Protecting both kids and protecting privacy not easy in the era of high tech

LB1092, the Adopt the Online Age Verification Liability Act, is currently being considered by the Legislature. This would require age verification for potentially harmful content to anyone under 18. The definition of harmful is taken from Miller v. California. 413 U.S. 15 (1973). The law reads, “A commercial entity shall not knowingly and intentionally publish or distribute material harmful to minors on the Internet on a website used in the regular course of business to create, host, or make available such material unless the entity uses it.” 

 Everyone agrees that protecting minors from harmful content is a noble goal. Still, some concerns exist about LB1092’s unintended consequences, the lack of enforcement mechanisms, and the legality of the proposed bill. 

Many states have passed a version of an online age verification act this year, and we are seeing the immediate effects. Pornhub is the 13th most visited site on the internet and offers material not suitable for children. Pornhub has pulled out of states like Texas this month, Montana, Virginia, and Utah because it cannot comply with the age verification law. They do this by blocking IP addresses originating in those states, but it can be comically easy to work around. 

Every computer connected to the internet is assigned a unique identifier known as an IP address. This IP address contains information about the user’s geographical location, including their state. Each time a user visits a website, like Pornhub, that website can determine the user’s IP address and therefore infer their location. If the IP address indicates that the user is from a state that has imposed an age verification requirement, the website can implement a block, preventing the user from accessing their content. 

But it turns out it is not hard to circumvent the age verification requirement by accessing a VPN. Even in states that do not have Pornhub, like Texas, a VPN makes it comically easy to access the site, A Virtual Private Network, or VPN, provides the capability to mask a user’s internet address. It achieves this by re-routing the user’s connection and making it appear as if they are browsing from a chosen location. This can be instrumental in bypassing geographical restrictions. By selecting a server located in an unrestricted area, users can seamlessly navigate around any potential digital roadblocks.  

It remains to be seen whether sites subjected to the age verification law in each state may use the VPN defense to combat civil liability or criminal prosecution or whether VPNs themselves are subject to these age verification laws. If there continue to be VPNs, which is more than likely, access to sites like Pornhub will be available via a five-minute workaround; the access and the demand for this material globally will not be decreased. Young children might not know about VPNs, but older children and teens will. This fact alone makes the proposed law unworkable currently. 

Free market alternatives already exist that allow parents to monitor and control what their child views online. These tools often come bundled with devices, offering parents greater flexibility and control over what their child sees and when they can access it. For instance, Apple’s parental controls are comprehensive and user-friendly, allowing parents to restrict content, set screen time limits, and even approve purchases and downloads. Similarly, Microsoft Family Safety allows parents to set screen time limits, block inappropriate apps and games, and track their child’s location for safety. These tools provide personalized control for parents without the need for overarching legislation, demonstrating the power of the free market to address these issues. This approach is more consistent with the principle of least restrictive means, i.e., achieving policy objectives in a way that imposes the least burden on individual rights and freedoms. 

Simply enabling the Apple filter for webpages disables clearing a device’s browsing history. This process takes just three minutes to complete. Therefore, a concerned parent can easily access and monitor their child’s browsing history. Unlike age verification laws that can be circumvented by a VPN, Apple parental controls are much more robust and cannot be bypassed similarly. Apple has regular software updates that fix potential loopholes, ensuring these controls remain effective and secure continuously. 

Numerous companies with religious backgrounds provide solutions, such as Covenant Eyes, that foster mutual accountability within families. These tools promote collaboration and open communication, helping families navigate online challenges together in a way consistent with their religious values. 

Then, there are the bill’s odd enforcement mechanisms. The enforcement mechanism for this law primarily rests on civil litigation initiated by parents themselves, placing the burden on families to enforce a law intended to protect them. Notably, the bill does not list any government enforcement mechanisms. Furthermore, the law only allows for parents to recoup for ‘actual damages’, a term which is not defined in the bill’s language. This raises questions about its interpretation – for example, if a child views an illicit image and subsequently experiences nightmares, how is the ‘actual damage’ of this quantified? 

This and other similar laws may be impeded by Section 230 of the Communications Decency Act, which grants immunity to certain content providers that host third-party content, even if they know about the content. Moreover, if a federal law has been enacted, state laws cannot conflict with that statute because it is preempted by federal statute. 

Companies are challenging age verification laws based on Section 230 immunity, leading to potentially costly litigation. This is an expenditure that other states may be able to afford, but Nebraska may not. Waiting to pass this type of regulation and then doing it right may be the more prudent course of action.  

LB1092 may inadvertently create a market that should not exist. Adding an age verification requirement to a website can financially burden the website owner, especially when accessible parental controls are readily available on most devices. 

Lastly, the privacy component of the Online Age Verification Act cannot be overlooked. Age verification requires collecting personal data, including sensitive information such as driver’s license details or birth dates. This raises serious concerns about data protection and privacy, especially considering rising instances of data breaches and misuse of personal information. Appropriate safeguards must be implemented to ensure this collected data is not exploited or compromised. It is too early to tell if these age verification laws will become a goldmine for hackers.  

Too many of these questions are unanswered to make this the right choice for Nebraska at this time.