How a British baroness is shaping America’s tech laws for kids

Gavin Newsom, California’s governor, was surrounded by aides, local politicians and campaigners last September when he signed a new law for the Golden State — the first of its kind anywhere in the U.S. — to protect children from seeing posts about self-harm or from predatory digital advertisers. But one of the most important architects of the bill wasn't in the room.

Beeban Kidron, a British baroness, watched from 5,000 miles away via Zoom, barely able to see the signing ceremony on a propped-up laptop in her North London townhouse, as proposals she dreamed up years ago became law in the U.S.

Officially, she’s Baroness Kidron, Order of the British Empire, of Angel, an upmarket and trendy neighborhood in North London favored by politicians and celebrities. The title evokes the type of pomp and ceremony — more akin to "Downton Abbey" than hard-nosed politics — at which the United Kingdom excels.

But Kidron, a film director-turned-children’s rights advocate, has used a combination of perseverance and savvy politics to become arguably the most important and effective driver of data privacy and social media rules in the United States.

“They boiled kids alive online, and everybody’s fed up,” is how Kidron put it bluntly in an interview with POLITICO when describing how tech companies had treated children for years.

Unsparing and relentlessly on message, the 62-year-old politician (her title isn’t hereditary, she was elevated to the U.K.’s House of Lords for her movie work in 2012) successfully campaigned for sweeping changes in the U.K. that forced Facebook, YouTube and TikTok to revamp how they interact with underage users.

That playbook, the U.K.’s Age Appropriate Design Code, required platforms to redesign their products with kids’ safety in mind and was copied by California’s lawmakers as they made their own plans to push back against social media’s perceived ills. Both laws also include hefty new safety protections for minors and obligations on social media giants to downplay harmful content from their feeds. California’s legislation will come into force in July 2024.

The U.S.’s 50 different state legislatures and a Congress largely unable to agree on any major new laws poses a huge challenge to would-be reformers of the tech industry. But in that void, guerrilla-style figures like Kidron can have outsized influence by working behind the scenes.

Her idea is that the onus belongs on the big tech companies, not parents and guardians of kids, to reshape their services to treat kids differently from adults using these digital products. Not everyone agrees — some conservative states are passing laws relying more on parental oversight than the corporate reforms in California’s law. And by virtue of California’s size and importance to the tech business, Sacramento’s legislation has become the country’s de facto standard.

That has made Kidron, whose film director credits include the second Bridget Jones movie, an unlikely example of how a fancy British accent, a touch of digital wonkery and an intense persistence to hold companies more accountable for how they treat children can pay off.

Now — with the U.S. still largely stuck at a national level, California girding to enforce its new rulebook and industry groups preparing to fight it — the question is where else it will work.

‘She has enormous influence’

During a two-hour conversation with POLITICO, Kidron tilted between optimism that the U.K. and California rules would have an oversized impact on social media and anger that tech companies were still not doing enough to protect kids online.

“The code had become a sort of torch for the fact that something can be done,” she said, fidgeting constantly, in a converted 19th-century tailor’s shop, now her production office, that butts up against her own home alongside multimillion-dollar townhouses and low-income housing.

Next to her were wall-to-wall binders that spanned her work in the U.K.’s House of Lords and her separate children’s rights campaigning group, the 5Rights Foundation, to her international advocacy, including in the U.S.

“This is a systemic problem,” she added, almost impatient about why the tech industry hadn’t moved further. “The current system allows the bad actors access to our children.”

Not everyone has welcomed an obscure British baroness entering the cutthroat world of American politics.

In December, NetChoice, an industry trade group whose members include Google and Meta, filed a lawsuit against California’s replica of the British online protections, arguing Sacramento’s rules would make social media companies “roving censors of free speech on the internet.”

This year, Kidron’s 5Rights Foundation pushed hard for other states like Maryland and Minnesota to follow the U.K.’s lead in passing their own kids-focused rulebooks. Those proposals failed because lawmakers ran out of time during legislative sessions.

Other U.S. states, including Utah and Arkansas, passed their own versions of online child protections. Those largely Republican lawmakers took a different approach, focused primarily on giving parents greater control over how their children access social media.

Kidron’s vision is that it’s up to the companies — which build, manage and profit from the platforms — to set safety guardrails. The British politician’s first goal in the U.S. was to support a national law, and in Washington, she’s rubbed shoulders with leading Republicans and Democrats for years.

In repeated trips to the Beltway, Kidron has met with Sens. Richard Blumenthal (D-Conn.) and Marsha Blackburn (R-Tenn.), the co-authors of the most high-profile Beltway children’s protection proposal, known as the Kids Online Safety Act, or KOSA.

“I think she’s been dynamite. The age verification standards in the U.K. is a model for us,” Blumenthal told POLITICO. “She has enormous influence. Her advocacy has impacted our way of thinking.”

KOSA, though, is almost certainly mothballed before next year’s elections because of the split party control in Congress. Another challenge to recreating the U.K. kids code in Congress is more technical but equally important: It’s based on that country’s comprehensive privacy regime, known as GDPR — something the U.S. still lacks.

“They already have those online privacy protections that we do not yet have,” said Blackburn, who was introduced to Kidron eight years ago and has stayed in touch ever since. She last met in February with the British politician in London and again, virtually, in March to discuss KOSA, and she continues to work with her to this day — demonstrating Kidron’s strong cross-Atlantic ties to reform kids' safety around the globe.

Her detractors claim that California’s rules give companies too much say over how they define what’s in the best interests of children and that overly zealous efforts to verify online users’ ages will undermine the wider public’s privacy rights if everyone has to upload their ages to access online services.

Those within the tech sector also chide Kidron’s European-style paternalism over how minors should be treated when using the web. The digital world should be free for all to decide what they want to see, her critics add, not become a walled-off garden based on black-and-white definitions of what is acceptable.

“Its drafting weaknesses are concerning enough that we urge other states not to use it as a starting point for their own bills,” according to the Electronic Frontier Foundation, a digital rights group, in reference to California’s kids code.

The accidental purist

Kidron stumbled into the world of children's rights more than a decade ago.

Just as smartphones became cheap enough for teenagers to buy, she walked into a room in mid-2012 — during a break from her movie projects — to find once-boisterous young people sitting around glued to constant notifications popping up on their devices.

“They were all just looking at their screens,” Kidron recounted. “I had a thought that sort of slammed into my brain: ‘Oh, this is interesting. What is it like to have that silence among kids and their attention elsewhere?’”

By 2013, that idea had morphed into InRealLife, a gritty documentary based on Kidron spending hours with teenagers, mostly in their bedrooms. She followed them on everything from online dating apps to hardcore pornography sites to mainstream social media platforms.

It was a wake-up call for Kidron in an era when tech giants were still perceived by almost all politicians as solely forces for good. Compared to today’s TikTok generation of constant barrage of smartphone notifications, the more sedate digital landscape of 2013 — one filled primarily with Facebook status updates — feels like a lifetime ago.

During the filming, the British director cut two children from the documentary because she believed their experiences online had made them too vulnerable to include in the movie. Another videogame-obsessed participant was kicked out of college soon after she finished filming. A fourth was recommended for psychological support.

What had begun as a project focused on a new digital frontier of childhood quickly shifted to a stark warning of an unregulated world controlled by tech companies.

“I became more and more convinced that, by accident, I had hit on a problem that was unseen,” she said.

In 2017, as the U.K. was overhauling its data protection rules, known as the General Data Protection Regulation, or GDPR, Kidron noticed an obscure passage that required companies to pay extra attention to how children’s personal information was treated. Within hours, she had sketched out how that could be applied to the tidal wave of digital services increasingly targeting kids.

That kernel of an idea eventually became the 15 principles on which the U.K., and then California, rules were forged.

They include requiring companies to consider the best interests of children when designing products; setting privacy settings to the highest level for underage users, by default; and revamping Big Tech’s complex algorithms to stop the recommendation of harmful content like self-harming videos to potentially vulnerable kids.

“I've worked in public administration, different forms all my life, and I've never seen anybody who gets shit done like this,” said William Perrin, a former adviser to Tony Blair, the former British prime minister, and trustee of the Carnegie Trust U.K., a local nonprofit that campaigned for the country’s kids code.

The death of Molly Russell — a 14-year-old whose suicide was eventually associated with her repeated engagement with self-harm posts on Instagram, according to a British government investigation — also galvanized wider political support across the U.K. for the reforms.

For Kidron, the goal was not to ban certain types of content or stop kids from accessing social media. Instead, she wanted tech companies to redesign their products with children in mind — and not just treat them as if they were adults.

“What would you do differently if you knew the end user was a child?,” she said.

In the months before the U.K.’s rules came into force in late 2021, social media companies decided it was easier to implement the rules globally. Under the British regime, the country’s privacy regulator was empowered to enforce the kids code with fines of up to four percent of a firm’s global revenue.

Almost overnight, TikTok limited the ability of teenagers to be contacted by strangers via direct message. Facebook pulled back on how advertisers could target underage users with personalized ads based on collecting people’s data. YouTube turned off its “autoplay” function for minors that allowed teenagers to doomscrool through endless, and potentially, harmful content.

“We have now seen what it is to design these products better,” said Kidon. “We should not be doing all this content control. We should be saying (to the companies): Design it better by default. That is your job.”

‘We borrowed from another country’

As soon as the U.K.’s rules were in place, the phone calls from the U.S. started.

While Kidron had fostered bipartisan ties within Washington, her attention shifted to California, where local lawmakers had recently passed the first state-based comprehensive consumer data privacy bill — with powers, similar to those in the U.K., for both the state’s attorney general and a newly created privacy regulator to hold companies to account.

California also had a track record of campaigning groups working on children’s issues, including Common Sense Media, a nonprofit that provides kid-focused ratings, and local politicians willing to take up the fight.

Kidron first reached out in late 2021 to Democratic Assemblymember Buffy Wicks, who had previously worked at Common Sense. Wicks said talking to Kidron was a “meeting of the minds” — and what Sacramento eventually passed, including lifting passages from the British rules, showed that while California led the U.S. on digital policymaking, the legislation’s impetus was borne out of Kidron’s work in the U.K.

“This was not a homegrown bill,” Wicks told POLITICO. “So we might be first in the nation. We borrowed this from another country.”

For her part, Kidron is loath to take credit for California’s law.

“Buffy had a bee in her bonnet, and she wanted to get it done,” Kidron said. Wicks then brought on board then-Republican Assemblymember Jordan Cunningham, who was eager to recreate the British kids’ code in a bipartisan show of unity increasingly rare, either at the state or federal level.

“We met over Zoom, when she was kind of pitching me and Buffy on the bill, explaining how it worked in the U.K., and we thought that was super cool,” Cunningham, who left the legislature at the end of 2022, told POLITICO about his first interactions with Kidron in what would eventually become the California Age Appropriate Design Code.

And she had what Cunningham called “that other distinct advantage” — “that British accent that makes you sound really smart to politicians,” he added.

Kidron and her American counterparts took a divide-and-conquer approach to passing California’s kids code. The U.S. lawmakers navigated the nuances of passing wide-ranging online protections in a state synonymous with Silicon Valley. That involved reframing the U.K. rules within a different regulatory landscape where the local privacy watchdog — the California Privacy Protection Agency — had barely been established.

To avoid overly aggressive litigation, for instance, California’s code gave companies 90 days to fix potentially harmful issues once they had been flagged, as long as firms already had done what they could to embed the legislation into their services.

Kidron’s role was to shoot down industry efforts to quash the law, explaining to lawmakers the proposed legislation was neither unwieldy or too complex — based on her existing experiences in the U.K.

Kidron had fought many of these battles before. “She already had Google and Facebook and everyone else on the record on this issue in the U.K.,” Wicks said. “I knew what the opposition was going to say and was able to figure out how to maneuver that within the legislative context of California.”

The lobbying became increasingly bitter. Kidron became embroiled in barbed attacks, including viral online accusations — based on her decadeslong movie career — that she had ties to disgraced producer Harvey Weinstein. She worked with him twice as a director but said she was not aware of his behavior that eventually led to his conviction on sexual assault and rape charges. Weinstein is appealing the charges.

“I do find it really interesting that, in their effort to stop products being designed with some sort of consideration of childhood, that they're willing to go that low,” she said.

For Cunningham, the former Republican assemblymember, Kidron was instrumental in getting the bill passed because she already had the answers to the inevitable industry pushback against more tech regulation. That advice will now be tested during an upcoming lawsuit, filed by NetChoice aimed at overturning California’s law.

“Normally tech says, ‘The sky is going to fall, we’re going to have to boot all kids off our app, social media as we know it will crumble,’’’ he said. “And, it’s like, wait a minute, they already have this law in the U.K., and the world isn’t falling apart. That argument doesn't work.”

The road ahead

From her cluttered office in North London, Kidron is already working on her next acts: forcing kid-friendly changes to the U.K.’s upcoming social media rules and steering U.S. lawmakers to enact nationwide children protection standards.

London’s Online Safety Bill, or efforts to remove hateful material from large online platforms, is currently being debated within the country’s Parliament. The British Baroness is leading a charge via the House of Lords to insert greater child protections — including forcing tech companies to verify the age of their users — into legislation expected to be passed by September.

In Washington, the prognosis is less optimistic.

Even after President Joe Biden name-checked greater privacy protections for children in his most recent State of the Union address in February, getting Blackburn and Blumenthal’s bipartisan bill through both chambers will be nearly impossible — even if Kidron’s push for kids’ online protections, first in the U.K. and subsequently in California, remain at the forefront of lawmakers’ minds

“Politicians from both sides of the Hill, on a bipartisan basis, express their frustration to me that they can’t get anything done,” said the British politician. “They are feeling desperate. But they also see what has happened in the U.K. and California, and that gets people excited.”