Meta, Google, TikTok and friends sue California to block kids privacy law

Free speech? Or 'roving internet censors'

An internet trade association whose members include Amazon, Google, Meta, TikTok and Twitter has sued the state of California to block a recently signed law that aims to protect kids online by requiring websites to verify the ages of all users. 

The legal challenge, filed on Wednesday in federal court, claims the state's Age-Appropriate Design Code Act (AB 2273) violates the First Amendment and existing federal law by controlling online speech and requiring "online service providers to act as roving Internet censors at the State's behest [PDF]."

It also clashes with the existing federal Children's Online Privacy Protection Act (COPPA) and violates the Fourth Amendment by forcing sites to reveal private, internal communications, according to the lawsuit. 

NetChoice, the industry group that is suing the state over the new law, argues that AB 2273 actually does more harm than good for children's privacy by forcing service providers to identify which users are under 18 years.

"By abandoning the First Amendment and forcing all websites to track and store information on both children and adults, California risks closing the internet and putting the digital safety of all Americans, and especially children, in jeopardy," NetChoice VP and General Counsel Carl Szabo said in a statement.

California Governor Gavin Newsom signed AB 2273 into law in September. It is set to take effect in 2024, and applies to any "business that provides an online service, product, or feature likely to be accessed by children." And by "children," it means anyone younger than 18.

Before offering their services or products to minors, businesses must assess whether these offerings could harm minors or use features to extend kids' time spent on the site, such as offering rewards for longer visits.

What about vaguely harmful services?

The state's definition of "harm" is too vague, according to the court documents. 

"A business could be expected to document the risks, for example, that photographs and videos depicting the global effects of climate change, the war in Ukraine, school shootings, or atrocities in Syria could cause minors anxiety; or that a content recommendation for the next episode of a cartoon TV series could 'harm' a minor who is struggling to focus on homework or to get more exercise," the lawsuit says.

However, it's the mandatory age verification piece of the legislation that has been the most troubling aspect to businesses and data privacy groups since the bill was proposed. 

AB 2273 requires regulated businesses to "estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers."

According to the lawsuit, "age certainty is not realistic." And there are workarounds to age verification technologies, which present their own data security and privacy problems.

"Any method that involves submitting official documents increases the risk that those documents could be stolen or leaked," the court documents argue. "More invasive age-verification methods — such as artificial intelligence, facial analysis, or facial recognition technologies — are far from foolproof and pose their own transparency, security, and privacy concerns."

NetChoice is a plaintiff in similar legal battles in Florida and Texas that challenge social media laws on First Amendment grounds.

At the federal level, legislation that also aims to protect kids' online safety and data privacy will likely face similar legal challenges if signed into law.

In a letter sent to US Senate leaders late last month, more than 90 organizations urged lawmakers to kill the proposed Kids Online Safety Act (KOSA), which they warned would incentivize service providers to collect more data on children, limit access to sex education and resources for LGBTQ+ youth, and allow parents to spy on their teens.

During the final weeks of the lame-duck Congress, advocates and lawmakers have suggested adding the kids' privacy proposal to the year-end defense or spending bill to ensure it passes ®.