These Senators Want the Federal Government To Verify Your Age Online

Requiring users to verify their age to use social media will degrade their privacy and cybersecurity.

Despite their many disagreements, Republicans and Democrats have developed a common affinity for social media regulation, largely relying on the disputed assumption that platforms like Instagram and TikTok severely degrade children's mental health. The latest regulatory proposal in Congress is the Protecting Kids on Social Media Act, sponsored by a bipartisan group of four senators: Sens. Brian Schatz (D–Hawaii), Tom Cotton (R–Ark.), Chris Murphy (D–Conn.), and Katie Britt (R–Ala.).

The bill features several flawed policies, drawing from recent state and federal social media proposals. It would require social media platforms to verify the age of every would-be user. Platforms could allow the unverified to view content, but not to interact with it or with other users. After providing age verification to register an account, underage teens would need proof of parental consent. Those under 13 years old would be completely barred from registering accounts.

The bill does propose one novel—and potentially dangerous—innovation. It would establish a "pilot program" for a federally run verification system. This system would ascertain social media users' age and, for teen users, confirm parental consent.

Age verification mandates, which invariably entail intrusive data gathering, threaten user data privacy and security. They also violate the individual's right to speak freely and anonymously online. Although the bill's authors sought to mitigate the risks their implementation would pose to users, they largely failed. Such risks are inextricable from the process of age verification itself. The bill proposes a legal safe harbor for social media platforms that choose to use the pilot program. To avoid even the appearance of noncompliance, many platforms will do just that.

The proposed pilot program would require would-be social media users to submit documentation to the Department of Commerce in order to verify their age. In return, the pilot program would provide a "credential" to be submitted to social media platforms. Users would verify parental consent by the same process. To administer the program, the government would necessarily obtain and store troves of personal data on American social media users—to prove regulatory compliance, if nothing else.

To protect user privacy, the bill directs Commerce to "keep no records of the social media platforms where users have verified their identity." It would also forbid the agency from sharing user data with platforms or law enforcement without user consent, a court order, or a program-specific fraud or oversight investigation.

Nonetheless, the bill would require users to register personal information with state authorities simply to speak online. Government agencies, under a legal pretext, could retrieve from social media platforms the records necessary to identify user accounts. Democrats have long been skeptical of the federal government's data abuses, but both parties—including newly skeptical Republicans—ought to understand these risks.

Federal identity verification has already fallen victim to abuse. The General Services Administration's (GSA) Login.gov is the federal government's identity verifier for federal job applications, disaster relief, and other government programs. According to a GSA inspector general report from March 2023, the GSA flouted federal guidelines and the agency "misled their customer agencies when GSA failed to communicate Login.gov's known noncompliance."

"GSA knowingly billed [Identity Assurance Level 2 (IAL2)] customer agencies over $10 million for services, including alleged IAL2 services that did not meet IAL2 standards," the report reads. "Furthermore, GSA used misleading language to secure additional funds for Login.gov." Of course, the site's mishaps aren't conclusive proof that the proposed verification pilot program would be similarly misgoverned. But they do serve as a reminder that federal programs—particularly sensitive or technical ones—quite often flounder due to incompetence or outright abuse.

The proposed federal verification program—indeed, the entirety of the bill—likely violates minors' speech rights. Many frame such proposals as being about parental empowerment. "By setting an age limit of 13—and requiring parental consent until age 18—our bill will put parents back in control of what their kids experience online," Cotton said of the bill. This framing obscures the full picture.

In Brown v. Entertainment Merchants Association (2011), the Supreme Court ruled that a California law barring minors from purchasing violent video games was unconstitutional. That case's outcome illuminates the social media bill's legal weaknesses.

"While some of the legislation's effect may indeed be in support of what some parents of the restricted children actually want, its entire effect is only in support of what the State thinks parents ought to want," the late Justice Antonin Scalia reasoned. He argued that while parents have broad authority over their kids, and the state may reinforce that authority, "it does not follow that the state has the power to prevent children from hearing or saying anything without their parents' prior consent." Moreover, Scalia stated, "such laws do not enforce parental authority over children's speech and religion; they impose governmental authority, subject only to a parental veto."

Various kinds of virtual communication are fast becoming Americans' primary forms of communication. Preexisting statutory and constitutional speech and privacy protections will mean little if tech-averse politicians legislate them out of the digital sphere. No matter how well-meaning they are, advocates of age verification mandates should think harder before inviting the government so deep into users' private lives.