Law / United States / 
Mississippi
HB 1126, Walker Montgomery Protecting Children Online Act
Miss. Code Ann. sections 45-38-1 to 45-38-13
In force since , under challenge in court.
A social media and minors rule binding private bodies.
- Private right of action
- No
- Penalties
- Enforcement as an unfair and deceptive trade practice; civil penalties
- Audit expectation
- none
- Court action
A suit challenging this law is pending. No court has blocked it. Premium data
What it requires
- Applies to digital service providers that let users socially interact, create profiles, and post or share content.
- Verify the age of all users.no control in the NIST Privacy Framework
- Obtain express parental or guardian consent before a known minor (under 18) may hold an account.NIST Privacy FrameworkCT.PO-P1
- Apply default privacy protections to minor accounts.NIST Privacy FrameworkGV.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Mississippi Attorney General
Litigation
- Court
- U.S. Court of Appeals for the Fifth Circuit
- Docket
- NetChoice v. Fitch, No. 1:24-cv-00170-HSO-BWR (S.D. Miss.); No. 25-60348 (previously No. 24-60341), U.S. Court of Appeals for the Fifth Circuit; related emergency application No. 25A97, Supreme Court of the United States
- Posture
- A federal district court granted NetChoice a preliminary injunction on . The Fifth Circuit vacated that injunction on and remanded the case. The district court enjoined enforcement again on , the Fifth Circuit stayed that injunction, and the Supreme Court denied NetChoice's application to vacate the stay on , so the law is currently enforceable. The Fifth Circuit heard oral argument on the merits of NetChoice v. Fitch on , and has not yet ruled.
Settledness
NetChoice's challenge to the Act is before the Fifth Circuit as No. 25-60348; on the Supreme Court denied NetChoice's application to vacate the Fifth Circuit's stay.
- As of
- Under challenge
- Yes
- Open questions
- What level of certainty is "appropriate to the risks that arise from the information management practices of the digital service provider" for the "commercially reasonable efforts to verify the age" duty in Section 4(1) of House Bill 1126?
- Does the duty to make "commercially reasonable efforts to verify the age" in Section 4(1) of House Bill 1126 require a provider to check an age the person has declared, or can it rely on the declaration where it has no reason to doubt it?
What it reaches
Age threshold
18
Covered services
Digital services allowing social interaction, profile creation, and content posting or sharing
Verification methods
Gov ID, Third party service, Self declaration
What it makes you log
Log retention
Section 4(2)(d) is one of six listed methods of parental consent; the others (a signed form, a call, a video call, an email exchange, any other commercially reasonable method) carry no retention rule. Section 5(1) also limits collection and use of a known minor's personal identifying information.
- As of
- Basis
- Purpose bound
- Prohibits retaining
- Government-issued identification information of a known minor's parent or guardian, after the identity is confirmed, where the provider uses that consent method
Logging duty
Section 4(1) requires a provider to have the person register an age and to make commercially reasonable efforts to verify it, and section 4(2) lets it obtain parental consent by one of six methods. Nothing in the act requires a provider to keep or produce a record that a check ran. Section 4(2)(d) names one consent method, collecting a parent's government identification, and requires the provider to delete that information after confirming identity.
- Kind
- None
- As of
What this law does
Requires digital service providers that let users socially interact, create profiles, and post content to verify the age of all users and obtain express parental or guardian consent before a known minor (under 18) may hold an account, with default privacy protections for minor accounts.
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .