The text of Arizona Senator Ruben Gallego’s new online digital ID bill is finally out. Gallego wants platforms to collect parents’ consent before their kids can create an account. It sounds straightforward, but the unanswered question is about how Gallego is going to know who's an adult and who’s a child without checking ID.
According to the bill, a platform is required to "take reasonable steps to determine...whether a user of the social media platform is a child.” Verifiable parental consent is described as "any reasonable effort (taking into consideration available technology) to ensure that a parent of a child authorizes such child to create and maintain an account or profile."
We obtained a copy of the bill for you here.
As usual, the bill doesn't explicitly say how that should be done or who will be doing the compliance checking.
However, it seems to be hinting that the Federal Trade Commission can get involved, at least if it feels like it. The Commission "may promulgate regulations establishing" the "acceptable methods by which a social media platform provider may determine whether a user of the platform is a child,” it says.
The rules also cover the "acceptable methods by which a social media platform provider may obtain and verify parental consent." Note that it says may, not shall. The FTC would get to define how people prove their age, and that’s something that the agency has already weighed in on in the past, causing great concern over its methods and ideas.
Also, platforms are left to guess what "reasonable" means, all while the FTC is breathing down their neck.
Ultimately, to comply with the law, everyone has to get checked. The duty attaches when a provider "knows or should know" a user is a child. It’s not possible for a platform to be able to say after the fact that it should have known it had under-16s on the platform without first carding everyone.
On that note, there is one aspect of the bill that sounds more positive.
A provider "may not use any information collected in complying with subparagraph (A) for any other purpose" (section 2(b)(2)(B)). It must also delete that information, "unless required by other applicable law."
The deletion comes either "when the user to which such information applies turns 16 years of age" or, if the user deletes the account first, at deletion. The information covered by that section includes everything that was collected during the process of determining whether a user is a minor or not.
However, both ways that the deletion could be triggered are irrelevant in the case of someone who was already over 16 at the time of the check.
The reach of this bill pretty much comes down to a single definition. Section 2(d)(6) draws "social media platform" broadly and carves out email, text messaging, educational platforms, video conferencing, online gaming "where social interaction is incidental to the game being played," and tools where interaction is incidental to the primary function. It then lets the Commission write rules "to determine what websites or internet mediums meet the definition." Enforcement runs through the FTC, which treats a violation as an unfair or deceptive practice, and through state attorneys general suing as parens patriae.
Congress is asked to find three short elements. Social media use by children "has been linked to mental health and developmental harms," certain features "may exacerbate those harms," and "children require additional protections online." The bill rests on those sentences and cites nothing else.
Gallego introduced it in the Senate on August 4 as S. 5226. It was read twice and referred to the Committee on Commerce, Science, and Transportation. The text now circulating is the Senate Legislative Counsel draft, which carries his name and the short title but leaves the bill number and the receiving committee blank.
