Utah’s first-in-the-nation legislation to restrict how social media companies treat young users and allow individuals to sue over violations will set the stage for a tech industry legal battle regarding their constitutionality.
Gov. Spencer Cox (R), citing concerns over youth mental health, plans to sign into law Thursday two bills that aim to protect children from addictive features and other potential harms of social media. Platforms such as Facebook and Twitter would have to obtain parental consent if a user under 18 wants to open an account, and the companies could face fines and lawsuits for running afoul of a host of new requirements.
The bills are among the most stringent efforts by state lawmakers across the country this year to regulate a child’s experience online. Tech industry groups said in letters asking Cox to veto the measures that they would violate the First Amendment and lead to frivolous lawsuits.
“Absolutely there’s going to be legal challenges,” Cox told reporters at a March 16 news conference, adding he expects eventual review by higher courts in cases. “We understand that. That has been clear from the beginning.”
Social media platforms and other online companies are navigating a changing state regulatory landscape, with lawmakers elsewhere considering dozens of measures to govern how they treat a broad swath of user data. The bipartisan interest in kids’ social media and privacy bills in particular has generated a variety of approaches, said David Stauss, partner at Husch Blackwell LLP.
“That feels like the Wild West,” Stauss said.
In Utah, one measure awaiting Cox’s signature (S.B. 152) would require social media platforms to verify the ages of residents starting March 1, 2024, and secure parental consent for users under 18 years old. Teens would be prevented from using social media during certain overnight hours without a parent changing the account setting.
Positive provisions include limiting the collection of a minor’s personal information, said Irene Ly, policy counsel for Common Sense Media, a group seeking to protect kids online that opposes the bill.
But a requirement to give parents access to the messages and posts written or received by a user under 18 is “basically like saying parents should be able to read their kids’ diaries,” Ly said.
The state Division of Consumer Protection would enforce the law, and the measure includes a private right of action for people to sue over violations.
The second measure (H.B. 311) would outlaw social media companies from using addictive design features for youth under 18 starting March1, 2024. Violations could come with civil penalties of $250,000 for each addictive feature or practice and $2,500 for each minor exposed to it, unless companies audit and correct their practices within a specified time frame.
The Republican-sponsored measure also includes a private right of action for harm suffered by a minor account holder. There would be a rebuttable presumption that the harm occurred if the user is under 16—making it easier for a claim to succeed in court.
California Democrats have proposed similar provisions the last two years, which shows “there’s a lot of bipartisan interest in this approach,” said Ly. Her group does support the latter bill that would crack down on addictive design features.
Tech industry opponents argue the Utah bills would introduce new risks to online users. Age verification could force businesses “to collect personal information they don’t want to collect and consumers don’t want to give,” Jordan Rodell, state policy manager for the Computer & Communications Industry Association, wrote in a letter to Cox.
The measures could also block access to social media for children who need a supportive online environment, such as those living in abusive households, Rodell wrote. Additionally, the private rights of action could open the floodgates to costly lawsuits, the letter said.
The tech industry agrees that protecting the mental health of children is a priority, but the Utah bills are a “misguided attempt to address the issue at best and a massive expansion of government-mandated personal information collection at worst,” said Dylan Hoffman, TechNet’s executive director for California and the Southwest, in a statement. TechNet’s members include
NetChoice, an industry group suing California over its 2022 law that compels online providers to assess the privacy and protection of children in their products, raised similar First Amendment issues with the Utah measures because of the barriers they would impose on accessing speech online. NetChoice declined to comment on potential litigation in Utah, but the group launched a litigation center Tuesday and noted the legal system is now the “battleground for the future of innovation and technology in the United States.”
Cox said he expects the pending social media restrictions to end up in higher courts. He argued the case law that opponents point to has been wrongly decided, particularly considering the evolution of the internet and new information about the health and safety impacts of social media.
“I feel confident that we’ll have a very strong fact pattern, we’ll have the research to back it up, we’ll have the evidence to show that companies knew about this, and they will lose in court,” Cox said.
Other categories of tech-and-data privacy legislation are gaining traction elsewhere. Iowa lawmakers sent to the governor a business-friendly comprehensive privacy bill (S.F. 262) supported by the Technology Association of Iowa.
The office of Gov. Kim Reynolds (R) did not respond to requests for comment on whether she will sign the measure into law.
The Iowa bill would give consumers new data rights starting in 2025, including opting out of having it sold. The bill is a starting point for consumer data protection and represents tech and industry consensus, Rep. Ray Sorensen (R), a lawmaker leading the push, said March 15 during legislative debate.
“We are taking the first step ourselves to help encourage Congress to act,” Sorensen said.
For consumers, the Iowa bill is weaker than nearly all of the five states with existing privacy laws, said Matt Schwartz, policy analyst for Consumer Reports. It locks in an industry wish list, he said, such as omitting requirements that consumers can use universal opt-out mechanisms to signal their privacy preferences across multiple websites.
“I would be hesitant to say it’s a step forward for consumers,” Schwartz said.
Businesses operating nationally or internationally won’t have any new compliance considerations if Iowa’s bill is signed into law, Stauss from Husch Blackwell said. Regional businesses, though, may fall under a consumer privacy law for the first time.
Stronger comprehensive privacy proposals are pending elsewhere, but which bills are ultimately enacted this year is “still very much a ‘to be determined,’” Stauss said.
To contact the reporter on this story:
To contact the editors responsible for this story: