Several states are pushing legislation that would curtail online access and social media use by kids, setting up yet another potential confrontation between states and Congress on technology policy. 

The Arkansas House of Representatives last week passed a bill that would require social media companies to verify the age of users and confirm that minors have permission from parents or guardians before opening an account. The bill now moves to the state Senate, which has already passed its own version of the bill. 

The Arkansas measure follows similar legislation signed into law by Utah Gov. Spencer J. Cox last month that requires social media platforms to verify the age of users, bans all ads for minors and imposes a curfew on social media use overnight for anyone below age 18. That law, which goes into effect March 1, 2024, also requires tech companies to give parents access to teenagers’ accounts. 

Last August, California was the first state to pass legislation mandating safeguards for minors online. The measure requires tech companies to design apps that default to privacy and safety settings to protect children’s mental and physical health. It goes into effect in July 2024. The tech industry is challenging the law in court. 

Connecticut, Louisiana, Maryland, Minnesota, New Jersey, Ohio and Texas are also considering bills that would require age verification of minors and parental consent.  

The states’ actions could raise the pressure on Congress to move on data privacy legislation that it has so far opted not to enact. The tech companies are already warning that without a national standard, the state laws could mean more data gets collected. 

“All of this further epitomizes the need for one national data privacy standard,” said Carl Szabo, vice president at NetChoice, a trade group that represents Amazon.com Inc., Google LLC, Meta Platforms Inc., TikTok, Yahoo Inc. and others. 

The complexity of having to comply with multiple state privacy laws and new measures addressing children’s safety “will push not only businesses, but parents and nonprofits to begin demanding Congress to enact one national standard,” he said.

Congress didn’t advance a national data privacy measure last year after House members including former Speaker Nancy Pelosi objected to a bill they deemed to be less stringent than privacy standards enacted by California. The Senate Commerce Committee voted favorably on two measures in July 2022 to address kids’ online privacy and prohibit advertising targeting children under 12 without the consent of parents. Neither measure got a floor vote.

The Senate bills advanced after a whistleblower’s revelations that Meta knew its products, such as Instagram, were harming the mental and physical health of teenage users but chose not to prevent such harm.

Aimee Winder Newton, a senior adviser to the Utah governor, said the state is still drawing up details on how its legislation would be implemented. 

The state’s Department of Commerce is preparing rules for tech companies to verify ages and for minors to get parental consent, Winder Newton said in an interview, adding that Utah is studying Louisiana’s digital wallet, which uses an app-based driver’s license system, as one way to verify age online.

To avoid collecting personal information on children and minors, Utah would require only adults to prove their age, Winder Newton said. 

If a user “can’t verify that they’re an adult, then they would default to a minor account,” Winder Newton said. “And that’s specifically so that minors are not giving any of their data information to social media companies directly.”

Tech sector sees more data collection

The companies would be required to use the internet addresses of Utah minors to determine whether they can be on the social media platforms at night, she said. But Szabo at NetChoice warned that the state laws would add to the data collection.

“In order for me to verify that you are authorized to access this website, I need to collect your perfect information every time you visit a website,” he said, referring to the need to collect all forms of identity each time a user goes online. “So, we would no longer have anonymous browsing.” 

He said a verified user could still hand a laptop or phone to a minor or child, and tech companies, with another form of data collection, would need facial recognition technology to ensure the person has been verified. Tech companies also would have to create a log of every person who visits a website and would have to store that information in order to respond to potential lawsuits, making that information more liable to be leaked, Szabo said. 

Jason Kelley, associate director for digital strategy at the Electronic Frontier Foundation, a nonprofit group that advocates for free speech and digital privacy, said a tough national data privacy standard may eliminate the need for age verification systems.

A federal measure that restricts the ability of tech companies to collect unlimited quantities of data on users could “shift the profit motive of a lot of these companies, which are built on data collection and targeted ads,” Kelley said in an interview. “That could lead to a less toxic online” experience overall. 

Less dependence on data collection and targeted ads could lead to more competition, which could give users and kids more options to choose platforms that offer greater protections and safer experiences, Kelley said. 

The foundation opposes the kind of age verification and parental consent laws backed by Utah and other states. Kelley said the laws are likely to be challenged on First Amendment grounds because they could affect adults already signed up to use social media platforms. 

Adults without a driver’s license, for example, could be locked out of social media accounts, “which is sort of one of the largest spaces that people use to communicate and interact in the modern era,” Kelley said. “It’s not just a problem for young people, but it starts as a problem for them and spreads to others in the state who want to use social media.”