Social media ID laws: A looming disaster for Americans?

Arkansas has just become the second US state after Utah to pass an age verification law for social media, requiring social media sites to work with third-party vendors to verify the age of new users. But while the Utah law does not go into effect until 2024, the Arkansas law, though fresh out of the legislative oven, will go into effect already this September. The law aims to protect children from social media harms, but it will affect all new users regardless of age, since everyone’s age will have to be checked to enforce it in earnest.

With several other states like Ohio, Minnesota, and Connecticut eyeing similar bills, let’s take a quick look at the Arkansas Social Media Safety Act — a trailblazing law whose implementation could set a precedent for others.

First porn, then socials, then what?

The Arkansas Act, signed into law by Governor Sarah Huckabbee Sanders on April 12, 2023, bears an uncanny resemblance to Louisiana’s ‘porn law,’ which requires porn sites to implement an age verification system to weed out minors. For more on the Louisiana ‘porn law’ and its privacy pitfalls, see our article.

But while there’s more or less a public consensus that kids shouldn’t be viewing porn or other types of NSFW content, it’s not so simple with social media. An argument can be made both for and against the use of social media by teens, so unlike the Louisiana ‘porn law,’ the Arkansas ‘social media law’ is more nuanced. Under the ‘Act,’ to join a social media platform from Arkansas, you need to prove your age and get your parents’ approval if you are a minor — that is if you’re under 18. To prove your age you’ll need to submit to an age verification system, which determines who can enjoy the site with no strings attached, who needs their parents’ blessing, and who is off-limits.

The law stipulates punishments for social media platforms that don’t check their users’ ages. They could face a hefty fine of $2,500 for every violation, plus pay for any harm that may have been caused by letting minors on their site without their parents’ approval. Considering that there are studies that link too much social media among youngsters to an increased suicide risk, it seems that a social media site which refuses to implement an age verification system will be playing with fire.

This age-verification system will need to be provided by a third-party vendor who would perform a “reasonable age verification method.” That method may include requiring a person to provide a digitized ID, such as a digital copy of a driver’s license, a government-issued ID or have them comply with “any commercial reasonable age verification method.”

This part of the Arkansas law copies the Louisiana ‘porn law’ almost verbatim. Except in the case of Louisiana, the law is already in effect and we can see its first results. So far, all porn sites that have implemented an age verification system require users to provide a digital copy of a state-issued ID or digital driver’s license. If social media sites take a cue from porn sites, it could mean that if you’re a minor who doesn’t already have an ID but wants to sign up to Instagram, you’ll probably have to get one and make sure it’s digital. The same goes for adults coming out of digital-less woods to join a social media site.

To which sites the law would apply?

It’s important to mention that the Arkansas law doesn’t apply to all social media: smaller platformers that make less than $100 million a year won’t be affected. Moreover, some of the entities that could be considered social media platforms will be let off the hook. For example, a company that “exclusively offers interacting gaming, virtual gaming, or an online service, that allows the creation and uploading of content for the purpose of interacting gaming” is exempted from the law. That means that if a company is mainly about gaming, like Fortnite or Roblox, they won’t have to build an age-verification system in. Neither will companies that provide cloud storage, and make less than 25% of their revenue from social media. That provision can spare Google-owned YouTube from the law requirements – there’s still confusion over whether the law would apply to it or not. And if a company is for professional networking or career development, like LinkedIn, they will also be spared by the law.

It seems that Arkansas lawmakers had particular social media sites in mind when they were baking the law — and it’s not that they’re being super secretive about the targets. A co-sponsor of the bill, Senator Tyler Dees said that the goal was “to empower parents and protect kids from social media platforms, like Facebook, Instagram, TikTok, and Snapchat.”

The law would only apply to users who will want to create an account with a social media platform after September 1, 2023. The existing accounts won’t be affected.

Identity theft: the hidden danger of the bill

Under the law, both a social media site and a third party vendor are prohibited from retaining a person’s identifying information after the access to the platform has been granted. And if they are found to have “knowingly” retained that information, they become liable for damages.

However, we cannot rule out the possibility that some social media sites or third parties may inadvertently or intentionally retain sensitive identification data and even seek to profit from it. There is no shortage of examples where social media apps misrepresented their data collection practices, or promised that certain information would be collected for one purpose and then ended up using it for another purpose. For example, Snapchat previously claimed that it needed the user’s phone number just to help them find their friends on the app, when in fact it was harvesting information about all contacts from the user’s address books. Facebook and Twitter separately claimed that they collected users’ phone numbers only for security purposes, when in fact they were repurposing them for targeted advertising. These are just a few examples of how information can be mishandled. It can also be leaked either from within the company or as a result of a breach.

Although the bill sailed smoothly through the Arkansas legislature, it still faced opposition from some lawmakers who feared it would put users, both children and adults, at greater risk of digital identity theft. Arkansas Republican Senator Ricky Hill was one of them. He argued that the law would be ineffective in stopping minors from using social media, and would only make people more vulnerable to having their identities stolen. Hill: “No matter what we do, we’re not going to prevent that [minors accessing social media] from happening. We’re wanting to put something into law that’s not going to change anything, except instead of this, we’re going to have our identity stolen.”

Similar concerns about privacy also kept Facebook’s "Instagram Kids,” a proposed social media site tailored for 10-12 year olds, from taking off. ‘Instagram Kids’ was a project by Meta (then still Facebook) to get kids, otherwise ineligible to create an account with Instagram, onto social media. While ‘Instagram Kids’ was touted as an ad-free safe haven where children could stay in touch with their friends while being overseen by parents, the proposal drew massive backlash from parents, lawmakers, and the governemnt. A group of 44 US attorneys demanded that Facebook put a lid on the project as it had “a record of failing to protect the safety and privacy of children on its platform, despite claims that its products have strict privacy controls.” Meta put the project on ice in September 2021, and has never picked it back up.

Bottom line

As with other laws that only apply to a specific state or country — in other words, a limited geographic area — it will be easy to circumvent the restrictions by using a VPN.

While this begs the question of whether the Arkansas and Utah laws are enforceable at all, we must remember that not all users are tech-savvy. Some may be unaware of privacy-preserving tools, such as a VPN, and may be all but forced to share their sensitive information with social media giants and whoever they hire to do age verification for them. Given the social media giants’ checkered privacy records, there’s a high risk that this data could be leaked or otherwise mishandled.

The future of age verification laws in other states may hinge on how Arkansas implements its law — so its enforcement could become a pivotal moment in the relationship between users and social media.

When it comes to protecting children from the dark side of social media, we are not in favor of blanket bans or policies that carry huge privacy and security risks and questionable benefits. It’s true that we as adults have a responsibility to protect children from the harmful effects of social media, but there are other ways to do it. We can lead by example, talk to our kids about social media, including both its benefits and risks (without painting everything black), and make good use of the privacy settings that are available. The key is to have a good rapport with the child, because given how tech-smart kids are these days, they are likely to find a way around the restrictions anyway.