Florida progresses new law to protect kids from social media and online harms

Earlier this year, Florida passed a law, House Bill 3, prohibiting children under 14 from using social media platforms and requiring parental consent for those aged 15 or 16. It also requires measures to prevent minors from accessing online pornography. While the question of age verification for obscene content has already been widely considered by federal courts and is destined for the Supreme Court before the end of the year, this is one of the first bills to tackle social media.  

The legal landscape: Anticipated challenges and constitutional questions

Free speech advocates have already signalled their intention to challenge these measures - although typically don’t take their case to court until much closer to the enforcement deadline, hoping to minimise the time available to prepare a defence. HB3 is set to become an active law on January 1st, 2025.

But with the publication this week of the detailed guidance from the Attorney General that interprets the law, it is clear that the State of Florida has already considered the likely arguments against the new law and sought to pre-empt them.

Implementation guidelines: Age verification and parental consent

Rather than requiring age verification for every use from the outset, the new rule only demands this if the platform sees clues that the user is potentially underage. If it then conducts an age verification process, it gains safe harbour from prosecution and private lawsuits, unless further information is revealed that makes it clear the user is definitely too young - what is known legally as “actual knowledge”.

This waterfall approach is clearly designed to make the case that for adults in general, they will not be burdened with a demand to prove their age. This has been the mainstay of the argument against all forms of age assurance in the US, that it is disproportionate and there are better, less inconvenient ways of protecting children, such as filtering content.

That question will no doubt be litigated later this year. However, if the state succeeds, then platforms will have little time to comply, so should prepare now on the assumption the law will survive, or at least not be subject to an injunction until a full hearing can be scheduled which may be some months after the Bill is due to come into force.

The same new rules also expand on the requirements for how to perform age checks and to confirm parental consent: “Reasonable age verification” is defined relatively broadly to mean “any commercially reasonable method regularly used by the government or businesses for the purpose of age and identity verification.”  This could include using a government-issued ID, but it would also allow for age estimation using a user’s email address or a facial age estimation check.

The regulations are more specific in setting expectations for obtaining parental consent.

“Reasonable parental verification” means any method that is reasonably calculated at determining that a person is a parent of a child that also verifies the age and identity of that parent by commercially reasonable means. Reasonable parental verification may include, but is not limited to, a controller:

1. requesting from a child the child’s parent’s name, address, phone number, and e-mail address;

2. contacting the name provided by the child and confirming that the parent is the child’s parent by obtaining documents or information sufficient to evidence that relationship; and

3. utilizing any commercially reasonable method regularly used by the government or business to verify that parent’s identity and age.

This creates an obvious opportunity to streamline the process by putting an email address at the heart of both steps. By asking the user for their email address, the platform can immediately check if they are 16+ with a high degree of confidence.  If they are not likely to be old enough, then the user can be asked to supply an email address for a parent, and that can then also be used for the third part of the requirement above before securing consent, having already established the parent’s identity and age.

Practical implications for platforms: Steps to take before January 1, 2025

With a clear political determination at the state level to enforce this new law and the risk of lawsuits on day one through the private right of action it creates, social media platforms and adult websites need to respond now to be ready for Jan 1, 2025. It is not worth risking being left unprepared in the hope that the federal judge will delay that start date.