Miami. The US state of Florida is placing increasing pressure on technology companies. In future they will be required to ensure that users can clearly prove their age before accessing social networks or certain websites. The legal basis is Florida House Bill 3 (HB 3), known as the ‘Online Protection for Minors’ law. It came into force on 1 January 2025 and prohibits children under the age of 13 from creating social media accounts. Teenagers aged 14 and 15 may only do so with parental consent.
The law is among the strictest social media regulations for minors in the United States. According to the state government, the aim is to protect children from the negative effects of social media.
Privacy concerns
Critics had already warned about the potentially far-reaching consequences for privacy, freedom of expression and digital anonymity. The core of the law lies in the clearly defined age limits. Platforms are required to enforce the rules actively and block or delete accounts that violate them. In addition, the law requires age verification for other online services, including websites containing pornographic material.
Florida’s government justifies the measure with a familiar argument. Social media platforms, it says, deliberately employ mechanisms such as algorithmic feeds, push notifications and endless scrolling to keep minors on their platforms for as long as possible. According to politicians, such mechanisms are intentionally addictive and harmful to children. The state must therefore intervene and exercise greater control over their use.
Yet the practical implementation raises a number of questions. If there are harmful mechanisms such as endless scrolling that carry a risk of addiction, it is not clear why the law does not address them directly. Such features can also be harmful for users over the age of 15. There is a considerable body of scientific research that would justify intervention in that area. Instead, the regulation obliges platforms to verify the age of their users.
There is, however, no reliable evidence showing at what age teenagers can use social media without it harming them. The law also fails to define which technical procedures should count as sufficient for verifying a user’s age. Nor does it set out how users’ personal data should be protected in the process, for example by routing verification through an independent trust centre. In practice, companies could therefore require identity documents, biometric data or other sensitive information. Critics see precisely that point as a troubling development.
A database of surveillance
To exclude a few million minors, critics argue, potentially hundreds of millions of adults would have to disclose their identity simply to gain access to ordinary online services. The technology associations NetChoice and the Computer & Communications Industry Association (CCIA) therefore filed a lawsuit against Florida. They argue that the law violates the First Amendment to the US Constitution, which protects freedom of speech. In their view, the regulation forces users to reveal personal information before they can access legal content.
A federal judge initially followed that reasoning and granted the plaintiffs partial relief. Parts of the law were temporarily blocked. The judge stated that the measure was likely unconstitutional because it restricts access to protected speech. An appeals court later lifted the injunction, also on a temporary basis, allowing Florida to enforce at least parts of the law while the legal dispute continues.
However, the debate goes far beyond legal questions. Privacy advocates warn that mandatory age verification could create an infrastructure that in the long run enables comprehensive identity control on the internet. Once platforms begin storing users’ identity documents or biometric data, a new repository of sensitive information emerges. The risks are obvious. Data leaks, government access or new forms of use could allow such data to be misused for a wide range of purposes.
The wrong approach
Florida is part of a broader global trend. Many governments are trying to regulate more strictly – and in some cases even prohibit – minors’ access to social media. Similar laws have been debated or adopted in several US states. Many of the legislative initiatives have likewise been accompanied by lawsuits alleging violations of freedom of expression and privacy.
The central political question remains unresolved. On the one hand, protecting children online is an undeniable necessity given the kinds of content they may encounter there. On the other hand, suspicion is growing in many quarters that lawmakers are not primarily motivated by child protection. The question remains how children can be effectively protected online without endangering fundamental principles such as privacy and free communication for all users. Florida, like several other states and countries, relies heavily on identity verification. That is the wrong tool.
Critics fear that mandatory age checks could create a new digital infrastructure for surveillance whose consequences have little to do with the stated aim of protecting children. Governments repeatedly restrict freedom on the internet, as in other areas of life, in the name of greater security. Personal responsibility – and above all the responsibility of parents for their children – is increasingly curtailed and transferred to the state.