On March 25, 2024, Governor Ron DeSantis signed Florida’s HB 3. The law requires that social media platforms prohibit users under 14 years old from creating accounts and requires these platforms to obtain parental consent for account registrants who are 14 or 15 years old. The law also imposes age verification requirements for online services that knowingly distribute a significant amount of “harmful” content.
In his press release, Governor DeSantis called HB 3 “landmark legislation.” Notably, Governor DeSantis vetoed an earlier iteration of the bill, HB 1, after raising concerns about the bill’s legality. HB 1 proposed banning users under 16 from creating or having accounts on social media platforms and required social media companies to verify the age of users. HB 3 removed the age verification requirements for social media platforms and modified the restrictions to allow 14- and 15-year-olds to have accounts with parental consent. However, Floridians younger than 14 years old are still banned from having accounts on social media platforms.
Many state legislatures are focusing their attention on minors’ use of social media platforms. Congress is also considering legislation that would add or amend existing laws regulating minors’ interactions with online platforms. Florida’s law, however, is the first time that an enacted state law has prohibited a segment of users from creating social media accounts, even with parental consent.
With the passage of Florida’s HB 3, a patchwork of state children’s privacy and safety laws is developing. Though many of these laws aim to address perceived harms to minors on social media services, their requirements and definitions vary.
Some state social media laws have faced constitutional challenges, with courts generally issuing preliminary injunctions against the states. Adding to the legal scrutiny, the United States Supreme Court heard NetChoice, LLC v. Paxton on February 26, 2024, which could affect states’ abilities to regulate sites that disseminate speech, including social media platforms.
However, at least some state legislatures, including Florida, are moving forward notwithstanding the likelihood of legal challenges. During the Florida House floor debates, Representative Michele K. Rayner said the following about HB 3: “… I don’t know if this is going to be the fix-all… Maybe this may not be the bill and we’ve got to come back next year and the year after, but at least we are acting. At least we are moving the needle.”
This alert summarizes HB 3’s key provisions, which take effect on January 1, 2025.
Who Does HB 3 Apply To?
HB 3 primarily applies to “social media platforms,” which are defined as online forums, websites, or applications that:
- allow users to upload content or view the content or activity of other users;
- have 10 percent or more of daily active users younger than 16 years old spending on average at least two hours per day on the days when using the platform during the previous 12 months (or previous month, if the platform did not exist during the previous 12 months);
- employ algorithms that analyze user data or information about users in order to select content for users; and
- have one or more of the following “addictive features”:
- infinite scrolling;
- push notifications or alerts;
- personal interactive metrics indicating the number of user clicks to indicate a reaction (e.g., likes) or the number of times content was shared;
- autoplay videos; or
- livestreaming.
The law does not apply to services where the “exclusive function” is email or private direct messaging.
Notably, an account holder is defined as a Florida resident who “opens an account or creates a profile or is identified by the social media platform by a unique identifier.” This language appears intended to cover users who have not registered for a service and may be browsing or using the service without an account or in a “signed-out” state.
What Does the Law Require of Social Media Platforms?
Social media platforms that fall within the law’s scope must prohibit minors younger than 14 years old from using the social media platform. The platforms must also terminate existing accounts held by account holders younger than 14 years of age, including those treated as younger than 14 for purposes of advertising. For existing accounts, account holders must be given 90 days to dispute their age before the account is terminated.
For minors who are 14 and 15 years old, the users can create new accounts once a parent provides consent. For existing accounts, if parental consent has not been obtained, the platform must plan to terminate the account after providing the account holder 90 days to dispute the platform’s determination. If this particular provision is enjoined as part of a lawsuit, this requirement will be severed from the law and 14- and 15-year-old users will be banned from becoming account holders instead.
For accounts associated with users under 16, the account holder or a confirmed parent or guardian must be able to request termination of the account (to be effective within five business days in the case of a minor’s request and within 10 business days for a parent or guardian request).
Who Can Enforce the Social Media Law?
Knowing or reckless violations of the law are considered an unfair or deceptive trade practice enforceable by the Florida Department of Legal Affairs. In addition to remedies usually available against such practices, companies can be held liable for up to $50,000 per violation, along with reasonable attorney fees and court costs. Punitive damages may also be assessed if there “is a consistent pattern of knowing or reckless conduct.”
The bill also provides a private right of action for the minor account holder for knowing or reckless violations. In those instances, the platform can be held liable for up to $10,000 in damages. While early iterations of state social media laws have focused on state enforcement, legislatures are increasingly proposing language that provides for a private right of action.
What Other Provisions Are There?
In addition to the social media provisions, HB 3 requires that certain businesses that publish “material harmful to minors” online conduct age verification to ensure that users attempting to access the material are 18 years of age or older.
This requirement only applies to companies that knowingly and intentionally publish or distribute such material on a website or application, and whose online service contains more than 33.3 percent of this material. The requirements do not apply to bona fide news or public interest sites or services. Internet, search engine, and cloud service providers are also not liable, so long as they are not responsible for the creation of the content itself.
Businesses have the option of conducting either anonymous age verification or standard age verification. The law outlines some requirements for this verification process, including not allowing a foreign-owned company to conduct the verification, not retaining personal information for longer than is necessary to complete the task, and not using personal information for other purposes. Third parties that provide age verification services for covered websites may be held liable if they violate the age verification process requirements.
Key Takeaways
The passage of HB 3 signals that legislatures are determined to enact additional protections for minors using online services, especially social media platforms. After Governor DeSantis’s veto of HB 1, the Florida legislature only had one week left in session to revise and approve an alternative proposal. That proposal, HB 3, passed by wide margins, demonstrating enthusiasm for this type of law. The focus on children and teen online privacy and safety has garnered attention at the state, federal, and international levels,1 and we anticipate that it will continue to be an area of interest in the future.
Wilson Sonsini Goodrich & Rosati routinely helps companies navigate complex privacy and data security issues, especially in the area of children’s and minors’ data, and will continue to monitor guidance and other state-level developments to assist clients with compliance. The firm also regularly helps affected companies deal with the challenges posed by state social media laws more generally. For more information or advice concerning your compliance efforts, please contact Christopher Olsen, Stephen Schultze, Rebecca Weitzel Garcia, or any member of the firm’s privacy and cybersecurity or internet strategy and litigation practices.
[1]The Wilson Sonsini Data Advisor regularly issues alerts on privacy and cybersecurity news, especially those pertaining to child and teen data. We have previously released alerts regarding the New York settlement with the College Board, the Federal Trade Commission’s ongoing COPPA rulemaking, the multi-state suit against Meta for alleged children and teen harms, and the UK Privacy Regulator’s continued focus on children’s privacy, among others.
