"SAFE" for Kids?

Updated Draft

-- By SidneyLee - 25 Oct 2024

Introduction

Data privacy and internet addiction are issues that affect social media users of all ages, but their effects on children are of serious concern. Social media platforms profit significantly off of adolescent users–a 2023 study estimates that in 2022, six major social media platforms generated almost $11 billion in advertising revenue attributed to users aged 0-17 years old (1). Critics claim that these platforms use manipulative algorithms to sustain engagement while collecting personal information for advertisers.

In June 2024, two bills addressing social media usage by minors were signed into law in New York (2). The Stop Addictive Feeds Exploitation (SAFE) for Kids Act and the Child Data Protection Act (CDPA) address addictive algorithms of social media and prohibit sites from using personal data of users under 18 years without parental consent (3).

Children’s privacy and online safety are important concerns and the law should seek to protect minors on the internet. However, due to enforcement obstacles and the potential for even greater data collection, it is difficult to say that these laws will have their intended effect.

SAFE for Kids Act and CDPA

SAFE and CDPA are fairly narrowly tailored in their application, and provide ways of opting into or out of requirements set by the legislation. Both acts only apply to users under 18 years old, and the restrictions imposed by SAFE and CDPA may be lifted with “verifiable parental consent.” SAFE prohibits “addictive feeds,” recommending media based on a user’s previous interactions with the platform or user’s device, that are designed to prolong social media usage (3). SAFE also prohibits social media operators from sending notifications from 12 AM to 6AM. CDPA prohibits operators of platforms “targeted to minors” and operators who have ‘actual knowledge’ that a user is a minor from processing the personal data of minors, with certain exceptions (e.g. collecting data is strictly necessary for the purpose of the website). Additionally, an operator must obtain informed consent from minors 13 years or older to collect data, and obtain informed consent from a parent of minors under 13 years old.

The OAG still has to define what “commercially reasonable and technically feasible methods” of determining age and “verifiable parental consent” entail. How much of a burden is placed on social media operators will depend on how narrowly the OAG construes these terms.

Are SAFE and CDPA Likely to Be Effective?

The legislation is not a negative outcome, but it is extremely unlikely to have any positive effect. Other social media platforms that ostensibly limit engagement or prohibit certain type of content based on age, such as Facebook and Youtube, do not in reality prevent young users from simply lying about their age when they first create their account. The “actual knowledge” requirement for platforms to be liable is a high standard for law enforcement to prove, and only applies to processing users’ data, which does not directly impact the user experience on a platform. How platforms verify parental consent will also determine how useful these new laws are. If young users are able to falsely obtain ‘parental consent’ just by creating another account, then the law is in effect useless. It is also undesirable for platforms to use such invasive methods of determining age and parental consent that it invalidates the premise of the legislation in reducing processing of personal data. Requiring parental consent may be effective for very young children who are not yet savvy enough to lie about their age or create multiple accounts, but are not likely to affect most young users.

Social media platforms should censor inappropriate content for minors, and should implement an optional parental control function so that parents have the opportunity to monitor the content their children are accessing. Providing a non-algorithmic alternative to “addictive feeds” may help deter ‘doom scrolling,’ particularly for platforms that do not allow users to search for specific content very easily, such as Instagram. However, a key exception for SAFE is that media can still be recommended in response to a specific search inquiry by the user, so the potential for addictive feeds is not eliminated. It would be useful to have more information on the proportion of content that is recommended to users based on their personal data, and how much is recommended based on user searches. If a significant proportion of content is shown to users based on collected data, then SAFE may actually help deter addictive scrolling. Social media operators are already having to use non-algorithmically personalized feeds to comply with the EU’s Digital Services Act, which requires platforms to use systems not based on profiling (4). The new legislation from New York and similar laws in other states could present an opportunity for operators to use more creative feed systems and diversify the content that users see, which offers benefits beyond addressing social media’s addictive nature.

Conclusion

There are aspects of SAFE and CDPA that should be kept for future consideration. Platforms should be prohibited as much as possible from processing data (for all users) but especially minors, reducing the addictive nature of feeds, and even prohibiting night time notifications can all be beneficial. However, the ease with which individuals are able to work around SAFE and CDPA requirements means that the laws are unlikely to be effective. Social media use is an inescapable part of daily life now. Allowing parental controls of technology is more desirable than not having them at all, but we should also invest more into teaching children how to use social media responsibly. We assume that because children now have grown up with the internet they know how to use it, but this could not be further from the truth. Young users take for granted or are unaware of data processing, location tracking, and AI generated content. Instead of simply trying to control what content young users are exposed to, we should educate children on how social media companies function so that they know how to protect themselves.