Estimated read time: 3-4 minutes
SALT LAKE CITY — Utah released the first proposed rule to direct social media companies when it comes to verifying the ages of users on Monday, per a new state law signed earlier this year.
Under the Social Media Regulation Act, platforms must verify the ages of all users in Utah and obtain consent from parents before allowing anyone under the age of 18 to join. The rule, submitted by the Department of Commerce's Division of Consumer Protection, is the first official proposal the agency has put forward to enact the law.
"The health and well-being of our kids is at stake, and we take that seriously," Utah Gov. Spencer Cox, who has been a vocal proponent of social media regulations, said in a statement. "These rules ensure that social media companies prioritize the safety and privacy of Utah's youth while allowing them the flexibility to select methods that best meet their needs."
In a news release, the division said it has determined several existing technologies that will allow companies to verify the ages of users without relying solely on a government-issued ID.
The acceptable methods include the following, as written in the rule:
- Validating and verifying mobile telephone subscriber information.
- Using dynamic knowledge-based authentication consistent with the method approved by the Federal Trade Commission.
- Estimating a current account holder's age based on the date a Utah account holder created the account.
- Checking a current or prospective account holder's Social Security number's last four digits against a third-party database of personal information.
- Estimating a current or prospective account holder's age using facial characterization or analysis.
- Matching a current or prospective account holder's verified government-issued identification to a live webcam photo or video of the person, or to the person who is physically present.
Companies can also use other forms of digital credentials that are established using one of the final two options listed.
The rule requires that platforms "make reasonable efforts to confirm a parent's or guardian's consent for a minor to open or use a social media account," by using methods approved by the FTC for verifying parental consent or by written consent.
It also specifies that companies "may not collect more than the least amount of data reasonably necessary" from users in order to verify their age, and requires that companies permanently delete that data as quickly as possible, within 45 days.
If platforms identify an account created by a minor without parental consent, they are required to terminate the account.
The Division of Consumer Protection can assess fines of up to $2,500 per violation if a company doesn't comply.
The rule has yet to be finalized, and members of the public can comment on it through Feb. 5, 2024, by visiting socialmedia.utah.gov. A public hearing on the rule will be held in Room 220 of the Senate Building at the Capitol on Nov. 1 at 9 a.m.
The Social Media Regulation Act goes into effect March 1, 2024.
