I’m a little tired of the misinformation and fear-mongering spreading about this bill. I reblogged something about it a few months ago, but I wrote it at 3AM on my bathroom floor so here’s something a little more coherent. By the way, I’m no legal scholar, but the full text of the bill is available online (link is at the bottom of post, Tumblr hates it for some reason) and is written in relatively plain language.
THIS BILL IS NOT SEEKING TO REDUCE PRIVACY. THIS BILL IS SEEKING TO INCREASE PRIVACY.
(plaintext: This bill is not seeking to reduce privacy. This bill is seeking to increase privacy)
I’ll get this out of the way first: there is absolutely no requirement for proof of age via United States Real-ID. I don’t even know how that would work, given that the internet is an international platform. I don’t know where that misconception came from, but it’s not mentioned anywhere in the text of the bill.
(plaintext: I’ll get this out of the way first: there is absolutely no requirement for proof of age via United States Real-ID. I don’t even know how that would work, given that the internet is an international platform. I don’t know where that misconception came from, but it’s not mentioned anywhere in the text of the bill.)
They do mention taking “reasonable steps” to ensure users’ age, but they also discuss increasing privacy surrounding age data and other data.
Previously existing California laws require businesses to inform customers of their privacy rights, inform them what is being collected, and say how it is used. That law was only passed two years ago, by state voter majority. Making a law decreasing privacy would be absurd so close to election season, basically guaranteeing no one currently in government would be coming back.
The goal of CA AB 2273 is to increase privacy for minors under 18. Any online place with a user base of mostly minors will be required to increase the default data privacy settings to maximum, and will be prohibited from using any data collected for anything but the purpose they claim to be using it for. This reduces the amount of data collected from children and prevents it from being used for unknown purposes. (Note: these requirements can be waived if the business goes to court and provides a compelling reason that doing this would be against the best interests of children online.) The bill also explicitly states that children’s privacy must be put above commercial interests if such things conflict.
The bill will require businesses whose platforms or specific features are likely to be accessed by children to submit a report every 2 years exploring whether the platform or feature could cause children to be “harmed” (that’s the word they use) in their use of the platform or feature, including witnessing harmful content, being exploited or targeted by dangerous people, or being targeted by ads and possibly-harmful algorithms.
The report will also determine whether the platform/feature collects data and how that data is used, and whether it uses features that encourage long periods of engagement or repeated engagement (including autoplay and notifications).
(Note: The bill lists out everything more specifically if you’re interested. I wrote up a draft of the post explaining everything the bill says, but it got really long and the important stuff got lost)
Then the company must take steps to document and mitigate the harms, keeping in mind the estimated age range of the target audience. Steps for a teenage-majority feature will probably be different than for a toddler-majority feature.
Could this harm sex workers? Possibly, depending on interpretation. But even the worst-case interpretation isn’t that different from the censorship advertisers are doing on their own, except without the goal of profit. Censorship isn’t even mentioned explicitly in the bill, although that doesn’t necessarily mean it won’t happen.
The bill will also require platforms/features to:
- Give children the maximum available data privacy settings by default.
- Require that privacy policies and terms of service are written in plain, simple language suited to the age of the user base. This is good for everyone, including disabled people and non-native English speakers.
- Inform children if/when their parents are accessing their location or online activity. This is huge. This will protect LGBTQ children’s privacy and safety, and will protect children with abusive families.
- Provide tools for children or parents/guardians to report privacy concerns and exercise their privacy rights.
Businesses are also prevented from using children’s data in any way that can harm them; or profiling children unless the business can provide a good reason for doing that; collecting, retaining, selling, or misusing children’s data (including age and location when it is not necessary); or maliciously coercing children into voluntarily reducing privacy settings or providing personal information. These are all steps to PROTECT privacy, NOT decrease it. (plaintext: these are all steps to protect privacy, not decrease it.) The bill also creates a team of multi-field experts who will be in charge of how this bill will be interpreted and enforced.
TL; DR: The bill doesn’t require websites to request any form of identification. It does require online platforms with a large under-18 user base to submit a report discussing what possible harms can come to children on their platform or using their features, and take age-appropriate steps to reduce harm. Harm explicitly includes targeted ads, data sale, and autoplay features. The bill also increases privacy settings for minors, including privacy from their parents, and requires Terms of Service agreements to be written in plain, age-appropriate language.
Bill Text - AB-2273 The California Age-Appropriate Design Code Act.