Minnesota Democratic Gov. Tim Walz signed legislation this week, overwhelmingly approved by the Legislature, that imposes far-reaching mandates on social media platforms in the name of protecting children.

House File 3148 gives platforms with as few as 10,000 users, or that have earned $1 billion globally in "one or more of the preceding three years," two weeks to guess the age of all users once they have spent "25 hours or more" on the platform "within a six-month period," using "reasonable efforts." 

If the platform is 80% confident the user is 16 years old or older at that time, it may treat the account holder as an adult, but otherwise it must treat them as a child and get "verifiable parental consent" before creating an account for them and set their defaults "at the most private levels."

When the same user has been on the platform for 50 hours within six months, it has another two weeks to guess their age and can assume they're an adult if 90% confident the user is 16 or older. 

Platforms must update their estimates for users' ages every six months "or as often" as they apply "any form of data analytics or artificial intelligence to update" their estimates of "any other demographic characteristics of the account holder for any reason, whichever period is shorter." They can quit guessing and monitoring user activity after an account has existed for 7 years.

They may not present "addictive interface features," including infinite scroll, push notifications, autoplay and "personal metrics" showing engagement with the user's content, or "targeted paid commercial advertising" in their displays or feeds, to any children.

The law takes effect in July 2027. Only two lawmakers voted against it in the House, and none in the Senate.

"The bipartisan consensus is remarkable given what the bill actually requires," civil liberties group Reclaim the Net said. "Buried beneath the child protection language is a surveillance apparatus that applies to every user, not just minors."

Platforms must "continuously analyze how you behave, what content you engage with, and who you communicate with for the better part of a decade. The law creates an obligation to surveil that didn’t exist before."

Every method of parental verification, from handing over credit cards to face scans paired with government-issued IDs, requires platforms to use "identity verification systems that harvest government documents and biometric information from families who want nothing more than to let their kid use an app," the group said.

Reclaim the Net flagged a provision unrelated to child protection. Platforms that become "aware of any information that a mass violence event is threatened, or has taken place, is taking place, or is likely to take place" in the state must report it within 24 hours to the Minnesota Fusion Center, which coordinates intelligence-sharing between local, state and federal law enforcement.