Youth Online Privacy in 2024 and Beyond

As we look back at 2024 and what the new year might bring in the data privacy space, one particular aspect stands out as a focus: youth online privacy and safety.

The year ended with a bang on that front, with Australia grabbing headlines in December by prohibiting children under 16 from using social media entirely and making companies potentially liable for millions of dollars in fines if they fail to keep children off their platforms.  While legislatures in the U.S. have mostly taken a more restrained approach, new laws passed in 2024 aimed to protect minors in a variety of ways, including limiting companies’ ability to collect and process minors’ data, mandating parental consent, and requiring companies to assess and address risks to minors.

At the federal level, the Kids Online Safety and Privacy Act (KOSA) passed the Senate in July 2024 and includes a host of obligations for online platforms, such as limiting access to harmful content, avoiding addictive design features, providing parental monitoring tools, and making it easy to remove minors’ personal data with an “eraser button.”  KOSA has bipartisan support, though its future in the new presidential administration is uncertain.  Federal regulators have also continued to expand rule-based privacy protections for minors.  In one of the first major developments of the new year in this space, on January 16, 2025 the FTC finalized updates to the Children’s Online Privacy Protection Rule to expand the definition of services “directed to children,” require additional parental consent to disclose minors’ data to third parties, add protections for biometric identifiers, and specifically warn that companies may not retain children’s data indefinitely for purposes of training AI tools.

Meanwhile, states have made clear they are not simply waiting to follow the federal lead.  In 2024, states across the nation took legislative action on youth online privacy, including:

• Colorado amended its state Privacy Act in May 2024 to impose a duty on online platforms to avoid processing personal data of minors in a way that creates a heightened risk of harm. 
• Florida signed HB 3 into law in March of 2024, a sweeping law that bans children under 14 from having social media accounts and requires parental consent for children between 14 and 15.
• Georgia’s SB 351 was signed into law in April 2024, requiring social media platforms to verify the age of social media account holders and obtain parental consent for children under 16.
• Ohio’s HB 33, which was signed into law in 2023 but went into effect in January 2024, similarly requires online platforms to obtain parental consent for minor users.
• Maryland passed the Maryland Kids Code, which took effect in October 2024 and requires impact assessments, imposes new privacy protections, and prohibits certain data collection and sharing practices related to minors.
• Mississippi’s Walker Montgomery Protecting Children Online Act was enacted in April 2024, requiring online platforms to verify users’ ages.
• New York enacted in June 2024 the Stop Addictive Feeds Exploitation for Kids Act, which requires social media companies to restrict addictive feeds on their platforms for minors.
• Tennessee enacted two new laws going into effect in 2025, the Protect Tennessee Minors Act and the Protecting Children from Social Media Act; the former requires websites with harmful content to verify users are over 18, and the latter requires age verification and parental consent when a minor attempts to create a social media account.

Even as states race to pass such laws, courts have forced them to hit the brakes.  Youth online privacy and protection laws faced consistent legal challenges in 2024, and so far, courts have largely sided with the plaintiffs challenging those laws and issued preliminary injunctions to block them.

California’s Age-Appropriate Design Code Act, for instance, imposed a number of obligations on businesses that provide online services, products, or features likely to be accessed by children.  Set to take effect in July 2024, the law was preliminarily enjoined through a lawsuit by Netchoice (a trade association including major tech and social media companies).  In August 2024, the Ninth Circuit upheld a lower court’s preliminary injunction as to the law’s Data Protection Impact Assessment requirement, while remanding for the district court to consider other challenged provisions.

Netchoice followed up its victory on the California statute by filing a string of similar lawsuits challenging other state laws directed toward children’s privacy and safety online—and met with similar success.  A federal court preliminarily enjoined the Arkansas Social Media Safety Act, which requires social media companies to verify users’ ages and ensure that minors have parental consent to use the platform.  Ohio and Mississippi’s new 2024 youth-focused laws suffered preliminary injunction too, as did one of the two new Tennessee statutes.  Florida has agreed not to enforce HB 3 until February 2025 to give a court the chance to rule on the plaintiffs’ preliminary injunction motion.  Indeed, some states have already yielded to legal pressure rather than defend their laws in court.  After passing laws in 2023 that required age verification, parental consent, and time-based restrictions on minor social media use, Utah repealed those laws in the face of a lawsuit and replaced them in February 2024 with new laws that largely dropped those features.  While the Colorado Privacy Act additions, Georgia’s SB 351, and Maryland Kids Code have not been enjoined, given the similarity between their provisions requiring data protection impact assessments, parental consent, or age verification and similar provisions courts have enjoined in other states’ laws, they are likely vulnerable to legal challenges as well.

It is not yet clear how the landscape in this area will evolve, but two things appear almost certain as we look forward to 2025: legislators and regulators will continue taking action to protect minors from perceived harms to their privacy and mental wellbeing online, and such laws will continue to face challenges to their constitutionality.