Digital Age Assurance Act Legislation - International Centre for Missing & Exploited Children

Model State Legislation

Digital Age Assurance for Mature Content

Be it enacted by the State Legislature —

Section 1. Short title.

This act shall be known as the “Digital Age Assurance Act of 2024.”

Section 2. Findings and purposes.

[Points to make:

Creating a barrier between minors and mature content and online experiences requires a solution that protects minors while protecting privacy and safeguarding personal information.
Current efforts to make online environments safer for children are ineffective.
95% of U.S. teens have access to smartphones, and on average teens in the U.S. use 40 different apps on digital devices. 97% of U.S. teens are daily internet users, with 46% saying they are online almost constantly.
Individual app or website-based age assurance will not protect minors across this broad online ecosystem.
The most effective and privacy-protective way of achieving age assurance is at the point of access, on devices themselves.
Parents want more control over their minors’ device use and online experiences. The best way to empower parents is to create an industry-wide solution where all online services are held to the same consistent standard.]

Section 3. Definitions. As used in this act, the term:

(a) “Application Store” means a publicly available website, software application, or online service that distributes third party platforms’ software applications to a computer, a mobile device, or any other general-purpose computing device.

(b) “Covered Manufacturer” means a manufacturer of a device, an operating system for a device, or an application store.

(d) “Device” means a device or a portion of a device that is designed for and capable of communicating across a computer network with other computers or devices for the purpose of transmitting, receiving, or storing data, including, but not limited to, a desktop, laptop, cellular telephone, tablet, or other device designed for and capable of communicating with or across a computer network and that is used for such purpose. (e) “Mature content” means the content defined in 18 U.S.C. 2256(2)(A) [or a state analogue].

(f) “Minor” means an individual under the age of 18.

(g) “Operating System Provider” means an entity that develops, distributes, and/or maintains, a device’s operating system, and provides common services. This includes but is not limited to the design, programming, and supply of operating systems for various devices such as smartphones, tablets, and other digital equipment.

(h) “Substantial portion” means more than 33-1/3% of total material on a website, application, or online service.

Section 4. Age assurance required.

(a) A Covered Manufacturer shall take commercially reasonable and technically feasible steps to –

(1) upon activation of a device, determine or estimate the age of the device’s primary user;

(2) provide websites, applications, application stores, and online services with a digital signal regarding whether an individual is under the age of thirteen, at least thirteen years of age and under sixteen years of age, at least sixteen years of age and under eighteen years of age, or at least eighteen years of age via a real-time application programming interface (“API”).

(3) if the Covered Manufacturer is an Application Store, obtain parental or guardian consent prior to permitting an individual under sixteen years of age to download an application from the Application Store and provide the parent or guardian with the option to connect the developer of such application with the approving parent or guardian for the purpose of facilitating parental supervision tools.

(b) For devices sold prior to the effective date of this act, Covered Manufacturers shall ensure that the requirements under subsection 4(a) are included in its operating system and app store versions and updates by default after the effective date. (c) Any website, application, or online service which makes available mature content:

(1) Is required to recognize and allow for the receipt of digital age signals as intended in this act;

(2) Where the website, application, or online service makes available a substantial portion of mature content, it is required to:

(i) block access to the website, application, or online service if an age signal is received indicating an individual as under eighteen years of age; (ii) provide a disclaimer to user or visitors that it contains mature content; and

(iii) label itself as restricted to adults.

(3) Where the website, application, or online service knowingly makes available less than a substantial portion of mature content, it is required to: (i) block access to known mature content if an age signal is received indicating an individual is not at least eighteen years of age, and (ii) provide a disclaimer to users or visitors prior to displaying known mature content.

(d) A website, application, or online service with actual knowledge that a user is under 18 years of age, including via receipt of a signal regarding an individual’s age in accordance with section 4(a)(2) shall, to the extent applicable and technically feasible, provide readily available features for parents or guardians to support a minor with respect to their use of the service, including features to help manage which individuals or accounts are affirmatively linked to the minor, to help manage the delivery of age appropriate content, and to limit the amount of time that the minor spends daily on the website, application, or online service.

(e) A Covered Manufacturer shall comply with this Act in a nondiscriminatory manner, specifically including, but not limited to:

(1) A Covered Manufacturer shall impose at least the same restrictions and obligations on its own websites, applications, and online services as it does on those from third parties;

(2) A Covered Manufacturer shall not use data collected from third parties, or consent mechanisms deployed for third parties, in the course of compliance with this Act to compete against those third parties, give the Covered Manufacturer’s services preference relative to those of third parties, or to otherwise use this data or consent mechanism in an anticompetitive manner.

(f) After notice and comment, the department may promulgate such rules and regulations as may be necessary to establish the processes by which entities are to comply with the provisions of this section.

Section 5. Enforcement.

(a) The Department shall have exclusive authority to enforce violations of this act. (b) Prior to initiating any action under this act, the Department shall provide an entity 45 days’ written notice identifying the specific provisions of this act the Department alleges are being violated. If within 45 days the entity cures the noticed violation and provides the Department a written statement that the alleged violations have been cured, no further action shall be initiated against the entity.

(c) If an entity continues to violate this act in breach of an express written statement provided to the Department under this section or fails to provide such written statement, the Department may initiate an action and seek damages for up to $10,000 per violation of this act [or … damages for up to $2,500 per each minor actually harmed in violation of this act]. Damages shall begin accruing after completion of the 45-day cure period in subsection 5(b).

(d) Nothing in this act shall be construed as providing the basis for, or be subject to, a private right of action to violations of this act or under any other law.

(e) A Covered Manufacturer, as defined in Section 3(c), shall not be subject to liability for failure to comply with this statute if that Covered Manufacturer has taken commercially reasonable and technically feasible steps to determine or estimate the age of the device’s user as provided in Section 4(a)(1).

Section 6. Severability. If any provision of this act or its application to any person or circumstances is held invalid, the invalidity does not affect other provisions or applications of this act, which can be given effect without the invalid provision or application, and to this end the provisions of this act are severable.

Section 7. Effective date. This act shall take effect one year after it shall have become a law.

Section 8. Uniform Standards. This act is intended to provide for uniformity of law. Any prior state laws, local ordinances, regulations, or policies adopted by a county, municipality, administrative agency, or other political subdivision of this state that are in conflict with the provisions of this act are hereby superseded and shall be deemed null and void to the extent of the conflict with this act.