Privacy & Information Security Law Blog

On January 9, 2024, an Ohio federal judge placed a temporary restraining order on Ohio’s Parental Notification by Social Media Operators Act, Ohio Rev. Code § 1349.09(B)(1) (the “Act”), which was approved in July 2023 and was set to go into effect on January 15,2024. Under the Act, parents must provide consent for children under 16 to set up an account on social media and online gaming platforms. The platform operators must also provide parents with a list of content moderation features.

The judgment comes amidst a heightened focus on children’s data privacy in the U.S. and abroad, with several states attempting to regulate children’s privacy at the state level and the FTC proposing significant changes to the COPPA regime at the federal level. Some states have taken a more targeted approach by placing restrictions around certain content or types of websites, such as social media platforms, while others have followed the more comprehensive approach of the UK’s Age Appropriate Design Code.

As anticipated, the laws have been met with criticism from industry and interest groups, and legal challenges have been brought in multiple courts. One of the key players in these lawsuits is NetChoice, a national trade association with members from big tech companies, which has been suing various states over these laws, primarily on First Amendment grounds. NetChoice has won similar cases (at least temporarily) in California and Arkansas. In the Ohio case, NetChoice filed a motion for preliminary injunction and temporary restraining order against Ohio Attorney General Dave Yost on the grounds that the Act unconstitutionally imposes parental consent limitations for children under 16 to access and engage in protected speech.

The Act regulates the “operator[s]” of “online website[s], service[s], or product[s]” that “target[] children” or are “reasonably anticipated to be accessed by children”; have users in Ohio; and allow users to participate in typical social media and online gaming platform activities (i.e., interact socially, create profiles, create lists of other users, have social connections, and create or post visible content). The Act requires operators to obtain verifiable parental consent (leveraging the consent standard and methods under COPPA) for children under 16 to sign up for social media and online gaming accounts. The Act also requires operators to provide parents with information about the operator’s features related to censoring or monitoring content, including any features that can be disabled for a particular profile. Fines for failure to comply with the Act are tiered, with up to $1,000 per day for the first 60 days, up to an additional $5,000 per day for days 61-90, and up to an additional $10,000 per day for day 91 and over. The court assessed whether the Act violates the First and Fourteenth Amendment rights of various social media and online gaming platforms and the First Amendment rights of users.

The court considered various factors, including:

• whether tech companies would suffer immediate irreparable harm (related to costs of compliance);
• whether minors would suffer immediate irreparable harm (related to not being able to access the platforms);
• the vagueness of the Act (NetChoice argued that its members would not know whether or how to comply with the Act); and
• whether the Act imposed impermissible restrictions on First Amendment-protected speech (versus the Attorney General’s characterization of the law as pertaining to the right to contract, which would require intermediate scrutiny).

In the judgment, the court noted that certain parts of the Act are “troublingly vague” (e.g., the law’s application to website operators that target children). The court also noted that the Act appears focused on parental consent with respect to accessing certain content, rather than the right to contract – “a breathtakingly blunt instrument for reducing social media's harm to children.” The court described the Act’s “untargeted” approach, focusing on the fact that parental consent is required only once (for account creation), and that the Act does not require additional protections from the specific dangers of social media once the child’s account has been created.