One of the most controversial and heavily negotiated bills this session was HB 18, which seeks to regulate the availability of content “harmful” to minors on the Internet. As introduced, the bill imposed a sweeping duty on any person who operates a website to “prevent physical, emotional, or developmental harm to a minor.” The filed version included a private cause of action by a minor’s parent or guardian for actual and punitive damages, equitable relief, and attorney’s fees and costs. It also created a DTPA violation on top of that.
As HB 18 wound its way through the legislative process, the general duty to “prevent harm” was refined into specific duties with respect to controlling access to certain material, verifying users, establishing a method for parents and guardians to intervene, regulating the collection and use of personal data, and so forth. The private cause of action fell by the wayside, leaving public enforcement by the attorney general through the DTPA. Thanks to the strenuous efforts of a united business front, the bill came out of the wash a lot cleaner than it went in.
Nevertheless, the final version of the bill, which the Governor will sign in the coming days, presents its own set of challenges. We are reminded of that scene in the 1996 film Twister, in which the hero and heroine storm chasers seek refuge from an F5 monster in a barn full of scythes, axes, machetes, and other steel implements with sharp edges. HB 18 is hung with liability-creating legal duties, the violation of any of which could bring down the attorney general’s office on a business that may well have no idea it’s breaking the law.
Let’s begin with the contours of prospective liability and what that may entail for compliance. While we are certainly relieved that the private cause of action was dropped from HB 18, that does not mean that the risk of litigation and substantial penalties should be underestimated. By shifting to public enforcement under the DTPA (Ch. 17, Business & Commerce Code), the bill gives broad authority to the attorney general’s consumer protection division to seek and a court to order:
- Injunctive relief if the division “has reason to believe that any person is engaging in, has engaged in, or is about to engage in” an unlawful act. The statute does not require the attorney general to notify the party subject to the action until just seven days before initiation of the action. § 17.47(a),(b);
- A civil penalty of up to $10,000 per violation, as awarded by the trier of fact. § 17.47(c);
- An additional civil penalty of $10,000 per violation, not to exceed $50,000, for violating the terms of an injunction; and
- Actual damages to compensate identifiable persons for money or property that may have been acquired by means of unlawful acts or practices, including the appointment of a receiver or sequestration of assets if the defendant fails to make restitution within a specified time.
Further, the consumer protection division has the statutory authority to conduct pre-violation investigations (§ 17.60) and make pre-suit civil investigative demands for documentary evidence (§ 17.61). Under the structure of public enforcement of the DTPA, therefore, a business challenged with complying with HB 18 will always be in a state of incipient or actual litigation with the state. This fact alone creates a substantial burden and cost of compliance.
But that’s not quite all on the liability front. HB 18 retains a vestige of the private cause of action in the filed version: a parent or guardian of a known minor “affected” by a violation my bring suit for a declaratory judgment under Chapter 37, CPRC, or an injunction against a digital service provider (DSP). Fortunately, the bill does not permit a court to certify a class action of parents and guardians. But that does not mean that this section of the bill (§ 509.152(b)) precludes mass litigation of another sort. Far from it. Chapter 37 declaratory judgment actions have the enticement of attorney’s fees, which although discretionary with the court, are universally requested in dec actions and frequently awarded. The more claimants a plaintiff’s attorney can gather together, the greater the potential award of attorney’s fees. Further, there is nothing in the bill that requires a choice of remedy between the state and private actions. In other words, they can proceed at the same time.
In short, liability exposure under HB 18 is real and potentially substantial. The question thus becomes whether the bill articulates clear and specific standards that provide businesses with a sufficient safe harbor from legal jeopardy. This is a question of duty, so let’s review the duties HB 18 establishes.
First, who even has to worry about all this? The onus falls on “digital service providers,” which the bill defines to means a person who owns or operates a “digital service.” A digital service includes “a website, an application, a program, or software that collects or processes personal identifying information with Internet connectivity.” Absent an exception (discussed below), this will catch pretty much any business that uses a website to communicate interactively with the public that may be accessed by a minor anywhere, any time. A DSP may further mean a person who “determines the purpose of collecting and processing the personal identifying information of users of the digital service” and “determines the means used to collect and process” that information.
Having laid down a broad definition of DSP, however, HB 18 proceeds to pare it down somewhat, narrowing its focus to a DSP who provides a digital service that: “(1) connects users in a manner that allows users to socially interact with other users on the digital service (e.g., social media sites); (2) allows a user to create a public or semi-public profile for purposes of signing into and using digital services; and (3) allows a user to create or post content that can be viewed by other users of the digital service, including sharing content on” a message board, chat room, or landing page, video channel, or “main feed that presents to a user content created and posted by other users.” This language reduces the size of the potential liability universe quite a bit, but considering the number of sites this writer uses for the purpose of accessing various goods and services, that universe is still pretty expansive.
There are also a number of specific narrower exemptions, including state agencies and political subdivisions, financial institutions or data subject to Gramm-Leach-Bliley, covered entities or business associates subject governed by HIPA and other federal privacy acts, small businesses, and institutions of higher education. Education services, employers who process employee data for employment purposes, DSPs that only facilitate e-mail or direct messaging, and DSPs that primarily provides users with access to news, sports, commerce, or content primarily generated or selected by the DSP. Finally, there is a catch-all exception for DSPs with no control over content that “solely provide[] access or connection to…an Internet website or to other information or content: (1) on the Internet; or (2) on a facility, system, or network not under the control of” the ISP or its related entities.
While most of these exceptions tailor the bill to specific activities not likely to involve the trafficking of proscribed material, it’s not clear to us why harmful material accessed on a small business’s site is any less “harmful” than that obtained anywhere else. We wonder whether this exception embeds an indefensible constitutional challenge in HB 18 based on the 14th Amendment’s equal protection guarantees. There is simply no rational basis, in our view, for penalizing some businesses and not others for precisely the same conduct. The size of the business is irrelevant, and there is no requirement in the bill that the “harmful material” be accessed by any minimum number of minors in order to be actionable. (Of course, any arbitrary threshold in the bill will have the same problem.) If a business prosecuted under HB 18 could show that a “small business” (which under SBA guidelines may still have hundreds of employees and tens of millions of dollars in revenues) does the same thing, it could be a mighty long day for the attorney general.
In short, we would urge caution with respect to the applicability of these exemptions and not assume anything. There are frontiers here that will have to be litigated, especially if the attorney general of the day takes a particularly aggressive stance on enforcement. While it’s likely that over a period of time the attorney general will evolve some kind of guidance about what it considers actionable and whom it considers liable, that process will take time and experience to play out. It goes without saying that nobody wants to be the first person sued under HB 18, but the enormous amount of effort, publicity, and political capital spent to pass this bill in the first place indicates that enforcement actions will not be far behind.
Second, what material is “harmful” to minors? HB 18 incorporates the current law definition contained in § 43.24(2), Penal Code. This provision deems harmful material “whose dominant theme taken as a whole: (A) appeals to the prurient interest of a minor, in sex, nudity, or excretion; (B) is patently offensive to prevailing standards in the adult community as a whole with respect to what is suitable for minors; and (C) is utterly without redeeming social value for minors.” But the statute likewise establishes an affirmative defense to prosecution that the sale, distribution, or exhibition of the harmful material was “by a person having scientific, educational, governmental, or other similar justification.” We should note here that a person who violates HB 18 also violates § 43.24, a Class A misdemeanor offense. This is important to keep in mind because if the consumer protection division pursues and prevails in an action under HB 18, the finding that the material at issue violates the Penal Code can presumably be handed over to a local prosecutor for criminal action.
Because HB 18 incorporates the Penal Code definition, however, means that HB 18 enforcement litigation will necessarily involve a threshold question that exists in every criminal prosecution for obscenity under Chapter 43. The current statutory standard is drawn verbatim from language in a series of U.S. Supreme Court decisions that wrestled with drawing the line between what speech the Constitution protects and what it does not. Just because HB 18 passed to such great fanfare does not mean that the businesses it regulates must check their constitutional liberties at the door. Any enforcement action undertaken by the attorney general will have to take into account the very real possibility of extended litigation over the actual “harmfulness” of the material at issue. The popular remark about obscenity” that “you know it when you see it” does not give much legal guidance to businesses potentially on the hook for $10,000 per violation.
The “per violation” nature of the penalty will also be a critical factor, we think, in the attorney general’s calculations about whether the pursue a suspected offender. Presumably, a new violation occurs every time a minor (or a parent or guardian of a minor, for that matter) accesses, views, or shares the material, multiplied by each day that the material remains available for access. If that is indeed the case, the amount of a prospective penalty can add up pretty quickly, even if the defendant responds reasonably promptly and takes it down. It seems likely that the attorney general will want to get the biggest bang for the buck possible and devote resources to litigating against entities with significant assets and traffic on their sites. But these are also the entities with the greatest capacity for fighting back, particularly in situations where the constitutional issues come into play. The other approach would be to pursue smaller violations against entities with little hope of withstanding the resources of the attorney general’s office. But it’s hard to see making much of a political splash with that approach.
In any event, we assume that HB 18 was meant to be enforced and that suitable defendants will be found. So what are an entity’s legal duties? In other words, what can the attorney general sue an entity for? Simply put, failing to do any of the following:
- Register the age of every person with whom a DSP enters into an agreement to create an account. § 509.051(a).
- Create a commercially reasonable review process to respond to a person’s request to alter the person’s registered age. § 509.051(c).
- Create a process by which the DPS may identify a known minor other than when the minor registers as younger than 18. This process must allow for parents and guardians to notify the DSP of the minor’s age and successfully dispute the minor’s registered age. § 509.051(d). Warning: this subsection appears to make a DSP responsible for figuring out if a person really is a minor’s parent or guardian based on whether that person “performs another function of a parent or guardian.” We have no idea what this is supposed to mean or what “another function” might be.
- Limit collection of a known minor’s personal identifying information to that “reasonably necessary to provide the digital service.” § 509.052(1)(A).
- Limit use of the known minor’s personal identifying information “to the purpose for which the information was collected.” § 509.052(1)(B).
- Prohibit a known minor from making purchases or engage in other financial transactions through the service. § 509.052(2)(A).
- Refrain from sharing, disclosing, or selling a known minor’s personal identifying information. § 509.052(2)(B).
- Refrain from using the digital service to collect a known minor’s precise geolocation data. § 509.052(2)(C).
- Refrain from using the digital service to display targeted advertising to a known minor. § 509.052(2)(D).
- Develop and implement “a strategy to prevent the known minor’s exposure to harmful material and other content that promotes, glorifies, or facilitates” a host of items, including: suicide, self-harm, or eating disorders; substance abuse; stalking, bullying, or harassment; or grooming, trafficking, child pornography, or other sexual exploitation or abuse.” § 509.053(a).
This is a red-flag warning. Do not overlook that HB 18 proscribes more than just harmful material as defined by the Penal Code. § 509.053 significantly expands the scope of the bill into areas with no existing jurisprudence that more concretely defines the liability standard, as is the case with obscenity. This provision may also make it easier for the attorney general simply to sidestep the constitutional issue altogether and lower the liability standard (as well as increase the potential penalties). This doesn’t mean that the First and Fourteenth Amendment issues go away, just that a defendant will have to frame the constitutional challenge in different terms. Now back to our regularly scheduled program.
- Require the strategy to include a long list of items, including: compiling and maintaining a comprehensive list of harmful materials or other content to block; using filtering technology and other protocols to enforce blocking; using hash-sharing technology to identify recurring content; creating and maintaining a database of keywords used for filter evasion; performing standard human-performed monitoring reviews; making available to users a comprehensive list of materials that will be filtered; and making the DSPs algorithm code available to independent security researchers. § 509.053(b). This section goes on to list several discretionary items that a DSP may include in its “strategy,” including third-party review, industry-specific best practices, and periodic audits. We would interpret these additional “discretionary” items as more or less mandatory, because the failure to implement any of them into the “strategy” will undoubtedly become part of any ensuing litigation.
- Create “parental tools” allowing verified parents to supervise a known minors use of the digital service. These tools must allow a parent to control the minor’s privacy and account settings, alter the duties of the DSP under § 509.052 (watch out for that one: this makes the DSP’s legal duties something of a moving target), restrict the ability of the minor to make purchases or engage in financial transactions, and monitor and limit the amount of time the minor spends on using the service. § 509.054. Remember that just because a DSP is required to create parental tools, there is no corresponding duty on the part of parents and guardians to make use of them. Which is to say, HB 18 imposes strict liability on a DSP, regardless of anyone else’s conduct.
- Make a commercially reasonable effort to prevent advertisers on the DSP’s services from targeting a known minor with advertisements that “facilitate, promote, or offer a product, service, or activity” that is unlawful for a minor “to use or engage in.” § 509.055. This provision likewise expands the scope of the bill and a DSP’s potential liability for material that is neither “harmful” nor covered by § 509.053.
- Make a commercially reasonable effort to ensure that an algorithm “does not interfere with the [DSP’s] duties under Section 509.053. § 509.056(1).
- Disclose in the DSP’s terms of service or privacy policy an overview of the way in which the DSP uses algorithms, how they promote, rank, or filter information, and what personal identifying information is used to provide information or content. § 509.056(2).
- For DSPs that knowingly publish or distribute material, more than one-third of which is harmful material as defined by § 43.21, Penal Code (obscene devices), use commercially reasonable age verification methods to verify that any person seeking to access to the service is at least 18. § 509.057(a).
- Refrain from entering into an agreement with a minor for access to content for which age verification is required under § 509.057(a). § 509.057(b).
- Use commercially reasonable methods to verify the identity of a minor’s parent or guardian and that person’s relationship to the minor. § 509.101(a). Another cautionary note: § 509.104 permits, but does not require, the Department of Family and Protective Services to designate a caregiver or member of the DFPS staff responsible for a minor in conservatorship to “perform the functions of the minor’s parent or guardian under this chapter.” According to CPS’s website, there are more than 38,000 minors currently under conservatorship. While that is a very small fraction of the nearly 7.4 million Texas residents under the age of 18, it may present a specific type of compliance problem when trying to verify a “parent” when there is no parent. More generally, moreover, the task of verifying parental authority for 7.4 million people at any one time is daunting to say the least, even if all 7.4 million had what we think of as a “nuclear family.” But they don’t: about 35% of minors (2.4 million) live in single-parent households, predominantly with their mother. This inconvenient fact will make compliance that much more difficult, if for no other reason than that single parents already have back-breaking duties to perform just to keep things together. How will DSPs get through to these already over-burdened parents in order to fulfill their legal duties under HB 18?
- Provide a process by which a verified parent may “participate in the DSP’s service. § 509.101(b).
An additional section of the bill addresses permissible electronic devices and software applications in public and open-enrollment charter schools, but at least there the bill requires the Texas Education Agency to adopt regulatory standards and does not authorize private or public enforcement.
If you are still reading this incredibly long and windy discussion, you are either a hard-core fan or justifiably nervous about the rollout of HB 18. If you don’t remember anything else about this discussion, you might take away the following bullet points:
- HB 18 imposes at least 19 separate legal duties. A violation of any of these will expose a business to liability. A violation of more than one duty will create additional violations and penalty exposure. A violation that continues for more than one day will multiply penalties (there is no cap). A violation that affects more than one user will ramp up liability for penalties. A compliance strategy, it seems to us, may need to emphasize a rapid response to any suggestion of a violation because the attorney general can swoop in without giving businesses much notice that they’re even in trouble.
- HB 18 applies to more than just obscenity—far more. It covers a wide array of materials (and products, too) that “promote, glorify, or facilitate” a long list of undesirable conduct. The problem is, what does it mean to “promote, glorify, or facilitate” an action taken by an independent third-party acting on its own volition? What is the standard of causation? Is mere access to the material to a minor enough of a nexus to an alleged “harm” to trigger liability? What is a reasonable limit of foreseeability? What kind of evidence would it take to either show causation or defend against it? We simply don’t know, and HB 18 does not provide any illumination.
- HB 18 does not eliminate a private right of action. Though the Legislature substantially cut back the original private action, parents still have a private claim for declaratory judgment and injunctive relief. These remedies come with attorney’s fees attached to them, which make them attractive to plaintiff’s counsel, especially in the case of a widespread violation with plenty of plaintiffs. There is nothing in the bill that prohibits the AG from filing suit and one or more parents coming in right behind them on the same facts.
- HB 18 creates absolutely no regulatory structure that can work with businesses to better define their duties and how to go about satisfying statutory standards. It seems terribly inefficient, particularly in a field of activity as complex and pervasive as this one, to regulate on a case-by-case basis in the judicial system. At some point there probably will be industry “best practices” to help fill in the gaps, but at this point and for the foreseeable future, businesses are on their own and may have to reinvent the wheel over and over again just to keep up with compliance standards that may change with each new court decision.
- It is some comfort that the operative sections of the bill don’t take effect until September 1, 2024, which gives businesses a little space to figure out what they’re going to do.
It’s interesting that HB 18 establishes a joint legislative committee to “conduct a study of the effects of media on minors.” That’s all to the good, but HB 18 puts the cart before the horse by making a whole passel of assumptions about how “media” affects minors and then attaching penalties to them. And look at the list of “media” HB 18 directs the committee to study: social media platforms, software apps, websites, TV, film, AI, mobile devices, computers, video games, virtual reality, and any other “media formats” that strike their fancy. This is a little like appointing a committee to study the nature of God, an infinite being whose ways cannot be humanly calculated. In essence, HB 18 directs a study of “everything, everywhere, all the time.” It also sets the stage for limitless legislative intervention, not just in the entertainment business, but in business and industry across the board because it provides a basis for studying allcommunications and advertising transmitted by electronic means.
In this sense HB 18 could be the gift that keeps on giving, generating ever increasing levels of regulatory liability exposure based on whomever or whatever popular politics of any stripe doesn’t like at the moment. The bill does not limit the duration of the committee, so it effectively establishes an open range for culture warriors to roam for the foreseeable future. Imagine one or more HB 18s every session, all based on the recommendations of the joint committee. We can of course hope this doesn’t happen, and the committee instead takes a cautious approach to additional regulation by litigation at least until we can see how HB 18 actually works. But that kind of approach maps poorly onto partisan political campaigns, particularly in primaries where social issues are front and center (which is now most, if not all, of them). The upshot of all of this is that HB 18 represents the beginning of the implementation of broad and comprehensive regulatory controls on electronic media, not the culmination.
