Safety and Privacy Can Clash in Kids Protection Bills, Privacy Experts Say

The ever-evolving child privacy landscape was the subject of a panel at a pre-conference workshop of the Student Privacy and Parental Consent event hosted by Public Interest Privacy Center (PIPC), Toyo University and George Washington Law.

First enacted in the U.K., the AADC “incentivizes businesses to design their online products with kids’ safety and privacy as priorities,” said Nichole Rocha, a privacy attorney with Rocha Public Affairs who worked on drafting the language that ended up in Maryland's legislation. “It puts part of the onus on companies to make their products safer from the get-go,” she said. “The age-appropriate design code requires a high level of privacy from design and default. You don't opt into privacy; it is there from the get-go." If you want fewer privacy protections, "you have to toggle out of them.”

Maryland's age-appropriate design code took effect Oct. 1. NetChoice challenged it in court on Monday (see 2502030065).

Maryland's AADC law “is substantially similar to California, but we did have the benefit of the first lawsuit that was filed in California when we were working on the language for Maryland,” said Rocha. “There are some significant, but not substantial, differences” in the bills that may help the Maryland version succeed. These differences include tighter definitions, a severability clause and changes to the data protection impact assessment portion of the bill so that it could not be construed to be about content, she said.

“Hopefully the fate of the Maryland [age-appropriate design code] is not the same as California's because of those changes,” Rocha said.

Amidst the flood of recent legislation aimed at protecting children online, it’s important to remember that privacy and safety are separate issues that can be at odds with each other when it comes to regulation and legislation, said Rocha and other panelists.

“When it comes to kids in particular, there's a tension between privacy and safety, and it's not always easy to tell what laws are intended to do or how they're going to function in the real world,” said Rocha. “The safest thing for kids would be absolute surveillance. That's not privacy-protective, so we've got to find a way to thread the needle to make sure that their privacy is protected, and they're not also exposed to foreseeable risk of harm.”

Age-assurance laws are a great example of how safety and privacy can be at odds, panelists said. “Age assurance is really the crux of the matter here,” said Amanda Lenhart, senior fellow at the Joan Ganz Cooney Center Sesame Workshop. “Almost all of these laws that we're passing toward the safety of or privacy of young people requires you know who the kids are … and it turns out that's not very easy.”

In order to protect children’s safety online, an extra burden of proving your age online must be implemented, which raises privacy concerns, she said. These methods vary from least invasive and accurate age declarations, where users tell a site how old they are, to age estimation, where a tool like facial recognition guesses how old a user is, to the most invasive but most accurate age verification: uploading an ID, Lenhart said.

Amelia Vance, president of PIPC, said that many of the laws from the past two to three years have attempted to meld two concepts, which was not always the case. It used to be that the discussion about trust, safety and children's best interests "was often over here, and the privacy conversation more broadly, was over [t]here," she said. "With the recent laws, they really are tied together, and you generally see elements from both the privacy and the safety side in almost every child privacy law or child online safety law that is proposed.” Some laws that focus on online safety more broadly contain "significant privacy aspects," said Vance: At the same time, many comprehensive privacy laws explicitly provide extra protections for kids.