When it comes to privacy law, as California goes, so does the nation. The Golden State is introducing a new child privacy law that could one day become the national standard. Although this legislation will not go into effect until 2024, it is the first in the nation to impose severe restrictions on internet companies’ interactions with minors. It requires companies to design platforms with the well-being of children in mind and bars eight common practices for data-collection.
Although California is the only state to pass this measure, similar bills have been recently considered in New York, Pennsylvania, Washington and West Virginia. And due to the “California Effect,” this law could influence some platforms to change their rules for every state. We have already seen a similar effect in the United Kingdom where privacy legislation provoked a global change with major platforms, such as YouTube, ensuring teenagers’ uploads are private by default.
That said, it is possible that tech companies could sue to block the bill. Some complain that vague language creates pressing questions regarding compliance. One example involves the requirement that platforms estimate the age of child users with a “reasonable level of certainty,” a requirement that could necessitate the collection of more personal data as opposed to less. Platforms have always struggled with age verification: Forcing users to click a homepage button that says, “Yes, I am over 18,” does not ensure verification to any real degree of certainty. However, some platforms are preemptively working to change this. Instagram, for instance, now requires that, to change one’s age from 18 to 18+, one must first submit a government-issued ID, a “video selfie” or the support of three adult followers.
Although federal law already protects children’s privacy through the Children’s Online Privacy Protection Act (COPPA), California’s legislation will be a seismic change. Under COPPA, all sites or services aimed at children under the age of 12 are required to request parental consent before collecting a child’s personal information. With this new law, however, the definition of “child” is expanded to include all minors up to 18 years old.
