BILL ANALYSIS Ó SB 568 Page 1 Date of Hearing: August 13, 2013 ASSEMBLY COMMITTEE ON JUDICIARY Bob Wieckowski, Chair SB 568 (Steinberg) - As Amended: August 5, 2013 As Proposed to be Amended SENATE VOTE : 37-0 SUBJECT : Privacy: Internet: Minors KEY ISSUES : 1)Should the operator of an Internet Website or online service be prohibited from marketing or advertising products or services to a minor under the AGe of 18, if the minor could not legally purchase those products or services? 2)Should AN operator be required, upon request of a minor, to remove or make anonymous content or information that the minor has posted on the operator's website or service? FISCAL EFFECT : As currently in print this bill is keyed non-fiscal. SYNOPSIS This author-sponsored bill responds to the pervasive use of the Internet, online services, and mobile applications by minors. It seeks to protect minors in two ways. First, the bill would prohibit the operators of Internet Web sites, online services, or applications that are directed at minors from marketing or advertising products that minors cannot legally purchase, such as alcohol and tobacco products. On line operators that target a more general adult audience would be prohibited from sending such advertisements if they had actual knowledge that the user is a minor. Second, this measure would permit a minor to remove information that has been publicly posted on the operator's site, service, or application, reflecting the author's belief that the immaturity of minors may cause them to sometimes unwisely post material without fully reflecting on potential consequences. State law generally does not prohibit the kind of information that Web sites, online services, and applications can collect and share; rather it only requires very general SB 568 Page 2 disclosure of those policies. A user's right to opt-out of data collection and sharing, to block advertising, or to remove content is generally dictated by the operator's unilateral "terms and conditions." This bill, by contrast, would require that operators refrain from sending certain kinds of advertisements to minors and allow minors to remove (or at least hide or make anonymous) content that the minor has posted. Federal law requires the operator of a service directed to children under the age of 13 to give notice of the kinds of information that is collected and how it is used, and it gives parents the opportunity to opt-out of future collection of their child's information. The Center for Democracy & Technology opposes this bill on First Amendment grounds and because, CDT asserts, it will have various unwanted and unintended consequences. SUMMARY : Prohibits, as of January 1, 2015, the operator of Internet website or online service, online application, or mobile application from marketing certain kinds of products or services to a minor, and permits a minor to remove posted personal information, as specified. Specifically, this bill : 1)Prohibits the operator of an Internet Web site, online service, online application, or mobile application that is directed to minors from marketing or advertising specified products or services on its Internet Web site, online service, online application, or mobile application. If marketing or advertising is provided by an advertising service, the operator shall notify the advertising service that the site, service, or application is directed to minors, and the advertising service shall be prohibited from marketing or advertising the specified products or services. 2)Prohibits the operator of an Internet Web site, online service, or application from marketing or advertising specified products or services to a minor if the operator has actual knowledge that a minor is using the operator's Web site, service, or application and the marketing or advertising is specifically directed to that minor based on information specific to that minor. Provides that an operator shall be deemed in compliance with this provision if the operator takes reasonable actions in good faith to avoid marketing or advertising the specified products or services. 3)Prohibits an operator of an Internet Web site, online service, or application directed to minors or who has actual knowledge SB 568 Page 3 that a minor is using the operator's site, service, or application from using, disclosing, compiling, or allowing a third party to use, disclose, or compile, the personal information of a minor with actual knowledge that such use, disclosure or compilation is for the purpose of marketing or advertising specified products or services. 4)Applies the above restrictions to the following products and services, which existing law prohibits a minor from purchasing: alcoholic beverages; firearms, handguns, or ammunition; handgun safety certificates; aerosol paints or etching creams that are capable of defacing property; tobacco products or controlled substances; BB devices; ultraviolet tanning devices; dietary supplements containing ephedrine; lottery tickets; salvia divinorum or Salvinorin A, or products containing the same; body branding; permanent tattoo; drug paraphernalia; electronic cigarettes; obscene matter; a less lethal weapon, as defined. 5)Specifies that the above restrictions shall not apply to incidental placement of products or services embedded in content if the content is not created primarily for the purpose of marketing and advertising of the restricted services and products. 6)Provides that nothing in this bill shall be construed to require an operator of an Internet Web site, online service, or application to collect or retain information about users. 7)Uses the following definitions for purposes of the provisions of this bill: a) "Minor" means a natural person less than 18 years of age who resides in the state. b) "Internet Web site, online service, online application, or mobile application directed to minors" means a site, service, or application that is created for the purpose of reaching an audience that is predominantly composed of minors, and is not intended for a more general audience comprised of adults. However, a site, service, or application shall not be deemed to be directed to minors solely because it refers or links to a site, service, or application directed to minors. SB 568 Page 4 c) "Marketing or advertising" means, in exchange for monetary compensation, to make a communication to one or more individuals, or to arrange for the dissemination to the public of a communication, about a product or service the primary purpose of which is to encourage recipients of the communication to purchase or use the product or service. d) "Operator" means any person or entity that owns an Internet Web site, online service, online application, or mobile application. It does not include any third party that operates, hosts, or manages, but does not own, an Internet Web site, online service, online application, or mobile application on the owner's behalf or processes information on the owner's behalf. 8)Requires an operator of a Web site, online service or application directed to minors, or an operator that has actual knowledge that a minor is using the site, service, or application, to permit a minor who is a registered user to remove content or information that the minor has posted, or to request that operator remove or anonymize the information. Specifies that the minor be notified of his or her right to request removal and that the notice contain clear instructions on how to do so. Provides that an operator would not be required to erase or eliminate information that was stored on or posted by a party other than the minor or if the operator is required by state or federal law to maintain the information. 9)Defines "posted" for purposes of the above provision to mean content or information that can be accessed by a user in addition to the minor who posted the content or information, whether or not the user is a registered user of the site, service, or application. EXISTING LAW : 1)Requires an operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California to post a privacy policy, as specified. (Business & Professions Code Sections 22575-22579.) 2)Requires a business that collects personal information about a SB 568 Page 5 California consumer and shares that information with a third party for marketing purposes to disclose, upon a consumer's written request, the categories of information that were disclosed to a third party for the third party's direct marketing purposes and the names and addresses of all third parties that received the information. Alternatively, a business may comply with this requirement by adopting a policy that allows a customer to prevent the disclosure of personal information to a third party for the third party's direct marketing purposes, and the business notifies the customer of his or her right to prevent disclosure under the policy and provides the user with a cost-free means of exercising that right. (Civil Code Section 1798.83.) 3)Requires, under federal law, an operator of an Internet Web site or online service directed to a child that is less than 13 years old, or an operator that has actual knowledge that it is collecting personal information from a child that is less than 13 years old, to provide notice of what information is being collected and how that information is being used, and to give the parents of the child the opportunity to refuse to permit the operator's further collection of information from the child. (15 USC Sections 6501-6506.) COMMENTS : Statistics cited by the author confirm what has become common knowledge: teen use of social networking and other online services, including the now pervasive "mobile apps," has expanded greatly in recent years. Moreover, the author believes that a minor's lack of maturity might make him or her more susceptible to aggressive marketing and more likely to post personal information online without always thinking about the consequences of doing so. Marketers are apparently aware that children and teens are avid consumers and susceptible to persuasion. For example, a Wall Street Journal investigation found that 4,123 "cookies" and other tracking devices were placed on a test computer that was used to visit the top 50 websites for children and teens, which was about 30% more than were placed on a test computer that visited sites that targeted a general audience. (See "On the Web, Children Face Intensive Tracking," Wall Street Journal, September 17, 2010.) The laudable goal of this bill, therefore, is to provide greater protection to minors when they visit Internet Web sites or use online or mobile services. An existing federal law known as the Children's Online Privacy Protection Act (COPPA) already SB 568 Page 6 provides some, albeit limited, protections to children under thirteen. For example, under COPPA the operator of a Web site or online service that targets children under thirteen must disclose the kinds of information that it collects and what it does with that information. COPPA also allows parents to opt-out of collection of the children's personal information. This bill differs from federal law in a number of ways. To begin with, this bill defines "minor" to include any user under the age of eighteen, whereas COPPA applies to users under the age of thirteen. Unlike COPPA, this bill would not affect the kinds of information that a Web site, online service, or application could collect, though it would effectively limit the use of such information for some marketing purposes; nor would this bill allow a parent to opt-out of collection on the child's behalf. Instead, this bill would add two new protections that both complement and go beyond federal protections: First, this measure will give minors the opportunity, subject to certain exceptions, to remove information that they have posted or stored on a Web site, online service, or application. There is no such opportunity under COPPA. It should be noted, however, that "removal" will not necessarily mean to literally "remove" by deletion or erasure. Rather, an operator can comply with a "removal" request by hiding the posting so that no other users can see or access it, or by otherwise making the posting anonymous. Second, the bill would prohibit the operator of the Web site, online service, or application from targeting minors with advertisements for goods and services that they cannot legally purchase. Of course, the operator of the Web site, service, or application cannot always know the age of the user; therefore, this bill would only apply to operators of Web sites, services, or applications that are "directed to minors," or to operators that have actual knowledge that a user is a minor, whether or not the site, service, or application specifically targets minors. In other words, the operator of a service that targets minors must comply with the provisions of this bill even though some of its users may be adults; conversely, the operator of a service directed to a general audience, but one which minors might still use, would not be required to comply with the law unless the operator had "actual knowledge" that the user was a minor. When is a Web Site "Directed to Minors ? One of the points SB 568 Page 7 raised by the bill's opponents, and other concerned parties, concerns the potential vagueness of the term "directed to minors." As most recently amended, the definitional section of the bill suggests that a site or service is "directed to minors" if it is "created for the purpose of reaching an audience that is predominantly composed of minors, and is not intended for a more general audience comprised of adults." [Emphasis added.] The definition adds that a site or service would not be deemed to be "directed at minors" merely because it contained links to sites or services that were directed to minors. Few would likely disagree that the Sesame Street Web site ( www.sesamestreet.org ) is directed to minors, and very young ones at that, since it consists of interactive, educational games for pre-school children. Under this bill, it seems to safe to say, that this would be a website that is "predominantly" designed for minors, even though adults may visit the site - whether to monitor what it offers to their children or if they secretly enjoy playing "Elmo the Musical Cowboy." But as one moves away from more obvious children's content and up the age scale, it may become more difficult to determine if a site or service is "predominantly" directed to minors or if it is directed to young adults more generally. For example, a search for "websites for teens" retrieves, among other things, a website called "12 Awesome Websites for Teens." Among the "awesome" websites is "Teens for Planet Earth," which describes itself as a "social networking site for teenagers who want to get involved in protecting our planet. They can connect with other green-minded teens, choose a project or create their own and really make a difference." ( www.teensforplanetearth.org ) This Web site too, given that it appears to be targeted to high school students, would likely be deemed predominantly directed to minors, even though 18 and 19 year-old teens might have an interest in protecting their planet as well. Other sites and services, however, such as ones that appeal to fans of youthful entertainers or pop musicians, are not as clearly "directed to minors," even though one might reasonably suspect that many if not most of their users are minors. If that were the case, then presumably under this bill such a site would not be considered a website directed to minors, and the website would only be required to restrict its advertising in accordance with this bill if it had actual knowledge that a user is a minor. SB 568 Page 8 Practical Impact of "Actual Knowledge" Component of Bill : With the exception of those websites that are indisputably "directed to minors," it is difficult to assess the practical impact of this bill, in part because it will be difficult for a Web site or online service to have "actual knowledge" of a user's age unless the minor has already submitted that information to the operator and the operator knows that the minor, and not someone else in the household, has logged onto the computer. For example, there is much disagreement about the practical effect of COPPA and the ability of Internet Web sites and online services to police even their own age policies. For example, Facebook requires that its users be at least thirteen years old - partly, perhaps, to avoid having to comply with COPPA - but it is well-documented that children quickly learn to circumvent this by entering a false birth date; indeed, one study suggests that about 10% of parents freely admit that they helped their children set up those deceptive and unauthorized accounts. On the other side, just as the user may be dishonest about his or her age, the operator may have an interest in not acquiring actual knowledge of the user's age. Indeed, the bill expressly states that the operator has no obligation to inquire into the age of the user, and it specifies that an operator will be deemed to be in compliance so long as it "takes reasonable actions in good faith" to avoid marketing prohibited goods, even when the operator has actual knowledge that the user is a minor. However, it is most likely impossible to craft legislation that can entirely eliminate the possibility of circumvention, whether on the part of the user or the operator, and this bill appears to be a good start at this objective. ARGUMENTS IN SUPPORT : Common Sense Media (CSM) supports this bill because it would "significantly improve the digital and online space for minors in California by outlawing the collection of personal information for the purpose of marketing age-restricted and illegal products. Additionally, it would add a critical 'eraser button' for kids and teens to more easily remove content or information that they have submitted to websites." CSM argues that while teen access to digital content has definite advantages, it also creates "inherent privacy risks" when personal information is indiscriminately posted or stored. CSM notes that this danger is especially an issue for minors, not only because of their lack of maturity, but also because research suggests that advertisers track minors to a much greater extent than they track adults. CSM concludes that this bill will be "a crucial step forward in ensuring that the SB 568 Page 9 online privacy rights of California minors are respected, and that our young people are protected from inappropriate advertising online and on mobile phones." The California Partnership to End Domestic Violence (CPEDV) also supports this bill as a necessary tool for protecting minors from advertising for inappropriate products, but it also suggests that the ability to erase potentially harmful or embarrassing content may help to reduce incidents of the teen dating violence and harassment that "often intersects with the digital world . . . Technology is often used as a tool of abuse, particularly for teens. This can include malicious posts on social media or posting private or embarrassing photos or information. SB 568 provides another tool teens can use to protect their privacy." ARGUMENTS IN OPPOSITION : The Center for Democracy and Technology (CDT) opposes this bill because of "its potential burden on minors' own First Amendment rights." CDT believes that the bill's application to websites and services that are "directed to minors" is unconstitutionally vague, and as such it will ultimately lead operators to restrict many marketing and advertising materials to both minors and young adults, even young adults who are not minors. CDT believes that "when faced with the obligations to treat minors differently . . . many operators [who are] unsure of their status under this bill will opt to bar minors from their sites and services altogether." CDT believes that, whether intended to or not, this bill will "restrict minors' access to constitutionally protected material, limit their opportunities for speech, and discourage development of content designed for younger audiences." CDT contends - and cites case law in support of this contention - that minors have as much right to receive constitutionally protected material as do adults, "and only in relatively narrow and well-defined circumstances may government bar public dissemination of protected materials to them." (Quoting Erznoznik v. Jacksonville (1975) 422 U.S. 205, 212-213.) In addition to these constitutional concerns, CDT also opposes this bill because of practical problems of implementation and unintended consequences. For example, CDT contends that this bill will only encourage minors to lie about their age when logging into or signing up for online services, which in turn will circumvent "efforts by operators to tailor content controls for different age groups." CDT also points out that federal SB 568 Page 10 COPPA law applies to children under the age of 13, not all minors under 18. CDT believes that this difference is critical, claiming that COPPA "works, to the extent that it does, because it is relatively easy to identify content intended for young children," as opposed to content designed for a general audience that includes young adults and older minors. While the language, themes, and images associated with children's material is readily recognized as such, CDT contends that it is much more difficult to draw a line between the interests of a 16 to17 year old and a young adult. Recent Amendments Address Some But Probably Not all Opposition Concerns : Some, but certainly not all, of CDT's opposition might be addressed by recent amendments. For example, recent amendments to the definition of a service "directed to minors" clarify that the bill's requirements will only apply to a Web site that is directed "predominantly" to minors, and the bill now expressly exempts Web sites and services designed "for a more general audience comprised of adults." Similarly, CDT's concern that operators will be forced to seek more information to verify a user's age is potentially addressed by an amendment that expressly states that nothing in the bill shall be construed to require an operator to collect age information about users. Finally, one of CDT's principle objections appears to be that this bill should follow COPPA in defining a "minor" as a person under the age of thirteen. However, the author is primarily concerned with the teens that most frequently use the Internet and social media services, and studies suggest that they are between the ages of thirteen and seventeen. PROPSOSED AUTHOR AMENDMENTS : The author wishes to take the following clarifying and substantive amendments in this Committee to address concerns raised by various stakeholders who, while not opposed to the bill per se, but have raised concerns. With these amendments, all opposition has apparently been removed except that of the Center for Democracy &Technology. - On page 2, line 14, strike out the second "application," and on page 3, line 3, strike out "shall" and insert: application: (1) Shall - On page 3 between lines 12 and 13 insert: (2) Shall be deemed in compliance with paragraph (1) if the operator takes reasonable actions in good faith designed to avoid marketing SB 568 Page 11 or advertising under circumstances prohibited under paragraph (1). - On page 3, line 28, strike out "if the marketing or advertising is" and insert: to that minor - On page 6, line 17, strike out "created" and insert: distributed by or at the direction of the operator - On page 6, line 18, after "in" insert: subdivision - On page 6 between lines 18 and 19, insert: (k) "Marketing or advertising" means, in exchange for monetary compensation, to make a communication to one or more individuals, or to arrange for the dissemination to the public of a communication, about a product or service the primary purpose of which is to encourage recipients of the communication to purchase or use the product or service. - On page 7, line 15, after "was" insert: stored on or - On page 7, line 19, after "was" insert: stored, - On page 7, line 19, after "republished" insert a comma REGISTERED SUPPORT / OPPOSITION : Support California Partnership to End Domestic Violence Children Now Common Sense Media Opposition Center for Democracy & Technology Analysis Prepared by : Thomas Clark / JUD. / (916) 319-2334 SB 568 Page 12