iKey takeaway: Last week, Arkansas became the latest state to pass legislation requiring social media companies to obtain parental consent before allowing minor users to create accounts on their platforms. The new law, titled Social Media Safety Act (“SMSA”) – is effective on September 1, 2023.
Similar to Utah’s Social Media Regulation Act (“Utah SMRA”, discussed here), SAMSA defines “social media company” and “social media platform” broadly. Numerous exclusions, however, narrow the term to a definition consistent with a general understanding of those terms. Exclusions include:
- a platform controlled by an entity with less than $100 million annual gross revenue,
- a platform with a predominant function of email, direct messaging, streaming services, news, sports or other content not generated by users,
- e-commerce, and
- business to business software not accessible to the general public, research and shared document collaboration
The below chart is a quick reference guide that compares key topics under SMSA and Utah SMRA. As shown below, Utah SMRA does not provide details with respect to age verification and parental consent methods and instead relies on Utah’s Division of Consumer Protection to promulgate rules. Although shorter, SMSA provides more detail about age verification methods than Utah SMRA. Unfortunately, the SMSA does not outline what constitutes valid parental or guardian consent and does not authorize rules to be promulgated to address this gap like the Utah SMRA does.
| Topic | Utah SMRA | AR SMSA |
| Effective | May 3, 2023 | September 1, 2023 |
| In force | March 1, 2024 | September 1, 2023 |
| Regulations forthcoming | × | |
| Key Requirements | ||
| Verify the age of all account holders. | × | × |
| “Minor” is under 18 years of age. | × | × |
| Engage a third-party vendor age verification vendor that uses “reasonable” methods to verify age, which include government-issued identification or digitized identification card or ”any commercially reasonable age verification method”. | × | |
| Prohibit retention of any “identifying information” after access is granted. | × | |
| Confirm parental or legal guardian express consent before creating a minor’s social media account. | × | × |
| Prevent creation of a minor’s social media account unless/until parental consent is verified. | × | × |
| Prohibit minor account holders from accessing their accounts between the hours of 10:30pm and 6:30am (with the time zone based on IP address) unless the consenting parent/guardian changes the default setting. | × | |
| Provide the consenting parent or guardian with a means to: access the minor’s account; view all posts the minor has made; view all responses and messages sent to, or by, the minor account holder; and change or eliminate the minor account holder’s permitted access time to use their account. | × | |
| Enforcement | ||
| Civil Penalties | × | × |
| Administrative Fines | × | |
| Cure Period | × | |
|
Private Right of Action
|
× On and after March 1, 2024, $2,500 per violation or actual damages “for financial, physical, and emotional harm incurred by the person bringing the action, if the court determines that the harm is a direct consequence of the violation” |
× $2,500 per violation or court ordered damages as well as court costs and reasonable attorney’s fees.
|
| Criminal penalties | Class A misdemeanor for knowing and willful violations | |
| (Please note that this chart is a helpful tool, but it is not exhaustive. The authors’ contact information is linked above if you would like more detailed information.) | ||
As both these laws come into effect, social media platform providers will need to work with counsel to harmonize the age verification and parental consent obligations. Meanwhile, Sen. Brian Schatz (D-HI) recently introduce the Protecting Kids on Social Media Act. Among other requirements, this federal law would require age-verification for social media users nation-wide with enforcements powers held by state attorneys general and the Federal Trade Commission.
