Minnesota law sets privacy and account rules for young social media users

Covered platforms must estimate some users’ ages and require verified parental consent to create or keep a child’s account. These rules cover Minnesota residents age 15 or younger who use platforms with at least 10,000 account holders or at least $1 billion in worldwide revenue in one or more of the prior three years. Platforms must base age estimates on information they collect in ordinary operations and generally need not collect or keep additional information for that purpose. If an estimate does not meet the required confidence level, the platform must treat the user as a child. It may treat the user as age 16 or older when it meets the stated confidence level. A platform need not estimate the age of someone who has held an account continuously for at least seven years. These requirements take effect July 1, 2027, and apply to accounts created before, on, or after that date.

Covered platforms may not show addictive features or targeted paid ads in a child’s account. The restrictions apply to covered platforms’ displays and feeds for children’s accounts. Addictive features include endless scrolling, personalized feeds, certain notifications, autoplay videos, personal reaction counts, and awards based on platform use. These restrictions take effect July 1, 2027, and apply to accounts created before, on, or after that date.

Covered platforms must use the most private default settings for children’s accounts and may not change those settings while the account holder remains a child. These requirements apply to children’s accounts on covered social media platforms. When seeking consent to create or continue an account, platforms must explain options for parents to monitor use and set daily, weekly, and time-of-day limits. Information collected through a child’s account may not be sold, transferred, or disclosed, except as needed to comply with state or federal law. These requirements take effect July 1, 2027, and apply to accounts created before, on, or after that date.

A child or parent may sue over a violation, and the attorney general may enforce knowing or reckless violations as deceptive trade practices. A child or parent may bring a civil case; the attorney general has enforcement authority over knowing or reckless violations. For a reckless or knowing violation, a child or parent who wins may receive actual damages or $10,000 in statutory damages, whichever is greater. Punitive damages may be awarded for a consistent pattern of reckless or knowing conduct. A platform is not liable if it used reasonable efforts to comply, considering available technology and information it possessed. These enforcement provisions take effect July 1, 2027. A damages case generally must be filed within three years after the person knew or should have known of the violation; the time limit is paused until the child turns 18.

Platforms must publicly post information about their interaction limits, content ranking, user activity, notifications, product experiments, and age estimation process. The posting duty applies to social media platforms and requires information on the platform’s website. This section takes effect July 1, 2027.