BILL ANALYSIS

 

 

 

C.S.H.B. 18

By: Slawson

Youth Health & Safety, Select

Committee Report (Substituted)

 

 

 

BACKGROUND AND PURPOSE

 

Mounting evidence draws a strong connection between uninhibited access to social media platforms and online content and the harmful consequences of such access—this is especially true for children. There is an epidemic of self-harm, suicide, substance abuse, sexual exploitation, and human trafficking among minors. In tandem, platforms are collecting and processing vast amounts of data from minors. This data raises privacy concerns and feeds algorithms that fuel online addiction. Advertising is increasingly of concern due to its sophistication built on data taken from children and its subtle manipulation. Parents are increasingly powerless to protect their children in the face of these sophisticated companies and the technologies they create.

 

C.S.H.B. 18, the Securing Children Online through Parental Empowerment (SCOPE) Act, seeks to prohibit a digital service provider (DSP) from entering into an agreement with a known minor without the consent of the known minor's parent or guardian and require a DSP to provide in those agreements the ability for the parent or guardian to permanently enable certain settings. The SCOPE Act seeks also to require certain disclosures regarding advertising and provide parents better insight into how algorithms are used to target their children.

 

CRIMINAL JUSTICE IMPACT

 

It is the committee's opinion that this bill does not expressly create a criminal offense, increase the punishment for an existing criminal offense or category of offenses, or change the eligibility of a person for community supervision, parole, or mandatory supervision.

 

RULEMAKING AUTHORITY

 

It is the committee's opinion that this bill does not expressly grant any additional rulemaking authority to a state officer, department, agency, or institution.

 

ANALYSIS

  

C.S.H.B. 18 amends the Business & Commerce Code to set out requirements for a digital service provider (DSP) with respect to the use of their service by minors. For purposes of the bill's provisions, a "minor" is a child younger than 18 years of age and a "digital service provider" is a person who owns or operates a "digital service," which the bill defines as a website, an application, a program, or software that performs collection or processing functions with Internet connectivity.

 

Prohibition on Agreements with Known Minors

 

C.S.H.B. 18 prohibits a DSP from entering into an agreement with a known minor, which the bill defines as a minor under circumstances where a DSP has actual knowledge of, or wilfully disregards, a minor's age, unless the known minor's parent or guardian consents in a verifiable manner that is specific, informed, and unambiguous and occurs in the absence of any financial or other incentive. The bill establishes that, for these purposes, an agreement includes a terms of service agreement, a user agreement, and the creation of an account for a digital service and further establishes that the following are acceptable methods for a DSP to obtain such consent from a known minor's parent or guardian:

·         providing a form for the parent or guardian to sign and return to the DSP by common carrier, facsimile, or electronic scan;

·         providing a toll-free telephone number for the parent or guardian to call to consent;

·         coordinating a call with the parent or guardian over videoconferencing technology;

·         collecting information related to the parent's or guardian's government-issued identification and deleting that information after confirming the identity of the parent or guardian;

·         allowing the parent or guardian to provide consent by responding to an email and taking additional steps to verify the parent's or guardian's identity; and

·         obtaining consent from a person registered with the DSP as the known minor's verified parent.

 

C.S.H.B. 18 requires a DSP to provide, and requires an agreement between the DSP and a known minor to include, a process for a known minor's parent or guardian to register with the DSP as the known minor's verified parent. The registration process must require the parent or guardian to confirm their identity using a method that is acceptable for obtaining consent. The bill authorizes a person registered with a DSP as a known minor's verified parent to give consent or perform other functions of a known minor's parent or guardian under the bill's provisions relating to a DSP with whom the verified parent is registered without confirming their identity through those acceptable methods.

 

C.S.H.B. 18 requires a DSP, before obtaining consent from a known minor's parent or guardian, to give the parent or guardian the ability to permanently enable settings to do the following:

·         enable the highest privacy setting offered by the DSP;

·         prevent the DSP from collecting any data associated with the minor that is not necessary to provide the digital service;

·         prevent the DSP from processing any data associated with the minor in a manner that is not related to the purpose for which the data was collected;

·         prevent the DSP from sharing, disclosing, or transferring data associated with the minor in exchange for monetary or other valuable consideration;

·         prevent collection of geolocation data by the DSP;

·         disable targeted advertising for the minor; or

·         prevent the minor from making purchases or financial transactions.

If a minor's parent or guardian, including a verified parent, gives consent or performs another function of a parent or guardian under the bill's provisions, the DSP is considered to have actual knowledge that the minor is less than 18 years of age and must treat the minor as a known minor.

 

Duty to Prevent Harm

 

C.S.H.B. 18 requires a DSP to exercise reasonable care to prevent physical, emotional, and developmental harm to a known minor in relation to the minor's use of the digital service, including the following:

·         self harm, suicide, eating disorders, and other similar behaviors;

·         substance abuse and patterns of use that indicate addiction;

·         bullying and harassment;

·         sexual exploitation, including enticement, grooming, trafficking, abuse, and child pornography;

·         advertisements for products or services that are unlawful for a minor, including illegal drugs, tobacco, gambling, pornography, and alcohol; and

·         predatory, unfair, or deceptive marketing practices.

A DSP must also exercise reasonable care to ensure that a known minor is not exposed to any of those types of harm in relation to the minor's use of the digital service.

 

Access to Data Associated with a Known Minor

 

C.S.H.B. 18 authorizes a known minor's parent or guardian to submit a request to a DSP to access any data on the digital service associated with the minor and requires a DSP to establish and make available a simple and easily accessible method by which such a request may be made. That method must allow a known minor's parent or guardian to access the following:

·         all data in the DSP's possession associated with the known minor, organized by type of data and by purpose for which the DSP processed each type of data;

·         the name of each third party to which the DSP disclosed the data, if applicable;

·         each source other than the minor from which the DSP obtained data associated with the known minor;

·         the length of time for which the DSP will retain the data associated with the known minor;

·         any index or score assigned to the minor as a result of the data, including whether the DSP created the index or score and, if not, who created the index or score;

·         the manner in which the DSP uses such an index or score;

·         a method by which the known minor's parent or guardian may dispute the accuracy of any data collected or processed by the DSP and request that the DSP correct any of that data; and

·         a method by which the known minor's parent or guardian may request that the DSP delete any data associated with the known minor collected or processed by the DSP.

The method must also require a known minor's parent or guardian to confirm the parent's or guardian's identity using a method deemed acceptable under the bill. However, a verified parent is not required to confirm their identity when making a request to the DSP with whom the verified parent is registered. The bill requires a DSP that receives a request to delete or correct data it has collected or processed to delete the information or to determine whether the relevant information is inaccurate or incomplete and make any corrections necessary, as applicable, not later than the 45th day after the request is made.

 

Advertising and Marketing Duties

 

C.S.H.B. 18 requires a DSP that allows advertisers to advertise to known minors on the digital service to disclose the following information in a clear and accessible manner at the time the advertisement is displayed:

·         the name of each product, service, or brand advertising on the digital service;

·         the subject matter of each advertisement or marketing material on the digital service;

·         if the DSP or advertiser targets advertisements to known minors on the digital service, the reason why each advertisement has been targeted to a minor;

·         the way in which data associated with a known minor's use of the digital service leads to each advertisement targeted to the minor; and

·         whether certain media on the digital service are advertisements.

 

Use of Algorithms

 

C.S.H.B. 18 requires a DSP that uses algorithms to automate the suggestion, promotion, or ranking of information to known minors on the digital service to ensure that the algorithm does not interfere with the DSP's duties to prevent harm to known minors. The bill also requires the DSP to disclose in its terms of service, in a clear and accessible manner, an overview of the manner in which the digital service uses algorithms to provide information to known minors and an overview of the manner in which those algorithms use data associated with a known minor.

 

 

Prohibition on Limiting or Discontinuing Digital Service

 

C.S.H.B. 18 prohibits a DSP from limiting or discontinuing a digital service provided to a known minor due to the nature of the responses made by the known minor's parent or guardian relating to the permanent enabling of certain settings as provided for by the bill.

 

Enforcement

 

C.S.H.B. 18 establishes that a violation of the bill's provisions constitutes a false, misleading, or deceptive act or practice as defined by the Deceptive Trade Practices-Consumer Protection Act. A remedy under that act is available for a violation, in addition to any remedy provided by provisions regarding the use of digital services by minors.    

 

Severability

 

C.S.H.B. 18 includes a provision establishing that if any provision of the bill or its application to any person or circumstance is held invalid, the invalidity does not affect other provisions or applications of the bill that can be given effect without the invalid provision or application, and to this end the provisions of the bill are declared to be severable.

 

Exceptions

 

C.S.H.B. 18 expressly does not apply to the following entities:

·         a state agency or a political subdivision;

·         a financial institution or data subject to the privacy requirements established under the federal Gramm-Leach-Bliley Act;  

·         a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the U.S. Department of Health and Human Services, established under the federal Health Insurance Portability and Accountability Act of 1996 and the federal Health Information Technology for Economic and Clinical Health Act;

·         a small business as defined by the U.S. Small Business Administration on September 1, 2024; or

·         an institution of higher education.

 

EFFECTIVE DATE

 

September 1, 2024.

 

COMPARISON OF INTRODUCED AND SUBSTITUTE

 

While C.S.H.B. 18 may differ from the introduced in minor or nonsubstantive ways, the following summarizes the substantial differences between the introduced and committee substitute versions of the bill.

 

The substitute changes the definition of "minor" from a child who is at least 13 years of age but younger than 18 years of age, as in the introduced, to a child who is younger than 18 years of age. The substitute introduces the concept of a "known minor" and defines the term as a minor under circumstances where a DSP has actual knowledge of, or wilfully disregards, a minor's age. The substitute makes the bill's provisions and the protections provided therein applicable with respect to known minors, rather than to minors generally as in the introduced.

 

The substitute further changes the scope of the bill's provisions by replacing the provisions in the introduced that prohibited a DSP from collecting a minor's personal identifying information unless the minor's parent or guardian gives consent with provisions prohibiting a DSP from entering into an agreement with a known minor unless the known minor's parent or guardian gives consent. The substitute includes provisions absent from the introduced specifying certain agreements that are included as part of that prohibition and establishing the acceptable methods of obtaining consent. The substitute also includes provisions absent from the introduced providing for the registration of a known minor's parent or guardian with a DSP as the known minor's verified parent and requiring a DSP to treat a minor as a known minor if the minor's parent or guardian gives consent or performs another function of a parent or guardian under the bill's provisions.

 

The substitute revises the provisions in the introduced establishing a DSP's duty to prevent harm by clarifying that the requirements apply in relation to the minor's use of the digital service. In addition, whereas the introduced required a DSP to prevent certain harm to minors and ensure that minors are not exposed to such harm, the substitute requires a DSP only to exercise reasonable care to do so.

 

Whereas the introduced required a DSP to make available to each parent or guardian who gives consent under the bill's provisions certain parental tools to allow the parent or guardian to supervise the minor's use of the digital service, the substitute does not. However, the substitute includes a provision that instead requires a DSP, before obtaining consent from a known minor's parent or guardian under the bill, to give the parent or guardian the ability to permanently enable certain settings.

 

Whereas the introduced authorized a minor or the minor's parent or guardian to submit a request to a DSP to access the minor's personal identifying information, the substitute authorizes a known minor's parent or guardian to submit a request to a DSP to access any data on the digital service associated with the minor and does not grant any authority to the known minor to make a request on their own accord. The substitute includes provisions absent from the introduced requiring a parent or guardian requesting access to confirm their identity, unless they are registered as a verified parent.

 

The substitute revises the requirement set out in the introduced for a DSP to make certain disclosures regarding advertising to minors to specify that the DSP is required to make the disclosures at the time the advertisement is displayed.

 

The substitute omits the provisions from the introduced that required a DSP that uses algorithms to automate the suggestion, promotion, or ranking of information to minors on the digital service to disclose in the DSP's terms of service options available to a minor and a minor's parent or guardian to modify the results of information provided by the algorithm, including the ability to opt out of or down-rank certain information, and the ability minors have to opt out of using the algorithm.

 

The substitute replaces the introduced version's prohibition against a DSP limiting or discontinuing digital services because a minor or the minor's parent or guardian withholds or withdraws consent to the collection or processing of any personal identifying information not required to provide the digital service with a prohibition against a DSP limiting or discontinuing a digital service provided to a known minor due to the nature of responses made by the known minor's parent or guardian with respect to the permanent enabling of certain settings.

 

The substitute omits the provisions from the introduced that authorized a minor's parent or guardian to bring a civil action against a DSP for a violation of the bill's provisions.

 

The introduced made its applicable to a DSP that collects or processes the personal identifying information of minors and either targets minors or knows or should know that the digital service appeals to minors, whereas the substitute applies to DSPs generally. However, the substitute includes a provision that was not in the introduced excepting certain entities and data from the applicability of the bill's provisions.

 

The substitute adds a short title for the bill, which is the Securing Children Online through Parental Empowerment (SCOPE) Act, which the introduced did not include.

 

The substitute includes a severability clause not present in the introduced.