There’s an uptick in laws aimed at keeping kids safe online, and following them can be difficult
In 2024, legislators unanimously passed the Maryland Kids Code, a law that requires tech companies to design online products and services in children’s best interests if it’s likely the age group will be accessing the offerings.
Critics say that the law is unconstitutional. It’s also part of a growing trend of state laws aimed at regulating companies that interact online with minors, according to privacy law experts.
The U.S. Supreme Court in June upheld a Texas law limiting children’s access to sexual materials online through age verification, finding that the law did not violate the First Amendment.
The state laws vary in content but can include parental consent rules or requirements that companies design their products and services in ways that ensure children’s safety. These efforts are often stymied in the courts over what critics say are unconstitutional restrictions on the First Amendment’s guarantee of free speech.
Some states, particularly in the South, have been focused on children’s access to social media. Those areas have passed laws intending to ensure companies confirm their users are adults or that young users have permission from their parents.
State laws also focus on prohibiting children’s access to pornography and ensuring their safety from predators.
Meg Leta Jones, a Georgetown University professor, studies digital privacy and legislation. She supports age verification laws but says legislators “are throwing things at the wall to see what sticks in terms of what’s going to get through the courts to ultimately keep kids safe online.”
Louisiana in 2022 was the first state to pass an age-verification law, requiring that online companies with a “substantial portion” of adult content check identification to ensure users are at least 18. A rush of copycat legislation followed in the next two years. As of July, 24 states had enacted age-verification laws.
Navigating the new laws can be challenging, says Sulina Gabale, a partner in the Washington, D.C., office of Orrick, Herrington & Sutcliffe.
“Companies are expected to comply with a patchwork of legislation,” says Gabale, a founding member of the firm’s cyber, privacy & data innovation practice.
“Operationally, it would be very burdensome to comply with all of them or even understand them because many of them conflict or overlap.”
In California, for example, legislators passed a law in 2022 requiring businesses to prioritize the privacy, safety and well-being of children under 18 when designing, developing and providing online services, features and products. It also requires that businesses study and document whether a new service, product or feature is likely to be accessed by children.
A separate law passed in 2024. It prohibits social media platforms from sending notifications to minors during school hours and late at night, and from knowingly providing minors with so-called addictive feeds without parental consent.
NetChoice, a national trade association of internet and social media companies, had success for the most part blocking the California laws in court.
“An unconstitutional law protects no one,” says Chris Marchese, director of the NetChoice Litigation Center. He adds that state legislators created “censorship regimes that masquerade as online safety laws” by targeting content and regulating protected speech.
Alternatively, others say the sites in question were not designed for children, but they were created to be highly persuasive and addictive.
“We know that when children are online, they are displacing other important tasks and are probably being exposed to harmful content for longer than is appropriate,” says Kris Perry, executive director of Children and Screens: Institute of Digital Media and Child Development.
She adds that legislators are enacting laws to try to “put up speed bumps so we can get ahead of what is going on and understand what the impacts are.”
Naomi R. Cahn, a University of Virginia School of Law professor, says there’s a large divide in our society over “how much protection we want to give to children.”
“This is something we battle over,” adds Cahn, who studies children’s online activity and the law. “How much control do you want the government to have about what children can view online? What are children’s First Amendment rights? What are parents’ rights? These are complicated questions.”
‘Inherently harmful’
The statistics paint an alarming picture: In 2024, according to a Pew Research Center study, half of teens ages 13 to 17 said they were “almost constantly” online.
In 2023, U.S. Surgeon General Vivek Murthy said there was growing evidence that social media is causing harm to the mental health of young people, and a year later, he called for warning labels on social media platforms. The American Psychological Association has also issued a health advisory sounding the alarm on the potential psychological harm connected to extensive or particular social media use by teens.
In January, the Federal Trade Commission finalized changes to the Children’s Online Privacy Protection Act, which became law in 1998. The updates strengthen restrictions on how children’s data is used as well as targeted advertising.
Despite concerns over the vulnerability of children and their social media use, there’s been no recent federal legislation passed to address the issue. In May, Sen. Mike Lee (R-Utah) reintroduced the App Store Accountability Act. If passed, the law would require app stores and developers to ensure parental approval for minors before downloading apps or making in-app purchases. Also in May, Sens. Richard Blumenthal (D-Conn.) and Marsha Blackburn (R-Tenn.) reintroduced the bipartisan Kids Online Safety Act, which is aimed at regulating what social media companies offer children online and reducing the addictive nature of the platforms.
‘Privacy fatigue’
Aaron Mackey, free speech and transparency litigation director at the Electronic Frontier Foundation, says Congress has “largely ceded” child online protection, and that there are opportunities for states to enact “real consumer data privacy laws that will be effective and constitutional.”
But, Mackey says, that’s not what’s happened so far. While some of the recent state legislation has addressed privacy concerns related to children’s data, much of it has focused on barring or making it harder for children to use certain apps, he adds.
“There’s this sort of wave across the country of lawmakers believing that online social media services are inherently harmful to minors and that the way to address that harm is to block access to these services,” Mackey says.
He also claims that laws requiring age verification are “counterintuitive in that they are claiming to protect children online, but they actually require increased information online because services have to verify every user’s age and collect information.”
Some states have gone further than that. Last year, Florida passed a law preventing children under 14 from having social media accounts and requiring that children ages 14 and 15 have social media accounts only with parental permission. In addition, the state law requires that social media sites close any previously existing accounts for children. Critics say the law violates the First Amendment, and it’s being challenged in court. In early June, a federal judge granted a preliminary injunction blocking portions of the new law while litigation continues.
According to Gabale, tech companies are experiencing “privacy fatigue.” She advises them to prioritize the laws that have not been challenged in court and “be mindful” of the others mired in litigation.
“When companies start seeing a risk of lawsuits or enforcement actions, that’s when they really need to wake up and pay attention to the details of what regulators and plaintiffs attorneys are focused on,” Gabale says.
Write a letter to the editor, share a story tip or update, or report an error.
