Big Tech carves loopholes out of state kids’ safety laws

A new law in Arkansas — the Social Media Safety Act — would bar any kids under age 18 from using social media apps unless they get parental consent.

Exempt from the statute, however, is Google’s YouTube — the single most popular social media app among teenagers ages 13-17.

Further West, Utah lawmakers passed an even stricter parental consent measure in late March banning kids from apps after 10:30 p.m., while offering exemptions for certain social media sites like LinkedIn. And now one of the Utah Republicans who championed the bill told POLITICO he’s considering rewriting the law to set up key legal protections for tech companies after talking to the industry over the past several months.

As the battle over online safety and privacy shifts from Washington to state houses, and states debate and pass a wave of digital-protection laws aimed at kids, Big Tech firms are fighting a state-by-state battle to protect themselves from the new rules — and landing some wins. A POLITICO review found multiple loopholes carved out of the laws in response to tech industry lobbying in state capitals.

In addition to the Arkansas and Utah bills, California’s Democrat-controlled legislature, which enacted the country’s first kids’ online safety law, recently removed a key provision in a new kids online safety bill that would have let Californians sue tech companies over “addictive design features,” following lobbying from tech companies.

The fight over digital protections is taking place far from Capitol Hill and K Street, the traditional battlegrounds for high-stakes regulatory fights, in part because Congress has failed to advance any of its own laws to protect kids online and states are filling the gap.

And the tech industry plans to keep up the pressure, with dozens more bills expected to see action across the country in the coming years.

Leading the lobbying campaigns are top trade associations for the technology industry, NetChoice, which represents Meta, Google, Amazon, TikTok and Twitter, and TechNet, which represents Meta, Google, Amazon and Snapchat. TechNet sent letters to Arkansas’ governor and Utah’s governor, and NetChoice also sent letters to Arkansas’ governor and Utah’s governor, asking them to veto their state bills, even as the groups worked behind the scenes to win exemptions and protections for some of the biggest social media companies.

Big Tech says the new laws remain fundamentally problematic, even if lawmakers make changes. “We see it as a way of making it harder for people to do what our core values speak to — which are free enterprise and free speech, so our opposition remains regardless of the amendments,” Carl Szabo, NetChoice’s vice president and general counsel, said in an interview.

At the federal level, lawmakers have introduced parental consent and kids online safety bills this session, but a divided Congress means those measures have a slim chance at passing.

The states, meanwhile, have seen a flurry of activity: More than 60 bills introduced in 2023 would either require parental consent for teens under 18 to access social media or mandate internet platforms redesign their products with kids’ safety in mind, according to data from the National Conference of State Legislatures. Many of the bills have bipartisan support, and there are measures being pushed in both Democratic and Republican-controlled legislatures.

Tech Scores Some Wins

In Arkansas, Republican state Sen. Tyler Dees said he pushed through amendments to narrow his bill’s focus on certain social media apps like Facebook, Snapchat and TikTok, after meeting with various tech trade groups and companies, including Google.

Arkansas lawmakers ultimately exempted companies that earn less than 25 percent of their annual revenue from social media — which would include Google’s YouTube. They also carved out exemptions for career networking sites like LinkedIn, cloud storage service platforms like Microsoft and Amazon, and online video gaming sites.

In Texas, Republican state Rep. Shelby Slawson introduced an amendment to her parental consent bill — H.B. 18 — before it passed the House in late April that would exempt their Google for Education and Google Workspace for Education platforms for schools.

Slawson said on the House floor the amendment was just intended to be “targeted” for products intended for educational purposes, but wouldn’t apply to larger platforms like YouTube or Amazon.

And in Utah, tech companies will have a chance to rewrite the law’s enforcement measures with Republican state Rep. Jordan Teuscher before it goes into effect next March. He told POLITICO that he’s planning to talk to tech companies this month about adding in a safe harbor to the law and passing an amended version before the it goes into effect next March.

Dees said that while the tech industry strongly opposed his Arkansas bill, it worked hard to keep a low profile while doing so. “There was always an awareness that they wanted to be more quietly working on it on the outskirts,” Dees said in an interview.

“No one wanted to be perceived as not trying to help children, but I can tell you there was definitely an initiative to completely kill this bill because they wanted to handle it themselves versus having anybody else step in,” he said.

In California, tech lobbyists also scored another victory. The state’s Senate Judiciary Committee removed a provision that would have allowed for private right of action lawsuits against tech companies — something that’s been strongly opposed by the industry. The same private right of action was eliminated from last year’s addictive social media design bill as well.

“The PRA gets amended out because members don’t like PRAs and it will kill the bill,” said California Democratic Assemblymember Buffy Wicks, who sponsored last year’s addictive design bill. “There was a lot of pressure from industry to take that out and thereby pressure from members.”

Former California Republican Assemblymember Jordan Cunningham, who co-authored the addiction bill, agreed that tech lobbying got the upper hand. He said he even had some tech companies say, “‘If you take that out, we don’t have major problems with it.’” He asked them if they dropped the PRA, would they drop their opposition to the bill. He said they responded, “‘Well we’re not so sure about that.’”

Tech’s all fronts war

The tech industry argues that complying with a patchwork of different — and often conflicting — state laws will be very difficult for companies to deal with, and one federal standard would be easier — and cheaper — to comply with.

“There’s not the internet of Texas, internet of Idaho, or internet of Montana. And if you’re building out compliance programs for the entire country, the idea of being able to do so on a state-by-state or device-by-device basis is incredibly costly and difficult,” David Edmonson, TechNet’s vice president of state policy and government relations, said in an interview.

Accountability groups say it’s a fundamental battle over tech’s role in society — and a potential threat to the industry’s bottom line.

Nicole Gill, co-founder and executive director of tech watchdog group Accountable Tech, said companies are running a two-track campaign. She said they’re making design changes that may make minor safety improvements for kids, “while at the same time, their government relations teams — up to their CEOs — are directly lobbying Congress and state legislatures to do absolutely nothing to regulate them.”

“And they’re doing this at the detriment to our children.”

Dees, the Arkansas lawmaker whose bill sailed through the legislature in less than 30 days, said the opposition isn’t surprising, given how many of the new laws strike at the heart of the social media business.

“Every one of these companies didn’t want this bill to pass,” Dees said. “Every one has fears that we will be messing with their profits.”

The industry has also taken the battle to the courts. NetChoice filed a suit against California’s age appropriate design code law in December 2022, and is considering litigation against Arkansas and Utah’s laws. “Conversations are being had,” said NetChoice’s Szabo. “There are a lot of people talking and analyzing.”

Over the last two years, social media platforms have started rolling out their own changes in an effort to get ahead of new regulations, and perhaps stave off further legislation. Meta says it’s not waiting for state legislation, and since 2018 has launched more than 30 tools, including time limits for teens, age verification tech and automatic privacy settings for teens under 16.

TikTok rolled out in March a 1-hour daily screen time limit for users under age 18, and privacy defaults for those under 16. Snapchat announced last August new features on its Family Center that went into effect in March letting parents limit the type of content their teens watch.

Some of the social media platforms raised concerns that state bills exempting certain players set uneven safety standards.

Kevin Martin, Meta’s vice president of public policy, said in a statement, “Youth online safety bills that hold different services to different standards will subject teens to inconsistent protections online. These bills should provide clear, consistent rules so all services meet the expectations of parents.”

Meanwhile, Jamal Brown, a TikTok spokesperson said, “We will continue working with lawmakers, industry peers, regulators and others in tackling industry-wide challenges related to youth safety and well-being.”

Google, LinkedIn, Amazon, Microsoft and Twitter declined to comment.

Second Chance in Utah

In Utah, tech companies will get another shot at winning a major victory as the bill’s main author says he’s open to changing its central enforcement mechanism.

Utah has two laws set to into effect on March 1, 2024, but Utah’s Teuscher said he’s planning to work with tech companies to amend one of the social media laws — S.B. 152 — to create a safe harbor to shield companies from private lawsuits if they comply with certain requirements, like potentially a certification regime.

Currently, tech platforms face fines up to $2,500 fines per violation if they’re sued for failing to verify the age of Utah minors on existing or new social media accounts.

“What we told them is that we would we want to pass the legislation as is, but that we would work over our interim — really starting in May — to try to see if we can develop a safe harbor that would exempt them from the private right of actions that are in the bill,” Teuscher said in an interview.

Teuscher said he’d consider creating a certification process, potentially under Utah’s Department of Commerce, and plans to start meeting with social media companies in May to discuss the details. Teuscher said he wants to introduce the measure next January, when the legislature convenes, and pass it before the prior law goes into effect in March.

“The point of the legislation isn’t to create some big litigious legislation, but really just to make sure that they’re actually doing what they’re supposed to,” Teuscher said.

A safe harbor could be a win for the tech groups. “The PRA is exceedingly broad and untested territory, and obviously one of our biggest concerns,” TechNet’s Edmonson said.

In the end, state lawmakers are up against some of the most powerful companies in the world, with the deepest pockets — and tech plans to continue fighting on all fronts.

But advocates for new limits say public sentiment is on their side. “It takes time, but eventually the public supports efforts to protect kids,” former California Assemblymember Cunningham said. “They can kind of slow it, but I don’t think they can stop it.”

CORRECTION: A previous version of this story misspelled Sen. Tyler Dees' name.