New Social Media Law Sparks Surveillance Fears

Finger tapping smartphone social media app icons.

Minnesota just turned every major social media platform into a standing-age detective bureau, and the real fight is over whether that protects kids or quietly expands surveillance on everyone.

Story Snapshot

Minnesota’s HF 4138 forces large platforms to estimate the age of nearly every Minnesota user, not just kids.
Children 15 and under cannot hold or keep accounts without “verifiable” parental consent, with default-max privacy settings.
Opponents warn the law nudges platforms toward continuous profiling and broader data collection in the name of child safety.
The clash tees up a national test: can states regulate kids’ social media use without building a quiet digital ID system for everyone?

Minnesota’s law quietly makes age estimation the new normal

Minnesota’s HF 4138 does not simply ask social media companies to check birthdates at the door; it orders them to algorithmically estimate the age of account holders who spend enough time on their platforms.^[1] Once a new user in Minnesota racks up 25 hours within six months, a covered platform has 14 days to estimate that user’s age using “reasonable efforts,” based on existing data and technology.^[1] If the platform cannot conclude with at least 80 percent confidence that the user is 16 or older, it must treat that user as a child.^[1] That “treat as a child” default sounds cautious, but it also means adults who do not look like adults to the algorithm get routed into a stricter, more restricted experience until the system becomes more confident. Opponents argue this creates a powerful incentive to dig deeper into behavior and demographics just to avoid overclassifying adults as kids.^[4]

The law then pushes platforms to refine these age guesses as people stay online.^[1] When a user crosses 50 hours in a six‑month window, the platform has another 14 days to revisit that estimate and now reach 90 percent confidence to treat the person as an adult.^[1] After that, the system must keep updating its age estimate at least every six months or as often as it uses data analytics or artificial intelligence to refresh any other demographic trait, whichever is more frequent.^[1] Business groups point out that last condition is the real kicker: if a platform fine‑tunes ad targeting every few days, it is effectively obligated to keep re‑evaluating age in the background.^[4]^[7] That looks less like a one‑time safety check and more like permanent, legally mandated age surveillance baked into routine analytics.

Parental consent becomes a gatekeeper for younger teens

Supporters of HF 4138 focus on what happens once the system decides someone is a “child,” defined as 15 or younger and residing in Minnesota.^[1] Covered platforms must require applicants to enter their month and year of birth, without prefilled defaults, and cannot create an account for a child without verifiable parental consent.^[1] The same rule applies if the platform’s own age‑estimation logic requires it to treat an existing user as a child; it may not maintain that account without going through a formal parental‑consent process.^[1] Any information collected for parental consent cannot be sold, transferred, or disclosed except as necessary to obtain that consent or obey law, a safeguard meant to calm privacy worries.^[1] For conservatives who want parents back in the driver’s seat, this is the core appeal: children do not get a full social media contract without their parents’ explicit say‑so.^[2]

Once a child’s account exists, HF 4138 dictates how it must behave.^[1] All privacy settings on a child’s account must default to the most private levels, and the platform may not loosen those settings while the user remains a child.^[1] Legislative summaries describe additional protections for minors under 16 around so‑called addictive features, targeted advertising, and the creation and termination of accounts.^[2]^[5] In effect, Minnesota builds a parallel, more locked‑down version of social media that snaps into place automatically whenever the system decides a user is 15 or younger. The design answers a long‑standing complaint from parents: child accounts are too open by default, leaving families to hunt through confusing menus just to limit exposure.

Privacy, speech, and the risk of a de facto digital ID

Trade groups like NetChoice and the Computer and Communications Industry Association see the same architecture very differently.^[4]^[7] Their testimony stresses that mandatory, ongoing age estimation for “all Minnesota account holders” forces platforms to collect and process more personal data, not less.^[4] To move users out of the “child” bucket and avoid stricter rules, companies must raise their confidence scores, which favors methods that lean on biometric inferences, behavioral patterns, or cross‑checking with government‑issued identification.^[4]^[7] That dynamic lines up awkwardly with American conservative skepticism of centralized identity systems: a law pitched as child protection may, in practice, encourage more pervasive tracking of adults.

Opponents also argue that pairing age estimation with parental‑consent gates and restrictions on “addictive” or recommended content turns HF 4138 into a speech throttle.^[4]^[6] NetChoice’s veto request warns that Minnesotans who cannot or will not hand over sensitive documents could face barriers to accessing lawful content, from political commentary to faith‑based material, simply because platforms cannot confidently categorize them as adults.^[6] That concern resonates with a conservative view that government should not condition access to legal speech on a willingness to present papers at the digital border. Yet the bill’s supporters respond that without enforceable duties and real penalties, platforms have little incentive to design for child safety at all.^[3]^[5] The fault line is not over whether kids deserve protection, but whether the state can impose it without conscripting private companies into building a permanent age‑estimation infrastructure that affects everyone who dares to log in.