Looks like Connecticut just signed a social media age verification law
What they're not telling you: Connecticut Age Verification Law Creates New Biometric Data Collection Infrastructure Without Federal Oversight Connecticut has enacted legislation requiring social media platforms to implement age verification systems and obtain parental consent before minors access algorithmic feeds, establishing a state-level identity verification apparatus that will collect and process biometric or government-ID data at scale without explicit federal data retention standards or corporate liability frameworks. Connecticut Public Act 24-66, signed into law in May 2024, mandates that social media companies employ "commercially reasonable and technically feasible methods" to verify user age before granting access to platforms with algorithmic content feeds. The law requires explicit parental permission for any minor under 18 and prohibits algorithmic notifications to minors between 9 p.m.
What the Documents Show
The statute does not specify which verification methods platforms must use, leaving implementation details to corporate discretion—a regulatory gap that effectively outsources both identity authentication and the retention of identity documents to private companies operating under minimal state oversight. The mechanism matters. Age verification systems typically require one of three approaches: government-issued ID scanning (creating permanent records of minors' biometric data or document scans stored on corporate servers), third-party age verification vendors (introducing data brokers like Intellinetics or AgeChecked into the collection chain), or behavioral analysis algorithms (which require platforms to collect additional surveillance data on user patterns to estimate age). Connecticut's statute does not restrict which method platforms choose, meaning Meta Platforms Inc., TikTok, YouTube, and Snapchat will independently decide what data they collect, where they store it, and how long they retain it. No state law—including Connecticut's—currently requires platforms to delete identity verification data after the stated purpose is fulfilled.
Follow the Money
Federal Children's Online Privacy Protection Act (COPPA) regulations, enforced by the Federal Trade Commission, mandate parental consent for children under 13 but do not establish deletion schedules for identity documents or verification records. This creates a persistent archive: once a minor's driver's license or state ID is scanned by a platform's verification system, that image exists in corporate databases with no mandatory expiration date. The law also introduces enforcement ambiguity. Connecticut designates the state's Department of Consumer Protection as the regulatory agency, but the statute contains no language defining what constitutes "commercially reasonable" verification methods or establishing penalties for data breaches involving age verification records. The FTC can theoretically bring enforcement actions against platforms under COPPA if age verification systems are deemed inadequate, but the agency has not issued guidance on what constitutes acceptable age verification infrastructure or what data retention timelines would comply with privacy standards. Platforms have begun signaling compliance approaches.
What Else We Know
Meta announced it would use third-party age verification vendors in certain jurisdictions, outsourcing the collection and initial storage of identity documents to companies including Jumio and IDology—both of which operate under their own privacy policies that may exceed or fall short of Connecticut's stated protections depending on contractual terms the state legislature did not define. The practical effect: Connecticut created a legal mandate for biometric identity collection from minors without establishing data ownership, deletion timelines, breach liability, or vendor oversight mechanisms. The state regulated the outcome—age gating—without regulating the infrastructure or the data those systems create.
What strikes me about this approach is that Connecticut solved a legitimate problem—algorithmic manipulation targeting children—by building a surveillance system that may outlast the behavioral concern it addresses.
The pattern here is institutional: legislatures identify a corporate harm, then mandate corporate-controlled solutions without establishing the data governance architecture those solutions require. Age verification works. But age verification systems create identity databases. Those databases become assets. Assets attract third-party interest—data brokers, law enforcement, litigation discovery. Connecticut did not address any of this.
The FTC should publish binding guidance on age verification data retention schedules before platforms deploy systems at scale. States should require deletion of identity documents within 30 days of verification completion. Platforms should be statutorily prohibited from using age verification data for any secondary purpose including ad targeting, algorithmic ranking, or disclosure to third parties.
Watch whether the FTC moves on this in the next fiscal year. If the agency treats age verification as a COPPA compliance issue rather than as a new data collection infrastructure, the statutory gap will persist across multiple states simultaneously.
Primary Sources
- Source: r/privacy
- Category: Surveillance State
- Cross-reference independently — don't take our word for it.
Disclosure: NewsAnarchist aggregates from public records, API feeds (Federal Register, CourtListener, MuckRock, Hacker News), and independent media. AI-assisted synthesis. Always verify primary sources linked above.