New Jersey’s Latest Tech Bill Threatens Online Privacy, Censors Users
New Jersey Bill A5750 marks a significant development in state-level efforts to control social media access for minors. While the bill draws from similar legislation in states like Arkansas, California, and Utah, it introduces arguably the most dangerous requirements for age verification and parental consent to date.
The bill mirrors Utah’s recently enacted parental consent law (SB 152), a Republican-backed law currently facing litigation by NetChoice, prohibiting social media services from ‘holding or opening’ accounts for users under 18 without parental consent. Like Utah, the bill raises substantial concerns regarding the First Amendment and access to information while imposing steep financial penalties on companies for noncompliance and a private right of action for future litigants.
However, where New Jersey’s approach notably diverges — and raises significant alarm — is in its mandate for social media companies to engage third-party vendors for processing sensitive and personally identifiable information for age and identity verification purposes. This requirement not only heightens the risk of data breaches but also creates potential opportunities for misuse of personal data by exploitative data vendors and governments alike.
New Jersey Bill A5750 Violates the First Amendment
As we’ve previously discussed, The Supreme Court’s decisions in landmark cases such as Reno v. ACLU and ACLU v. Ashcroft have established a clear constitutional stance against online age verification laws. This principle has only been further reinforced by recent federal court rulings in Arkansas and California, where attempts to implement new age verification laws have been temporarily blocked.
“Age-verification requirements are more restrictive than policies enabling or encouraging users (or their parents) to control their own access to information, whether through user-installed devices and filters or affirmative requests to third-party companies,” NetChoice, LLC v. Griffin, 5:23-CV-05105 (W.D. Ark. Aug. 31, 2023).
New Jersey’s bill requires social media companies to verify the ages of all new and existing users. Similar to the law in Utah, social media services must terminate accounts of existing users who fail to verify their age within 14 days, putting existing users at a crossroads: provide personal information or lose account access.
Adult users may be understandably reluctant to hand over their identification documents and biometrics to age verification vendors. Consequently, the bill expressly requires social media companies to block non-compliant users from accessing information they are legally entitled to enjoy. These First Amendment concerns similarly arise for users under the age of 18 as The Supreme Court previously held in Brown v. Entertainment Merchants Association that even minors are entitled to the First Amendment right to access legally protected expression.
Moreover, in challenging New Jersey’s social media regulation for minors, the state faces a tough First Amendment test: demonstrating a compelling governmental interest in the regulation. While Arkansas, California, and Utah have previously relied on the US Surgeon General’s report on social media’s negative impacts, conflicting evidence weakens this stance. Recent studies by Pew Research Center, the American Psychological Association, Oxford University, and The Journal of Pediatrics present a different view, indicating either beneficial effects or no proven harm of social media on teens, undermining state justification for such regulations.
And similarly, even among hill progressives, concerns regarding current approaches to kids online safety prevail:
“For me, legislation is successful if it gives law enforcement the tools to address the full panoply of harms that children are facing, including mental health harms [but also] that it does not in any way cut off the lifeline that social media is to kids in rural America, LGBT teens anywhere in the country who see social media as a place where they find community, they find resources, they find support,” FTC Commissioner, Alvaro Bedoya.
Hence, New Jersey’s proposed age verification law creates a familiarly formidable barrier for adult and minor users, significantly impeding access to protected speech online without compelling justification; a glaring constitutional hurdle that states have previously failed to clear.
New Jersey Bill A5750 Harms Marginalized Teens
New Jersey’s bill enumerates a variety of ways for social media companies to verify age, including via “age estimation” techniques. Similarly, the bill provides several ways for parents to verify their identities in order to grant consent. With that said, the bill levies significant penalties, including the threat of private lawsuits, against companies that erroneously provide accounts to minors due to faulty age estimation or consent verification. Hence, social media companies are incentivized to adopt methods for age and identity verification that they deem most reliable, in other words: government ID checks and facial recognition.
For users aged 13 and older, the proposed age and parental identity verification process could also lead to significant delays. For comparison, Amazon’s verification system for new seller accounts, which includes facial scans and government ID checks, can take up to two business days, sometimes longer during peak periods. Social media companies implementing similar identity verification measures for parental consent will undoubtedly experience the same. Such delays could prevent or suddenly restrict teens’ access to crucial information, resources, and online support communities, impacting their well-being and access to online resources significantly.
As Commissioner Bedoya noted, this result is particularly concerning for teens who depend on social media for support and community for coping with mental or physical health issues. Our recent Supreme Court filing in NetChoice & CCIA v. Moody and Paxton identified several subreddit communities (like r/stopdrinking, r/mentalhealth, r/EatingDisorders, r/AuntieNetwork) that offer essential support to struggling and marginalized users. These groups are critical for teens in states like New Jersey and Utah, who stand to lose access to these resources.
Furthermore, like Utah, New Jersey’s proposed legislation overlooks the diverse family structures present in the U.S. Many children are in foster care, have divorced parents with joint legal guardianship, or live in environments unsupportive of their sexual identity, reproductive rights, or lifestyle. Parental consent laws, notably championed by the Right, not only hinder their access to vital online communities and resources but also inappropriately place social media companies in the role of arbiters in consent and custody disputes, a role they are ill-equipped to handle.
New Jersey Bill A5750 Puts Users’ Privacy and Security at Risk
New Jersey’s bill goes further than Utah’s by mandating that social media companies delegate age and identity verification to third-party vendors. For age verification, the bill permits third-party vendors to collect mobile telephone subscriber information, social security numbers, government identification documents (including alternative forms of identification information) to be compared with a photograph or video of the user, or facial biometrics. For parents and guardians undergoing consent verification, the bill permits visual identification via live video, government identification information (including alternative forms of ID), or even through a third party supplying information about the parent or guardian as long as the third party does not “disclose the personal information of children.”
Outsourcing verification introduces significant security risks. Third-party vendors might not meet the high cybersecurity standards of social media companies, creating vulnerabilities that cybercriminals can exploit. Such supply chain attacks can lead to unauthorized access to sensitive data, including the age, identity, and consent-related information of both users and their guardians.
Beyond the risk of cyberattacks, the third-party vendors themselves can also exploit user information. Not all vendors maintain high ethical standards regarding user privacy and data security. Some may engage in practices like selling or misusing the data they gather. This risk becomes more pronounced if the vendors operate under lax regulatory oversight or if the agreements between the primary service and these vendors don’t enforce strict data handling protocols. As a result, users’ sensitive and personally identifying information, once collected by these vendors for verification, could be used for nefarious purposes like identity theft and exploitation.
Moreover, governments can also misuse personally identifiable information. For example, states like Texas that currently criminalize abortion and the provisioning of reproductive health information, can issue subpoenas to social media companies and their third-party data vendors to target women and others who violate these laws. Outside the U.S., foreign adversaries such as the Chinese and Russian governments routinely hack public and private U.S. entities to obtain sensitive information about U.S. citizens.
In temporarily blocking California’s Age Appropriate Design Code, the District Court similarly recognized these privacy and security concerns:
“Based on the materials before the Court, the CAADCA’s age estimation provision appears not only unlikely to materially alleviate the harm of insufficient data and privacy protections for children, but actually likely to exacerbate the problem by inducing covered businesses to require consumers, including children, to divulge additional personal information.” NetChoice, LLC v. Bonta, №22-cv-08861-BLF (N.D. Cal. Sep. 18, 2023).
Given NetChoice’s track record in successfully contesting age verification laws in California and Arkansas, one might expect legislators to be more circumspect in proposing similar measures. Yet, New Jersey appears poised to follow Utah’s footsteps, potentially provoking an analogous legal challenge; an unnecessary burden of poor legislative decision-making, with New Jersey’s taxpayers bearing the costs.
Chamber of Progress (progresschamber.org) is a center-left tech industry association promoting technology’s progressive future. We work to ensure that all Americans benefit from technological leaps, and that the tech industry operates responsibly and fairly.
Our work is supported by our corporate partners, but our partners do not sit on our board of directors and do not have a vote on or veto over our positions. We do not speak for individual partner companies and remain true to our stated principles even when our partners disagree.
