Late last month, Colorado Governor Jared Polis rightly vetoed the bipartisan and poorly named Protection for Users of Social Media Act over concerns that it suppressed free expression and endangered privacy. Despite the good intentions of the policymakers involved, this was the best outcome. The bill was fatally flawed due to reporting requirements that would have endangered the privacy of the minors the bill aimed to protect.
The main provision would have required platforms to report illegal content, such as the sale of guns, drugs, or abusive content, to law enforcement and it would have banned the user who created this content from the platform. It would have also aimed to ensure timely platform response to law enforcement search warrants.
If the bill stopped there, it might not be particularly controversial. Where it failed as a matter of good policy, however, is in its mandate to require each platform to create a report based on minors’ online activities. This report would have forced platforms to collect and document significant amounts of information on minor users: how many minors in Colorado used the platform and for how long, when they used it, what they interacted with, and the safety settings they used. In other words, social media platforms would have been forced to extensively monitor users, tracking and recording their every move on the platform.
The bill would have also mandated a commercially viable age assurance system be implemented, albeit more leniently than other bills requiring this. The data collection involved in many age verification methods has made past social media bills contentious. The Protection for Users of Social Media Act would have used age verification as a jumping-off point. Platforms would have had to not only know and keep a record of who was a minor on their platform but collect enough information to satisfy the state reporting requirements.
Collecting and maintaining vast amounts of data on the online habits of minors—including data on the measures they take to keep themselves safe—makes for a tempting target for online predators. Data breaches are unfortunately common. Forcing companies to collect more data would have put Colorado children at risk. Even if the information were deidentified and nothing could be traced to a particular individual, this would still have included when minors tend to be online, the content they most interact with, and the common safety tools they use. If a hack was ever successful, the nefarious actors would gain ample information on children.
Policy decisions about online safety and privacy require policymakers to balance delicate tradeoffs. Even so, exploring options to improve cooperation between law enforcement and social media is a topic worthy of consideration—but the Protection for Users of Social Media Act would have created new problems for people who care about privacy through its extensive documentation requirements. It was met with a deserving veto.
Trey Price is a policy analyst with the American Consumer Institute, a nonprofit education and research organization. For more information about the Institute, follow us on X @ConsumerPal.