Paul Taske is Policy Counsel for NetChoice.
* * * *
In April, Arkansas Governor Sarah Huckabee Sanders signed SB 396, the “Social Media Safety Act,” into law. NetChoice has now filed suit. We are seeking a preliminary injunction to stop the law from taking effect.
In short, SB 396 is a roadblock to accessing some of the largest, most popular social media services. The law imposes both age verification and parental consent requirements. Account holders for the covered platforms must turn over some form of government ID to prove they are 18 or older before accessing the service. If a user refuses to submit such documentation, even if that person is an adult, the law prohibits him from accessing the site. For minors, however, age verification is insufficient. The law requires that they also provide proof of parental consent to get online. And despite mandating significant data collection, SB 396 forbids covered services from “retaining any identifying information” about users. Instead, the law requires third-party vendors to retain such data.
The law is rife with constitutional issues. NetChoice’s complaint focuses on the First Amendment, vagueness under the Fourteenth Amendment’s Due Process Clause, federal preemption, and the Dormant Commerce Clause.
To start, the First Amendment prohibits the government from passing laws that abridge the freedom of speech. Any legislation that directly regulates or otherwise restricts speech must be necessary to achieve a compelling government interest to avoid running up against well-established First Amendment principles. These principles include prohibiting speech merely because of the speaker’s identity, or the content or viewpoint of the speech itself. And just like individuals, digital services, including social media companies, are protected by the First Amendment.
Despite good intentions to protect minors online, SB 396 runs directly into the First Amendment. In fact, SB 396 discriminates based on speaker, content and viewpoint. The law is content-based because it treats platforms whose primary purpose is “interacting socially” differently than those whose primary function is, for example, news, sports, entertainment, research or other “non-social” ends. These types of content-based distinctions are impermissible under the First Amendment.
SB 396’s speaker- and viewpoint-based distinctions fare no better. Speakers are treated differently because the law applies only to certain disfavored companies. The law targets companies like Meta and Twitter, yet it would allow the same speech on places like Gab, Mastodon, Truth Social and Bluesky. Similarly, the law favors some viewpoints over others by excluding organizations that primarily generate their own content (e.g., streaming services like Netflix) from liability.
The Supreme Court has long repudiated the idea that legislatures can determine which speech is valuable. SB 396 does just that—and thus should be enjoined for violating the First Amendment.
While the law makes these speaker, content and viewpoint distinctions, it’s nonetheless quite difficult to pin down exactly to whom SB 396 applies. Of course, the law applies to social media companies—which it defines as a place where users can “create a public profile, establish an account, or register as a user for the primary purpose of interacting socially with other profiles and accounts.” Yet nowhere is “primary purpose” defined. Without a definition, numerous companies are left to guess whether they are covered under the law. Does it apply to Spotify where users can interact to share playlists with one another? How about Goodreads where users share updates and recommendations on the latest books they’ve read? Or Pinterest where some users may create accounts to interact with others while others use it entirely for planning personal activities ranging from home-DIY projects to their ideal wedding reception?
The Due Process Clause requires that a reasonable person be able to understand what actions the law prohibits and whom the law regulates. Absent sufficient definitional guidance, a law will be struck down as unconstitutionally vague. Because SB 396 lacks these necessary guardrails and leaves open the question of applicability, it should be struck down.
Despite these constitutional infirmities, proponents of SB 396 will fall back on the important purpose served by the law: namely, protecting minors online. Yet, that argument runs headlong into another constitutional problem: the Supremacy Clause.
One bedrock structure of our constitutional system is federalism. Both Congress and the states can regulate, but when Congress lawfully acts, a state law in conflict with federal law will be preempted. That is precisely the case here. In 1998, Congress passed the Children’s Online Privacy Protection Act (COPPA) to tackle minors’ online safety.
COPPA set the rules of the road by establishing the responsibilities websites have toward minors. And, to avoid any conflicts, Congress expressly stated that the states were prohibited from passing regulations inconsistent with COPPA’s rules. Nonetheless, SB 396 imposes requirements which directly conflict with COPPA.
First, COPPA only imposes special responsibilities on websites that are “directed to children” (i.e., directed at minors under 13). On the other hand, SB 396 imposes restrictions on social media companies regardless of whether their services are directed toward minors. Second, COPPA’s restrictions end after a minor turns 13. Yet SB 396 applies to all minors. Finally, COPPA permits a website to retain personal information for users, but SB 396 prohibits any data retention by the platforms and instead requires that the data be retained by a third party
Given these numerous inconsistencies, it is easy to see how and why SB 396 conflicts with COPPA and is therefore preempted.
The complaint’s final argument against SB 396 is that it violates the Dormant Commerce Clause because it regulates commerce outside of Arkansas’s borders. The Constitution treats each of the individual states as equal sovereigns. That means no state may regulate beyond its own borders. SB 396 violates this principle because certain provisions lack language tying the regulation to Arkansas. For example, the provision regulating the retention of personal information applies broadly to a “commercial entity” which can be understood to apply to all commercial entities. This would forbid a California-based service from retaining the information of New York users. It is precisely this sort of extra-territorial regulation that the Dormant Commerce Clause forbids.
While these are the issues we raise in our complaint, they are by no means the only problems with SB 396. There are two additional problems worth examining: the rights of users and third-party data storage.
First, the Supreme Court has long held that the First Amendment includes the right to speak anonymously. To speak anonymously, no one else can know who is speaking. But by requiring age-verification, the government is necessitating that your age be verified with some form of ID. A driver’s license, passport or birth certificate would suffice. But by providing such documentation, a user discloses his identity and forfeits the ability to speak anonymously. The law requires that all users verify their age, so the loss of anonymity will apply to minors and adults with equal force.
Second, SB 396 actively undercuts its own stated goal of protecting minors online. The major services that are clearly covered (e.g., Facebook, Instagram, TikTok) are precisely those that have poured substantial dollars and efforts into creating an environment safe for minors. Facebook alone has spent $13 billion since 2016 on safety and security. But those smaller platforms who are known for their openly repugnant content (e.g., Gab and 4Chan) are not covered. To avoid verifying their ages, minors will be incentivized to abandon safer platforms for less secure alternatives.
These companies expend considerable effort building trust between their services and their users, but SB 396 requires that the data, which must be collected, be collected by unknown third parties. This hardly seems like an appropriate way to actually secure minors and their data online.
NetChoice supports measures to keep minors safe online, but such an end must be accomplished by respecting the Constitution’s guarantees, structure and guardrails, not by running roughshod over them. Because SB 396 is replete with constitutional defects, NetChoice staunchly opposes the law. We are confident the court will agree.