Utah bill would require kids to give sensitive identification online
Several miles from Big Cottonwood Canyon’s world-class hiking, Utah’s Legislature is considering a bill with the laudable goal of protecting children online. However, if enacted, it would absolutely decimate the privacy of children as they browse the internet.
Even with the best of intentions, legislators may unknowingly cause more problems.
SB152 requires large online platforms to verify the age of Utah residents before they may access these sites by uploading a government-issued ID to the respective site. And for users under 18 years of age, parents must give the platform consent to allow their child to use it, along with the name and birth date of their child and the parents’ physical mailing address.
But how this age verification would be performed is key to many of the bill’s issues.
The legislation requires any social media company with at least 10 million account holders to keep “a record of any submissions provided under the requirements of this section … as a record of compliance with” this law. That means that TikTok — which Utah Gov. Spencer Cox (along with many other governors) saw fit to ban from state government devices carte blanche — would be mandated by law to maintain a list of users’ IDs and addresses.
“China’s access to data collected by TikTok presents a threat to our cybersecurity,” said Cox in the December announcement. The legislation’s requirement that the information be stored “in a secure manner” and not used for any other purpose is also hardly reassuring when companies and even government agencies are hacked regularly, affecting hundreds of millions of people.
It is important to note that the law would apply to many companies such as Facebook and Twitter, but also Pornhub (22 million registered users and it offers interactive features that means it would be covered by this law) and even AllTrails. By the way, Pornhub’s parent company owns the largest online age-verification company. And other companies hope to scan all users’ faces as a means of verification, which raises other privacy concerns.
Many parents would find advanced age-gating of internet services — particularly ones with lewd content — valuable. But incentivizing users of any age to hand over IDs and home addresses to any of these companies means incentivizing atrocious security practices. Even the collection of this information itself is a massive risk for data, privacy and security, especially given the sensitive nature of some of the companies covered, and given good actors’ and governments’ struggles to secure data.
The bill also raises further security concerns with the prescribed mechanism for giving parents access to their children’s accounts. The law reads that the platform must provide “a password or other means for the parent or guardian to access the account.” As Mike Masnick of Techdirt also realized, although it allows for other means, the password ought not to be an option, as the platform itself should not have access to them. They should be encrypted and secret.
Utah’s Libertas Institute also addresses an issue regarding VPNs — which users can utilize to appear as though they are logging on from elsewhere. They note that the bill puts the legal burden on companies to prevent minors from bypassing age verification by using a VPN to seem as if they are accessing the sites from another state.
“While the use of VPNs can be detected, the location of a VPN user cannot, and a company would need to require each VPN user to verify their location before they can access the site,” reads the Libertas Institute post.
But this requirement would violate other states’ “data-privacy laws which prohibit companies from conditioning access on a user providing personal information like an IP address or something more.” There is no way social media companies could legally comply with both laws.
The efforts from the bill’s sponsors come from a rational desire to ensure kids are safe and protected. But these efforts — like all policy solutions — need to be vetted to ensure they will solve problems and not create other, worse problems. It’s also why the R Street Institute advocates for a federal privacy law. And further, this demonstrates how advancing privacy concerns around protecting children needs to be done without setting bad precedent for privacy overall or weakening privacy solutions for others.
Image credit: sakkmesterke