Privacy, free speech, children’s online safety collide in age assurance legal wars

By this point, the amount of collective hand wringing over children’s online safety and related age assurance legislation could surely twist the head off a mule.

While both Republican and Democrat politicians wave red flags warning of all the bad stuff on the internet that might harm kids, digital rights advocates are crying foul over what they see as overly restrictive and potentially damaging age assurance laws that could limit access to crucial resources, especially for marginalized youth.

Meanwhile, a group representing social media moguls points to the First Amendment as a reason they should be able to collect data from teenagers, and mounts a legal blitz against age check laws.

CDT claims age assurance tech is ineffective, risky

A new missive from the Center for Democracy and Technology (CDT), a nonprofit with offices in Washington and Brussels, notes that the organization has filed a brief in Netchoice v. Bonta, the California case that has the tech industry lobby group suing to stop the state from enforcing its “Protecting Our Kids from Social Media Addiction Act,” SB 976.

CDT’s brief alleges that there are “significant privacy and security risks associated with various age verification technologies,” and that “implementing the age verification requirements of California’s Senate Bill 976 will burden and potentially block adults’ access to constitutionally protected speech while failing to achieve its goal of protecting children from the dangers of social media addiction.”

In its brief, the CDT runs down its list of age assurance technologies for the purpose of proving they are “insufficiently effective at their stated task and pose security and privacy risks to individuals that use them.” Biometric facial scanning, first-party signal analysis, uploading a government document, zero knowledge proofs: all get trotted out for a legal lashing, while the First Amendment is flogged alongside them.

“Biometric scanning is by its nature imprecise, especially inaccurate for certain populations, typically requires the exclusion of young adults, and can be circumvented,” it says. “Age estimation from biometric scanning is probabilistic and, accordingly, can only give estimated age within ranges.”

Furthermore, the CDT argues that the accuracy of age estimation by biometric scan “is strongly influenced by algorithm, sex, image quality, region-of-birth, age itself, and interactions between those factors.”

Cue the reminder that, while biometric testing by the National Institute of Standards and Technology (NIST) says the majority of facial recognition algorithms are more likely to misidentify people with darker skin, women and the elderly, the most accurate algorithms show very low differentials in the Institute’s latest testing.

Zero knowledge proofs create honeypots, rights group says

Finally, CDT says, “age estimation by biometric scanning raises many security and privacy concerns because linking individuals’ biometric scans to their browsing activity creates a tempting target for thieves, hackers, and hostile foreign governments.”

As for zero knowledge proofs and their promise of data minimization and user control, the CDT says that “while ZKP presents an opportunity to verify age without disclosing identifying information at the moment a visitor enters a website, it does not eradicate the need for an initial collection and verification of personal information to create the pre-verified data bank that is then encrypted and used for this verification process.” In other words, it says, ZKP creates biometric data honeypots.

Age assurance tech doesn’t restrict people; laws do

The conclusion to the CDT’s brief is worth quoting at length, in that it illustrates the dissonance in its thinking. Technologists, it says “are working to develop age verification systems that accurately indicate age without identifying an individual and protect user data and identification. While these technologies are not yet mature, their development suggests it is possible to protect children from harmful material without risking online security and privacy.”

Yet the group insists on maintaining that “no current technology offers a fail-safe solution that protects privacy while ensuring accuracy. CDT emphasizes that these verification methods increase barriers to online access and create risks for both minors and adults seeking protected online content, ultimately chilling First Amendment rights.”

The legal argument, however, is not against what the technology can do – and, indeed, does – but the alleged violations of constitutional freedoms in how age assurance is legislated. The group says “SB 976 applies heavy restrictions on speech without instituting commensurate safeguards. It does little to protect children from social media addiction and presents significant privacy and security risks that will burden and even prevent adult access to constitutionally protected content.”

In short, it is not the age verification tools that are supposedly chilling First Amendment rights, but the laws. Should the U.S. be able to get its legal ducks in a row, the age assurance sector would surely be content to innovate to its needs. As Iain Corby, executive director of the Age Verification Providers Association (AVPA), recently told the U.S. Supreme Court, “if American technology can put a man on the moon, it is absolutely possible to prove your age without disclosing your identity and to do so with very little burden.”

Social media firms largely evade criticism while mounting legal pushbacks

Indeed, while the CDT pitches stones at age assurance technology, the tech goliaths who cause the problem to begin with – and are financing legal defenses through the lobby group NetChoice – are complaining that nasty governments increasingly won’t allow them to collect the data of teenagers, a restriction they say could damage their precious bottom line.

A report in MLex says that massive social platforms including Google, Meta, Snap and Pinterest are warning investors that, with governments demanding a hands-off approach to the personal data of teens, “they could be forced to withdraw or modify products, see fewer users visiting their platforms, and have a user population that spends less time scrolling through videos or posting content when they do visit the platform.”

In Meta’s own words, taken from its recent 10K filing, “new legislation or regulatory decisions may restrict our ability to collect and use information about minors or also limit our advertising services or our ability to offer products and services to minors in certain jurisdictions.”

One can almost hear the world’s tiniest violin playing a mournful lament for Mark Zuckerberg, currently the third-richest man in the U.S.

More court battles on the way as states introduce age assurance bills

Even with all the recent activity, the legal battle over age check legislation is just beginning. Per MLex, more than 50 bills aimed at enhancing protection of children online have been introduced across 27 state legislatures for the new legislative season.

While most are crafted to address porn and other adult content online, many are following California’s lead in putting age restrictions on social media platforms. Oklahoma, Hawaii, South Carolina, Indiana and Rhode Island all have bills that would require parental consent for a minor to open a social media account. Nebraska, South Carolina, Washington, Illinois and Oklahoma are pursuing age appropriate design codes in the mode of California. Legislation putting the onus of age verification on app stores has been introduced in Utah, Alaska, South Carolina, Hawaii and South Dakota.

Addictive feeds are another target for legislators in Hawaii and New York.

In Oklahoma, Republican Representative Chad Caldwell, a sponsor of HB 1275 on parental consent, has pitched a challenge to the barons of Silicon Valley: “If a social media company really believes in free speech and in protecting our kids, if they want to comply with this law, all they have to do is remove some of the addictive components and qualities of their product, and they wouldn’t run afoul of this law.”

Netchoice, of course, has no intention of standing down. If recent history has taught us anything, it is that the biggest names in social media, who have the biggest fortunes in the land, will do almost anything to remain in control.

The hand wringing continues. Hide your mules.

Article Topics

age verification  |  biometrics  |  Center for Democracy & Technology  |  data privacy  |  digital identity  |  face biometrics  |  lawsuits  |  legislation  |  Netchoice  |  social media