🔒 Free Privacy App IT
← Observatory

Meta, 18 billion for teen harm and a personal AI assistant (Muse) inside your inbox

On 8 September 2026 Meta introduced Muse, a personal agent that reads your mail, keeps your calendar, books a trip and completes a purchase on your behalf. Alongside the product it announced something no other company is offering a consumer, namely that by the end of the year the whole environment that agent works in will be encrypted with a key only you hold. Not even Meta will be able to get in.

Thirteen days earlier, on 26 August, the same company had settled with forty-eight US states for 18 billion dollars over claims that it designed platforms which foster addictive behaviour in teenagers. The two announcements belong together, and not because this is a trial. The hard part of this story is not the technology, which is serious and on one specific point the most advanced anyone is offering. It is whether an ordinary person, after fifteen years of headlines about Meta and privacy, will be willing to believe it.

What Meta is building, and it deserves to be said properly

The starting idea is WhatsApp's end-to-end encryption, where a message leaves your phone encrypted and opens only on the recipient's, and whoever carries it cannot read it. That works as long as there is a person on the other side. Put an artificial intelligence model there and that model is one of the two endpoints, and to answer you it has to read what you write in the clear. That is why talking to an assistant has never been as private as messaging a friend.

Meta decided to attack exactly that problem. Since 2025 WhatsApp's artificial intelligence features have run inside Private Processing, a system that puts the model in a trusted execution environment, meaning a slice of a server isolated at processor level where not even the administrator of that machine can look. The models work in a confidential virtual machine on AMD SEV-SNP processors and Nvidia GPUs in confidential mode, storing no messages. Requests travel through a third-party relay that hides the sender's IP address from Meta, authentication uses anonymous credentials that prove you are entitled to the service without saying who you are, and your phone can use remote attestation to verify that the server really runs the code it claims to run.

Four-step diagram showing the path of a message through Meta's Private Processing system, from the phone to the anonymous relay and into the confidential virtual machine

What happens to your message inside Private Processing. Source, Engineering at Meta (2025).

With Muse, Meta raises the bar again. The Muse Confidential VM announced for the end of the year does not protect a single request, it protects the whole environment the agent lives in for days, holding your conversations, your documents and your authorisations, and it encrypts that with a key that stays in your hands. In the company's own words, not even Meta will be able to reach it.

Where the claim to a first is real, and where it is not

Precision matters here, because it is easy to overstate this in either direction.

Meta is not the first to apply confidential computing to consumer artificial intelligence. Apple got there in 2024 with Private Cloud Compute, a rigorous design that processes requests without retaining them, allows no privileged runtime access, and publishes its own binaries so that anyone can inspect them. Anyone saying nobody is doing this has not looked.

Meta's first lies elsewhere, on two points nobody else has yet put together.

The first is who holds the key. In Apple's model the guarantee is that Apple cannot look and that you can verify it, but the signing keys stay with Apple. What Meta announces is different, namely a key you hold. That is the difference between trusting a company that has tied its own hands and not having to trust anyone at all.

The second is what gets protected. Apple protects a request that lasts a few seconds. Meta proposes to protect an agent that works for days, holds your credentials, opens the browser and acts on your behalf. Nobody else is doing that. OpenAI's agent also runs on a dedicated computer in the cloud, but it retains the session, the browsing history and the screenshots until you delete them by hand. Anthropic asks for permission app by app, in a design aimed more at developers. Google has not yet shipped anything comparable to a consumer audience.

Comparison of Meta, Apple, OpenAI and the others on dedicated virtual machine, user-held key and published independent audit

Who offers what in consumer artificial intelligence privacy. Source, the companies' public documentation (2024-2026).

The most striking part is the published audit

There is a detail the debate almost missed, and it says far more than any press release.

Meta published a full technical paper on Private Processing, opened a dedicated bounty programme for anyone finding flaws in that system, and let an independent security firm take it apart piece by piece. In 2026 Trail of Bits published that audit. It found 28 issues, 8 of them high severity, and sixteen were fully fixed before launch. Among them, configuration files loaded after attestation that could inject code, a security patch level taken on the firmware's word rather than verified, and attestations without a timestamp that could be replayed indefinitely.

Stop for a second on what that means. A company allowed somebody to publish, in black and white, that its privacy system had eight serious flaws. This is the only thing that makes a privacy promise verifiable rather than promotional, and it is the exact opposite of hiding. Meta itself writes in its own paper that researchers have repeatedly demonstrated the ability to bypass the guarantees of these environments. No marketing department writes a sentence like that.

The missing piece, stated without drama

What is available today is not yet what was announced, and the two are worth keeping apart.

Today Muse runs in a Secure VM, a dedicated computer in the cloud isolated from other users' agents, with a second program separated at system level, the Sentinel, approving everything that leaves for the internet. It is a good architecture. It is not, however, a cryptographic barrier between you and the company, and Meta did not hide that. David Singleton, vice president of engineering for consumer products at Meta Superintelligence Labs, confirmed that access to the data inside that machine is barred by internal policy and remains technically possible.

Comparison of the Secure VM available today and the announced Confidential VM, showing who holds the encryption key

What Muse's virtual machine protects today and what changes with the confidential version. Source, Meta Newsroom and SiliconANGLE (2026).

That is the right way to look at any announcement, including the ones we like. A feature is judged when it exists. Until then, anyone switching Muse on today is relying on a corporate policy, which is a different thing from mathematics.

And here the hard part begins, and it is not technical

Suppose that in three months the Confidential VM arrives exactly as promised. The question stays intact, and it is the question of this article. How many people will say yes?

Timeline of the proceedings and settlements on privacy and minors involving Meta from 2011 to 2026

The open account, from the first Federal Trade Commission orders to the 2026 settlement on teenagers. Source, FTC, US state attorneys general and press reports (2011-2026).

Between 2011 and 2012 the company settled with the Federal Trade Commission over charges that it made users' private information public without their approval. In 2019 came the 5 billion dollar penalty, at the time the largest ever, for breaching the 2012 order on four separate counts. In 2023 the same authority charged Meta with violating its privacy order. In between sits Cambridge Analytica. In June 2025 the public feed of the Meta AI app exposed private conversations belonging to users who had not understood that the share button made them visible to everyone.

And finally the settlement of 26 August 2026. Eighteen billion dollars spread over ten years, forty-eight states plus the District of Columbia and several territories, with Texas settling separately for more than one billion. Meta denied wrongdoing and agreed to settle after evidence had been heard in court. Among the commitments are a two-hour daily limit for users under eighteen, a curfew from midnight to six in the morning and age checks subject to external audits.

The survey data says what you would expect. In 2023 a Forbes Advisor study placed Meta as the technology company UK users trusted least with their data, with 48 per cent judging it untrustworthy. In February 2025 the Forrester Consumer Pulse survey recorded that only a third of online adults in the US and the UK trusted Meta the same or more than the year before.

The paradox that will decide everything

There is one figure that turns the argument around, and it is the most honest one to put on the table. A survey of 1,999 US users of AI assistants published in July 2026 shows that more than 80 per cent report concerns about how their data is handled, while only 18 per cent have paid anything to protect it. We say privacy matters, and then we pick the most convenient tool.

That opens two scenarios which look alike and are not alike at all.

In the first, Meta ships the Confidential VM, has it verified by outsiders as it already did with Private Processing, and wins back pieces of trust with proof rather than advertising. That would be good news for everyone, because when a company that size raises the bar the others have to follow, and verifiable privacy stops being a niche.

In the second, Muse succeeds simply because it saves time, and nobody cares about the key at all. That would still be a commercial success, but it would say nothing about trust. It would say that trust is no longer needed, and that convenience is enough. That is the worst lesson the industry could learn, because it would remove anyone's reason to build things like the Confidential VM.

The difference between those two scenarios is not Meta's to decide. People decide it, one authorisation at a time.

What this means for a school or an organisation in Europe

Muse currently exists only in the United States. In Europe an agent with these permissions runs into the General Data Protection Regulation, the Artificial Intelligence Act and the digital markets rules, and Meta is already under scrutiny precisely over WhatsApp, since in June 2026 the European Commission imposed interim measures to restore access for competing assistants, following the investigation opened by the Italian competition authority in July 2025.

In the meantime the practical decision arrives before the regulation does. In a school or an office, the agent somebody connects to their professional mailbox processes data about students, families and colleagues, and almost always does so without anyone having decided it. Three criteria we teach in our programmes, to be applied to any tool and not only to this one.

  • Always ask who holds the key. It is the question that separates a technical guarantee from a commercial promise, and it applies to every vendor. If the answer is "the vendor, but it has committed not to look", you have a commitment. If it is "you", you have a guarantee.
  • A feature is assessed when it exists, not when it is announced. That goes for Meta and for everyone else, including the vendors we happen to like. Between an announcement and a release there are months in which the data flows anyway.
  • No agent on institutional mail without a written decision. Connecting a tool to a mailbox holding data about minors is a processing operation, not a personal productivity choice.

What Meta is trying to do deserves close attention and, if the company keeps its word, respect as well. Bringing the logic of end-to-end encryption inside artificial intelligence is the most useful thing a large platform can do for people right now. It remains true that trust is not designed alongside the architecture. It accumulates over time, and it is earned through repeated proof. As we noted when writing about the shift from memory to judgment, the competence tomorrow's citizens need is not knowing how to use the tool. It is knowing how to tell a promise from a proof.

Do you want to find out which artificial intelligence tools your school or organisation is already using, and equip yourself with criteria to judge them rather than simply absorb them? Contact us for an AI readiness assessment or read our educational mission.

Methodological note

This article is based on Meta's official announcement of 8 September 2026 and on the technical documentation the company has published, combined with independent press reporting and a third-party security audit. Features of Muse described as forthcoming, first among them the Confidential VM, are announcements and not functions that can be verified at the date of publication, and should be read as such.

The comparison with other companies rests on public documentation available as of 9 September 2026. Apple's Private Cloud Compute and Meta's Private Processing pursue similar goals with different trust models, and there is no single metric that settles which is better in the absolute. The claim to a first concerns two specific and verifiable elements, namely the custody of the key declared to rest with the user and the application of confidential computing to a persistent agent environment.

The survey data should be read with care. The Forbes Advisor and Forrester figures measure stated opinions on different samples and are not directly comparable with one another. The survey of 1,999 US users of AI assistants is weighted to the population that already uses these tools rather than to the general population. Correlation is not causation, and none of these numbers predicts how many people will adopt Muse.

This text is not legal advice. Assessments of lawfulness, legal basis and impact assessment must be made case by case with your own data protection officer.

Sources