Just when you thought the internet was safe from the meddling minds of the Supreme Court, the Justices have decided to take another crack at reviewing whether or not a new set of state regulations of the internet violates the First Amendment. And this time, it has a “but won’t you think of the children online” element to it as well.
Just a day after concluding decisions for the last term and (thankfully) not destroying the internet with its NetChoice decisions, the Supreme Court released a new order list regarding petitions for cert and announced that it would be taking Free Speech Coalition’s challenge to Texas’ internet age verification law, giving it yet another chance to potentially screw up the internet (or, hopefully, to reinforce free speech rights).
If you haven’t been following this case, it’s an important one for the future of privacy and speech online, so let’s bring everyone up to speed.
Two decades ago, there was an early moral panic about kids on the internet, and Congress went nuts passing a variety of laws aiming to “protect the children online.” Two of the bigger attempts — the Communications Decency Act and the Child Online Protection Act — were dumped as unconstitutional in Reno v. ACLU and Ashcroft v. ACLU.
Among other things, the Reno case established that the First Amendment still applies in online scenarios (meaning governments can’t pass laws that suppress free speech online) and the Ashcroft case established that age restricting access to content online was unconstitutional as it failed “strict scrutiny” (necessary to uphold a law that has an impact on speech). In large part, it failed strict scrutiny because it was not the “least restrictive means” of protecting children and would both likely block kids from accessing content they had a First Amendment right to access while also blocking adults from content they had a right to access.
However, we’re deep in the midst of a very similar moral panic about “the kids online” these days, despite little actual evidence to support the fearmongering. Nonetheless, a ton of states have been passing all kinds of “protect the kids online” laws. This is across both Republican and Democrat-controlled states, so it’s hardly a partisan type of moral panic.
Multiple courts have been (rightly) tossing these laws out as unconstitutional one after another, with many (rightly) pointing to the decision in Ashcroft and pointing out that the Supreme Court already decided this.
Many of the age verification laws (especially those in Republican-controlled states) have been focused specifically on adult content websites, saying those sites in particular are required to age gate. And while it makes sense that children should not have easy access to pornographic content, there are ways to limit such access without using problematic age verification technology, which puts privacy at risk and is not particularly effective. Indeed, just a couple weeks ago, an age verification vendor used by many internet companies was found to have leaked personal data on millions of people.
Allowing age verification laws online would do tremendous damage to the internet, to kids, and to everyone. It would create a regime where anonymity online would be effectively revoked, and people’s private data would be at risk any time they’re online. People keep pitching ideas around “privacy-protective age verification” which is one of those concepts, like “safe backdoors to encryption,” that politicians seem to think is doable, but in reality is impossible.
One of the many states that passed such a law was Texas, and like most other states (the only exceptions to date have been on procedural grounds in states where a suit can’t be filed until someone takes action against a site for failing to age-gate) the district court quickly tossed out the law as obviously unconstitutional under the Ashcroft ruling.
But, just months later, the Fifth Circuit (as it has been known to do the past few years) decided that it could ignore Supreme Court precedent, overturn the lower court, and put the law back into effect. I wrote a big long post explaining the nutty thinking behind all this, but in effect, the Fifth Circuit decided that it didn’t have to follow Ashcroft because that only dealt with “strict scrutiny,” and the Judges on the Fifth Circuit believed that a law like this need only face intermediate scrutiny, and on that basis the law was fine.
Again, this bucked every possible precedent. And just last week, as yet another trial court, this time in Indiana, threw out a similar law, the judge there walked through all the many reasons the Fifth Circuit got things wrong (the Indiana court was not bound by the Fifth Circuit, but the state of Indiana had pointed to the Fifth’s ruling in support of its law).
Back in April, we had explained why it was important for the Supreme Court to review the Fifth Circuit’s bizarre ruling, and that’s where things stand now, thanks to them granting cert.
Of course, it’s anyone’s guess as to how the Supreme Court will rule, though there are a few signs that suggest it may use this to smack down the Fifth Circuit and remind everyone that Ashcroft was decided correctly. First, especially this past term, the Supreme Court has been aggressively smacking down the Fifth Circuit and its series of crazy rogue rulings. So it’s already somewhat primed to look skeptically at rulings coming out of the nation’s most ridiculous appeals court.
Second, if the Fifth’s reasoning wasn’t nutty, then there would be little to no reason to take the case. Again, the Court already handled nearly this very issue twenty years ago, and the Fifth Circuit is the first to say it can just ignore that ruling.
That said, any time the Supreme Court takes up an internet issue, you never quite know how it’s going to end up, especially given Justice Kagan’s own comment on herself and her colleagues that “these are not, like, the nine greatest experts on the internet.”
On top of that, any time you get into “for the children” moral panics, people who might otherwise be sensible seem to lose their minds. Hopefully, the Supreme Court takes a more sober approach to this case, but I recognize that “sober analysis” and this particular Supreme Court are not always things that go together.
We keep pointing out that, contrary to the uninformed opinion of lawmakers across both major parties, laws that require age verification are clearly unconstitutional*.
Such laws have been tossed out everywhere as unconstitutional, except in Texas (and even then, the district court got it right, and only the 5th Circuit is confused). And yet, we hear about another state passing an age verification law basically every week. And this isn’t a partisan/culture war thing, either. Red states, blue states, purple states: doesn’t matter. All seem to be exploring unconstitutional age verification laws.
Indiana came up with one last year, which targeted adult content sites specifically. And, yes, there are perfectly good arguments that kids should not have access to pornographic content. However, the Constitution does not allow for any such restriction to be done in a sloppy manner that is both ineffective at stopping kids and likely to block protected speech. And yet, that’s what every age-gating law does. The key point is that there are other ways to restrict kids’ access to porn, rather than age-gating everything. But they often involve this thing called parenting.
The court starts out by highlighting that geolocating is an extraordinarily inexact science, which is a problem, given that the law requires adult content sites to determine when visitors are from Indiana and to age verify them.
But there is a problem: a computer’s IP address is not like a return address on an envelope because an IP address is not inherently tied to any location in the real world but consists of a unique string of numbers written by the Internet Service Provider for a large geographic area. (See id. ¶¶ 12–13). This means that when a user connects to a website, the website will only know the user is in a circle with a radius of 60 miles. (Id. ¶ 14). Thus, if a user near Springfield, Massachusetts, were to connect to a website, the user might be appearing to connect from neighboring New York, Connecticut, Rhode Island, New Hampshire, or Vermont. (Id.). And a user from Evansville, Indiana, may appear to be connecting from Illinois or Kentucky. The ability to determine where a user is connecting from is even weaker when using a phone with a large phone carrier such as Verizon with error margins up to 1,420 miles. (Id. ¶¶ 16, 19). Companies specializing in IP address geolocation explain the accuracy of determining someone’s state from their IP address is between 55% and 80%. (Id. ¶ 17). Internet Service Providers also continually change a user’s IP address over the course of the day, which can make a user appear from different states at random.
Also, users can hide their real IP address in various ways:
Even when the tracking of an IP address is accurate, however, internet users have myriad ways to disguise their IP address to appear as if they are located in another state. (Id. ¶ B (“Website users can appear to be anywhere in the world they would like to be.”)). For example, when a user connects to a proxy server, they can use the proxy server’s IP address instead of their own (somewhat like having a PO box in another state). (Id. ¶ 22). ProxyScrape, a free service, allows users to pretend to be in 129 different countries for no charge. (Id.). Virtual Private Network (“VPN”) technology allows something similar by hiding the user’s IP address to replace it with a fake one from somewhere else.
All these methods are free or cheap and easy to use. (Id. ¶¶ 21–28). Some even allow users to access the dark web with just a download. (Id. ¶ 21). One program, TOR, is specifically designed to be as easy to use as possible to ensure as many people can be as anonymous as possible. (Id.). It is so powerful that it can circumvent Chinese censors.
The reference to “Chinese censors” is a bit weird, but okay, point made: if people don’t want to appear as if they’re from Indiana, they can do so.
The court also realizes that just blocking adult content websites won’t block access to other sources of porn. The ruling probably violates a bunch of proposed laws against content that is “harmful to minors” by telling kids how to find porn:
Other workarounds include torrents, where someone can connect directly to another computer—rather than interacting with a website—to download pornography. (Id. ¶ 29). As before, this is free. (Id.). Minors could also just search terms like “hot sex” on search engines like Bing or Google without verifying their age. (Id. ¶ 32–33). While these engines automatically blur content to start, (Glogoza Decl. ¶¶ 5–6), users can simply click a button turning off “safe search” to reveal pornographic images, (Sonnier Decl. ¶ 32). Or a minor could make use of mixed content websites below the 1/3 mark like Reddit and Facebook
And thus, problem number one with age verification: it’s not going to be even remotely effective for achieving the policy goals being sought here.
With this background, it is easy to see why age verification requirements are ineffective at preventing minors from viewing obscene content. (See id. ¶¶ 14–34 (discussing all the ways minors could bypass age verification requirements)). The Attorney General submits no evidence suggesting that age verification is effective at preventing minors from accessing obscene content; one source submitted by the Attorney General suggests there must be an “investigation” into the effectiveness of preventive methods, “such as age verification tools.
And that matters. Again, even if you agree with the policy goals, you should recognize that putting in place an ineffective regulatory regime that is easily bypassed is not at all helpful, especially given that it might also restrict speech for non-minors.
Unlike the 5th Circuit, this district court in Indiana understands the precedents related to this issue and knows that Ashcroft v. ACLU already dealt with the main issue at play in this case:
In the case most like the one here, the Supreme Court affirmed the preliminary enjoinment of the Child Online Protection Act. See Ashcroft II, 542 U.S. at 660–61. That statute imposed penalties on websites that posted content that was “harmful to minors” for “commercial purposes” unless those websites “requir[ed the] use of a credit card” or “any other reasonable measures that are feasible under available technology” to restrict the prohibited materials to adults. 47 U.S.C. § 231(a)(1). The Supreme Court noted that such a scheme failed to clear the applicable strict scrutiny bar. Ashcroft II, 542 U.S. at 665–66 (applying strict scrutiny test). That was because the regulations were not particularly effective as it was easy for minors to get around the requirements, id. at 667– 68, and failed to consider less restrictive alternatives that would have been equally effective such as filtering and blocking software, id. at 668–69 (discussing filtering and blocking software). All of that is equally true here, which is sufficient to resolve this case against the Attorney General.
Indiana’s Attorney General points to the 5th Circuit ruling that tries to ignore Ashcroft, but the judge here is too smart for that. He knows he’s bound by the Supreme Court, not whatever version of Calvinball the 5th Circuit is playing:
Instead of applying strict scrutiny as directed by the Supreme Court, the Fifth Circuit applied rational basis scrutiny under Ginsberg v. New York, 390 U.S. 629 (1968), even though the Supreme Court explained how Ginsberg was inapplicable to these types of cases in Reno, 521 U.S. at 865–66. The Attorney General argues this court should follow that analysis and apply rational basis scrutiny under Ginsberg.
However, this court is bound by Ashcroft II. See Agostini v. Felton, 521 U.S. 203, 237–38 (1997) (explaining lower courts “should follow the case which directly controls”). To be sure, Ashcroft II involved using credit cards, and Indiana’s statute requires using a driver’s license or third-party identification software.10 But as discussed below, this is not sufficient to take the Act beyond the strictures of strict scrutiny, nor enough to materially advance Indiana’s compelling interest, nor adequate to tailor the Act to the least restrictive means.
And thus, strict scrutiny must apply, unlike in the 5th Circuit, and this law can’t pass that bar.
Among other things, the age verification in this law doesn’t just apply to material that is obscene to minors:
The age verification requirements do not just apply to obscene content and also burden a significant amount of protected speech for two reasons. First, Indiana’s statute slips from the constitutional definition of obscenity and covers more material than considered by the Miller test. This issue occurs with the third prong of Indiana’s “material harmful to minors” definition, where it describes the harmful material as “patently offensive” based on “what is suitable matter for . . . minors.” Ind. Code § 35- 49-2-2. It is well established that what may be acceptable for adults may still be deleterious (and subject to restriction) to minors. Ginsberg, 390 U.S. at 637 (holding that minors “have a more restricted right than that assured to adults to judge and determine for themselves what sex material they may read or see”); cf. ACLU v. Ashcroft, 322 F.3d 240, 268 (3d Cir. 2003) (explaining the offensiveness of materials to minors changes based on their age such that “sex education materials may have ‘serious value’ for . . . sixteen-year-olds” but be “without ‘serious value’ for children aged, say, ten to thirteen”), aff’d sub nom. in relevant part, 542 U.S. 656 (2004). Put differently, materials unsuitable for minors may not be obscene under the strictures of Miller, meaning the statute places burdens on speech that is constitutionally protected but not appropriate for children
Also, even if the government has a compelling interest in protecting kids from adult content, this law doesn’t actually do a good job of that:
To be sure, protecting minors from viewing obscene material is a compelling interest; the Act just fails to further that interest in the constitutionally required way because it is wildly underinclusive when judged against that interest. “[A] law cannot be regarded as protecting an interest ‘of the highest order’ . . . when it leaves appreciable damage to that supposedly vital interest unprohibited.” …
The court makes it clear how feeble this law is:
To Indiana’s legislature, the materials harmful to minors are not so rugged that the State believes they should be unavailable to adults, nor so mentally debilitating to a child’s mind that they should be completely inaccessible to children. The Act does not function as a blanket ban of these materials, nor ban minors from accessing these materials, nor impose identification requirements on everybody displaying obscene content. Instead, it only circumscribes the conduct of websites who have a critical mass of adult material, whether they are currently displaying that content to a minor or not. Indeed, minors can freely access obscene material simply by searching that material in a search engine and turning off the blur feature. (Id. ¶¶ 31–33). Indiana’s legislature is perfectly willing “to leave this dangerous, mind-altering material in the hands of children” so long as the children receive that content from Google, Bing, any newspaper, Facebook, Reddit, or the multitude of other websites not covered.
The court also points out how silly it is that the law only applies to sites with a high enough threshold (33%) of adult content. If the goal is to block kids’ access to porn, that’s a stupid way to go about it. Indeed, the court effectively notes that a website could get around the ban just by adding a bunch of non-adult imagery content.
The Attorney General has not even attempted to meet its burden to explain why this speaker discrimination is necessary to or supportive of to its compelling interest; why is it that a website that contains 32% pornographic material is not as deleterious to a minor as a website that contains 33% pornographic material? And why does publishing news allow a website to display as many adult-images as it desires without needing to verify the user is an adult? Indeed, the Attorney General has not submitted any evidence suggesting age verification would prohibit a single minor from viewing harmful materials, even though he bears the burden of demonstrating the effectiveness of the statute. Ultimately, the Act favors certain speakers over others by selectively imposing the age verification burdens. “This the State cannot do.” Sorrell v. IMS Health Inc., 564 U.S. 552, 580 (2011). The Act is likely unconstitutional.
In a footnote, the judge highlights an even dumber part of the law: that the 33% is based on the percentage of imagery, and gives a hypothetical of a site that would be required to age gate:
Consider a blog that discusses new legislation the author would like to see passed. It contains hundreds of posts discussing these proposals. The blog does not include images save one exception: attached to a proposal suggesting the legislature should provide better sexual health resources to adult-entertainment performers is a picture of an adult-entertainer striking a raunchy pose. Even though 99% of the blog is core political speech, adults would be unable to access the website unless they provide identification because the age verification provisions do not trigger based on the amount of total adult content on the website, but rather based on the percentage of images (no matter how much text content there is) that contain material harmful to minors.
The court suggests some alternatives to this law, from requiring age verification for accessing any adult content (though, it notes that’s also probably unconstitutional, even if it’s less restrictive) to having the state offer up free filtering and blocking tech for parents to make use of for their kids:
Indiana could make freely available and/or require the use of filtering and blocking technology on minors’ devices. This is a superior alternative. (Sonnier Decl. ¶ 47 (“Internet content filtering is a superior alternative to Internet age verification.”); see also Allen Decl. ¶¶ 38–39 (not disputing that content filtering is superior to age verification as “[t]he Plaintiff’s claim makes a number of correct positive assertions about content filtering technology” but noting “[t]here is no reason why both content filtering and age verification could not be deployed either consecutively or concurrently”)). That is true for the reasons discussed in the background section: filtering and blocking software is more accurate in identifying and blocking adult content, more difficult to circumvent, allows parents a place to participate in the rearing of their children, and imposes fewer costs on third-party websites.
And thus, due to the fact that the law is pretty obviously unconstitutional, the judge grants the injunction, blocking the law from going into effect. Indiana will almost certainly appeal and we’ll have to just keep going through this nonsense over and over again.
Thankfully, Indiana is in the 7th Circuit, not the 5th, so there’s at least somewhat less of a chance for pure nuttery on appeal.
As more and more governments try to pass more and more laws requiring age verification, some of us keep pointing out that age verification will cause a ton of harm. For all the talk of how it’s necessary to “protect the children,” the only way to verify ages is to collect a ton of private information on people, which then makes that information a target.
People like Jonathan Haidt in his new book like to pretend that there’s some magical way of doing privacy-protective age verification by outsourcing it to a third party, but that just passes the buck and makes that third party a target. Just a few weeks ago, we talked about this a bit in the context of Australia, where a third-party age ID verification vendor used by bars had a breach, leaking more than 1 million customer records.
Of course, some people would say, “but that’s a bar, that’s different than a website.”
Well, then, this new story should catch your attention. First reported by 404 Media, AU10TIX, an Israeli-based online identification company used by TikTok, ExTwitter, Uber, LinkedIn, PayPal, Fiverr and others has been leaking drivers’ licenses. For over a year.
The set of credentials provided access to a logging platform, which in turn contained links to data related to specific people who had uploaded their identity documents, Hussein showed. The accessible information includes the person’s name, date of birth, nationality, identification number, and the type of document uploaded such as a drivers’ license. A subsequent link then includes an image of the identity document itself; some of those are American drivers’ licenses.
The data also appears to include results from AU10TIX’s verification process, with a field for “liveness” reading “true”; the “probability” of that conclusion on a scale of 0 to 1, with a potential result being 0.9486029; and other fields called “DocumentAuthenticity” and “OverallQuality.” More results appear to relate to AU10TIX’s comparison of a photo of the person’s face to their uploaded document, with another section referencing a photo called “PhotoForFaceComparison.jpg.”
Another screenshot from the tool shows a line chart with one axis labeled “clientOrganizationName.” That axis includes “TikTok_Shop_Creator,” “Impersonation_XCorp,” and “uber-carshare-passport,” apparent references to the three tech giants.
Cool, cool. Nothing to be concerned about there at all.
Just last year, when Elon first hired this company to provide identification services for ExTwitter, we warned that these systems are not at all reliable and can be a threat to privacy. Turns out we were right.
As always, collecting unnecessary data makes you a target. And this data became a target and was exposed. The way we minimize that is not by forcing more companies to collect more such data. It’s to not need to collect such data in the first place.
This isn’t a case where someone just discovered this breach and no harm was done. Indeed, it appears that significant harm was done here:
The credentials appear to have been harvested by malware in December 2022, and first posted to a Telegram channel in March 2023, according to timestamps and messages from the Telegram channel that posted the credentials online. 404 Media downloaded these credentials and found the name matched that of someone who lists their role on LinkedIn as a Network Operations Center Manager at AU10TIX. The file contained a wealth of passwords and authentication tokens for various services used by the employee, including tools from Salesforce and Okta, as well as the logging service itself.
So this data has been out there for over a year. And shared. Widely. For over a year.
Can lawmakers please stop requiring more companies to harm everyone’s privacy this way? These breaches are only going to keep happening, and they’re only going to get worse the more and more ignorant policymakers keep forcing more companies to collect more such data, based on a myth that age verification will magically make the internet safe and wholesome. It won’t.
Apparently, the world needs even more terrible bills that let ignorant senators grandstand to the media about how they’re “protecting the kids online.” There’s nothing more serious to work on than that. The latest bill comes from Senators Brian Schatz and Ted Cruz (with assists from Senators Chris Murphy, Katie Britt, Peter Welch, Ted Budd, John Fetterman, Angus King, and Mark Warner). This one is called the “The Kids Off Social Media Act” (KOSMA) and it’s an unconstitutional mess built on a long list of debunked and faulty premises.
It’s especially disappointing to see this from Schatz. A few years back, I know his staffers would regularly reach out to smart people on tech policy issues in trying to understand the potential pitfalls of the regulations he was pushing. Either he’s no longer doing this, or he is deliberately ignoring their expert advice. I don’t know which one would be worse.
The crux of the bill is pretty straightforward: it would be an outright ban on social media accounts for anyone under the age of 13. As many people will recognize, we kinda already have a “soft” version of that because of COPPA, which puts much stricter rules on sites directed at those under 13. Because most sites don’t want to deal with those stricter rules, they officially limit account creation to those over the age of 13.
In practice, this has been a giant mess. Years and years ago, Danah Boyd pointed this out, talking about how the “age 13” bit is a disaster for kids, parents, and educators. Her research showed that all this generally did was to have parents teach kids that “it’s okay to lie,” as parents wanted kids to use social media tools to communicate with grandparents. Making that “soft” ban a hard ban is going to create a much bigger mess and prevent all sorts of useful and important communications (which, yeah, is a 1st Amendment issue).
Schatz’s reasons put forth for the bill are just… wrong.
No age demographic is more affected by the ongoing mental health crisis in the United States than kids, especially young girls. The Centers for Disease Control and Prevention’s Youth Risk Behavior Survey found that 57 percent of high school girls and 29 percent of high school boys felt persistently sad or hopeless in 2021, with 22 percent of all high school students—and nearly a third of high school girls—reporting they had seriously considered attempting suicide in the preceding year.
Gosh. What was happening in 2021 with kids that might have made them feel hopeless? Did Schatz and crew simply forget about the fact that most kids were under lockdown and physically isolated from friends for much of 2021? And that there were plenty of other stresses, including millions of people, including family members, dying? Noooooo. Must be social media!
Studies have shown a strong relationship between social media use and poor mental health, especially among children.
Note the careful word choice here: “strong relationship.” They won’t say a causal relationship because studies have not shown that. Indeed, as the leading researcher in the space has noted, there continues to be no real evidence of any causal relationship. The relationship appears to work the other way: kids who are dealing with poor mental health and who are desperate for help turn to the internet and social media because they’re not getting help elsewhere.
Maybe offer a bill that helps kids get access to more resources that help them with their mental health, rather than taking away the one place they feel comfortable going? Maybe?
From 2019 to 2021, overall screen use among teens and tweens (ages 8 to 12) increased by 17 percent, with tweens using screens for five hours and 33 minutes per day and teens using screens for eight hours and 39 minutes.
I mean, come on Schatz. Are you trolling everyone? Again, look at those dates. WHY DO YOU THINK that screen time might have increased 17% for kids from 2019 to 2021? COULD IT POSSIBLY BE that most kids had to do school via computers and devices at home, because there was a deadly pandemic making the rounds?
Maybe?
Did Schatz forget that? I recognize that lots of folks would like to forget the pandemic lockdowns, but this seems like a weird way to manifest that.
I mean, what a weird choice of dates to choose. I’m honestly kind of shocked that the increase was only 17%.
Also, note that the data presented here isn’t about an increase in social media use. It could very well be that the 17% increase was Zoom classes.
Based on the clear and growing evidence, the U.S. Surgeon General issued an advisory last year, calling for new policies to set and enforce age minimums and highlighting the importance of limiting the use of features, like algorithms, that attempt to maximize time, attention, and engagement.
Wait. You mean the same Surgeon General’s report that denied any causal link between social media and mental health (which you falsely claim has been proved) and noted just how useful and important social media is to many young people?
From that report, which Schatz misrepresents:
Social media can provide benefits for some youth by providing positive community and connection with others who share identities, abilities, and interests. It can provide access to important information and create a space for self-expression. The ability to form and maintain friendships online and develop social connections are among the positive effects of social media use for youth. , These relationships can afford opportunities to have positive interactions with more diverse peer groups than are available to them offline and can provide important social support to youth. The buffering effects against stress that online social support from peers may provide can be especially important for youth who are often marginalized, including racial, ethnic, and sexual and gender minorities. , For example, studies have shown that social media may support the mental health and well-being of lesbian, gay, bisexual, asexual, transgender, queer, intersex and other youths by enabling peer connection, identity development and management, and social support. Seven out of ten adolescent girls of color report encountering positive or identity-affirming content related to race across social media platforms. A majority of adolescents report that social media helps them feel more accepted (58%), like they have people who can support them through tough times (67%), like they have a place to show their creative side (71%), and more connected to what’s going on in their friends’ lives (80%). In addition, research suggests that social media-based and other digitally-based mental health interventions may also be helpful for some children and adolescents by promoting help-seeking behaviors and serving as a gateway to initiating mental health care.
Did Schatz’s staffers just, you know, skip over that part of the report or nah?
The bill also says that companies need to not allow algorithmic targeting of content to anyone under 17. This is also based on a widely believed myth that algorithmic content is somehow problematic. No studies have legitimately shown that of current algorithms. Indeed, a recent study showed that removing algorithmic targeting leads to people being exposed to more disinformation.
Is this bill designed to force more disinformation on kids? Why would that be a good idea?
Yes, some algorithms can be problematic! About a decade ago, algorithms that tried to optimize solely for “engagement” definitely created some bad outcomes. But it’s been a decade since most such algorithms have been designed that way. On most social media platforms, the algorithms are designed in other ways, taking into account a variety of different factors, because they know that optimizing just on engagement leads to bad outcomes.
Then the bill tacks on Cruz’s bill to require schools to block social media. There’s an amusing bit when reading the text of that part of the law. It says that you have to block social media on “federally funded networks and devices” but also notes that it does not prohibit “a teacher from using a social media platform in the classroom for educational purposes.”
But… how are they going to access those if the school is required by law to block access to such sites? Most schools are going to do a blanket ban, and teachers are going to be left to do what? Show kids useful YouTube science videos on their phones? Or maybe some schools will implement a special teacher code that lets them bypass the block. And by the end of the first week of school half the kids in the school will likely know that password.
What are we even doing here?
Schatz has a separate page hyping up the bill, and it’s even dumber than the first one above. It repeats some of the points above, though this time linking to Jonathan Haidt, whose work has been trashed left, right, and center by actual experts in this field. And then it gets even dumber:
Big Tech knows it’s complicit – but refuses to do anything about it…. Moreover, the platforms know about their central role in turbocharging the youth mental health crisis. According to Meta’s own internal study, “thirty-two percent of teen girls said that when they felt bad about their bodies, Instagram made them feel worse.” It concluded, “teens blame Instagram for increases in the rate of anxiety and depression.”
This is not just misleading, it’s practically fraudulent misrepresentation. The study Schatz is citing is one that was revealed by Frances Haugen. As we’ve discussed, it was done because Meta was trying to understand how to do better. Indeed, the whole point of that study was to see how teens felt about using social media in 12 different categories. Meta found that most boys felt neutral or better about themselves in all 12 categories. For girls, it was 11 out of 12. It was only in one category, body image, where the split was more pronounced. 32% of girls said that it made them feel worse. Basically the same percentage said it had no impact, or that it made them feel better.
Also, look at that slide’s title. The whole point of this study was to figure out if they were making kids feel worse in order to look into how to stop doing that. And now, because grandstanders like Schatz are falsely claiming that this proves they were “complicit” and “refuse to do anything about it,” no social media company will ever do this kind of research again.
Because, rather than proactively looking to see if they’re creating any problems that they need to try to fix, Schatz and crew are saying “simply researching this is proof that you’re complicit and refuse to act.”
Statements like this basically ensure that social media companies stick their heads in the sand, rather than try to figure out where harm might be caused and take steps to stop that harm.
Why would Schatz want to do that?
That page then also falsely claims that the bill does not require age verification. This is a silly two-step that lying politicians claim every time they do this. Does it directly mandate age verification? No. But, by making the penalties super serious and costly for failing to stop kids from accessing social media that will obviously drive companies to introduce stronger age verification measures that are inherently dangerous and an attack on privacy.
Perhaps Schatz doesn’t understand this, but it’s been widely discussed by many of the experts his staff used to talk to. So, really, he has no excuse.
The FAQ also claims that the bill will pass constitutional muster, while at the same time admitting that they know there will be lawsuits challenging it:
Yes. As, for example, First Amendment expert Neil Richards explains, “[i]nstead of censoring the protected expression present on these platforms, the act takes aim at the procedures and permissions that determine the time, place and manner of speech for underage consumers.” The Supreme Court has long held that the government has the right to regulate products to protect children, including by, for instance, restricting the sale of obscene content to minors. As Richards explains: “[i]n the same way a crowded bar or nightclub is no place for a child on their own”—or in the way every state in the country requires parental consent if it allows a minor to get a tattoo—“this rule would set a reasonable minimum age and maturity limitation for social media customers.”
While we expect legal challenges to any bill aimed at regulating social media companies, we are confident that this content-neutral bill will pass constitutional muster given the government interests at play.
There are many reasons why this is garbage under the law, but rather than breaking them all down (we’ll wait for judges to explain it in detail), I’ll just point out the major tell is in the law itself. In the definition of what a “social media platform” is in the law, there is a long list of exceptions of what the law does not cover. It includes a few “moral panics of yesteryear” that gullible politicians tried to ban and were found to have violated the First Amendment in the process.
It explicitly carves out video games and content that is professionally produced, rather than user-generated:
Remember the moral panics about video games and TV destroying kids’ minds? Yeah. So this child protection bill is hasty to say “but we’re not banning that kind of content!” Because whoever drafted the bill recognized that the Supreme Court has already made it clear that politicians can’t do that for video games or TV.
So, instead, they have to pretend that social media content is somehow on a whole different level.
But it’s not. It’s still the government restricting access to content. They’re going to pretend that there’s something unique and different about social media, and that they’re not banning the “content” but rather the “place” and “manner” of accessing that content. Except that’s laughable on its face.
You can see that in the quote above where Schatz does the fun dance where he first says “it’s okay to ban obscene content to minors” and then pretends that’s the same as restrictions on access to a bar (it’s not). One is about the content, and one is about a physical place. Social media is all about the content, and it’s not obscene content (which is already an exception to the First Amendment).
And, the “parental consent” for tattoos… I mean, what the fuck? Literally 4 questions above in the FAQ where that appears Schatz insists that his bill has nothing about parental consent. And then he tries to defend it by claiming it’s no different than parental consent laws?
The FAQ also claims this:
This bill does not prevent LGBTQ+ youth from accessing relevant resources online and we have worked closely with LGBTQ+ groups while crafting this legislation to ensure that this bill will not negatively impact that community.
I mean, it’s good you talked to some experts, but I note that most of the LGBTQ+ groups I’m aware of are not listed on your list of “groups supporting the bill” on the very same page. That absence stands out.
And, again, the Surgeon General’s report that you misleadingly cited elsewhere highlights how helpful social media can be to many LGBTQ+ youth. You can’t just say “nah, it won’t harm them” without explaining why all those benefits that have been shown in multiple studies, including the Surgeon General’s report, somehow don’t get impacted.
There’s a lot more, but this is just a terrible bill that would create a mess. And, I’m already hearing from folks in DC that Schatz is trying to get this bill added to the latest Christmas tree of a bill to reauthorize the FAA.
It would be nice if we had politicians looking to deal with the actual challenges facing kids these days, including the lack of mental health support for those who really need it. Instead, we get unconstitutional grandstanding nonsense bills like this.
Everyone associated with this bill should feel ashamed.
The Supreme Court has made it pretty clear that age verification laws for websites violate the First Amendment. It’s had a couple of shots at this and really seemed to indicate that such laws are unconstitutional because age verification would block First Amendment-protected content from people who should be allowed to see it.
So, it was little surprise when a Texas district court ruled that Texas’ law saying adult content websites need to include a form of age verification was unconstitutional. The ruling was detailed and careful.
Which means it was no surprise when the Fifth Circuit did the Fifth Circuit thing and overturned the lower court decision. I already went into the weeds on how silly the opinion was, but it does this weird tapdance where it pretends it can effectively ignore those cases that discussed age verification, because those cases all involved “strict scrutiny” and the judges on the panel felt that this could use a lower standard of “rational basis.”
This is wrong for all the reasons we talked about in that last post, and you probably don’t need another 16 paragraphs in this article about the differences between strict scrutiny and rational basis.
The Free Speech Coalition, who brought the original case, have filed a cert petition for the Supreme Court to hear the case. On the same day, they also filed an emergency petition on what is generally known as the “shadow docket,” asking for the court to stop the enforcement of the law, at least until the Supreme Court has reviewed their cert petition.
Shadow docket applications from each circuit go up to specific Justices, and Justice Alito gets to review the 5th Circuit. This seems unfortunate, given he’s the Justice most likely to go along with their nonsense.
On Tuesday, Alito rejected the request for a stay (without comment).
The Free Speech Coalition put out a statement, mostly about the fact that they’re still focused on getting the main show, the cert petition, picked up by the Supreme Court, and this may just be a temporary bump in the road.
While the Supreme Court has denied our application to stay the Fifth Circuit’s decision upholding age verification requirements in Texas, our petition for full merits review before the Supreme Court remains pending. We look forward to continuing this challenge, and others like it, in the federal courts. The ruling by the Fifth Circuit remains in direct opposition to decades of Supreme Court precedent, and we remain hopeful that the Supreme Court will grant our petition for certiorari and reaffirm its lengthy line of cases applying strict scrutiny to content-based restrictions on speech like those in the Texas statute we’ve challenged. We will continue to fight for the right to access the internet without intrusive government oversight.
While perhaps not the most surprising turn of events, it is still a frustrating interim bit of nonsense. Hopefully the petition is granted and the full case can be heard by other Justices who might better remember how the First Amendment works.
Jonathan Haidt’s new book, “The Anxious Generation,” has become a NY Times bestseller, and he’s making media appearances basically everywhere you look, telling people that social media has “rewired children’s minds” and that it is uniquely harmful.
We’ve talked about Haidt in the past, and especially his ability to consistently cherry-pick and misread the actual data on such things.
Haidt is telling a story a lot of people want to hear. The world has some very real problems happening these days, and it’s clear, simple, and ultimately wrong to be able to blame them on social media. It’s just that, in getting the diagnosis wrong, it lets people feel better about themselves, while brushing away actual real problems and doing the hard work of trying to dig up solutions.
The Daily Beast asked if I would review the book for them, and they’ve now published over 2000 words I wrote about the myriad problems of Haidt’s book. I’m not going to repeat it here, so please go read it over there, as I put a lot of time into that review.
But, as a quick summary: he’s wrong on the data, which undermines his entire argument. Almost every single expert in the field who does actual research on these issues says so. Candice Odgers ripped apart his misleading use of data in Nature. Andrew Przybylski, who has done multiple, detailed studies using massive amounts of data going back years, and keeps finding little to no evidence of the things Haidt claims, has talked about the problems in Haidt’s data. Ditto Jeff Hancock, at Stanford, who recently helped put together the National Academies of Sciences report on social media and adolescent health (which also did not find what Haidt found).
Indeed, one thing that came up in looking over the “strongest” research in the book was that (contrary to some of Haidt’s claims), data outside of the US on suicide rates seem to show they’re often (not always) going down, not up. Even worse, the data on depression in the US showing an increase in depression rates among kids is almost certainly due to changes in screening practices for depression and how suicide ideation is recorded.
As my review notes, though, the problems with the data are only the very beginning of the problems with the book. Because, in the first part of the book, Haidt misleadingly throws around all the data, but in the latter part, he focuses on his policy recommendations and basically comes up with a bunch of very silly ideas that have no data to back them up:
He suggests raising the age at which kids can use certain websites from 13 to 16. Why 16? Based on his gut. He literally says he “thinks” age 16 “was the right one for the minimum age,” but presents no research or data to explain why. He notes that at that age they’re mature enough to handle the internet, though he doesn’t explain why.
And why suggest limiting access to age 16, rather than teaching kids digital literacy and how to better use the internet to avoid harms? He doesn’t say. He just decides what he thinks is right.
Elsewhere, he argues that there’s really little downside to implementing his policy solutions, and the review tries to dig into just how wrong that is. Cutting off kids from methods of communication that many use to find their communities, or to communicate with far-flung friends and family, can be really harmful.
But, the thing that gets me the most is that anyone who has actually spent time on internet policy issues knows that every policy solution in the space involves very serious nuances and tradeoffs. Haidt jumps in to the deep end doing a YOLO belly flop with zero consideration of any of those tradeoffs.
He supports KOSA, despite the fact that pretty much everyone agrees it will do real harm to LGBTQ+ teens. He supports age verification, despite data protection experts noting that it’s a privacy nightmare and the Supreme Court saying it violates the First Amendment.
He tends to brush off any concerns in the manner of a person who is selling a book, but has never had to actually deal with the actual nuances, tradeoffs, and consequences of complicated policy decisions he doesn’t fully understand:
Some of Haidt’s suggestions are so disconnected from any actual research or data as to raise questions about exactly where he’s coming from. There’s an entire chapter talking about how the kids these days just need to be more spiritual and religious, which seems like an odd and out of place discussion in a book about social media (and, on a separate note there is at least some research suggesting that kids today are finding spirituality via social media).
When even his former co-author, Lukianoff, pointed out that Haidt’s proposals clearly violate the First Amendment, Haidt’s only response is to suggest that if First Amendment advocates get together, he’s sure they can figure out ways to do age verification that is Constitutional.
This is the classic “nerd harder” demands of a non-expert insisting that if actual experts try hard enough, surely they can make the impossible possible.
And my biggest concern in all this is that by playing up a new moral panic to sell books and the “Jonathan Haidt brand,” real harm is caused:
The actual harms to getting this wrong could be tremendous. By coddling the American parent, and letting them think they can cure what ails kids by simply limiting the internet access, real harm can be caused.
Kids who actually do rely on the internet to find community and social interactions could grow further isolated. Even worse, it stops parents and teachers from dealing with actual triggers and actual problems, allowing them to brush it off as “too much TikTok,” rather than whatever real cause might be at play. It also stops them from training kids how to use social media safely, which is an important skill these days.
Treating social media as inherently harmful for all kids (when the data, at best, suggests only a very small percentage struggle with it), also would remove a useful and helpful tool from many who can be taught to use it properly, to protect a small number of users who were not taught how to use it properly. Wouldn’t a better solution be to focus on helping everyone to use the tools properly and in an age appropriate manner?
As noted, there’s a lot more in there. Again, the full review clocks in at over 2000 words, but I’m hopeful that, even as Haidt’s book is getting widespread attention, people might, finally, begin to realize that he’s selling a bill of goods which appears to be a lot more harmful than the unproven harms he claims to be warning about.
I think we could witness one of the most important First Amendment legal showdowns ever.
The U.S. Supreme Court is being asked to rule on the constitutionality of mandatory age verification for porn websites. If the high court takes up the case, it would queue up a landmark debate pertaining to the First Amendment and privacy rights of millions of people.
Free Speech Coalition and the parent companies of the largest adult entertainment websites on the web filed suit in the U.S. District Court for the Western District of Texas with the intention to block House Bill (HB) 1181.
HB 1181 requires mandatory age verification for porn websites with users from Texas IP addresses. It also requires pseudoscientific health warnings to be posted on adult websites. Counsel representing the coalition and the porn companies argued that it violated the First Amendment rights of consumers and owners of the websites. This prompted the federal district court to initially enjoin the state of Texas from enforcing the law because its text appeared to be unconstitutional.
Soon after this, Paxton announced lawsuits against the parent companies of Pornhub, xHamster, and Stripchat for violations of HB 1181. The penalties total in millions of dollars in damages, per the law. After the lawsuits for HB 1181 violations were announced and filed in circuit courts in Travis County, counsel for the plaintiffs tried to hold enforcement while they petitioned the high court to take up the case for consideration. Justice Samuel Alito, the circuit justice for the Fifth Circuit, has yet to indicate that the case will be taken up by the Supreme Court. There is no reason why they shouldn’t take it up because of how important this case is moving forward, and how this issue is showing up in so many other states.
The case, Free Speech Coalition et al. v. Paxton, is so important that the national affiliate of the American Civil Liberties Union announced they are aiding the plaintiffs and their current counsel, a team from the big law firm Quinn Emanuel, in their case. They will support the petition for writ of certiorari, potential oral arguments, etc. to render House Bill 1181 and all age verification laws as unconstitutional pipedreams.
Plaintiffs accurately argue that this is settled law, referring to the high court’s landmark decision in Reno v. American Civil Liberties Union. This decision found that segregating the content of the internet by age violates the rights of not only adults but for minors. The vast majority of age verification laws as they are structured now do just that.
While the Supreme Court provided for a less restrictive means to filter out minors from viewing age-restricted materials and potentially facing some level of harm, the vehicles of enforcement and some of the options touted in these bills for controlling minors’ web usage are, to the plaintiffs and civil liberties organizations, a violation of the First Amendment. ACLU and Quinn Emanuel attorneys for the plaintiffs present these arguments in their petition for writ of certiorari, which was filed in April 2024. Now, we just need the Supreme Court to take this seriously and not let the Fifth Circuit, the circuit that upheld a ban on drag shows, dictate law for the nation.
Michael McGrady covers the legal and tech side of the online porn business, among other topics.
Florida Gov. Ron DeSantis, who failed miserably in his run for president, signed a very controversial bill into law that requires age verification for porn websites and bans social media for minors under the age of 14. The act, House Bill (HB) 3, is one of the most restrictive laws of its kind to be implemented in the United States. The bill enters force on January 1, 2025, but it will be ripe for a legal showdown brought by social media companies and adult industry firms.
Like age verification laws implemented elsewhere in the country, HB 3 is broad and offers very little clarification on how to enforce the provisions of these laws. The Florida bill, in my view, attempts to do too much by simply relying on the “protect the children” narrative. According to HB 3, minors who want to use social media must get permission from their parents through an age check. Also, the bill tries to lump the age verification debate surrounding porn into a single issue. The legislation’s sponsors and Gov. DeSantis falsely present House Bill 3 as a data privacy measure protecting minors and adults alike. But, as we’ve seen time and again, mandatory age verification requirements – no matter how advanced or secure age verification technology can be – are actually a violation of a user’s right to privacy and anonymity on the internet as a whole.
The American Civil Liberties Union (ACLU) of Florida issued a warning discussing these very shortcomings in the law in the weeks before DeSantis signed HB 3. The warning itself fell on countless deaf ears at the Florida State House, as ACLU of Florida’s legislative director Kara Gross accurately said, “The age-verification requirements in HB 3 place barriers between users, whether they’re adults or minors, and their constitutional right to speak online. Age verification requirements blatantly chill the speech and threaten the privacy of adults by requiring them to surrender their anonymity to engage in constitutionally protected speech.” Gross isn’t wrong.
No matter how you handle age verification, you’re still verifying your age through the use of some sort of personal information. This ranges from government identification to artificial intelligence-assisted age estimation and (now, more than ever) biometrics. While the vendors of age verification software tout high-end security, they do so by significantly downplaying or overtly dismissing the most basic lesson in security studies: no system is impenetrable. And the assumption that requiring the broad use of age-gating software can suddenly serve as a silver bullet to protect minors from viewing age-restricted content on the internet is not only faulty reasoning but very dangerous.
Beyond that, I need to remind you all that all of the current legal and policy instruments being used to require age verification are unconstitutional.
Michael McGrady covers the legal and tech side of the online porn business, among other topics.
What a day. Texas is now the most populated U.S. state to be geo-blocked by Aylo, the parent company of the popular adult tube site Pornhub.com. With a population of barely over 29.5 million people, residents of the Lone Star State must use a VPN to view porn on Aylo’s network of free and premium websites.
The geo-block comes after the U.S. Fifth Circuit Court of Appeals ruled that a Texas age verification law targeting pornography was constitutional. The federal case was brought by Aylo, the parent companies of other adult websites, and the Free Speech Coalition.
Despite the Fifth Circuit completely overlooking decades of Supreme Court precedent indicating that any sort of age verification measure infringes on First Amendment rights, the conservative judges, 2-1, powered through. As Mike Masnick noted in his column on the decision, Judge Patrick Higginbotham – in dissent from the two other judges of the panel – rightfully pointed out that First Amendment protections aren’t thrown out just because Texas tries to be the nanny state. Senior U.S. District Judge David Alan Ezra initially ruled the Texas age verification law, House Bill 1181, unconstitutional and issued a preliminary injunction to block the law. Texas won on appeal. Litigation is still ongoing. Ken Paxton, the attorney general of Texas, also filed a lawsuit against Pornhub in Travis County courts alleging violations of House Bill 1181, and seeks millions in damages.
A few states away, Indiana just adopted an age verification law. Senate Bill 17, which was proposed by state Sen. Mike Bohacek of Michiana Shores and is set to enter force on July 1, 2024. I wrote for Techdirt about Senate Bill 17 because an early version of the bill carried with it criminal penalties for violators of the age verification requirement. Luckily, the bill was amended to drop those penalties. Still, SB 17 is a very slippery slope for Hoosiers and the United States in general. The Indiana chapter of the American Civil Liberties Union called the bill an unconstitutional violation against adults.
The legal environment pertaining to age verification and free speech online is now more fraught than ever. Developments like these reveal an ongoing civil liberties clusterfuck instigated by the anti-pornography lobby in the name of “protecting” minors. In much of my previous work for Techdirt and for other publishers, I have highlighted how efforts to restrict or even ban legal pornography in the U.S. are steeped in the far-right Christian nationalism that has gripped the Republican Party. Don’t forget about Project 2025. This group openly wants to ban porn and imprison those whom they deem “pornographers.”
To hear some people talk about it, anyone having anything to do with adult content should be imprisoned. This is why, as a journalist and a commentator, I keep writing about anti-porn clusterfucks like Aylo bowing to Texas or any other state controlled by politicians declaring “victory” against porn.
The First Amendment still exists. Case law still exists. Hopefully, the likes of Texas and Indiana – really all of the states under the yoke of authoritarian anti-porn, pro-censorship laws – are finally reminded that this type of paternalistic meddling is un-American.
Michael McGrady covers the legal and tech side of the online porn business, among other topics.
