The Trouble With Mandatory Age Verification Online

(See our previous articles about this topic.)

A new bipartisan (aka the very worst kind of tyranny) bill in Congress seeks to 1) ban anyone under 13 from social media platforms entirely, 2) require parental consent for anyone over 13 but under 18 to join such platforms, 3) require mandatory age verification (and verification of parental status) to enforce the above.  This is very similar to Utah's new law, which is the strictest one passed to date.

(Arkansas recently passed a similar law as well, but theirs exempts so many social media platforms as to render it largely toothless in practice.  I'm sure the fact that the same state that recently relaxed child labor laws for youth under 16 also conveniently exempted LinkedIn is entirely a coincidence, right?)

The bill as currently written would apply the age verification requirement to all new accounts opened after enactment, and would have a two year grace period (why not simply exempt entirely, like in Josh Hawley's bill?) for existing accounts after which unverified accounts would be suspended.  Fortunately, unlike Hawley's bill, it does not specifically require government-issued ID (yet).

It doesn't take a rocket scientist to see the pitfalls of such a sledgehammer approach to a problem that really calls for a scalpel.  Not only does it arguably infringe on the First Amendment rights of people under 18, but it also backfires on adults over 18 almost as badly as well.  The Electronic Frontier Foundation (EFF) wrote an excellent article as to the very real perils and pitfalls that come with mandatory age verification, not least of which include the undermining of what is left of any semblance of privacy and anonymity online for all ages.  It is not much of a leap from that to further censorship and surveillance, digital ID, and ultimately social credit scoring to effectively lock "undesirable" people out of the public square for the purpose of power and control--a budding totalitarian's dream come true (and a nightmare for everyone else).  As a best case scenario, it will sound the death knell for what's still left of the free and open internet as we knew it.

Kafka, meet trap.  Pandora, meet box.  Albatross, meet neck.  Baby, meet bathwater.  Camel's nose, meet tent.  Horse, meet barn.  Trojan, meet horse.

Make no mistake, this is a Trojan horse!

The ONE possibly good thing in this bill is that it prohibits the use of algorithmic recommendation systems for people under 18 (why not all ages?), but otherwise it throws out the proverbial baby with the bathwater, and likely does more harm than good.  While it simultaneously lets Big Tech largely off the hook in terms of design safety.  That makes the bill both over-inclusive and under-inclusive.

Thus, Twenty-One Debunked categorically opposes this bill or any other that contains mandatory age verification for social media and/or the internet in general.  But in the event that mandatory age verification does become a foregone conclusion, we demand that the following safeguards be included:

• It must be as narrowly tailored as humanly possible.  Think scalpel, not sledgehammer. 
• The age limit should be no higher than 16 for social media or any other sites (except 18 for stuff like porn, gambling, and dating sites).
• All existing social media accounts (that were opened prior to the law's enactment date) must be "grandfathered" and thus fully exempt from mandatory age verification, period.
• A varied "menu" of options for age verification must be available for all.  Government-issued ID should be only one of many options. 
• All data collected for the purpose of age verification must be deleted immediately after verification, and not retained for any purpose whatsoever. 
• Age verification must be "one and done" when opening a new account.
• At most, only people who look and/or claim to be under 25 should be subject to age verification, similar to how it is done for requiring ID for buying tobacco products offline at the store.
• And there must be full liability for any misuse or abuse of data collected for the purpose of age verification. 

Then, and only then, would the slippery slope become less slippery.  Otherwise, slopes are MUCH slipperier than they appear!

Until then, we will vehemently oppose any bill that is stricter than the competing bills COPPA 2.0, KOSA in its newest version, and the Kids PRIVCY Act.  And we support the current "Age Appropriate Design Codes" already in places like California and the UK as well, which put the onus on Big Tech to make their platforms safer.  Make those the national standard in the USA.  Also, make social media safer for ALL ages as well.  But any further is a bridge too far for us.

(TL;DR version:  Just make "California standards" (both CCPA and CAADCA) the national standard, and also better data privacy laws for all ages.)

Oh, and by the way:  DON'T think it will stop at 18, or stop at social media, either.  Once this inherently illiberal bill passes, it will inevitably shift the Overton window further in the dystopian direction, making further encroachments of civil liberties that much easier going forward.  Just look at history. 

Three years ago, we effectively saw just how very quickly the unthinkable and the unquestionable can completely switch places given enough of a panic.  Let's NOT make the same mistake again!

UPDATE:  Already there are some people on Twitter who believe this bill doesn't go far enough as far as age limits, with some calling for the hard age limit to be raised to 21 or even higher.  You may laugh, but once this bill passes, that is really not much of a leap.  And how long before Big Tech, who currently opposes any hard age restrictions, will flip flop and openly come out in favor of raising the hard age limit, first to 18 and then 21, in return for less regulation overall, much like Big Alcohol, Big Tobacco, and Big Vape did?  Clearly 2023 smells a LOT like 1983 in that regard.

In other words, we have seen this movie before.  And it really doesn't end well.

UPDATE 2:  The leading competing bill, the Kids Online Safety Act (KOSA), has recently been resurrected with amendments that fixed some of its more glaring flaws for now.  That said, while we would MUCH rather KOSA pass compared to the much worse mandatory age verification bill discussed above, KOSA unfortunately still remains significantly problematic in its new version as well, and thus we cannot fully support it as currently written.  It can still be a potential Trojan horse.  That said, COPPA 2.0 and the Kids PRIVCY Act are good enough as written.  It is notable that the Center for Humane Technology doesn't include KOSA on their list of proposed policies.

Why there is still no serious attempt at any general comprehensive privacy legislation for all ages, and one that is content-neutral, currently remains a mystery (not).  The powers that be don't want it.

UPDATE 3:  Looks like reasonable doubt still remains about the more fanciful claims regarding the supposed causal link between social media, smartphones, and the teen mental health crisis when you zoom out and look at enough non-Anglo countries.  And yes, contrary to Jon Haidt, that IS an appropriate bar to clear before abruptly making truly radical (and likely unconstitutional) changes to society, especially from a place of moral panic.

UPDATE 4:  We should also note that Section 230 of the Communications Decency Act is often a frequent target for reform, if not outright repeal.  It effectively provides civil liability protection for online platforms who host user-generated content, with very few exceptions, and it is thus the sine qua non of the free and open internet as we know it.  While we can debate the merits of some degree of reform perhaps, repealing it in its entirety would throw the proverbial baby out with the bathwater, and have a chilling effect on free speech.  Section 230 repeal would be even worse than mandatory age verification. 

UPDATE 5:  Is Big Tech the new Big Tobacco? Honestly a better analogy is that Big Tech is new Big Oil.  And while there most likely is a "there", there, in terms of teen mental health issues, the specious idea of there being absolutely no safe level of social media use before some arbitrarily high age and they should be banned completely from it is a gross exaggeration. 

See also the EFF's other excellent article.

UPDATE 6:  See another great rebuttal here.

UPDATE 7:  KOSA is even worse than we thought, and thus we vehemently oppose it.  It is literally a textbook example of a Trojan horse that will effectively censor the internet and have a chilling effect on free speech, and also act as a likely gateway to the very same (de facto) mandatory age verification discussed above.  It needs a fundamental overhaul before it can even be considered at all.  As a wise man said, "no amount of lipstick can save this pig".

UPDATE 8:  See this other new study.

FINAL THOUGHT:  If we really want to throw the proverbial One Ring into Mount Doom for good in regards to Big Tech's highly toxic business model, we need to ban surveillance advertising, ban data brokers, and implement strong, comprehensive digital privacy legislation for ALL ages, period.  And go antitrust on the adtech duopoly as well.  In other words, platforms need to put users first, period.  And call their bluff whenever Big Tech falsely claims that a parade of horribles of some sort would result from doing so.  Ask them, "is that a threat, or a promise?"  

(Mic drop)