California Gov. Gavin Newsom enacted the California Age-Appropriate Design Code Act.
The new law, signed into law by Newsom on September 15, 2022 and passed by the state congress at the end of August, will implement some of the toughest privacy requirements for children in the United States, particularly when it comes to social media.
The law restricts apps’ ability to collect data on people under the age of 18 and requires them to implement their “highest privacy standards” for children and young people.
Additionally, the law requires technology-focused companies to incorporate technology to verify a user’s age before granting access to their platforms.
“We are taking aggressive measures in California to protect the health and well-being of our children,” Newsom said in a press release.
However, the move was not well received by some tech companies, who openly criticized it for restricting democratic freedoms.
“Even though [the legislation]The motive of is well intentioned, many of the means chosen are unconstitutional and risk unintended consequences,” commented Chris Marchese, advisor to NetChoice, a trade association of technology and internet-based companies.
In fact, according to Marchese, the law violates the First Amendment by restricting constitutionally protected speech and violating the editorial rights of websites, platforms and apps.
“[The bill] will also have the unintended consequence of blocking the internet even for adults,” Marchese added.
Evan Greer, director of Fight for the Future, a consumer advocacy group, echoed Marchese’s point, adding that the bill specifically harms LGBTQ+ youth and other vulnerable young people for whom the online community can be a lifeline.
“The bill is so vague and broad that it will almost certainly lead to widespread use of invasive age-verification techniques that expose children (and everyone else) to increased surveillance while claiming to protect their privacy,” Greer said .
“The requirement for age verification also makes it almost impossible to use online services anonymously, threatening freedom of expression, particularly for marginalized communities, human rights defenders, whistleblowers and journalists.”
The law will go into effect in June 2024, but as of this writing, it’s unclear whether tech companies will change their policies in the US to implement the design code, or limit it to individual locations.
According to David Ruiz, threat content author at Malwarebytes, the legislation could also be the latest bulwark against stalkerware.