Ohio Enacts Law Requiring Parental Consent for Social Media Accounts | Practical Law

Ohio Enacts Law Requiring Parental Consent for Social Media Accounts | Practical Law

Ohio enacted a social media parental notification act, which protects social media users under age 16 by requiring certain online service providers to obtain verifiable parental consent before a child can sign up and agree to service terms. The act sets out acceptable consent methods and requires services to deny access to a child without consent.

Ohio Enacts Law Requiring Parental Consent for Social Media Accounts

Practical Law Legal Update w-040-3779 (Approx. 4 pages)

Ohio Enacts Law Requiring Parental Consent for Social Media Accounts

by Practical Law Data Privacy & Cybersecurity
Published on 02 Aug 2023 • Ohio
Ohio enacted a social media parental notification act, which protects social media users under age 16 by requiring certain online service providers to obtain verifiable parental consent before a child can sign up and agree to service terms. The act sets out acceptable consent methods and requires services to deny access to a child without consent.
On July 4, 2023, Ohio Governor Mike DeWine signed the state's annual budget, HB 33, which includes a social media parental notification act, requiring operators of certain online services, websites, and products to obtain verifiable consent from a legal guardian for a child under 16 to agree to terms of service, register, sign up, or otherwise create a username.
The requirements apply to operators, defined as any business, entity, or person that operates an online website, service, or product with Ohio users that allows users to do all of the following:
  • Interact and share a social connection with other users within the website, service, or product (service).
  • Create a public or semipublic profile to log in and use the service.
  • Create or post content that other users can view, including on message boards, chat rooms, video channels, direct or private messages or chats, and a landing page or main feed that presents content generated by other users.
If, according to provided factors, their service targets or is reasonably anticipated to be accessed by children, an operator must:
  • Obtain verifiable consent from a child's legal guardian to any contract with the child, including terms of service, registration, signup, or account creation, by directing them to:
    • sign and return a consent form by mail, fax, or email;
    • in connection with a transaction, use a credit card, debit card, or payment system that notifies the primary account holder of each transaction;
    • connect to trained personnel via a toll-free phone number or videoconference; or
    • verify their identity with a form of government-issued identification, to be checked against a database and promptly deleted.
  • Provide the legal guardian with a list of the service's moderation and censoring features, including any that can be disabled, and a link where the information can be accessed later.
  • Deny a child access to and use of the service if they do not receive their legal guardian's affirmative consent.
  • Send written confirmation of consent after receipt by email, mail, fax, or, if reasonable efforts to determine this information fail, telephone.
  • Terminate a child's use or access to the service within 30 days after receiving a legal guardian's notice that consent was in error or that consent is withdrawn.
The Ohio Attorney General has exclusive enforcement authority, with a 90-day notice to cure period for operators in substantial compliance. The Attorney General may seek injunctive relief, civil penalties, and reasonable costs. Civil penalties include up to $1,000 per day for the first 60 days of noncompliance, with escalated penalties for additional days.
The Social Media Parental Notification Act goes into effect January 15, 2024.