Beacon Hill leaders took bold steps this month aimed at tackling what they call an “out-of-control” youth social media addiction problem, comparing their efforts to the fight against Big Tobacco.
The Massachusetts House voted 129-25 to ban kids under 14 from having social media accounts and to require parental consent for 15- and 16-year-olds to use social media.
Gov. Maura Healey followed up with her own bill that would impose a default set of restrictions for minors’ social media accounts, including a two-hour-a-day limit and the disabling of features — like auto-playing videos — that encourage users to stay online.
Healey, who’s described the two measures as complimentary, says both pieces of legislation prove government leaders are committed to coming up with solutions “to protect our young peoples’ health and their well-being and their sense of self.”
But a key question remains: how would this all work in practice?
Healey’s bill and the House bill would both require social media companies to have some sort of system in place to check users’ ages, to determine the appropriate level of access. Neither bill goes into specifics about how a user would need to prove their age, instead leaving it to Attorney General Andrea Campbell’s office to come up with regulations.
House Ways and Means Chairman Aaron Michlewitz has said that approach would allow for more flexibility than writing details into law, letting Campbell respond to a rapidly evolving tech ecosystem. The House bill says social media platforms would need to implement an age verification or assurance system that uses “the best technology available to reasonably and accurately identify a current or prospective user’s age.”
Under Healey’s bill, the AG’s office would be able to publish regulations “identifying commercially reasonable and technically feasible age assurance methods with measures reasonably calculated to accurately identify a user’s age and to identify the appropriate level of accuracy required.”
Critics have flagged the age verification piece as a privacy concern, saying that determining age involves uploading potentially sensitive data like a government ID or a photo that can be scanned for an age estimate based on facial features.
“What we’ve seen in the past is that makes all of us more vulnerable to identity theft if companies are storing our IDs and face scans in insecure databases,” Evan Greer, director of the digital rights group Fight for the Future, told GBH News. “Discord, for example, had their age verification provider hacked and lost 70,000 people’s credentials in one incident.”
Greer was among a group of activists who protested outside the Boston Public Library Tuesday as Healey appeared on GBH’s Boston Public Radio. As Healey left the library, Greer handed the governor a section-by-section summary of her legislation breaking down parts where Greer sees problems .
Members of Healey’s staff plan to meet with Greer and other advocates next week to discuss the bill.
“I know that folks are going to continue to meet with my office, we’ll continue to work with the Legislature on this, but I have to believe that there is a way to come up with something sensible that protects the health and wellbeing of our kids who are really, deeply impacted by the prevalence of these social media platforms in their lives,” Healey said during her radio appearance.
The governor said her bill would not require social media users to upload a photo ID, and the platforms would need to delete any data it collects for age verification within 10 days.
Asked if she trusted tech companies to delete the data, Healey said, “I think to do nothing is just not the way to go.”
“Don’t you think these platforms understand their technology enough to do what needs doing?” she said. “We just need to require it by law, and I’m comfortable that we can work with groups about any concerns we have around privacy.”
According to the Future of Privacy Forum, different age assurance options include simply asking a user to provide their birth date, inferring an age based on online activity, using AI to estimate age from a facial image or video, or checking a government-issued ID against a live photo.
Online age verification is a relatively new idea that’s “still developing in terms of what the various modalities that are available and how to do that the right way that also protects privacy,” said Cobun Zweifel-Keegan of the International Association of Privacy Professionals.
Questions for policymakers to work out, Zweifel-Keegan said, include what tools provide certainty about someone’s age, and what happens to the information after it’s collected. He gave an example of the TSA scanning an air traveler’s ID and pledging to immediately delete the image after the security check.
“That’s the kind of restriction in practice that is necessary to kind of create privacy protections around identity and make sure that people are comfortable sharing that kind of information with a social media company,” Zweifel-Keegan said.
Beyond privacy, Zweifel-Keegan said there are also issues of equity and access to consider, like how people without government IDs can validate their age.
Another possible challenge to implementing age-based social media restrictions is the dedication of young people to accessing the apps anyways.
Research from Aura, a Boston-based digital security company that offers a parental monitoring product, found that nearly one in five kids under 13 reported spending four or more hours a day on social media, with many children either bypassing age verification measures or spending long stretches online once given a parent’s consent.
Scott Kollins, Aura’s chief medical officer and a clinical psychologist, said as age-check technology evolves, so, too will kids’ ability to find workarounds. He said age restriction legislation should be paired with education and ways to help parents understand how their kids are using their devices.
“There’s any number of ways where if these platforms are appealing to young people, I think they’re going to figure out a way to get on them,” Kollins said. “Some will be easier than others, but they’re out there, you’ve got access with your device, and so they’re going to figure it out.”
