Tech watchdog fears social media regulation bill could harm minors’ privacy

As Gov. Kathy Hochul and leaders in state government make a last-minute push to pass a pair of bills regulating social media content for kids, a prominent technology watchdog group is warning that the age-verification provisions of one of the bills could actually compromise adolescents’ privacy and make them less safe.

Lawmakers are currently trying to pass the New York Child Data Privacy Act, which would forbid social media companies from gathering and sharing adolescent user data without parental consent, and the SAFE For Kids Act, which would require social media companies to treat users under 18 years old differently from adults – limiting minors’ access to the sites between midnight and 6 a.m. and restricting what kinds of potentially addictive content can be shown to minors without parental permission. Both bills are sponsored by state Sen. Andrew Gounardes and Assembly Member Nily Rozic.

The bills were left out of the state budget but have had the support of Hochul and state Attorney General Letitia James since the beginning. Meta, which owns Facebook and Instagram, has unsurprisingly opposed the bills – and Gounardes has attributed much of the opposition to the bill to lobbying by social media giants.

But the Surveillance Technology Oversight Project – a tech watchdog group that is critical of social media companies’ extensive data collection – has also raised concerns about how the SAFE for Kids Act could affect anonymity and privacy for adolescent internet users. The group fears that the bill’s requirement that social media companies verify users’ ages would result in users (including minors) surrendering even more private information to companies like Meta than they were before.

David Siffert, the Surveillance Technology Oversight Project’s legal director, told City & State that the SAFE for Kids Act reneges on a promise made to internet users since the advent of the world wide web. “It basically means the end of anonymity on the internet for anyone who wants to use social media, which is obviously problematic,” he said.

Siffert is concerned about the possible methods of age verification that may crop up or be expanded as a result of the bills. Age verification is not a new concept; at its most basic, websites will just ask users to input their birthdays. But Hochul has promised that under the SAFE for Kids Act, social media companies would have to use age verification measures that are not so easy to cheat.

“There will be more control than just giving a birthday,” the governor said at a press conference this week.

The SAFE for Kids Act would require that social media companies use “commercially reasonable” methods to verify users’ ages. Both social media companies and specialized identity verification companies already use a variety of methods to attempt to check users’ ages. Meta currently infers age through a user's activity, and there are also options available for companies to verify ages by using phone numbers, credit and debit card checks, verified email accounts, on-site certification of age, voice recognition and biometrics.

But Siffert said he is uncomfortable with social media companies having this information in the first place. “I mean, it is very sensitive information,” he said. “It's your identity, meaning that you can't functionally browse the internet without your identity, going along with it.”

He said that he is also concerned about children needing parental approval for social media use, which he said could harm LGBTQ youth by allowing their parents to sign off on their use of certain platforms, like Trevor Space, an online community for queer youth. 

Supporters of the bill argue that since companies like Meta are already using some forms of age verification, the bill will not require them to put in place any additional measures or collect any additional information. 

Supporters also say that the SAFE for Kids Act does not mandate age-gating, or denying service unless a users’ age is verified. Instead, the bill requires users’ ages to be verified through “commercially reasonable” means in order to allow minors and their parents to decide what sort of algorithmic feeds they are exposed to.

Gounardes said that tech companies are attempting to muddy the waters by suggesting that they don’t already employ age verification tools while collecting data on their users, when in reality they use the practice to generate billions. 

“So make no mistake, keeping kids online by serving them addictive content they didn't sign up for has nothing to do with free speech or an open internet: it's a cash grab, and our children are paying the price," he said in a statement.