Guest Column: A Reality Check on the So-Called “App Store Accountability Act” by Graham Dufault

A Reality Check on the So-Called “App Store Accountability Act”
by Graham Dufault, General Counsel, ACT | The App Association

The threats to kids’ safety online are real, and parents are understandably looking for ways to protect their children from online harms.

Last year, South Dakota legislators were asked to fast track legislation that purported to do just that, the App Store Accountability Act (ASAA), as part of a raft of measures targeted at child safety online. But ASAA was not like the others, and fortunately, it failed. Its deeply flawed approach ignores the fact that not all websites or mobile applications pose the same risk because its purpose is not about protecting kids, but companies.

Its failure is not surprising when you know the company behind the idea. Meta—the company that owns Facebook and Instagram—which has been the focus of repeated investigative reports and congressional hearings for harm caused to kids, is the primary drafter. To put it simply, if you don’t trust Instagram or Facebook with your kids’ sensitive personal information—and from public reporting you shouldn’t—you probably shouldn’t trust them to draft the laws governing your kids’ data either.

That said, ASAA’s problems are much deeper than just the interest groups behind it. The bill would require any person who makes an app (a student, a pizza chain, or a local retailer) to create a mechanism to receive age information about the people they serve. Then, they would be liable for complying with federal kids’ privacy laws that otherwise have no reason to apply to the fish identification app FishSD or SpartanNash’s app. These apps have no reason to build systems to receive this information and then be liable for having it. It’s a completely unnecessary risk.

At ASAA’s heart is a mandate to verify the ages of every single potential user of an app store—and then put every single app on the store on notice as to that age determination. To put this in perspective, age verification is the most stringent form of “age assurance.” Because verification requires collecting official documentation with date of birth, it is both the most accurate in assessing a user’s age as well as the highest-risk form of it because of the sensitive private documents a user must provide (i.e., birth certificate, driver’s license, passport). Therefore, verification is used only sparingly in the real world—such as to determine someone’s over-18 status when purchasing tobacco.

The corollary to this is that age verification is not generally used to keep people out of the grocery store, which sells goods and services that are generally not age restricted. So, when ASAA came along and sought to impose it on every single potential user of a store, the red flags went up right away. In fact, this is partially why a  federal court blocked enforcement of the Texas ASAA. While the state’s justification for the law was to protect kids from truly harmful or unsafe content online, the law is simply orders of magnitude broader than that, impeding access to and severely burdening providers of every single type of app.

South Dakota addressed the issue of age verification online when it enacted HB 1053, requiring verification before accessing “material harmful to minors.” The legislature has done its job on this issue, and it should steer clear of ideas like ASAA. The measure may be helpful to a subset of the largest social media platforms—but for kids, parents, and developers in South Dakota, ASAA is all risk and no reward.

—

The App Association is a global trade association for small and medium-sized technology companies. We work with and for our small business members to promote a policy environment that rewards and inspires innovation while providing resources that help them raise capital, create jobs, and continue to build incredible technology.