The Political Hat

     California passed a law requiring you be verified before using an operating system. Now, Colorado has followed suit, with SB 51.

The bill requires an operating system provider to: Provide an accessible interface at account setup that requires an account holder to indicate the birth date or age of the user of that device to provide a signal regarding the user’s age bracket (age signal) to applications available in a covered application store;

Provide an application developer (developer) that requests an age signal, with respect to a particular user, the technical ability to call an age signal via a reasonably consistent real-time application programming interface that identifies, at a minimum, the user’s age-bracket data; and

Send only the minimum amount of information necessary to comply with the bill. An operating system provider shall not share an age signal with a third party for a purpose not required by the bill.

     Now, New York is considering a similar law, S8102.

PURPOSE OR GENERAL IDEA OF BILL:

To require devices to conduct commercially reasonable age assurance for users under the age of 18 at the point of device activation, unlocking the ability to enforce all other digital privacy and safety laws for underage users

SUMMARY OF PROVISIONS:

Section one of this bill creates a new Article 45-A in the General Business Law (GBL) to require all manufacturers of Internet-enabled devices, operating systems, or application stores to conduct commercially reasonable and technically feasible age assurance for users at the point of device activation.

Device manufacturers would be able to rely on an age assurance method previously identified by the Office of the Attorney General (OAG) under the regulations for the SAFE for Kids Act in Article 45 of GBL, or a method identified under new regulations promulgated by the OAG if OAG believes that updated regulations for this law are necessary. Covered manufacturers would be required to delete information collected for the purposes of age assurance immediately after determining the user’s age and would not be able to favor their own apps over those of third parties by imposing additional restrictions or conditions on the latter.

Applications (apps) would then be required to request the age signal from the device manufacturer at the point of app download and launch by a user. The age signal would be communicated to the app via a real-time application programming interface (API) and would be encrypted. The age signal would communicate whether a user is under the age of 13, between 13 and 15 years old, between 16 and 17 years old, or at least 18 years old and a legal adult.

     Not to be left out, Illinois is considering a similar law, SB3977.

Creates the Children’s Social Media Safety Act. Provides that, no later than January 1, 2028, an operating system provider shall: (1) provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both; (2) provide an operator who has requested a signal with respect to a particular user a signal that identifies the user’s age by category; and (3) send only the minimum amount of information necessary to comply with the provision. Provides that an operator shall not offer a platform in the State without conducting age verification as required under the Act to determine whether a user is a minor. Provides that, for all users that the operator has actual knowledge to be a minor, the operator shall use specified default settings for the minor. Provides that a violation of the Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective January 1, 2027.

     This push for similar language in such a short amount of time in many different states and countries is disconcerting. Brazil has a similar law that is going into effect this month.

Continue reading →