In North Carolina, legislators are considering a bill that would grant consumers more control over data collected and sold by companies. Great! Who can argue against that? But that’s not all it’s about. Following national trends, it would also set forth troubling age verification requirements for social media. Although pitched in a “save the kids” framing, these laws are likely to cause more harm than good.
Last month, state senators Terry Brown (D) and Allen Chesser (R) introduced the NC Personal Data Privacy Act, which sets forth six consumer rights regarding personal data. Amongst them, people can request to see what information is being collected about them, correct inaccuracies, and opt out if companies are selling their data to third parties. Some information is exempt, like health information protected under HIPAA. In addition, companies don’t need to comply if doing so would reveal trade secrets.
The bill seems to partially follow the Consumer Privacy Act of North Carolina, which was previously introduced in the state Senate but died in committee. However, Eric Null, co-director of the Center for Democracy and Technology’s Privacy & Data Project, told Gizmodo via email that the bill is “another example of industry-friendly privacy legislation” that offers little protection due to “weak data minimization protections (essentially restarting current law around deceptive practices) coupled with extremely broad exemptions.”
Unlike its predecessor, this bill doesn’t solely focus on consumer privacy. In its second half, it also requires that social media establish “reasonable age verification methods” to prevent minors from creating accounts without parental permission. Under the law, social media platforms have to utilize third-party vendors to carry out this process. Approved methods include providing third parties with a driver’s license or another form of government-issued identification. There are some exceptions to this process, like gaming sites or platforms generating less than $100,000 in annual revenue.
Age verification legislation is often associated with restricting porn access like with Texas’ HB 1181 that is now the center of a Supreme Court case. Last year, North Carolina even passed its own porn bill called the PAVE act. However, legislation extending age verification to social media has been popping up nationwide. In 2023, Arkansas passed its version, and numerous states are considering bills, including Minnesota, which actually wants to implement anonymous verification, and Pennsylvania. This year, U.S. senators also reintroduced the Kids Off Social Media Act to federally mandate social media age verification.
Anyone with an ounce of awareness would balk at this legislation, though. First off: They aren’t going to work. It’s already easy to get around age verification on porn websites. But according to Null, age verification is “privacy-invasive,” especially when it requires the use of a third-party vendor.
“The requirement…benefits no one except age verification providers,” Null said. “To force such a thing is even more privacy-intrusive, as not only will the social media company likely have access [to] user IDs, so will service providers.”
Although most bills ban social media platforms and/or vendors from retaining people’s information, you cannot guarantee it. Companies lie all the time about what data they have or how it is being used. (Which makes it a little ironic to slip age verification mandates into a bill that’s framed as data protection, but I digress.) In addition, data breaches are becoming increasingly common, which can have real-world consequences like identity theft.
Privacy advocates like the Electronic Frontier Foundation have also noted that age verification legislation will disproportionately restrict already marginalized communities. In the U.S., millions of adults either do not have or cannot receive a government ID. Those most affected include low-income people, the elderly, young adults, and communities of color. Overall, while laws may seem like they’re addressing a problem, age verification just falls under the usual U.S. moral panic disguised as progress.