Are you a young person fighting back against bad bills like KOSA? Become an EFF member at a new, discounted Neon membership level specifically for you--stickers included!
A new bill sponsored by Sen. Schatz (D-HI), Sen. Cotton (R-AR), Sen. Murphy (D-CT), and Sen. Britt (R-AL) would combine some of the worst elements of various social media bills aimed at “protecting the children” into a single law. It contains elements of the dangerous Kids Online Safety Act as well as several ideas pulled from state bills that have passed this year, such as Utah’s surveillance-heavy Social Media Regulations law. The authors of the Protecting Kids on Social Media Act (S.1291) may have good intentions. But ultimately, this legislation would lead to a second-class online experience for young people, mandated privacy-invasive age verification for all users, and in all likelihood, the creation of digital IDs for all U.S. citizens and residents.
The Protecting Kids on Social Media Act has five major components:
- Mandate that social media companies verify the ages of all account holders, including adults
- Ban on children under age 13 using social media at all
- Mandate that social media companies obtain parent or guardian consent before minors over 12 years old and under 18 years old may use social media
- Ban on the data of minors (anyone over 12 years old and under 18 years old) being used to inform a social media platform’s content recommendation algorithm
- Creation of a digital ID pilot program, instituted by the Department of Commerce, for citizens and legal residents, to verify ages and parent/guardian-minor relationships
All Age Verification Systems are Dangerous — Especially Governments’
The bill would make it illegal for anyone under 13 to join a social media platform, and require parental consent for anyone between the ages of 13 and 18 to do so. Thus the bill also requires platforms to develop systems to verify the ages of all users, as well as determine the parental or guardian status for minors.
The problems inherent in age verification systems are well known. All age verification systems are identity verification systems and surveillance systems. All age verification systems also impact all users because it’s necessary to confirm the age of all people in order to keep out one select age group. This means that every social media user would be subjected to potentially privacy-invasive identity verification if they want to use social media.
Anyone age 13 to just under 18 will be required to obtain parental consent before accessing social media. We are against such laws.
As we’ve written before, research has shown that no age verification method is sufficiently reliable, covers the entire population, and protects data privacy and security. In short, every current age verification method has significant flaws. Just to point out a few of the methods and their problems: systems that require users to upload their government identification only work for people who have IDs; systems that use photo or video to guess the age of a person are inevitably inaccurate for some portion of the population; and systems that rely on third-party data, like credit agencies, have all of the problems that this third-party data often has, such as incorrect information. And of course, all systems could tie a user’s identity to the content that they wish to view.
An Age Verification Digital ID “Pilot Program” is a Slippery Slope Towards a National Digital ID
The bill’s authors may hope to bypass some of these age verification flaws by building a government-issued digital ID system for the (voluntary) use by all citizens and lawful residents of the U.S. to be able to verify their ages and parent/guardian-minor relationships on social media platforms (although this “pilot program” would likely not be completed before the age verification requirements went into effect). But this program risks falling down a slippery slope toward a national digital ID for all purposes.
Under the bill, individuals would have to upload copies of government-issued and other forms of identification, or people’s asserted identities and ages would be cross-referenced with electronic records from state DMVs, the Internal Revenue Service, the Social Security Administration, state agencies responsible for vital records, “or other governmental or professional records that the Secretary [of Commerce] determines are able to reliably assist in the verification of identity information.”
EFF and other civil liberties organizations have long been critical of digital ID systems and policies that would move us toward them. While private, commercial age verification systems come with particular concerns, government versions that rely on digital IDs are also dangerous.
Data sharing concerns don’t disappear because the government is involved
Mission creep is a serious concern. The intention of this ID system may only be to authorize social media access; the bill states that the pilot program credential “may not be used to establish eligibility for any government benefit or legal status.” But it’s unlikely that age and parental status verification would be its only use after its creation. Congress could easily change the law with future bills. Just look at the Social Security Number–once upon a time, it was only meant to allow Americans to participate in the federal retirement program. Even the Social Security Administration admits that the number “has come to be used as a nearly universal identifier.” Online government identity verification for accessing social media is already dystopian; who knows where the system would end up after it’s in place. Without very careful and thoughtful management and architecture, a digital ID system could lead to loss of privacy, loss of anonymous speech, and increased government surveillance.
STOP THE "PROTECTING KIDS ON SOCIAL MEDIA" ACT
Data sharing concerns also don’t disappear because the government is involved—in fact, they may be more acute. In third-party age verification systems, a private company generally acts as a middle-man between a government and the requesting site or platform. In fact, the bill contemplates the use of “private identity verification technology providers" as part of the pilot program. The third party may collect a user’s documentation and compare that to a government database, or compare a user’s biometric information with government records. This creates the opportunity, without more protection via regulation or other means, for the third party to collect an individual’s personal data and use it for their own commercial purposes, including by selling the data or sharing it with others. The data is also at risk of being accessed by unknown and innumerable nefarious individuals and entities through a data breach.
Additionally, current and past practices of government data sharing should make anyone leery of uploading their private information to the government as well, even to an agency that theoretically already has it. All age verification systems are surveillance systems as much as they are identity verification systems. Government agencies sharing data with one another is already a danger—as of 2020, the FBI could search or request data from driver’s license and ID databases in at least 27 states. The total number of DMVs with facial recognition at the time was at least 43, with only four of those limiting data sharing entirely. That puts two-thirds of the population of the U.S. at risk of misidentification.
From a practical perspective, it’s unclear how effective or accurate such a system would be: it may sound simple to compare a person’s uploaded record with one that’s on file, but people without IDs, those whose names have changed, and anyone who has ever experienced a snafu in government document processing know better. As an example, in 2022, the IRS backed away from a decision to use a third-party identity verification system—ID.me—specifically because it forced people to use flawed facial recognition and endure four-hour waits to be verified.
Parental Consent for Older Minors Is the Wrong Approach to Safety Online
Under this law, anyone age 13 to just under 18 will be required to obtain parental consent before accessing social media. We are against such laws.
First, requiring parental consent for teens’ use of these platforms would infringe on teens’ free speech, access to information, and autonomy—which also must include, for older teens, privacy vis-à-vis their parents. The Supreme Court has repeatedly recognized that young people enjoy First Amendment protections for expressing themselves and accessing information. The Court has stated, for example, that speech generally “cannot be suppressed solely to protect the young from ideas or images that a legislative body thinks unsuitable for them.”
The world envisioned by the authors of this bill is one where everyone has less power to speak out and access information online
Access to private spaces online for research, communication, and community are vitally important for young people. Many young people, unfortunately, encounter hostility from their parents to a variety of content—such as information about sexual health, gender, or sexual identity. (Research has shown that a large majority of young people have used the internet for health-related research.) The law would endanger that access to information for teenagers until they are 18.
Also, it is unfortunate but true that some parents do not always have their childrens’ best interest in mind, or are unable to make appropriate decisions for them. Those young people—some of whom are old enough to work a full-time job, drive a car, and apply to college entirely on their own—will not be able to use some of the largest and most popular online websites without parental consent. It goes without saying that those most harmed by this law will be those who see social media as a lifeline—those with fewer resources to begin with.
Second, Congress should not remove parents’ ability to decide for themselves what they will allow their child to access online, the vast majority of which is legal speech, by assuming that parents don’t want their children to use social media without parental consent. Parents should be allowed to make that decision without governmental interference, by using already available filtering tools.
Worse, not only would minors between 13 and 18 be required to gain parental consent, but under this law anyone below the age of 13 would be banned from social media entirely—even if their parents approve. This outright ban is a massive overreach that goes far beyond current laws like COPPA, which prohibits social media and other online companies from collecting data for commercial purposes from children under age 13 without parental consent. Under this law, children would be banned even from social media platforms that are designed specifically for kids—again, whether parents approve of its use or not.
Third, verification mechanisms will invariably stumble when dealing with a variety of non-traditional families. It’s unclear how age verification and parent/guardian consent will function for children with different last names than a parent, those in foster care, and those whose guardians are other relatives. Children who, unfortunately, don’t have an obvious caregiver to act as a parent in the first place will likely be forced off these important spaces entirely. Though it’s not explicit in the bill, if a person violates the law by misrepresenting their identity—say, if you’re a minor pretending to be a parent because you don’t have an obvious caregiver—you could be charged with a federal criminal offense, a charge that is otherwise rare against children. The end result of these complex requirements are is that a huge number of young people—particularly the most vulnerable—would likely lose access to social media platforms, which can play a critical role for young people in accessing resources and support in a wide variety of circumstances.
The Protecting Kids on Social Media Act is a Bad Alternative
While this bill is technically an alternative to the Kids Online Safety Act, it is a bad one. As we’ve said before, no one should have to hand over their driver’s license just to access free websites. Having to hand over that driver’s license to a government program doesn’t solve the problem. The world envisioned by the authors of this bill is one where everyone has less power to speak out and access information online, and we must oppose it.
STOP THE "PROTECTING KIDS ON SOCIAL MEDIA" ACT
