U.S. Failure to Pass Kids Privacy Law Means States Must Act, Wash. Senators Told

“At least 35 states have introduced legislation related to age assurances, and at least 10, including California and Texas, have passed laws to that effect,” said Adam Eitmann, legislative director for Washington Attorney General Nick Brown (D). “The attorney general would welcome federal legislation to address this vital matter, but Congress so far has not acted. We can't afford to wait. States need to lead the lead on this, and Washington state, home to some of the largest and most cutting-edge technology companies, should be at the forefront of that.”

Sen. Noel Frame (D) and Sen. Keith Wagoner (R) introduced SB-5708 at the AG's request. It lists requirements including age estimates and the collection of personal information by businesses who provide online services likely to be accessed by minors. Frame noted that the state bill would protect minors between ages 13 and 17, unlike federal law that only applies to those 13 and under.

When asked how a user’s age would be determined, Frame deferred to the AG office. However, she said “these companies have very powerful tools at their disposal, and it's reasonable to expect them to decipher between children and adults,” she said.

Eitmann didn't have a direct answer, either. “The bill is generally broad for a reason, and that is to allow the companies to reasonably meet that requirement,” he said. “We do know that companies have pretty advanced profiles on users and folks who are accessing their websites or using their devices and things like that. The technology also is rapidly evolving, and so companies have multiple ways that they can reasonably" verify ages.

Taku Mineshita, special advisor for Gov. Bob Ferguson (D) on youth behavioral health, supported the bill. He said it “takes a critical step in protecting Washington's children from the harms of exploitive online practice, addressing addictive feeds, strengthening data privacy protections and ensure ensuring greater transparency.” Mineshita specifically supported the bill limiting data collection of children.

Jai Jaisimha, co-founder of Transparency Coalition, also supported privacy protections in the bill. “Unlike many other bills in the past," SB-5708 seems "to have real clarity around the privacy settings that are required to be provided to minors,” he said. “Carefully clarifying that the regulation applies only to those elements that are controlled by the underlying algorithm, while respecting the rights of minors to request their own media, appropriately restrict what personal information is connected."

Matthew Hong, a high school student, said the bill was in minors' best interests. “We are in dire need of privacy protection,” he said. “When you're a kid, you want to jump on the trend and be where all your friends are, and it is utterly deceptive for the hosts of online spaces, especially during your most vulnerable phase, to pry for and store your information beyond your age range,” especially when “it can be used to attack your insecurities and social engineers scams targeted towards you.”

Business groups opposed the bill. Morgan Irwin, government affairs director for the Association of Washington Business noted that the language of SB-5708 is similar to laws in both California and Texas that are currently facing federal district court litigation. Irwin said he would be happy to work with the sponsors to help clean up the language, however. Rose Feliciano, TechNet executive director-Northwest, Rose Feliciano, also opposed the bill for First Amendment reasons, citing the NetChoice lawsuits against the California Age-Appropriate Design Code (see 2502070019) and the more recent Maryland version of the code (see 2502030065).

In addition, Irwin raised logistical concerns with requiring age verification. Under this bill, “it seems unlikely that a business would be able to retain" data like IP addresses, "so every single time a person logged on, you would have to reassess and reestablish if that person is a minor,” he said. “It'd be extremely difficult for a company to do that."

The Chamber of Progress also has concerns about age verification, said Robert Singleton, senior director of policy the Western U.S. Requiring businesses to estimate users’ age is "a tremendous encroachment of individual privacy.” It raises cybersecurity risks and runs contrary to the idea of data minimization, he said.

However, Eitmann said the "bill builds on proposed federal legislation and laws that have been passed in other states, and it thoughtfully balances the interests of children, parents and online companies ... The state is at an important crossroad. With our lives lived increasingly online, what steps are we willing to take to protect some of our most vulnerable residents?”