5 Questions With Family Studies: Clare Morell on Utah’s Social Media Law

On March 23, 2023, Governor Spencer Cox of Utah signed two pieces of legislation into law, known together as the “Social Media Regulation Act” (SMRA). Among other things, the SMRA requires that to open a social media account, an individual prove, through age verification, that he is 18 years or older, and requires that a minor obtain parental permission for opening a social media account. The legislation is the first of its kind in the country and marks a watershed for how technology companies are able to intrude upon family life. Should families have authority over their technologies or should technology have authority over families? This question is critical to answer given the link between social media and the teen mental health crisis, and with technological advances in artificial intelligence and the so-called metaverse that promise to be even more powerful. With the SMRA, Utah has given parents more power over technology’s reach into their kids’ lives.

Utah’s new social media law was inspired, in part, by an August 2022 report, Protecting Teens from Big Tech: Five Policy Ideas for States, which was co-sponsored by the Institute for Family Studies (IFS) and the Ethics and Public Policy Center (EPPC). Few people understand the significance of this legislation better than EPPC scholar Clare Morell, the report’s lead author. So, IFS asked her five questions about the SMRA and what it portends for American families. 

Institute for Family Studies: Utah just passed pioneering new legislation to give parents more control over what their kids do online. Why is this important? 

Clare Morell: Utah is the first state to pass legislation to protect kids from the harms of social media. No other state, nor the United States Congress, has yet been able to pass any law related to children and social media. So, Utah is stepping out as a leader to be the first. This is important because the only law on the books to date has been a federal law, the Children's Online Privacy Protection Act or COPPA, passed in 1998, so it does not deal with social media directly. Rather, it deals with a company's ability to collect data from minors online. COPPA allows companies to collect data from children over the age of 13 without parental consent. And so, it has set the de facto age of social media to 13. However, we also know that children, ages eight to 12, are on these platforms. And that is because the knowledge standard of COPPA requires that companies have actual knowledge that a minor was on their platform. So, it's been very difficult to even enforce this low age of 13.

Utah has now stepped into the gap and said that we, as a state, will protect children, even if Congress does not. This is very important because we also know that social media is harmful, especially for younger teens and tweens. And we've seen the data now borne out about the rises in mental health issues correlated with social media. Jean Twenge and others have even shown that it's not just a correlation but also causation, because other factors do not explain the sudden rise in mental health issues documented since around 2011, shortly after the invention of the “like” button by Facebook and when smartphones became ubiquitous among teens, which is how most of them are accessing social media. There were spikes in anxiety, depression, suicides, self-harm, eating disorders, et cetera. It's really important that we recognize these harms to children from social media, and now Utah is stepping up to do something about it. 

IFS: What does the Utah law actually do? 

Morell: Primarily, the legislation empowers parents by requiring parental consent for any minor in Utah to open or operate a social media account. This also requires, then, that users of social media in Utah have to verify their age, and if they are under the age of 18, a parent has to provide parental consent for them to have an account. The law also creates certain protections for minor accounts: that they're not to appear in search results, or be targeted for advertising, or have their user data and personal information collected or shared, and that they are not able to receive direct messages from adult accounts that they aren't "friends” with already. So, it prevents social media from being as aggressive in targeting kids with advertising or suggesting groups or posts to them, which is how we know these apps work—by their algorithms that are really aggressive towards children. And then it also will require social media companies to automatically shut down minor accounts between 10:30 pm to 6:30 am, to ensure that children are getting the proper sleep they need. It is essentially an overnight shutdown of social media for minors. This is important, since sleep deprivation has been shown to be a very likely mechanism for the mental health effects we're seeing from social media, such as depression and anxiety. 

What the bill also does is give full administrator-level access to parents, so that they can see everything that their children are doing, or receiving, or seeing on social media. All of those provisions I just mentioned are actually part of the Senate bill (SB 152). So lastly, the House bill (HB 311) creates a private right of action so that parents are able to hold these Big Tech companies accountable for harms to their children. It gives them a right to sue for damages—on behalf of their teens—for harms caused by addiction and other design features, from social media companies, and it has shifted the burden of proof to the social media companies to prove that a harm has not been done. The House bill also empowers Utah's Division of Consumer Protection to investigate social media companies for design harms, which can cause addiction in minors, and to levy fines against those companies for violations. So, it's very comprehensive legislation to hold social media companies accountable, mainly doing so by empowering parents and then protecting children from some of the harmful elements. 

IFS: What is innovative about Utah’s approach?

Morell: Well, it really empowers parents, by drawing on the body of contract law. The Terms of Service for a social media account is essentially a contract. Case law indicates that parents can be held responsible for enforceable contracts that their children enter in to. Therefore, parents have an undeniable interest in controlling and overseeing with whom and when their children enter into contracts. So, it's a very reasonable response to have a regulation in Utah that now requires parental consent for children to form these online contracts, because creating a social media account is forming an online contract with that company. Parents, therefore, should have the right to consent for their child to enter into a contract and open a social media account. Also, by focusing on parental consent tied to the creation of a social media account, rather than consent for data collection, the law will avoid federal preemption by COPPA. 

The more states that step up and pass these types of laws will really force the Big Tech companies to change the way that they do business, in a way that better protects our children and empowers parents.

IFS: Critics claim that this law is government overreach. Others are worried about user privacy. What do you say to these concerns?

Morell: First, this is not government overreach. This is a precise function of government that when we recognize as a society that something is harmful to children, the government acts on their behalf to protect our children from those harms. And this has often been done in the past, particularly with harm from other types of Big Business. Take the example of Big Tobacco, laws like the FTC Act’s Unfair or Deceptive Trade Practices section—which has specific provisions preventing companies from deceptively or falsely advertising to children—was used against Big Tobacco, which was directly targeting their advertising to children: you may remember Joe Camel. We have often in the past, as a society, taken steps to limit Big Business's ability to go after our children with their products if they are harmful to our children and their health, because we recognize that children are more vulnerable and not as discerning as adults. We cannot allow our children, then, to be harmed by certain products. We took action against Big Tobacco. Now, we are recognizing it is time to take action against Big Tech’s social media. 

In general, government also age restricts things that we have deemed to be inappropriate or harmful for children all the time. There are age restrictions for alcohol, tobacco, even driving a car—these activities are dangerous to children, and so we've age-restricted them. 

Second, I think the concerns about privacy mainly focus on age verification and parents having full access to what their kids are seeing and doing online, that this kind of infringes on "children's right to privacy." On the first concern of age verification: the bill has left it up to the Utah Department of Commerce to make the rules related to the age-verification and parental consent requirements, and they have a year to do so. It's my understanding that they are intending to make as many options available as possible for adults to verify their ages, in ways that will not compromise user privacy. There are all sorts of innovative ways, now, for age to be verified, without people having to upload a photo ID of themselves, like a government ID, if people are concerned about giving over that type of data online. And so, there are things like using your transactional data, such as credit cards or bank accounts with a reversible charge, or other states have used a third-party vendor to provide a digital ID and then used a two-factor authentication process, whereby that third-party company verifies to the website to which an adult is trying to gain access that yes, indeed, this person is over the age of 18, without actually giving over any of that ID information to the company itself. This is what Louisiana has done for their porn site age-verification law. And, as part of this rulemaking process, there will be opportunity for public comment for people to submit their concerns, or their preferences, or ideas about how age verification could be done best without infringing on user privacy. I do expect that those will be taken into consideration in issuing a final rule, and that a final rule will seek to provide a wider range of options that allow people to protect their user privacy in verifying their age for social media in Utah. 

Regarding the concern about parents now having full access to minors' accounts, I will also say that there are legal precedents for protecting the rights of parents over their children and the communications their children are seeing. For example, the Supreme Court has upheld laws that allow parents to prohibit mailings from sources that are known to send sexual or other otherwise non-child friendly solicitations in the mail. So, if parents can prevent mailings from being sent to their kids, state laws could reasonably require parents to have oversight of the communications their children are receiving and sending online. The Supreme Court also has upheld indecency regulations of broadcast radio and television, with the goal of protecting children and the rights of parents to protect their family from inappropriate communications. So, there's legal precedent for what Utah’s law is doing. 

IFS: What advice would you give governors and lawmakers in other states who are considering some similar legislation of their own?

Morell: I would say follow suit, as soon as possible! The more states the better. The more states that step up and pass these types of laws will really force the Big Tech companies to change the way that they do business, in a way that better protects our children and empowers parents. I think the more states that pass laws will also push Congress to update COPPA as is needed, and for Congress to pass better laws on a national level to protect children online, particularly from the harms of social media. Utah's law is on good, solid legal ground with its approach of drawing on contract law. It's an innovative approach, and it empowers parents and protects children, and would hold Big Tech companies actually responsible for any violations, which COPPA has so far really failed to do. 

For all those reasons, I think Utah's law is a home run. It's always hardest to be the first state to do something, but Utah has done that and paved the way so other states can more easily follow in their trail. The more states that do this, the easier it will make it for other states to pass such laws. This is what our democracy does—the states are laboratories of democracy. It's exciting to see Utah testing out this new approach, and I hope other states will get on board.