I traced $2 billion in nonprofit grants and 45 states of lobbying records to figure out who's behind the age verification bills

submitted by
edited

www.reddit.com/r/linux/s/WqwsCnFE8E

God, I hate posting a Reddit comment, but this is huge. Every claim is sourced (I have not verified personally).

Edit: Well, Reddit does what reddit does, it’s been removed. Here is a github link: https://github.com/upper-up/meta-lobbying-and-other-findings

cross-posted from: https://lemmy.bestiver.se/post/985257

Comments

98
642

Log in to comment

Hot Top New Old
edited

tl;dr it was Meta (because of course it was). It is a little strange though, I would think they would absolutely want this sort of PII but they’re pushing for Google and Apple to deal with it.

 reply
151

I’m guessing one of the motives is to be able to get more data from non meta users. If the API exists at the operating system level, they can then use the code behind that stupid little Facebook button that every website has to get user age as well as the normal browser fingerprinting data.

 reply
80

God, I hate them so f-n much. Ad-supported social media must die.

 reply
32

My understanding is the API only applies to app stores.

 reply
-2

Nope. Most of these legislations are pushing for OS level.

 reply
35

Yes, and the OS communicates this to the app stores.

 reply
-7

App stores and anything else that makes a call to that API.

 reply
24

Your browser would have to allow that.

 reply
-9
Continue thread

That is incorrect, the OS communicates the data to any “app” running on the system that asks for it. The text of the bill (the CA bill specifically is the one I have read) states that any developer of any app must ask for the age bracket from either the OS or the App Store, so the OS will have to have the API open to any “app” running on the device, not just the “app store”. Also, they define “app store” as any website or software that people can download and install software from, which is VERY broad.

 reply
5

And everything else, including via the little Facebook button on various pages.

 reply
4

Or take the blame. Either way, I was expecting Palantir.

 reply
18

Zuck is on board with destroying democracy as much as Theil, otherwise Zuck wouldn’t have personally hired Joel Kaplan back in 2009.

 reply
19
edited

Well of course he is. Billionaires believe they are special little kings who deserve far more than democracy can ever offer them. One vote? Are you kidding? Just one vote each? Not for them. They deserve more. And so, they’re intent on destroying it for millions.

Petty, ambitious tyrants, down to the stunted emotional growth of past rulers. Grow up with everyone telling you you’re a king vs growing into incredible money before you’ve finished developing into a full adult.

 reply
9

Billionaires need to be dealt with. Snuffed out root and stem.

 reply
4

Every legislator who has rolled with them has basically said: fuck the constitution of the United States.

 reply
5

They don’t want to deal with the costs, just get the data. At least that’s what I got from the text, as a reason why they were pushing to make social networks extempt and keep it on app/OS level.

Fuckers.

 reply
3

But they’re not getting the data. The data is going to Google, MS and Apple. All they’re getting is an age bracket.

 reply
-1

For now… But they are pushing laws that require the infrastructure for data harvesting be built into the OS level and then broadcast the data to any program that asks for it without question…

 reply
1

Inside scoop having talked to the company meta uses. Since they use face identification to check age, my belief is that it burdens them with biometric data that the federal government wants rights to. That puts them in a precarious situation if they don’t want to share said data, or can’t make enough off it for the risk, just like problem Discord had. Much safer to have ad-focused data.

 reply
1

I recall reading an article a few days ago saying it was Meta behind it. I feel like tons of research wasn’t needed when the answer key was already known.

 reply
-4

Independently verifying it is still worthwhile.

 reply
30
edited

And provided an insight to the whole flow of dark money.

Edit: Otherwirse they could just brush it off as a rumor/conspiracy theory.

 reply
2

Horrible company is responsible for horrible thing they claimed to have done. More at 11.

 reply
-2

Horrible company says “what? Me? No, guv, we just run ads”.

Best to get receipts.

 reply
5
edited

because reddit is made of AIDS & fail, the post they removed

I’ve been pulling public records on the wave of “age verification” bills moving through US state legislatures. IRS 990 filings, Senate lobbying disclosures, state ethics databases, campaign finance records, corporate registries, WHOIS lookups, Wayback Machine archives. What started as curiosity about who was pushing these bills turned into documenting a coordinated influence operation that, from a privacy standpoint, is building surveillance infrastructure at the operating system level while the company behind it faces zero new requirements for its own platforms.

I want to be clear about what this is and isn’t. I am not the author of the earlier r/linux post by aaronsb and I’m not affiliated with them. I titled this to draw attention on this subreddit because the privacy implications go well beyond Linux. Every source cited here is a public record.

What the bills actually require you to hand over

Most reporting on these bills says something vague like “age checks at device setup.” The statutory language is more specific and more invasive than that.

California AB-1043, signed October 2025 and effective January 1, 2027, defines “Operating system provider” under Section 1798.500(g) as “a person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose computing device.”

Every OS provider must then: provide an interface at account setup collecting a birth date or age, and expose a real-time API that broadcasts the user’s age bracket (under 13, 13 to 15, 16 to 17, 18+) to any application running on the system.

Read that again. Every app on your device gets to query a system-level API that returns your age bracket in real time. This isn’t age verification at the point of accessing restricted content. This is a persistent age-broadcasting service baked into the operating system itself, queryable by every installed application.

Colorado SB26-051 (passed the Senate 28-7, now in the House) copies the same definitions in the same order, same penalty structure ($2,500 per child for negligent violations, $7,500 for intentional ones), same exemptions. The template is the ICMEC “Digital Age Assurance Act,” and it’s been introduced or is pending in Illinois (three separate bills), New York, Kansas, South Carolina, Ohio, Georgia, Florida, and at the federal level.

New York’s S8102A goes further. It requires device manufacturers to perform “commercially reasonable and technically feasible age assurance” at device activation and explicitly bans self-reporting. The AG picks the approved methods. That means biometric age estimation or government ID verification before you can use a device you purchased.

Exemptions in all of these bills cover broadband ISPs, telecom services, and physical products. None contain any exemption for open-source software, non-commercial projects, or privacy-preserving verification methods.

The status right now:

State Bill Status
CA AB-1043 Enacted, effective Jan 1, 2027
CO SB26-051 Passed Senate, in House committee
LA HB-570 Enacted, effective July 1, 2026
UT SB-142 Enacted, first in nation
TX SB-2420 Enjoined by federal judge
NY S8102A Pending
IL HB-3304, HB-4140, SB-2037 Pending
Federal KOSA, ASAA Pending

The privacy architecture these bills create

Here’s what concerns me most from a privacy perspective. These bills don’t just verify age once. They create a persistent identity layer inside the operating system that applications can query at will.

The commercial age verification vendors who would provide this infrastructure (Yoti, Veriff, Jumio) charge $0.10 to $2.00 per check, require proprietary SDKs, demand API keys tied to commercial accounts, and operate cloud-only with no self-hosted option. Your age verification data goes to a third-party cloud service. Every time.

Compare this to what the EU built. The EU Digital Identity Wallet under eIDAS 2.0 is open-source, self-hostable, and uses zero-knowledge proofs. You can prove you’re over 18 without revealing your birth date, your name, or anything else. No per-check fees, no proprietary SDKs, no data going to a vendor’s cloud. The EU’s Digital Services Act puts age verification obligations on Very Large Online Platforms (45M+ monthly users), not on operating systems. FOSS projects that don’t act as intermediary services are explicitly outside scope. Micro and small enterprises get additional exemptions.

EU approach US bills
Who’s regulated Platforms with 45M+ users All operating systems
FOSS exemption Yes, five separate mechanisms None
Verification method Open-source wallet, zero-knowledge proofs Commercial vendors, biometric data to cloud
Cost to non-commercial projects $0 $100K to $2M/year
Privacy architecture Selective disclosure, privacy by design Full age data to vendor cloud
Works offline Yes No, internet required per check

The US bills assume every operating system is built by a corporation with the infrastructure and revenue to absorb these costs. The EU started from the opposite assumption and built accordingly.

Who wrote the legislation

This is where it gets interesting. Rep. Kim Carver (R-Bossier City), the sponsor of Louisiana’s HB-570, publicly confirmed that a Meta lobbyist brought the legislative language directly to her. The bill as drafted required only app stores (Apple, Google) to verify user ages. It did not require social media platforms to do anything.

Meta deployed 12 lobbyists across 9 confirmed firms for this single bill, paying at least $324,992 (described as a “very conservative estimate"). The confirmed firms include Pelican State Partners (who also lobby for Roblox, letting Meta frame this as “broad industry support” rather than one company’s project), Adams and Reese LLP (the #1 ranked Louisiana government affairs firm), and State Capitol Solutions.

Nicole Lopez, Meta’s Director of Global Litigation Strategy for Youth, testified at the House Commerce Committee in support. She also testified in South Dakota for a similar bill. She’s Meta’s national point person for these laws.

HB-570 passed unanimously at every stage: House 99-0, Senate 39-0. So why did Meta need 12 lobbyists? Because the votes were never the concern. The lobbyists were there to control the text and block amendments.

The key amendment battle came from Senator Jay Morris, who expanded the bill to include app developers alongside app stores after Google’s senior director of government affairs publicly questioned why “Mark Zuckerberg is so keen on passing these bills.” When Morris introduced his amendment, Meta went silent. The conference committee compromise maintained dual responsibility but kept the primary burden on app stores, which is what Meta wanted from the start.

At that same Senate hearing, Morris directly questioned DCA Executive Director Casey Stefanski about who funds her organization. She reportedly deflected, said she “wasn’t comfortable answering,” then under continued pressure admitted tech companies provide funding but refused to name them.

The advocacy group that doesn’t legally exist

The Digital Childhood Alliance presents itself as a coalition of 50+ conservative child safety organizations (later inflated to 140+, though only six have ever been publicly named). It has been testifying in favor of these bills across states. Here is what public records show about its legal status:

I searched all four regional extracts of the IRS Exempt Organizations Business Master File (eo1 through eo4.csv), which cover every tax-exempt organization registered in the United States. DCA is not there. No EIN exists for this organization.

I also searched for incorporation records in Colorado, DC, Delaware, and Virginia, plus OpenCorporates (200M+ companies), ProPublica Nonprofit Explorer, GuideStar, and Charity Navigator. No incorporation record exists in any of them.

DCA’s domain was registered December 18, 2024 through GoDaddy with privacy protection and a four-year registration. The website was live and fully formed one day later: professional design, statistics, testimonials from Heritage Foundation and NCOSE staff, ASAA talking points already loaded. This is not a grassroots launch. This is a staging deployment of a pre-built site. 77 days later, Utah SB-142 became the first ASAA law signed in the country.

DCA processes donations through For Good (formerly Network for Good, EIN 68-0480736), which is a Donor Advised Fund. For Good explicitly states in its documentation that it serves “501(c)(3) nonprofit organizations.” DCA claims 501(c)(4) status. DCA is classified as a “Project” (ID 258136) in the For Good system, not as a standalone nonprofit. I searched all 59,736 For Good grant recipients across five years, roughly $1.73 billion in disbursements. Zero grants to DCA, DCI, NCOSE, or any related entity. The donation page appears to be cosmetic.

Bloomberg reporters exposed Meta as a DCA funder in July 2025. The Deseret News detailed the arrangement in December 2025. No version of the website, across 100+ Wayback Machine snapshots, has ever disclosed funding sources. Every blog post and testimony targets Apple and Google. Meta is never mentioned or criticized.

DCA’s leadership traces directly to NCOSE (National Center on Sexual Exploitation):

 reply
73
edited

continued

Casey Stefanski, Executive Director, spent 10 years at NCOSE as Senior Director of Global Partnerships. Unusually, she never appears on any NCOSE 990 filing as an officer, key employee, or among the five highest-compensated staff. A senior director title at a $5.4M organization for a decade with no 990 appearance suggests either below-threshold compensation, an inflated title, or something else about the arrangement.

Dawn Hawkins, DCA’s Chair, simultaneously serves as CEO of NCOSE.

John Read, DCA’s Senior Policy Advisor, spent 30 years at the DOJ Antitrust Division investigating app stores and Big Tech.

NCOSE’s own 501(c)(4) structure turns out to be complicated. Tracing Schedule R filings across four years reveals that NCOSE created “NCOSE Action” (EIN 86-2458921) as a c4 in 2021, reclassified it from c4 to c3 in 2022, then created an entirely new c4 called “Institute for Public Policy” (EIN 88-1180705) in 2023 with the same address and the same principal officer (Marcel van der Watt). By 2024 the original entity had disappeared from Schedule R entirely.

Despite NCOSE’s website describing NCOSEAction as “created by NCOSE,” and Schedule R listing the Institute as a “controlled organization,” all 19 transaction indicators between NCOSE and the Institute are marked “No.” No grants, no shared employees, no shared facilities, no reimbursements. Zero reported transactions between a parent and its own controlled c4 while staff move freely between them. Concurrently, NCOSE’s lobbying spending tripled from $78,000 to $204,000, coinciding with DCA’s launch and the ASAA legislative push.

$70M+ in super PACs, deliberately fragmented

Meta poured over $70 million into state-level super PACs and structured every one to avoid the FEC’s centralized, searchable database:

Entity Meta’s contribution Type Notable detail
ATEP $45M Bipartisan 527 PAC Co-led by Hilltop Public Solutions
META California $20M State PAC Chaired by Brian Rice, Meta VP of Public Policy
California Leads $5M State PAC Union-partnered
Forge the Future Downstream from ATEP State PAC (TX) Policy priorities mirror ASAA language
Making Our Tomorrow Downstream from ATEP State PAC (IL) Also chaired by Brian Rice

By registering every PAC at the state level rather than federally, Meta scatters filings across dozens of state ethics commission databases with different formats, different disclosure timelines, and no centralized search. Each filing is technically public. Aggregating them into a coherent picture requires manually querying each state. This is structural opacity by fragmentation.

Forge the Future’s stated policy priorities include: “Empowering parents with oversight of children’s online activities across devices and digital environments.” That is functionally identical to the ASAA framing.

Of 20 Meta-backed candidates across Texas and North Carolina primaries, 19 won (Washington Post, March 12, 2026).

The firm that bridges both tracks

This is the finding that connects two things I’d been tracking separately.

Hilltop Public Solutions, a Democratic consulting firm, shows up in three distinct contexts:

  1. Co-leads ATEP, Meta’s $45M bipartisan super PAC
  2. Involved in DCA’s messaging coordination, per investigative reporting
  3. Connected to Forge the Future, the downstream Texas PAC with ASAA-aligned policy priorities

This makes Hilltop the first confirmed entity bridging Meta’s political spending operation and the DCA advocacy campaign. The firm helping Meta elect “tech-friendly” state legislators also coordinates messaging for the nominally independent grassroots organization pushing those legislators to pass ASAA.

The dark money network

Meta’s Colorado lobbying runs through Headwaters Strategies, paid $338,500 since 2019, with monthly payments jumping from roughly $5K/month to $14K-$30K/month starting July 2023 as state-level age verification bills accelerated.

Headwaters co-founder Adam Eichberg simultaneously serves as a registered Meta lobbyist in Colorado, as Chair of the Board of the New Venture Fund (the flagship entity of the Arabella Advisors network, $669M revenue), and as founding board member of the Windward Fund (another Arabella entity, $311M revenue). The Arabella network operates four entities from the same building at 1828 L Street NW, Washington DC, with combined annual revenue exceeding $1.3 billion. NVF transfers $121.3M per year to the Sixteen Thirty Fund, a 501(c)(4) with no donor disclosure requirements.

I parsed the IRS Form 990 Schedule I filings across all five Arabella entities. That’s 4,433 grants totaling approximately $2.0 billion. I searched for every child safety, age verification, and tech policy organization I could identify. Zero matches. The Schedule I grant pathway is definitively ruled out. If Meta money flows through this network, it would have to travel via fiscal sponsorship, consulting fees, or non-grant payments, which are inherently less transparent.

The Eichberg connection matters not because it proves a pipeline, but because the person receiving Meta’s lobbying payments chairs the governance structure of the largest anonymous-donor-funded advocacy network in US politics. That structural overlap is documented regardless of whether money moves through it.

The company that benefits

Meta’s own Horizon OS (powering Quest VR headsets) already has Meta Account age verification, a Get Age Category API, Family Center parental controls, Quest Store age ratings, and default minor account protections. I scored Horizon OS at 83% compliance readiness with these mandates.

Meta is not opposing these bills. In Colorado, I pulled lobbying records from the Secretary of State’s SODA API and found Meta’s four registered lobbyists on SB26-051 listed in a “Monitoring” position. Not amending, not opposing. Watching.

On every social media regulation bill in Colorado, Meta takes an “Amending” position, actively fighting changes. Across 117 lobbying records on 22 bills:

  • Bills regulating social media: Meta position is “Amending” (fighting)
  • The one bill putting the burden on OS providers: Meta position is “Monitoring” (watching)

Meta fights bills that regulate Meta. Meta watches bills that regulate everyone else.

In California, Meta spent over $1 million on state lobbying in the first three quarters of 2025 and publicly supported AB-1043, breaking ranks with its own trade associations (TechNet and Chamber of Progress both opposed it). Meta supported a bill that creates surveillance infrastructure at the OS level while leaving social media platforms untouched.

Meta’s LD-2 filings with the Senate explicitly list H.R. 3149/S. 1586, the App Store Accountability Act, as a lobbied bill. The filing narrative includes “protecting children, bullying prevention and online safety; youth safety and federal parental approval; youth restrictions on social media.” In the same filing, Meta also lobbies on KOSA and COPPA 2.0, which would regulate Meta directly. Meta supports the bill that burdens its competitors and lobbies to weaken the bills that burden itself. Both positions appear in the same quarterly disclosure.

The privacy questions

I’ve tried to present findings here, not conclusions. But from a privacy standpoint:

Why does the company that profits from collecting user data draft legislation requiring every operating system to collect age data and broadcast it to every installed application via a system-level API?

Why do these bills mandate commercial age verification vendors (Yoti, Veriff, Jumio) whose business model is collecting biometric data, while the EU’s equivalent uses open-source zero-knowledge proofs that reveal nothing beyond “over 18”?

Why is there no data minimization requirement in any of these bills for the age verification data itself? AB-1043 creates a persistent age signal API. Who governs what happens to the data flowing through it?

Why does Meta fund an advocacy group with no legal existence in the IRS system to push legislation that creates new data collection infrastructure at a layer below Meta’s own products, while Meta faces zero new requirements?

Why does the company whose lobbyist drafted one of these bills write it to specifically exclude social media platforms from the age verification mandate?

If the goal is child safety, why regulate the operating system, which has no direct contact with children, instead of the social media platforms where the documented harm occurs?

What you can do

If you’re in CO, IL, or NY, these bills are still in committee. Comment on the record. System76’s CEO met with the Colorado bill’s sponsor on March 9 and the sponsor suggested excluding open-source software. The conversation is happening now.

Contact the EFF, FSF, and Software Freedom Conservancy with the specific statutory language and compliance gap numbers. They need to know these definitions cover volunteer-maintained software with no exemption.

Read the actual bill text. CA AB-1043 is searchable on leginfo.legislature.ca.gov. CO SB26-051 is on leg.colorado.gov. The definitions are what matter, not the news summaries.

If you maintain software that could be classified as an “operating system provider” under these definitions, start thinking about your response now. CA AB-1043 takes effect January 1, 2027. Louisiana HB-570 takes effect July 1, 2026.

Sources (all public records)

Bill text: CA AB-1043 (Chapter 675, leginfo.legislature.ca.gov), CO SB26-051 (leg.colorado.gov), LA HB-570 Act 481 of 2025 (legis.la.gov), NY S8102A (nysenate.gov), TX SB-2420, UT SB-142 (le.utah.gov)

Federal lobbying: OpenSecrets Meta profile (opensecrets.org, client ID D000033563), Senate LDA filing UUID b73445ed-15e5-42e7-a1e8-aeb224755267

 reply
41
edited

continued

Colorado lobbying: CO Secretary of State SODA API (data.colorado.gov, datasets vp65-spyn, dxfk-9ifj, df5p-p6jt)

Louisiana lobbying: LA Board of Ethics, F Minus database (fminus.org/clients/pelican-state-partners-llc/, fminus.org/clients/meta-platforms-inc/)

California lobbying: CalAccess (cal-access.sos.ca.gov), Bloomberg Government

Super PACs: Forge the Future (texasforgefuturepac.com), Texas Ethics Commission, Illinois State Board of Elections, Politico (Feb 2, 2026), Washington Post (Mar 12, 2026)

DCA records: WHOIS/RDAP (rdap.org), Wayback Machine CDX API (100+ snapshots), IRS EO BMF (eo1-eo4.csv), OpenCorporates, ProPublica, GuideStar

NCOSE: IRS Form 990 FY2020-FY2024 including Schedule R; NCOSEAction/Institute for Public Policy (EIN 88-1180705); original NCOSE Action (EIN 86-2458921) via Schedule R history

For Good/Network for Good: forgood.org, DCA donation page source (targetable_type=Project, targetable_id=258136), For Good 990s via ProPublica (EIN 68-0480736, 59,736 recipients searched)

IRS 990 filings: ProPublica Nonprofit Explorer: NVF (EIN 20-5806345), STF 2024 (sixteenthirtyfund.org), DCI (EIN 39-3684798), Windward, Hopewell, North Fund, NCOSE (EIN 13-2608326), ConnectSafely (EIN 47-3168168)

Campaign finance: CO TRACER bulk data (tracer.sos.colorado.gov), FollowTheMoney.org, FEC API (Meta PAC C00502906)

Reporting: Bloomberg (July 2025), Deseret News (Dec 2025), The Center Square, ACT | The App Association, Dome Politics, Pluribus News, Nola.com, Privacy Daily

EU framework: EUR-Lex (Digital Services Act, eIDAS 2.0 Regulation), EUDIW GitHub repository, T-Scy consortium

Technical: freedesktop.org, GNOME/KDE documentation, Meta developer docs (developer.meta.com/horizon)

Full dataset, OSINT tasklist, and all processed findings are published with sources embedded in each file: github.com/upper-up/meta-lobbying-and-other-findings

This is an ongoing investigation. Pending: Texas Ethics Commission records for Forge the Future expenditure recipients, NCOSEAction’s first 990 filing, IRS Form 8872 for ATEP, and FOIA responses from Colorado and Louisiana. If you have access to lobbying data from states I haven’t covered (IL, NY, UT, GA), I’d appreciate a heads up.

I am not claiming Meta wrote every one of these bills. Louisiana is confirmed by the sponsor; the others use a shared ICMEC template. I am not claiming there is a direct Arabella-to-DCA funding pipeline; I checked $2 billion in grants and found no evidence. I am not claiming child safety isn’t a legitimate concern. What I am documenting is: the company whose lobbyist drafted HB-570 wrote it to exclude its own platforms; the advocacy group pushing these bills nationally has no legal existence and is confirmed funded by Meta; the same consulting firm bridges Meta’s super PAC and DCA’s messaging; none of these bills exempt open-source or non-commercial software while the EU equivalent does; and the mandatory age-signal API creates persistent surveillance infrastructure at the OS level with no data minimization requirements. The records are above. Draw your own conclusions.

This section documents what happened when this investigation was posted to Reddit, and provides context on Meta’s documented history of using astroturfing, coordinated reporting, and platform manipulation to suppress unfavorable content.

What happened

The original version of this investigation was posted to r/linux, where it was mass reported and pulled down pending moderator review (150 upvotes, roughly 15k views before being pulled down some 40 minutes after being posted)

The content that was suppressed names Meta lobbying firms, traces documented payments, cites Senate LD-2 filings, and links to IRS records. It identifies Hilltop Public Solutions as the first confirmed entity bridging Meta’s $45M super PAC and the DCA astroturf campaign. This is the kind of content that a well-resourced actor would have reason to suppress.

I cannot prove the mass reports were coordinated rather than organic. That is the point of the tactic: Reddit’s infrastructure makes it impossible to distinguish genuine community objections from manufactured ones, and it rewards the behavior either way by automatically removing the content.

Meta has done this before

In March 2022, the Washington Post reported that Meta hired Targeted Victory, one of the largest Republican consulting firms in the country, to run a nationwide astroturfing campaign against TikTok. Internal emails obtained by the Post showed the campaign:

  • Placed op-eds and letters to the editor in regional news outlets across the country, none of which disclosed the connection to Meta or Targeted Victory
  • Promoted stories about dangerous TikTok “trends” that had actually originated on Facebook
  • Pushed local politicians and political reporters to frame TikTok as a threat to children
  • In an internal email, a campaign director wrote that the “dream would be to get stories with headlines like ‘From dances to danger: how TikTok has become the most harmful social media space for kids’”

Meta’s spokesman defended the campaign by saying “all platforms should face a level of scrutiny consistent with their growing success.” Meta did not deny hiring the firm or directing the campaign. The story was confirmed by the Washington Post, Fortune, Variety, CBS News, Engadget, Tortoise Media, the Boston Globe, and Techdirt, among others.

This is not speculation about what Meta might do. This is what Meta has been publicly documented doing: hiring firms to plant stories, manufacture public concern about competitors using child safety as the framing, and conceal the corporate origin of the messaging. The Targeted Victory campaign and the DCA campaign use the same playbook: fund an outside entity to push messaging that serves Meta’s commercial interests while hiding Meta’s involvement.

Reddit’s bot and astroturfing problem is structural

Research published in Nature (Scientific Reports) documented coordinated political astroturfing patterns across platforms including Reddit. A separate study found that at least 15% of content in surveyed subreddits was posted by corporate trolls or bot accounts designed to manipulate public opinion.

Since June 2025, bot networks have been systematically exploiting Reddit and Meta’s own moderation systems through mass reporting. Thousands of legitimate Facebook groups were deleted after coordinated bot reports triggered automated enforcement. The same mass-reporting tactic works on Reddit: a small number of accounts can file reports, trigger automated removal, and flag the poster’s account for site-wide spam filtering, all without engaging with the content.

Venture-backed firms like Doublespeed now offer astroturfing-as-a-service across Reddit, TikTok, and Instagram, operating physical phone farms to bypass platform detection. The infrastructure for suppressing content through coordinated inauthentic behavior is commercially available.

What this means for this investigation

Meta spent $26.3 million on federal lobbying in 2025 and deployed 86+ lobbyists across 45 states. It funded a nationally active advocacy group (DCA) with no legal existence in the IRS system. It hired Hilltop Public Solutions to simultaneously run its $45M super PAC and coordinate DCA’s messaging. It previously hired Targeted Victory to run a covert astroturfing campaign against TikTok using child safety as the narrative frame.

This investigation documents all of that with primary sources. A post containing those findings was mass reported on Reddit within hours and suppressed site-wide by automated systems. Whether the reports were organic or coordinated, the outcome is the same: the content was removed from the platform where Meta has both the motive and the documented capability to suppress it.

The research is published in a git repository with every source embedded. It does not depend on Reddit’s infrastructure to survive.

Sources

 reply
39
edited

continued

 reply
40

I know it’s a lot of information and difficult to summarize, but doesn’t anyone have a TL;DR? Who’s behind it?

 reply
7

Those are found in other comments: Meta, NCOSE, Heritage Foundation.

Meta is covertly supporting bills to weaken the burden on itself and shift it on others (especially competitors) while NCOSE & Heritage Foundation want to regress society as usual.

 reply
24

Conveniently while also forcing all operating systems to install infrastructure to collect data about the user and broadcast it to every single program ran on the device… Make the OS do the data collection, give it to Meta for free.

 reply
9

Thanks. Yeah, I saw Meta in another comment after I posted my question.

 reply
3

What’s surprising me is that it passed unanimously with 99 votes in Louisiana House. I know Louisiana is as dead red as it can possibly be, but still, not a single nay for such an Orwellian book bill??

 reply
1

It really throws a light on the shit that they’re up to over this side of the Atlantic.

https://www.irishtimes.com/technology/big-tech/2025/10/30/data-protection-rules-completely-out-of-control-meta-tells-government/ https://archive.is/M8wbm

https://noyb.eu/en/former-meta-lobbyist-named-dpc-commissioner-meta-now-officially-regulates-itself

https://compliancehub.wiki/the-masks-are-off-ireland-appoints-meta-lobbyist-to-police-meta-on-data-protection/

Meta has engaged in significant lobbying activities within the European Union regarding privacy and content regulations, often overlapping with discussions on “chat control” (a controversial EU proposal to scan private messages for child sexual abuse material, or CSAM).

 

Key developments regarding Meta’s influence in the EU, based on recent reports, include:

Lobbying on AI and Tech Regulation: As of April 2025, reports suggest Meta has been actively lobbying to influence or dilute EU artificial intelligence and technology regulations.

Influence on Digital Privacy Legislation: Meta and other “Big Tech” entities have been subject to intense scrutiny and lobbying investigations concerning how they affect European privacy laws, including GDPR compliance and potential chat control measures.

Regulatory Independence Concerns: Civil society organizations (including the Centre for Countering Digital Hate and EDRi) have raised concerns about the influence of former Meta lobbyists on EU regulators, notably the Irish Data Protection Commission (DPC), which is the lead supervisor for Meta in the EU.

Antitrust and Competition Conflicts: In February 2026, the European Commission notified Meta of a statement of objections regarding the exclusion of third-party AI assistants from WhatsApp, viewing this as an abuse of its dominant position. This indicates that while Meta lobbies, it is also facing heavy EU regulatory action.

Data Protection Fines: Meta has previously faced substantial fines, such as the €1.3 billion fine in 2023 linked to US-EU data transfer practices. 

The “chat control” legislation has faced delays and significant debate regarding its impact on privacy vs. security, with civil liberties groups opposing the mandatory scanning mechanisms that the proposal would introduce.

 reply
31

lobbyists are why most people get into politics. all soulless piece of fucks…

 reply
1
edited

I’m glad to have an answer that allows me to direct my hate. Problem is, I already hated Facebook and The Heritage foundation.

 reply
29

Same -_-

I miss the old internet. It’s the most conservative thing I’ll ever say.

 reply
6

I deploy hundreds of docker containers every day that run general purpose operating systems. These bills seem dumb at a fundamental level regardless of the terrible privacy implications.

 reply
52

And then some kid buys a used raspberry pi or wipes an old computer and circumvents it all anyway.

 reply
15

Github is MS, so better save it while you still can.

 reply
17
edited

Codeberg mirror is quick and easy to set up, /u/lmmarsano@group.lt !

 reply
6

That’s an impressive investigation.

It would be tough to find a better example of why lobbying in the US is fundamentally broken. An entity like Meta has ample funding to break up an operation into distinct cells that do not directly interact in public forums, while tracking the whole process in documents protected by ACP. I think it’s particularly telling that Meta lobbyists are quietly nodding along legislation pushed by “grass roots” activists and that Meta’s new OS just happens to implement the technology exactly as described in the law.

It’s that sort of coordinated effort that the RICO act was drafted specifically to address, but it’s perfectly legal.

 reply
15

while tracking the whole process in documents protected by ACP.

ACP?

 reply
7

Attorney-Client Privilege. Sorry, I should have just said it.

For anyone who might have avoided this part of the world, ACP makes communications between you and your counsel inadmissible in court. In big companies, it’s somewhat common to bring lawyers into discussions under the auspices of seeking legal advice, but primarily to ensure that if any artifact from that discussion were to be uncovered by an adversary, it couldn’t be used in a lawsuit.

 reply
10

Thank you for this. Like, I heard a bit about this but set it aside as “to be researched later” without realizing how far along the stupidity had gotten.

 reply
14

“The research is published in a git repository with every source embedded. It does not depend on Reddit’s infrastructure to survive.”

proceeds to post on Microslop’s Github

 reply
69

Shouldn’t be hard to clone it to any other git server. Since you’re concerned, get on it.

Sdf probably even has their own.

 reply
58

Yup, they do! It’s on the list of 101 SDF things I should be using but somehow amn’t.

I wonder how many forks outside of Github there would be going for this repo by end of tomorrow…

 reply
17

 reply
18

A whole domain? Hopefully this doesn’t cost them much. I’m guessing until then copies of the repo on notabug and/or codeberg that one can cross-check ought suffice.

 reply
5
she/her

That kind of surprised me too, so I downloaded the repository. Now it’s sitting on my archival drive in case I need to put it somewhere, and dumped on a random neocities website for… amusement mostly.

 reply
2
edited

So Meta (and their allies) are actively pushing and lobbying (illegally, if you look at DCA that doesn’t even exist?) for laws that force operating systems to build a permanent age API thats full time accessible for apps?

Why not use a digital identity wallet like Europe : You can prove that you are 18+ without sharing your date of birth, name, or other information (via zero-knowledge proofs), it’s like a confirmation paper from a bank or another institution without any actual information about yourself. Plus there’s parental consent to children’s accounts (as COPPA in the U.S. already does), or like by doing verification locally or through open-source systems, not through commercial companies with a central Database.

They knowingly ignore better, more privacy friendly alternatives to age verification because by forcing operating systems to implement a permanent age API, they create a system that burdens competitors like Apple and Google and Free and Open Source software who sometimes cant even abide to those rules, all-the-while meta’s own platforms are often excluded. Apparently this fits into a broader strategy to normalize surveillance and increase dependence on commercial verification companies, which Meta indirectly benefits from.

I dont really see this changing, I expect meta getting away with everything and getting worse cause look at the inauguration. But musk also got booted so who knows. But in the end America usually doesnt care about customer rights, privacy rights, or childrens rights ig.

Im awaiting the results of the latest lawsuit where zuckerberg had to testify about accusations that social media, including Instagram, harm children’s mental health. https://edition.cnn.com/2026/02/19/tech/takeaways-mark-zuckerberg-testifiessocial-media-child-mental-health

 reply
17

Why not, not do age verification at all?

I don’t want the government or any corporation involved in verifying anything about me online.

 reply
1
edited

Yeah we should deffo support privacy watchdogs who lobby for us(customer rights, consumer rights, privacy rights etc) and advice the government and when its election time, check who’s the nerd vote

 reply
1

The idea of a national ID would never pass in the US. Both parties are against it for various reasons.

 reply
1

Well it would facilitate ICE’s work somewhat.

 reply
2
edited

Was there ever any doubt? They’ve been trying to tie devices to identities for years now. This is just the end game.

The funny thing is, it’s kinda hard to prove that surveillance based ads actually work. Ad platforms like to throw numbers of how may people see ads around, but it’s hard to actually tie those numbers to sales. What’s worse is that the way these ads are bought, sold, and how ad placement is commodified means that everything remains intentionally vague to the people buying ads. In most cases, all they know is that “everyone is doing it” and “making lots of money” and if they don’t they’ll be left out of the revenue party.

Right now, enough people are still drinking the kool-aid that it’ll remain a safe revenue stream for companies like Meta unless something happens that hurts the cash flow of their customers. But, it kinda makes you wonder, if the vagueries of the online add ecosystem caused companies to reconsider the investment during an economic crisis, how would these ad platforms that have recently gotten very cozy with fascists make money?

 reply
6

Fuck that fucking shitty website.

It’s crazy the amount of censorship that goes on there and how accepted it is by its audience.

 reply
6

Can we trace who is behind anti trans lobbying in US and UK?

 reply
9
edited

We already did. The epstein emails showed that they intentionally started an anti trans campaign via 4chan that spread so that they could undermine the safety of trans women and lock them into unregulated sex work. Also, jkr was one of their buddies.

 reply
17

But who is donating money right now? There is definitely still a lot of money pouring into this.

 reply
6

Probably whoever was paying him to begin with. The pedophile parties didnt stop when he got arrested. They just moved somewhere else.

My best guess is the heritage foundation and the like. Probably not one single person or group but a coalition of the worst and richest people on the planet

 reply
10
edited

good old reddit, must have been a real wrench for you

wait a second what are you doing reading reddit in the first place?

traitor! impure!

 reply
4
OP

Actually, it was a hackernews link originally.

But for some interest-based subs, I still stick my nose in a hoover up knowledge without contributing back. Considering I janitored about 30 niche subs before the appageddon, I think they’re net negative since I left roughly about when you did. I was probably replaced by a bot, so maybe they’re happier.

 reply
1

The EPSTEIN CLASS which the Government is doing EVERYTHING to Protect is Behind wanting you AND your Child’s IDS? I COULDNT have Guessed!

 reply
10

Yes. The way these laws are written, our devices could be mandated to take a quick picture of our underage children during setup and/or login.

Then that picture can be secured to today’s standards, ensuring a data breach.

I can imagine why the Epstein class would want that to happen - more information when they are choosing which of our children to kidnap.

 reply
1

And… It’s gone. What the fuck?

 reply
6

If you’re also trying to avoid github because Microslop, looks like this is further hosted on https://tboteproject.com/, with a decentralized repository on https://tboteproject.com/git/hekate/attestation-findings

 reply
3

Social media is optional. Quit relying so much on the internet for entertainment. Sail the high seas. Arr.

 reply
3
OP

Wish the platform owners didn’t make enough money shearing sheep that they can use it to fuck it up for the rest of us.

 reply
1
Insert image