While Federal Legislation Flounders, State Privacy Laws for Children and Teens Gain Momentum

In the absence of more robust federal requirements, states are stepping in to regulate not only the processing of all minors’ data, but also online platforms used by teens and children. This follows a common pattern in which states filled the gaps left by an absence of federal privacy law — seen with the proliferation of state legislation on data breach notification, health, artificial intelligence and now, children under 18. Without preemptive federal legislation, these state laws create a dizzying and challenging compliance patchwork for businesses, with laws that are interpreted and enforced by regulators with varying priorities.

These new children’s “privacy” laws seek to address a spectrum of concerns including service design, potential harm, parental oversight, age verification, consent and data processing. While most of the concepts are not novel — kids under 13 have been afforded additional protections and been given limited access to certain platforms in the past — the breadth of these new laws, the covered platforms, the design mandates, and the application to teens are new. Outright bans on accessing social media platforms and potential bans related to use of apps stores without parental consent for all minors are ushering in a new era of restrictions for minors online.