New York
CNN
—
Meta CEO Mark Zuckerberg told lawmakers in a congressional hearing last January that it didn’t make sense for his platforms to verify how old their users are in order to serve them age-appropriate experiences. Instead, that responsibility should lie with app stores, he said.
Just over a year later, one state has taken his advice.
Utah passed a first-of-its-kind bill last week requiring app stores to verify users’ ages and obtain parental consent before minors could download apps to their devices.
The bill, which is awaiting Utah Governor Spencer Cox’s signature, marks a win for Zuckerberg and other platform operators, who have faced mounting pressure to make a bigger effort to protect children and teens online. And it could lead to a major shift in how all users – not just young people – interact with app stores. At least eight other states have introduced similar bills.
But the bill is already facing pushback from Apple and Google, as well as other critics who say it raises privacy and First Amendment concerns.
“While only a fraction of apps on the App Store may require age verification, all users would have to hand over their sensitive personally identifying information to us — regardless of whether they actually want to use one of these limited set of apps,” Apple, which has long made privacy central to its brand, said in a report published last week. “That’s not in the interest of user safety or privacy.”
In a blog post published Wednesday, Google’s director of government affairs and public policy, Kareem Ghanem, criticized what he called “fast-moving legislative proposals being pushed by Meta and other companies in an effort to offload their own responsibilities to keep kids safe to app stores.”
“These proposals introduce new risks to the privacy of minors, without actually addressing the harms that are inspiring lawmakers to act,” Ghanem said.
Both Apple and Google have suggested alternative proposals that would involve a shared responsibility for age verification between app stores and app developers. They’re also pushing for privacy-protected age data to be shared only with the platforms that need it.
Google this week sent a veto request to Utah’s governor over the bill, along with bill text of its proposal, Google spokesperson Danielle Cohen told CNN.
For proponents of legislation like the Utah bill, the idea is relatively simple: make app stores a sort of central clearinghouse for age verification that all apps can rely on to ensure they’re not exposing young people to potentially harmful or inappropriate content.
“I don’t think that parents should have to upload an ID or prove that they’re the parent of a child in every single app that their children use,” Zuckerberg told the Senate Judiciary Committee during last year’s hearing. “I think the right place to do this, and a place where it would be actually very easy for it to work, is within the app stores themselves.”
This type of law would take the pressure off companies like Meta — which has faced years of fierce criticism for exposing young users to harms such as sexual harassment and eating disorder content — to verify users’ ages and potentially collect sensitive information in the process. Even as Meta has rolled out a growing slate of teen safety features, critics have said that young people could evade them by signing up for accounts with inaccurate birthdates. Some critics also say such tools put too great a burden on parents to monitor their kids’ app usage on an ongoing basis.
Utah’s App Store Accountability Act is aimed at curbing this issue. If signed into law, app store operators would be required to identify a users’ “age category” — either an under-13 “child,” a 13- to 16-year-old “young teenager,” a 16- to 18-year-old “older teenager” or an 18-and-over “adult” — and share it with app developers, while protecting the data used to verify it.
Under the law, a minor’s account would have to be linked to a parent’s account, and the app store would have to seek parental consent before the minor could download an app or make in-app purchases. The law would be enforced starting next year.
So, in theory, a parent could simply turn down their teen’s request to download Instagram or another social media app if the parental oversight tools feel insufficient or too complex.
The day the Utah bill passed, Meta, Snap and X released a joint statement applauding the legislation that said, “Parents want a one-stop shop to verify their child’s age and grant permission for them to download apps in a privacy-preserving way.”
Cox, Utah’s Republican governor, posted on X last week that his office would be reviewing the bill, which he said provides “a more streamlined and privacy-conscious solution for families.” Cox’s office did not respond to a request for comment from CNN about whether he plans to sign the bill into law.
However, critics of the bill say it could raise both legal and practical questions.
For example, what happens if families have a device that both children and adults use? Whose age should the app store verify?
What about young people with complex family situations for whom it may not be straightforward to get parental approval for each app download, even for benign apps like those used for educational purposes?
And how will app stores implement the age verification requirements in just one state? What if users travel or use virtual private networks to hide their locations?
But privacy is at the core of concerns regarding such proposals. Although the Utah law is designed so that users wouldn’t have to hand over information to verify their age across multiple platforms, they’d still need to provide personal data — likely a government ID or a scan of their face — to verify their age via the app stores. And it wouldn’t just apply to children, but to anyone who uses the app store, regardless of what apps they want to access.
“This level of data sharing isn’t necessary — a weather app doesn’t need to know if a user is a kid,” Google’s Ghanem wrote in his Wednesday post.
And it’s not just the app stores expressing that concern.
“At this moment when there is legitimate concern about the vast amounts of information that people freely hand over to social media companies, app stores, devices and other services, why are we as a legislative matter requiring them to collect more information, right?” said Aaron Mackey, free speech and transparency litigation director at the Electronic Frontier Foundation.
The Utah law does not specify the method app stores would need to use for age verification. But the use of AI and facial recognition could run the risk of misidentifying users ages.
“A lot of these age assurance technologies that sort of guess your age can be wrong in both false positive and false negatives,” Mackey said. “If you are a 40-year-old who happens to have a younger face, you could be misclassified as a minor.”
Kerry Maeve Sheehan, director of legal advocacy for the tech industry-backed advocacy group Chamber of Progress, wrote in a blog post last week that the Utah law could run afoul of the First Amendment by forcing adults to choose between handing over personal information or accessing “legally protected online speech.” Likewise, minors would be forced to get parental consent before accessing protected online speech.
Last year, a federal judge blocked a separate but similar Utah law that required social media companies to verify users’ ages on First Amendment grounds.
And while such laws are being lauded by platform operators like Zuckerberg, it wouldn’t take them entirely off the hook, according to Jane Horvath, partner at the law firm Gibson, Dunn & Crutcher and former Apple chief privacy officer.
For example, she said, it could force app developers to grapple with the fact that they may already have children under the age of 13 on their platforms that they weren’t aware of. That could mean they’re violating the Children’s Online Privacy Protection Act, which prohibits online platforms from collecting data on children under the age of 13 without parental consent — a problem platforms would need to swiftly address.
“Once app stores start sending a signal to apps, they will have actual knowledge that they have children on their platform, and they’ll either have to delete their accounts, block them” or find another way to comply with the law, Horvath said.
Despite the concerns, many parents and online safety experts say something needs to be done to protect young people online.
Lawmakers like Utah’s governor may simply be doing “the best they can with the tools they have as a policymaker,” said Kris Perry, executive director of the research organization Children and Screens: Institute of Digital Media and Child Development.
“It’s pretty much universally accepted that kids are not doing well with this much exposure,” Perry said.
