Law / United States / 
Massachusetts
S.2581 as amended by the House (text of H.5349), An Act to promote student learning and mental health
A social media and minors rule binding private bodies.
- Audit expectation
- none
What it requires
- Applies to websites and applications that let users register accounts and create and share user generated content, other than videoconferencing, email, and educational services.
- Do not allow an account for a user under 14.no control in the NIST Privacy Framework
- Terminate and delete existing accounts of users under 14 by .NIST Privacy FrameworkCT.DM-P5
- Obtain verifiable parental consent for 14 and 15 year old users, verified through the best available age verification technology.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Massachusetts Attorney General
Settledness
Section 6 of the House text directs the attorney general to promulgate regulations to implement the chapter, including the definition of "social media platform".
- As of
- Open questions
- How much of the content a service displays must be "primarily generated by users" for it to be a "social media platform" under General Laws chapter 93M, section 1, as the House text would insert it, for a service that mixes user-generated content with content the service publishes itself?
- Does a messaging service that lets users post to large channels or groups fall within the exclusion of "SMS, MMS, RCS or similar text messaging telecommunications services" from "social media platform" in General Laws chapter 93M, section 1, as the House text would insert it?
What it reaches
Age threshold
14
Covered services
Websites and applications that permit users to register accounts and create and share user generated content, excluding videoconferencing, email, and educational services.
Verification methods
Gov ID, Self declaration, Parental consent
What it makes you log
Who may demand the log
Data subject
What the log must hold
Input reference, Age assurance result
Log retention
Section 3(c) separately requires data gathered for age assurance, appeals and parental consent to be segregated, kept confidential and used for no other purpose.
- As of
- Basis
- Unspecified
- Prohibits retaining
- All personal information the platform holds about a user terminated for being under 14 or for lacking required parental consent, unless a legal requirement to maintain it applies
Logging duty
Section 4 requires a social media platform to post publicly the number of users processed by its age assurance system, users granted or denied access, appeals and terminations, and sections 2(a)(3) and 2(b)(3) require it to give a parent of a user under 16 access to the age assurance data the user submitted within 5 business days of a request. None of this can be done without records of the checks, but the bill names no log, contents or retention period for them, and no audit; the Attorney General receives public complaints under section 7.
- Kind
- Implicit
- As of
- Provision
- Chapter 93M as inserted by section 3 of House No. 5366, sections 2(a)(3), 2(b)(3) and 4
- Trigger
- age_assurance
What this law does
As passed by the House, would bar social media platforms from allowing an account for a user under 14, require termination and deletion of existing under-14 accounts by , and require verifiable parental consent for 14 and 15 year old users, verified through the best available age verification technology, alongside a school day cellphone ban.
The House engrossed it 129 to 25 on by substituting the text of H.5349; the Senate non-concurred on and the bill is in a six member conference committee.
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .