States take the lead on kids' online safety bills

US state legislatures are advancing bills tackling distinct elements of the youth online data privacy and security landscape that could inform Congressional debates around federal standards.

From Oregon to Vermont, several states have passed laws that will require parental consent for app store downloads, ban the collection and sale of children's online data, including precise geolocation information, and implement what advocates of the legislation have called "privacy-by-default" safeguards.

Navigating a complex patchwork of state laws requires collaboration between industry and government, but proposed legislation also presents opportunities for companies to innovate and adapt to new frameworks, experts told S&P Global Market Intelligence.

"Laws are crucial for establishing guardrails in every industry, but they should not hinder innovation by being excessively burdensome," said Darren Williams, founder and CEO at BlackFog, a global cybersecurity company. "While most businesses are comfortable with some level of oversight, they do not want it to compromise innovation."

A balancing act

There has been a vigorous debate about the level of government involvement in regulating online marketplaces such as app stores and the extent to which safety can be ensured without compromising privacy. At the federal level, the Kids Online Safety Act remains in limbo after being modified into several different iterations, including one that was heavily influenced by Elon Musk, who briefly was a special adviser to the Trump administration and owns X, the social media platform formerly known as Twitter. The original intent of the law was to hold social media companies more accountable for potential harm caused to minors using their platforms. It also sought to enable the federal government to investigate and sue websites believed to cause children psychological distress.

Oregon Gov. Tina Kotek on June 3 signed HB 2008 into law. The bill received the endorsement of Consumer Reports for preventing the sale of location information at a time when concerns have heightened that such data is increasingly being used against consumers.

"Minors' personal information is also inherently sensitive and should not be available for sale to the highest bidder," said Matt Schwartz, policy analyst at Consumer Reports.

On May 27, Texas Gov. Greg Abbott signed into law SB 2420, the App Store Accountability Act, a bill that would require Apple Inc. and Alphabet Inc.'s Google to verify user ages for their app stores and mandate parental consent for downloads and in-app purchases for users under 18. Utah passed a similar bill in April, and South Carolina's state legislature introduced its own age verification and consent bill in January.

A Google spokesperson sent Market Intelligence a blog post with an alternative to the Utah law published by the company's director of public policy, Kareem Ghanem.

"We are focused on solutions that require appropriate user consent and minimize data exposure," Ghanem wrote. "Our legislative framework, which we'll share with lawmakers as we continue to engage on this issue, has app stores securely provide industry standard age assurances only to developers who actually need them — and ensures that information is used responsibly."

A spokesperson for Apple did not immediately respond to requests for comment.

Room for debate

Advocacy groups have pushed for action at the state level in the absence of comprehensive federal laws. In some cases, federal legislation has been ineffective at protecting children, said David Dunmoyer, campaign director for tech policy at the Texas Public Policy Foundation, a conservative research institute.

"It's been clear that the opportunity has been given for these tech companies to voluntarily adopt more child safety standards, and while there have been some attempts, they're fully missing the mark," Dunmoyer said. "And so our conclusion is that there is a role of government to step in and protect the minor population that's ultimately being preyed upon by these big tech companies."

Critics of the bill, such as the center-left trade group Chamber of Progress, say the legislation poses a serious threat to privacy and free speech, arguing that a blanket age verification requirement would undermine privacy for all users.

"App developers are better positioned to implement tailored safety measures as they have a a deeper understanding of their apps' features, audiences, and risks," Kouri Marshall, Chamber of Progress' director of state and local public policy for the central and southern region, wrote in a letter urging Abbott to veto the bill.

Dunmoyer said data privacy is one of the "animating principles" behind SB 2420 and the movement for heightened online safety measures for minors. He pointed to the Texas Data Privacy Security Act, signed into law in 2023, which allows Texans to delete information that companies — known colloquially as data brokers — collect on users and opt out of data collection that some social media companies conduct.

SB 2420 requires the instantaneous deletion of age verification data upon using it to verify user age inside of app stores and at the individual app level.

"Our argument is that with those two things together, and especially with adding [KOSA] it's even more pro privacy," Dunmoyer said. "Now let's make sure, once that data is taken in and you acknowledge the age, it's deleted instantaneously, so it can't be sold or purchased by data brokers or other entities."

'Privacy by default'

Nebraska Gov. Jim Pillen signed into law the state's Age-Appropriate Design Code Act on May 30, while a similar bill has been sent to Vermont Gov. Phil Scott's desk.

Vermont's proposed online safety law, which was endorsed by the Vermont Kids Coalition, would set one of the highest privacy default settings of any US state. While the bill does not require a duty to mitigate harm from content or parental consent, it would apply to all online businesses accessible to minors and take effect July 1, 2026, if signed into law.

Nebraska's design code emphasizes parental controls over privacy and account settings, placing time limits on scrolling and restricting ads or certain content that might not be deemed suitable for minors. It will become enforceable on Jan. 1 and apply to social media and online platforms.

"There is strong bipartisan support and recognition that social media is a source of harm, allegedly," said Lucy Porter, an attorney with expertise in data security and privacy at Bracewell. "What ultimately these laws have at their root is an attempt to prevent or shield those children from those harms."

The current iteration of KOSA allows for states to be more restrictive in requiring companies to step up and mitigate potential harms, Porter said.

"They're certainly all coming from a place of, 'we have this thing that society has decided is a problem, and therefore, how can we attempt to solve it?'" Porter said. "And so they're going to try to solve it in a bunch of different ways, and that's what these laws are trying to do."

What's happening this week?

Below is a list of hearings, webinars and other tech, media and telecom-related events being held in the nation's capital and beyond, virtually and in-person this week:

June 3

➤ The Brookings Institution: The United States, China, and the war in Ukraine

➤ Center for Strategic & International Studies: Spotlighting the Role of Creativity and Ownership in the US Patent System

➤ Atlantic Council: A conversation with Rep. French Hill on stablecoins and the future of money

➤ Center for a New American Security: CNAS 2025 National Security Conference | America's Edge: Forging the Future

June 4

➤ House Financial Services Committee: American Innovation and the Future of Digital Assets — From Blueprint to a Functional Framework

➤ Senate Appropriations Committee: Hearings to examine proposed budget estimates for fiscal year 2026 for the Department of Commerce.

June 5

➤ House Judiciary Subcommittee on Crime and Federal Government Surveillance: Foreign Influence on American Data Through the CLOUD Act

➤ House Oversight and Government Reform Committee: The Federal Government in the Age of Artificial Intelligence

➤ Joint Economic Committee: Barriers to Supply Chain Modernization and Factor Productivity Enhancements

➤ American Enterprise Institute: Emerging Technologies and Strategic Competition — A Conversation with Senator Todd Young

Register to join us in-person at the Kagan Media & Telecom Summit 2025 in New York City on June 10. Kagan research experts and industry leaders will share their data, projections and insights about the media landscape's ongoing digital transformation. Seize this opportunity to learn from industry experts and network with fellow high-level decision-makers in media, sports and investment management.