Texas has joined Arkansas and Utah as the third state to impose requirements on social media accounts for those under 18. Namely, with the Securing Children Online through Parental Empowerment Act (“SCOPE Act”), Texas will place requirements on “digital service providers.” The law goes into effect September 1, 2024. It does not provide for a private right of action. Instead, enforcement will be by the Texas attorney general.

Under the law, a digital service provider is not only a “website, application, software, or program” but also an entity that determines the “purpose and means of processing” users’ personal information. Unlike the Utah law, there is no user or monetary threshold. The law does have some exemptions. Notably for most, sites that generate content rather than serving as a platform for others to post content and user content (like comments and chat) are incidental, are exempt. Exemptions also exist for small businesses, higher education institutions, and entities subject to HIPAA or GLBA.

If a company is a covered digital service provider, it must:

• Conduct age verification: When registering for an account, digital service providers must ask users their age. If a user indicates that they are under 18, they cannot be allowed to “age up.” The provider must then follow the laws’ information limitation, content restrictions, and parental controls requirements.

• Limit information collected from minors: Providers can only collect information that is reasonably necessary to provide the digital services. Additionally, minors’ geolocation information cannot be shared or disclosed.

• Content restrictions: Providers will need to put in place a strategy to limit minors’ access to content that can be harmful to them. By way of example, this includes information about suicide or bullying content. The provider’s strategy must include, among other things, keeping a list of harmful material and filtering it from minors. Content filtering will need to include both technical measures and human-review. Relatedly, service providers must make commercially reasonable efforts to stop third party advertisers from targeting minors with ads for products and services that are “unlawful for a minor” in the state of Texas.

• Parental involvement: Digital service providers must give parents the ability to “participate” in their children’s accounts. To do this, the provider must first verify the person as the parent. Once verified, providers will need to allow parents the ability to supervise the account. This includes accessing and controlling their children’s account settings. Parents also need to be able to limit how long their children use the service and restrict children’s ability to make purchases.[1] Like Arkansas’ law (but unlike Utah) the SCOPE Act is silent on whether parents must be provided with access to a minor’s content and messages.

Putting it into Practice: While this law has narrow applicability, it signals a trend at a state level to regulate social media consumption by minors. We anticipate that this trend will continue in other states.

FOOTNOTES

[1] Sec. 509.054(b).