Internet News

Putting children under surveillance and limiting their access to information doesn't make them safer--in fact, research suggests just the opposite. Unfortunately those tactics are the ones endorsed by the Kids Online Safety Act of 2022 (KOSA), introduced by Sens. Blumenthal and Blackburn. The bill deserves credit for attempting to improve online data privacy for young people, and for attempting to update 1998's Children's Online Privacy Protection Rule (COPPA). But its plan to require surveillance and censorship of anyone under sixteen would greatly endanger the rights, and safety, of young people online.

KOSA would require the following:

• A new legal duty for platforms to prevent certain harms: KOSA outlines a wide collection of content that platforms can be sued for if young people encounter it, including "promotion of self-harm, suicide, eating disorders, substance abuse, and other matters that pose a risk to physical and mental health of a minor."

• Compel platforms to provide data to researchers

• An elaborate age-verification system, likely run by a third-party provider

• Parental controls, turned on and set to their highest settings, to block or filter a wide array of content

There are numerous concerns with this plan. The parental controls would in effect require a vast number of online platforms to create systems for parents to spy on--and control--the conversations young people are able to have online, and require those systems be turned on by default. It would also likely result in further tracking of all users.

ights organizations agree have a greater need for privacy and independence than younger teens and kids. And in contrast to COPPA's age self-verification scheme, KOSA would authorize a federal study of "the most technologically feasible options for developing systems to verify age at the device or operating system level." Age verification systems are troubling--requiring such systems could hand over significant power, and private data, to third-party identity verification companies like Clear or ID.me . Additionally, such a system would likely lead platforms to set up elaborate age-verification systems for everyone, meaning that all users would have to submit personal data.

Lastly, KOSA's incredibly broad definition of a covered platform would include any "commercial software application or electronic service that connects to the internet and that is used, or is reasonably likely to be used, by a minor." That would likely encompass everything from Apple's iMessage and Signal to web browsers, email applications and VPN software, as well as platforms like Facebook and TikTok--platforms with wildly different user bases and uses. It's also unclear how deep into the 'tech stack' such a requirement would reach -- web hosts or domain registries likely aren't the intended platforms for KOSA, but depending on interpretation, could be subject to its requirements. And, the bill raises concerns about how providers of end-to-end encrypted messaging platforms like iMessage, Signal, and WhatsApp would interpret their duty to monitor minors' communications, with the potential that companies will simply compromise encryption to avoid litigation.

Censorship Isn't the Answer

KOSA would force sites to use filters to block content--filters that we've seen, time and time again, fail to properly distinguish"good" speech from "bad" speech. The types of content targeted by KOSA are complex, and often dangerous--but discussing them is not bad by default . It's very hard to differentiate between minors having discussions about these topics in a way that encourages them, as opposed to a way that discourages them. Under this bill, all discussion and viewing of these topics by minors should be blocked.

Research already exists showing bans like these don't work: when Tumblr banned discussions of anorexia, it discovered that the keywords used in pro-anorexia content were the same ones used to discourage anorexia. Other research has shown that bans like these actually make the content easier to find by forcing people to create new keywords to discuss it (for example, "thinspiration" became "thynsperation").

The law also requires platforms to ban the potentially infinite category of "other matters that pose a risk to physical and mental health of a minor." As we've seen in the past, whenever the legality of material is up for interpretation, it is far more likely to be banned outright, leaving huge holes in what information is accessible online. The law would seriously endanger access to information to teenagers, who may want to explore ideas without their parents knowledge or approval. For example, they might have questions about sexual health that they do not feel safe asking their parents about, or they may want to help a friend with an eating disorder or a substance abuse problem. (Research has shown that a large majority of young people have used the internet for health-related research.)

KOSA would allow individual state attorneys general to bring actions against platforms when the state's residents are "threatened or adversely affected by the engagement of any person in a practice that violates this Act." This leaves it up to individual state attorneys general to decide what topics pose a risk to the physical and mental health of a minor. A co-author of this bill, Sen. Blackburn of Tennessee, has referred to education about race discrimination as " dangerous for kids ." Many states have agreed, and recently moved to limit public education about the history of race , gender, and sexuality discrimination.

Recently, Texas' governor directed the state's Department of Family and Protective Services to investigate gender affirming care as child abuse. KOSA would empower the Texas attorney general to define material that is harmful to children, and the current position of the state would include resources for trans youth. This would allow the state to force online services to remove and block access to that material everywhere--not only Texas. That's not to mention the frequent conflation by tech platforms of LGBTQ content with dangerous "sexually explicit" material. KOSA could result in loss of access to information that a vast majority of people would agree is not dangerous, but is under political attack.

Surveillance Isn't the Answer

Some legitimate concerns are driving KOSA. Data collection is a scourge for every internet user, regardless of age. Invasive tracking of young people by online platforms is particularly pernicious--EFF has long pushed back against remote proctoring , for example.

But the answer to our lack of privacy isn't more tracking. Despite the growing ubiquity of technology to make it easy, surveillance of young people is actually bad for them , even in the healthiest household, and is not a solution to helping young people navigate the internet. Parents have an interest in deciding what their children can view online, but no one could argue that this interest is the same if a child is five or fifteen. KOSA would put all children under sixteen in the same group, and require that specific types of content be hidden from them, and that other content be tracked and logged by parental tools. This would force platforms to more closely watch what all users do.

KOSA's parental controls would give parents, by default, access to monitor and control a young person's online use. While a tool like Apple's Screen Time allows parents to restrict access to certain apps, or limit their usage to certain times, platforms would need to do much more under KOSA. They would have to offer parents the ability to modify the results of any algorithmic recommendation system, "including the right to opt-out or down-rank types or categories of recommendations," effectively deciding for young people what they see -- or don't see -- online. It would also give parents the ability to delete their child's account entirely if they're unhappy with their use of the platform.

ould likely cover features as different as Netflix's auto-playing of episodes and iMessage's new message notifications. Putting these features together under the heading of "addictive" misunderstands which dark patterns actually harm users, including young people.

EFF has long supported comprehensive data privacy legislation for all users. But the Kids Online Safety Act would not protect the privacy of children or adults. It is a heavy-handed plan to force technology companies to spy on young people and stop them from accessing content that is "not in their best interest," as defined by the government, and interpreted by tech platforms.

The UK government's new online censorship laws have been brought before parliament. The Government wrote in its press release:

The Online Safety Bill marks a milestone in the fight for a new digital age which is safer for users and holds tech giants to account. It will protect children from harmful content such as pornography and limit people's exposure to illegal content, while protecting freedom of speech.

It will require social media platforms, search engines and other apps and websites allowing people to post their own content to protect children, tackle illegal activity and uphold their stated terms and conditions.

The regulator Ofcom will have the power to fine companies failing to comply with the laws up to ten per cent of their annual global turnover, force them to improve their practices and block non-compliant sites.

Today the government is announcing that executives whose companies fail to cooperate with Ofcom's information requests could now face prosecution or jail time within two months of the Bill becoming law, instead of two years as it was previously drafted.

A raft of other new offences have also been added to the Bill to make in-scope companies' senior managers criminally liable for destroying evidence, failing to attend or providing false information in interviews with Ofcom, and for obstructing the regulator when it enters company offices.

In the UK, tech industries are blazing a trail in investment and innovation. The Bill is balanced and proportionate with exemptions for low-risk tech and non-tech businesses with an online presence. It aims to increase people's trust in technology, which will in turn support our ambition for the UK to be the best place for tech firms to grow.

The Bill will strengthen people's rights to express themselves freely online and ensure social media companies are not removing legal free speech. For the first time, users will have the right to appeal if they feel their post has been taken down unfairly.

It will also put requirements on social media firms to protect journalism and democratic political debate on their platforms. News content will be completely exempt from any regulation under the Bill.

And, in a further boost to freedom of expression online, another major improvement announced today will mean social media platforms will only be required to tackle 'legal but harmful' content, such as exposure to self-harm, harassment and eating disorders, set by the government and approved by Parliament.

Previously they would have had to consider whether additional content on their sites met the definition of legal but harmful material. This change removes any incentives or pressure for platforms to over-remove legal content or controversial comments and will clear up the grey area around what constitutes legal but harmful.

Ministers will also continue to consider how to ensure platforms do not remove content from recognised media outlets.

Bill introduction and changes over the last year

The Bill will be introduced in the Commons today. This is the first step in its passage through Parliament to become law and beginning a new era of accountability online. It follows a period in which the government has significantly strengthened the Bill since it was first published in draft in May 2021. Changes since the draft Bill include:

• Bringing paid-for scam adverts on social media and search engines into scope in a major move to combat online fraud .

• Making sure all websites which publish or host pornography , including commercial sites, put robust checks in place to ensure users are 18 years old or over.

• Adding new measures to clamp down on anonymous trolls to give people more control over who can contact them and what they see online.

• Making companies proactively tackle the most harmful illegal content and criminal activity quicker.

• Criminalising cyberflashing through the Bill.

Criminal liability for senior managers

The Bill gives Ofcom powers to demand information and data from tech companies, including on the role of their algorithms in selecting and displaying content, so it can assess how they are shielding users from harm.

Ofcom will be able to enter companies' premises to access data and equipment, request interviews with company employees and require companies to undergo an external assessment of how they're keeping users safe.

The Bill was originally drafted with a power for senior managers of large online platforms to be held criminally liable for failing to ensure their company complies with Ofcom's information requests in an accurate and timely manner.

In the draft Bill, this power was deferred and so could not be used by Ofcom for at least two years after it became law. The Bill introduced today reduces the period to two months to strengthen penalties for wrongdoing from the outset.

Additional information-related offences have been added to the Bill to toughen the deterrent against companies and their senior managers providing false or incomplete information. They will apply to every company in scope of the Online Safety Bill. They are:

• offences for companies in scope and/or employees who suppress, destroy or alter information requested by Ofcom;

• offences for failing to comply with, obstructing or delaying Ofcom when exercising its powers of entry, audit and inspection, or providing false information;

• offences for employees who fail to attend or provide false information at an interview.

Falling foul of these offences could lead to up to two years in imprisonment or a fine.

Ofcom must treat the information gathered from companies sensitively. For example, it will not be able to share or publish data without consent unless tightly defined exemptions apply, and it will have a responsibility to ensure its powers are used proportionately.

Changes to requirements on 'legal but harmful' content

Under the draft Bill, 'Category 1' companies - the largest online platforms with the widest reach including the most popular social media platforms - must address content harmful to adults that falls below the threshold of a criminal offence.

Category 1 companies will have a duty to carry risk assessments on the types of legal harms against adults which could arise on their services. They will have to set out clearly in terms of service how they will deal with such content and enforce these terms consistently. If companies intend to remove, limit or allow particular types of content they will have to say so.

The agreed categories of legal but harmful content will be set out in secondary legislation and subject to approval by both Houses of Parliament. Social media platforms will only be required to act on the priority legal harms set out in that secondary legislation, meaning decisions on what types of content are harmful are not delegated to private companies or at the whim of internet executives.

It will also remove the threat of social media firms being overzealous and removing legal content because it upsets or offends someone even if it is not prohibited by their terms and conditions. This will end situations such as the incident last year when TalkRadio was forced offline by YouTube for an "unspecified" violation and it was not clear on how it breached its terms and conditions.

The move will help uphold freedom of expression and ensure people remain able to have challenging and controversial discussions online.

The DCMS Secretary of State has the power to add more categories of priority legal but harmful content via secondary legislation should they emerge in the future. Companies will be required to report emerging harms to Ofcom.

Proactive technology

Platforms may need to use tools for content moderation, user profiling and behaviour identification to protect their users.

Additional provisions have been added to the Bill to allow Ofcom to set expectations for the use of these proactive technologies in codes of practice and force companies to use better and more effective tools, should this be necessary.

Companies will need to demonstrate they are using the right tools to address harms, they are transparent, and any technologies they develop meet standards of accuracy and effectiveness required by the regulator. Ofcom will not be able to recommend these tools are applied on private messaging or legal but harmful content.

Reporting child sexual abuse

A new requirement will mean companies must report child sexual exploitation and abuse content they detect on their platforms to the National Crime Agency .

The CSEA reporting requirement will replace the UK's existing voluntary reporting regime and reflects the Government's commitment to tackling this horrific crime.

Reports to the National Crime Agency will need to meet a set of clear standards to ensure law enforcement receives the high quality information it needs to safeguard children, pursue offenders and limit lifelong re-victimisation by preventing the ongoing recirculation of illegal content.

In-scope companies will need to demonstrate existing reporting obligations outside of the UK to be exempt from this requirement, which will avoid duplication of company's efforts.

Pornhub, Pornhub, XHamster, XNXX and XVideos do not comply with French rules contrived from a law against domestic violence.

The French internet censor Arcom (previously CSA) took legal action on March 8 and requested the blocking of 5 pornographic sites: Pornhub, Pornhub, XHamster, Xnxx and Xvideos. The censor sent an injunction to the platforms and left 15 days to comply with the law. The websites did not comply.

Since the vote on the law against domestic violence in 2020, an amendment specifies that sites can no longer be satisfied with asking Internet users to declare that they are of legal age by clicking on a simple box.

Depending on the judge's decision, ISPs will be forced or not to block access to the incriminated sites. In case of blocking, visitors to the pornographic site will be redirected to a dedicated Arcom page.

Distributors of pornographic content are therefore required, in theory, to check the age of their visitors. But how? There is currently no legally defined method to achieve this. The censor itself has never given guidelines to the platforms.

In fact data protection authorities have rather put a spanner in the works that has left the industry scratching its head. In an opinion issued on June 3, 2021, the National Commission for Computing and Freedoms (Cnil) decreed that a verification system which collects information on the identity of Internet users would, in this context, be illegal and risky. Such data collection would indeed present significant risks for the persons concerned since their sexual orientation -- real or supposed -- could be deduced from the content viewed and directly linked to their identity.

Faced with these legal contradictions, Senator Marie Mercier, rapporteur for the amendment, has simply banged the table harder:

I don't want to know how they are doing, but they have to find a solution . The law is the law.

Porn tube websites have explained their reluctance to implement. The option to use third-party verifiers may prove very expensive for a business model based on a high number of users making up for low advertising income per users. An estimate denied by the Tukif site, says that the cost of a verification service goes from 0.0522c to 0.222c per user, a cost to be multiplied by their 650,0000 unique daily visitors.

It is presumed that many porn users will be very reluctant to hand over dangerous ID proof to porn websites so blocking the entry of some audiences, while discouraging others will lead to collapsing income.

The websites also note that as the regulator hasn't attempted to block all porn tube sites then users will be more likely to swap to unrestricted websites rather than submit to ID verification on those website mandated to do so.

A German court has ruled against the country's hate speech law, saying it is illegal to share innocent users' data with law enforcement.

In 2018, Germany passed a controversial law requiring social media companies to remove criminal content and report it to law enforcement. Last May, the German parliament amended the law, passing even stricter and wider regulations for social media companies. The expanded version of the law took effect in February.

Google, Meta, and Twitter filed legal complaints against the law in January 2022. In its complaint, Twitter argued that:

We are concerned that the law provides for a significant encroachment on citizens' fundamental rights.In particular, we are concerned that the obligation to proactively share user data with law enforcement forces private companies into the role of prosecutors by reporting users to law enforcement even when there is no illegal behavior.

On March 1, Cologne's administrative court ruled on Meta's and Google's complaint. The court argued the online hate-speech law violated EU law because it allowed users' data to be shared with law enforcement even before it is determined if a crime has been committed.

The decision can be appealed at a higher court.