Data privacy and online protections for children: Developments and challenges
Over the past four years, state legislators have increasingly turned their attention towards minors’ privacy and presence online with a focus on social media access and parental consent, age verification and limitations, and harmful platform design. This shift in focus is no surprise, given the growing desire to protect minors online from lasting effects, the prominence of international age restrictions on social media, and the latest headlines confirming the potential harm of social media on younger populations with Meta recently agreeing to pay up to $17.1 billion to settle claims with various state attorneys general alleging the company designed Instagram and Facebook to be addictive for teens while hiding the harm it had on younger user’s mental health and wellbeing.
With these noble intentions in mind, a number of states have implemented laws requiring parental consent for minor social media account creation. States argue that age restrictions and parental consent requirements place a marginal burden on access while addressing severe mental health harms and addictive designs targeting children online. However, these regulatory developments have not gone unchallenged, with opponents to age restriction and parental consent laws arguing that these laws violate the First Amendment by restricting lawful speech and forcing users to hand over sensitive personal data unnecessarily to verify their age. One such notably vocal opponent that has been spearheading the movement to enjoin bills in this space is NetChoice.
Since November of 2024, NetChoice, a trade association that launched in 2001 with the goal of ensuring the protection of free enterprise and free expression on the Internet, advocating for the benefits of limited government intervention and online competition, have initiated a number of challenges against minor-focused legislation, including actions against bills in California, Arkansas, Texas, and Utah.
Most recently, NetChoice took to the Sixth Circuit to challenge the Parental Notification by Social Media Operators Act (Ohio Rev. Code 1349.09). The Parental Notification by Social Media Operators Act was enacted in the 2023 budget bill, H.B. 33 of the 135th General Assembly, and specifically required that an operator whose site targets children, or is reasonably anticipated to be accessed by children, must obtain verifiable consent from a parent or legal guardian before a minor under the age of 16 could create an account, register, or otherwise sign up for the site. Verifiable consent from a parent or guardian could be provided via a signed form returned by mail, fax, or email; a credit or debit card transaction that notifies the account holder; a call to a staffed toll-free number; a videoconference with trained personnel; or a check of government-issued identification against an identity database.
The Act was promptly contested by NetChoice in a federal district court in the Southern District of Ohio with a ruling in favor of NetChoice in NetChoice v. Yost, finding that the Act was a facially unconstitutional, content-based restriction on speech that failed strict scrutiny and was unconstitutionally vague, permanently enjoining the Act. Then, on June 18, 2026, the U.S. Court of Appeals for the Sixth Circuit reversed the lower court’s decision in NetChoice v. Yost, holding that NetChoice had not established the Act to be facially unconstitutional and remanded the case with instructions to enter judgment for the Ohio Attorney General. However, the Sixth Circuit later paused enforcement of its mandate to allow NetChoice time to appeal to the U.S. Supreme Court.
Separately, on August 28, 2026, the U.S. Court of Appeals for the Sixth Circuit ruled in favor of NetChoice in its ongoing challenge of Tennessee’s Protecting Children from Social Media Act, HB 1891, vacating a lower court’s denial of NetChoice’s request for a preliminary injunction and sending the case back to the U.S. District Court for the Middle District of Tennessee for further consideration, in NetChoice v. Skrmetti.
Under HB 1891, social media companies would be required to collect personal information to verify the ages of prospective account holders and to obtain verifiable parental consent before allowing minors to create accounts on the respective platforms. Asserting claims of First Amendment violations on the grounds that governments are prohibited from imposing digital identification requirements as a condition of accessing lawful, free speech online, NetChoice promptly challenged the bill and sought to enjoin enforcement.
The lower court previously concluded that NetChoice failed to demonstrate an imminent threat of irreparable harm, as required in a successful motion for a preliminary injunction, on the grounds that Tennessee had not yet enforced the law against NetChoice members (i.e., large social media conglomerates), denying NetChoice’s motion for a preliminary injunction. On appeal, the Sixth Circuit recognized that companies like NetChoice’s members could suffer irreparable harm from the unrecoverable compliance costs they can incur in complying with a law that said companies are challenging on the grounds of constitutionality and that the mere threat of loss or limitation of First Amendment free speech rights can also result in irreparable harm in the form of chilled or deterred speech, even before the law comes into force.
The Sixth Circuit’s ruling vacated the lower court’s denial of a preliminary injunction and remanded the case for the U.S. District Court to consider the remaining factors of NetChoice’s argument, including NetChoice’s likelihood of success on its constitutionality challenges.
Though the results of NetChoice’s and other opponents to age verification and parental consent legislation’s efforts remain an open question, there is certainty in the knowledge that similar challenges will continue to arise as states recognize ongoing threats to minors and other vulnerable populations online in arguably the new last frontier.
