Law / United States / 
Ohio
HB 33, Parental Notification by Social Media Operators Act
Ohio Rev. Code section 1349.09
A social media and minors rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Obtain verifiable parental consent before allowing a child under 16 to create an account on a social media platform directed to children or reasonably expected to be accessed by them. Accepted methods include a signed form, credit card verification, a phone or video call, or government ID.NIST Privacy FrameworkCT.PO-P1
- Disclose the content moderation features and parental control features your platform makes available.no control in the NIST Privacy Framework
These lines are LexLint's reading of the law's text. Also read by: NetChoice, LLC v. Yost, No. 25-3371 (6th Cir. ) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalties
Civil penalties up to $1,000 per day for the first 60 days of noncompliance, up to $5,000 per day for days 61 through 90, and up to $10,000 per day thereafter.
Who enforces it
Enforcement body
Ohio Attorney General (exclusive authority)
Litigation
- Court
- U.S. Court of Appeals for the Sixth Circuit
- Docket
- NetChoice, LLC v. Yost, No. 25-3371 (6th Cir.); underlying No. 2:24-cv-00047 (S.D. Ohio)
- Posture
- The Act was blocked from its start (TRO, then preliminary injunction) and permanently enjoined by the district court on . On the Sixth Circuit reversed in a divided decision, holding NetChoice lacked third-party standing to raise its members' minor users' First Amendment rights and failed to show the Act facially unconstitutional on its own claims, and remanded with instructions to enter judgment for the Attorney General. The Sixth Circuit denied rehearing en banc on , with no judge requesting a vote, although one judge would have granted rehearing, and on the Supreme Court extended the time to petition for certiorari to .
Settledness
The Sixth Circuit reversed the judgment of the district court and remanded with instructions to enter judgment for the Attorney General in its opinion of .
- As of
- Case link
- https://www.opn.ca6.uscourts.gov/opinions.pdf/26a0177p-06.pdf
- Case citation
- NetChoice, LLC v. Yost, No. 25-3371 (6th Cir. )
- Open questions
- Does a general-audience social media service that is "reasonably anticipated to be accessed by" unemancipated children under 16 fall within Ohio Revised Code section 1349.09(B), when the Sixth Circuit rejected the facial vagueness challenge by reasoning about an operator that clearly targets children?
What it reaches
Age threshold
16
Covered services
Online services, websites, and products that target children or are reasonably expected to be accessed by children
How the hook was established
express
What makes it apply
User location
Verification methods
Parental consent, Gov ID
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Log retention
- As of
- Basis
- Purpose bound
- Prohibits retaining
- A parent's or legal guardian's government-issued identification, once the identity check that uses it is complete
Logging duty
The operator must obtain verifiable parental consent, send the parent written confirmation, deny access without it and end access within thirty days of a withdrawal, which cannot be done without keeping the consent state. The section is enjoined; this entry reads its text.
- Kind
- Implicit
- As of
- Provision
- Ohio Rev. Code 1349.09(B)(1), (D)(1), (E) and (F)
- Trigger
- consent_or_optout
What this law does
Operators of social media platforms directed to or reasonably expected to be accessed by children must obtain verifiable parental consent, through methods such as a signed form, credit card verification, phone or video call, or government ID, before allowing a child under 16 to create an account. Operators must also disclose available content moderation and parental control features.
How courts have read itPremium data
Our analysis of this law draws on 3 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .