm is global, safety investment is not

Bangladeshi children face the same addictive mechanics as American children, but within a less protected information environment. They also encounter risks shaped by local language, social stigma, weak mental-health support, religious and political tensions, and the difficulty of complaining to a person who understands its context.

Leaked 2019 documents show that Facebook classified countries into different tiers, with Brazil, India and the US receiving round-the-clock monitoring, while Bangladesh was placed in a bottom tier where content was reviewed only after a moderator escalated it. That year, 87% of Facebook's misinformation budget went to the US, despite the country having roughly one-tenth of its users.

"Meta and its parent company are registered in the US and are legally liable there. In Bangladesh, however, they do not face the same level of legal liability," he said. "Since the parent company is based in the US, its legal obligations and exposure are different. That disparity in legal accountability is a key factor," Miraj said.

How Bangladesh's PDPA was nerfed 

When the Personal Data Protection Ordinance was promulgated in November 2025, a serious violation by a firm the size of Meta or Google could, in principle, have been measured against a slice of its revenue. 

General violations would have drawn fines of between 1% and 2% of annual turnover; significant data fiduciaries, the category the largest platforms fall into, faced between 2% and 5%. 

The 2026 Act discards it. Its Section 32 sets flat ceilings up to Tk25 lakh for a breach of a data subject's rights, up to Tk50 lakh for a significant data fiduciary, and Section 33 caps a security failure at Tk25 lakh. 

A Tk50 lakh fine is indistinguishable from the cost of doing business. Tech Global Institute, reviewing the draft in October 2025, had noted the turnover model was among the few levers capable of disciplining global firms.  

The ordinance carried criminal liability up to five years' imprisonment for unauthorised processing, up to seven for sensitive-data violations. The Amendment Ordinance of February 2026 stripped imprisonment for managing directors; the April Act removed every custodial provision. What was a criminal statute is now a financial-penalty regime, with appeals to the tribunal under Section 68 of the ICT Act. 

Accountability needs an institution with teeth

Even a stronger substantive law will accomplish little if Bangladesh cannot establish what happened inside the platform.

Meem Arafat Manab, a researcher and computer scientist specialising in AI governance, ethics, data-protection law and digital rights, said successful litigation requires evidence that Bangladesh's framework does not yet force platforms to produce.

"For a case like this, you need more than a law. You need a substantial paper trail showing what the company actually did, which requires proper auditing and reporting. Bangladesh's existing legal framework does not make that kind of documentation mandatory." 

They added, "If you look at Europe, or even Kenya, companies are required to provide regulators with detailed information about what data they hold, how they use it, who is affected and what impact their activities have. Bangladesh does not have comparable reporting or impact-assessment requirements."

Shahzeb Mahmood said, "The question is not simply whether the government can take action against Meta. It is whether our laws clearly establish what platforms are required to do, within what timeframe, what consequences follow when they fail, and how users can seek redress."

Manab said, "Bangladesh needs a dedicated online-safety framework requiring large platforms to conduct child-rights and algorithmic-risk assessments, publish country — and language-specific transparency reports, preserve evidence, submit to independent audits and operate accessible complaint and appeal systems in Bangla. The authority implementing it must be independent, and the law needs proper reporting and enforcement mechanisms."

For Miraj Ahmed Chowdhury, the harder question is what, exactly, children need protecting from. He thinks that the answer reaches well beyond a single company.

"This is essentially a question of legal frameworks, but it is also a question of negotiation with the platforms. We need to explore whether we can reach agreements with them on specific safety issues and get them to commit to certain guidelines," he said.

"But before doing that, we need to establish exactly what we want to protect children from. The challenge is that the issue is not limited to Facebook. Children are using Instagram, increasingly so. They use YouTube. Many are now using AI tools to search for information, and then there are conventional searches and online marketplaces. There can be hundreds of different types of online platforms, each with its own set of risks," Miraj further said, adding that the first step should be to identify and assess those risks. 

"Once we understand the threats children face across these platforms, we can develop a much more effective policy response."

Bangladesh's strongest response may therefore lie in its market size. 

"Governments need to act together because market size is ultimately the strongest leverage against a company like Meta," Sushmit said. "Bangladesh alone is a relatively small market for Meta. But Bangladesh working with Indonesia, Pakistan, Nigeria, the Philippines and Vietnam would create a bloc that the company could not easily ignore or negotiate with one country at a time."