By Nathan Lindfors, Policy Director, Engine Advocacy & Foundation
In a series of State Policy Updates, we are exploring how state initiatives are impacting the innovation happening in startup ecosystems across the country. While much of Engine’s work centers on policy advocacy and education in the federal landscape, state-based policymakers impact startup formation and growth through their own work. We’re tracking what’s working for startups, what’s falling short, and what federal policymakers can learn from their state-level counterparts.
Several proposals — including two in Utah speeding towards final approval — would change the way all users, and especially young users, use the Internet and would create compliance burdens for Internet companies. Utah lawmakers are fast-tracking efforts aimed at protecting minors online and would require, among other things, that companies verify their users’ age, including through things like collecting drivers licenses.
The bills come among similar efforts passed and proposed in other states, before Congress, and from the President to regulate how children and young adults can interact online. Advocates and policymakers behind the efforts usually have the largest Internet and social media companies in mind, but many of the policies will negatively impact startups, while simultaneously failing to protect kids.
California jumped out ahead of other states and Congress last year by unanimously passing the California Age Appropriate Design Code Act, which was later signed into law by the state’s governor. The law has no threshold for compliance, and instead requires any business with “an online service, product, or feature likely to be accessed by children” to, among other things, estimate the age of their users and conduct impact assessments before releasing products (and make the assessments available to the government at their request). The law was predicted at the time to inspire copycats, despite it being an untested concept likely to burden innovation, effectively require more intrusive data collection for the purposes of age-verification, impact products far beyond those for children, and disempower parents, all while facing legal challenges under the First Amendment.
The Utah bills are not exact copycats of the California law, but they have similar overall goals and carry similar problems, especially with regard to age-verification. The Senate bill, S.B. 152 applies to Internet companies with certain interactive features and requires those companies to verify the ages of all users from the state. It additionally bans those under 18 from having accounts without parental consent, limits the types of activities and content that those individuals can see, and limits the hours that users under 18 can access their accounts. The bill would be enforced by the Division of Consumer Protection and create a private right of action to allow individuals to sue companies for alleged violations. In practice, the bill creates a lot of work for in-scope companies, requires they collect lots of sensitive identifying information (making them a target for malicious actors), and exposes them to expensive and potentially vexatious private lawsuits. And while the bill is aimed at interactive platforms with 10 million users, the compliance burdens will disproportionately fall on the companies at the smaller end of the spectrum.
The House version, H.B. 311, originally contained many of these same provisions, but was changed before it passed the Utah House on Thursday. The bill’s author recognized and attempted to solve some of the problems outlined above, but also greatly expanded the scope of applicable companies to those with five million users globally. That will wrap up and burden many more companies all across the country.
And similar ideas are finding traction at the federal level. In his State of the Union address on Tuesday evening, President Biden called on Congress to pass measures designed to protect children online. A memo released before his speech highlighted the product design approach found in the California law, and the president was likely alluding to the Kids Online Safety Act and Children and Teens’ Online Privacy Protection Act. Those measures were advanced last Congress but ultimately failed to pass, in part due to the potential for damaging consequences.
Each of these efforts have laudable goals but carry some significant risks for the children they wish to protect. Requiring companies to verify the age of their users (in law or in effect) means they must collect large amounts of sensitive personal information — government IDs, dates of birth, home addresses, or even scans of individuals’ faces. (Or they can rely on third-party age verification services, the largest of which is owned by a company that operates several pornography sites). Collecting such information puts Internet users at risk and appears to frustrate the goals of these legislative efforts.
Startups don’t want to have this sort of information either. Children can benefit from innovative products and services, and these sorts of laws could stand in the way. Take, for instance, ChessUp, a smart chess board made by the Overland, Kansas-based startup Bryght Labs. Their product lets players of varying skill learn and play chess with a global community of players and “came from the idea of making the learning experience of chess much more accessible and immediate, allowing kids to play a game right out of the gate…with their family and not have to worry about the skill differences,” as founder Jeff Wigh told Engine. ChessUp maintains user profiles to track games, record stats, and match players up against one another, but the company doesn’t keep data about the age of its users, something Wigh would like to avoid because their product is meant for all ages. “As a company, we don’t want to be in the position of having to collect and retain information about our users’ ages or implement age restrictions. That would create a burden for us and be privacy-invasive for our users.”
Besides privacy concerns, impacts on startups’ ability to compete, and poor user experience, there are security risks to startups of collecting and holding the sensitive information required for age verification. Such information is sought after by malicious cybercriminals, and having it on hand makes startups and other companies a target. Startups already fear and expend considerable resources to prevent data breaches, and policymakers should not put them (and their users’ data) at higher risk.
Civil liberties groups have warned that these efforts will impact all users and their opportunities for expression. Of course, verifying age means all Internet users will need to be verified. Some may not have government IDs, or some — like those from persecuted groups — might have reason to not want to share their ID with Internet services. The ability of those individuals to express themselves will be dampened by these efforts. Children have First Amendment rights to speak and receive information, too, and many — especially those who don’t have safe and supportive homes — have valid reasons for wanting to seek information or communicate without their parents’ permission.
Policymakers are united in wanting to safeguard children, and some are taking more productive approaches, including investing in education and resources to help parents and children navigate the Internet safely. Several states — like New Jersey — have advanced such efforts to support parents and increase digital literacy. And many in Congress have expressed interest in passing a uniform, consistently enforced federal privacy framework to give all Americans — including children — privacy protections, and create clear obligations for companies. Such a law stands to create needed certainty while protecting individuals online, and should be a priority over risky, untested approaches that might actually create more risks to privacy, security, and expression.
Engine is a non-profit technology policy, research, and advocacy organization that bridges the gap between policymakers and startups. Engine works with government and a community of thousands of high-technology, growth-oriented startups across the nation to support the development of technology entrepreneurship through economic research, policy analysis, and advocacy on local and national issues.
