Massachusetts S 3164: An Act protecting children from addictive social media feeds

Summary

Legislative Analysis: Massachusetts Senate Bill 3164 An Act Protecting Children from Addictive Social Media Feeds --- 1. Primary Purpose and Policy Objectives Senate Bill 3164 establishes a comprehensive regulatory framework to protect minors from algorithmically-driven, engagement-maximizing features of social media platforms. The bill's core legislative intent is to limit the exposure of users under 18 years of age to design mechanisms—specifically algorithmic content curation, infinite scroll, autoplay, and nocturnal push notifications—that behavioral research has associated with compulsive use patterns and adverse mental health outcomes. The bill operates through a default-protective settings model rather than outright prohibition, preserving platform access while constraining manipulative design features for covered minors. A secondary objective is transparency and accountability through mandatory data reporting to the Attorney General. --- 2. Key Provisions and Mechanisms A. Definitional Framework (Ch. 93M, §1) The bill introduces precise statutory definitions central to its operative scope: - "Addictive social media feed": Algorithmically curated content streams based on user-associated data, subject to eight enumerated carve-outs preserving: (i) non-persistent data recommendations; (ii) device/accessibility-based selection; (iii) user-explicitly subscribed content; (iv) user-directed filtering; (v) direct/private communications; (vi) search-responsive content; (vii) sequential content from the same source; and (viii) compliance-necessary recommendations. This definition is notably granular and represents the definitional cornerstone of the entire regulatory scheme. - "Covered minor": A user for whom the platform operator has actual knowledge of minority status, establishing a knowledge-based triggering standard rather than a strict liability standard. - "Covered operator": Any person or legal entity operating a social media platform, broadly construed. - "Age signal": A device-level, categorical age-range transmission from operating system or application distribution providers that does not require disclosure of government-issued identification or biometrics—a privacy-preserving age verification mechanism. - Excluded platforms: Email, SMS/MMS/RCS services, cloud storage, e-commerce marketplaces (where user interaction is transaction-incidental), educational technology platforms (subject to FERPA compliance and executed student data privacy agreements), and document collaboration services are expressly excluded from "social media platform" coverage. B. Default Safety Settings — Two-Tier Framework (§2) Tier 1 — Suspected Minors (§2(a)): Operators must deploy commercially reasonable and technically feasible age-determination methods, with a user opt-out mechanism requiring clear, conspicuous pre-use notice. For users determined to be minors or who opt out of age determination, operators must implement mandatory default settings: | Default Requirement | Specification | |---|---| | Disable addictive social media feed | Algorithmic curation prohibited by default | | Disable push notifications | 12:00 a.m. – 6:00 a.m. blackout period | | Disable autoplay/auto-advance | No automatic content progression | | Disable infinite scroll | No endless pagination | | Usage time reminders | Mandatory acknowledgment after 1 cumulative hour; every 30 minutes thereafter | Operators are prohibited from allowing users to alter these defaults unless age has been affirmatively verified as non-minor status. Tier 2 — Actual Knowledge of Minority Status (§2(b)): Where operators have actual knowledge of minor status, additional account-level privacy protections apply by default: - Content visibility restricted to connected accounts only - Precise geolocation data (defined as within 1,750-foot radius accuracy) sharing with other users disabled - Content sharing and direct messaging limited to connected accounts Modification parameters: - Settings under clauses (i), (iii), and (iv) are adjustable by the minor - Geolocation sharing (clause ii) requires verifiable parental consent, with consent data subject to strict use-limitation and immediate post-determination deletion requirements - Geolocation, if unlocked, may be shared only with specifically selected connected accounts—not broadcast generally Anti-Degradation Clause (§2(c)): Operators are expressly prohibited from withholding, degrading service quality, or increasing pricing for users operating under default safety settings—preventing punitive upselling or feature-gating practices. Dark Pattern Prohibition (§2(b)(3)): Operators may not: (i) allow bulk modification of multiple default settings simultaneously; or (ii) prompt or solicit users to change default settings unless necessitated by an expressly requested service feature—a direct legislative response to documented "nudging" and interface manipulation practices. C. Age Assurance Regulatory Scheme (§3) The Attorney General is mandated to promulgate regulations establishing commercially reasonable and technically feasible age-determination methods. Regulatory mandates include: - Multiple verification pathways, including at least one method not solely reliant on government-issued identification or permitting user anonymity relative to the operator - Data minimization: Collection limited to strictly necessary age-determination data - Mandatory deletion of all personal data beyond the age determination itself, immediately upon determination - Use limitation: Age-verification data prohibited from secondary use or combination with other user data - Appeals process: Operators must implement a user appeal mechanism for adverse age-determination outcomes - Safe harbor: Operators using compliant age-assurance methods and not determining a user to be a minor may operate under a non-minor presumption unless actual knowledge is subsequently obtained - Full exemption: Operators using compliant methods who prohibit determined minors from platform access entirely are exempt from §2 requirements The AG may also, by regulation, require operating system providers to transmit age signals to covered operators—a notable potential extension of regulatory reach to device ecosystem intermediaries (e.g., Apple iOS, Google Android). Regulatory factors to be considered include: operator size and financial resources, cost-effectiveness of available methods, and impact on user safety and experience—building proportionality into the framework. D. Data Reporting and Transparency (§4) Covered operators must submit quarterly de-identified aggregate data to the Attorney General including: - Number of minor users (by age or age range) - Time spent on platform by minor users (by age or age range) - Frequency and type of default setting modifications by minor users All such data shall be publicly posted on the AG's website. The AG retains regulatory authority to require additional data categories. E. Enforcement Mechanism (§5) - Violations of §2 constitute unfair or deceptive acts or practices under M.G.L. ch. 93A - Exclusive enforcement authority vested in the Attorney General (no private right of action) - Civil penalties: - §2 violations: Up to $5,000 per non-compliant user account—creating potentially significant aggregate liability for large-scale platforms - §4 violations (data reporting): Up to $1,000,000 per violation, with each day of non-compliance constituting a separate violation F. Implementation Timeline (§§2–3 of Enacting Provisions) - March 1, 2027: Attorney General regulatory deadline - August 1, 2027: Operative effective date of substantive provisions --- 3. Fiscal Impact State Revenue/Expenditure: - The bill generates no direct tax revenue - Civil penalties accrue to the Commonwealth but are enforcement-contingent and not projectable - Fiscal burden falls on the Office of the Attorney General, which assumes significant new regulatory, rulemaking, enforcement, and public data-portal obligations; appropriation may be required - The AG's establishment of a public online complaint submission platform (§8) represents an additional administrative infrastructure requirement Industry Compliance Costs: Fiscal impact to covered operators is substantial but unquantified in the bill text. Large platforms (Meta, TikTok, Snap, YouTube/Google) face: - Engineering costs for age-assurance infrastructure - Default settings reconfiguration across user bases - Quarterly data compilation and reporting systems - Potential legal exposure calculated per-account ($5,000 × millions of minor users = potentially billions in maximum theoretical liability) The bill's proportionality provisions in §3(c)(i) (considering operator size and financial resources in rulemaking) partially acknowledge this disparate burden. No formal fiscal note is appended to the bill text as provided. --- 4. Affected Stakeholders | Stakeholder | Impact | |---|---| | Social media platforms (Meta/Instagram, TikTok, Snap, YouTube, X) | Primary regulated entities; face major compliance infrastructure requirements and enforcement exposure | | Operating system providers (Apple, Google) | Potential mandated obligation to transmit age signals; regulatory reach into device ecosystem | | Application distribution providers (App Store, Google Play) | Defined within scope; potentially subject to age-signal transmission requirements | | Minors under 18 | Primary protected class; subject to default restrictions but retain some adjustment autonomy | | Parents/legal guardians | Role in verifiable parental consent for geolocation unlocking; expressly not granted additional general account access or control rights | | Educational institutions/EdTech platforms | Expressly exempted, provided FERPA compliance and executed data privacy agreements are maintained | | Office of the Attorney General | Substantially expanded regulatory, enforcement, and public transparency responsibilities | | Massachusetts residents generally | Beneficiaries of public data disclosure; adult users indirectly affected through platform-wide implementation | --- 5. Notable Provisions, Potential Controversies, and Analytical Observations A. First Amendment Considerations The bill's restrictions on algorithmic curation implicate Moody v. NetChoice (U.S. 2024) and ongoing federal jurisprudence regarding whether social media editorial algorithms constitute protected speech. The bill's focus on design features rather than content moderation may offer some constitutional insulation, but litigation is foreseeable. B. Section 230 Preemption Federal Communications Decency Act §230 preemption arguments may be raised, though the bill targets platform design mechanics rather than third-party content liability—a distinction courts have increasingly recognized as outside §230's scope. C. Privacy-Protective Age Verification Design The bill's requirement of at least one non-government-ID-based, anonymity-preserving verification method (§3(d)(i)) and its data minimization/deletion mandates reflect deliberate legislative balancing between age assurance efficacy and civil liberties concerns—a notably more privacy-conscious approach than comparable legislation in other jurisdictions. D. Opt-Out Mechanism Tension The provision allowing users to opt out of age-determination methods (§2(a)(1))—triggering the same default protective settings as a confirmed minor—creates a notable design feature: users seeking to avoid age-screening receive identical restrictions to confirmed minors, potentially incentivizing disclosure rather than avoidance. E. Per-Account Penalty Exposure The $5,000-per-noncompliant-account civil penalty structure, while subject to AG enforcement discretion, creates theoretical aggregate liability in the hundreds of millions to billions of dollars for major platforms with large minor-user populations, representing one of the most aggressive penalty structures among comparable state social media minor-protection statutes. F. Substitute Draft History The bill as reported (S. 3164) is a Senate Ways and Means Committee substitute for the original S. 30, indicating meaningful committee modification to the initial proposal; the extent of substantive changes from S. 30 is not determinable from the provided text alone. G. No Private Right of Action The exclusive AG enforcement model, while administratively streamlined, forecloses direct private remediation for affected minors or parents—a design choice that concentrates enforcement discretion and may limit accountability if AG resources are constrained. --- Analysis prepared based on bill text as filed July 2, 2026. Legislative history of predecessor bill S. 30 and fiscal note documentation not available for review.

Bill Text

SENATE  .  .  .  .  .  .  .  .  .  .  .  .  .  .  No. 3164 
 
The Commonwealth of Massachusetts 
_______________
 
In the One Hundred and Ninety-Fourth General Court 
(2025-2026) 
_______________
 
 
 
SENATE, July 2, 2026. 
 The committee on Senate Ways and Means to whom was referred the Senate Bill 
protecting children from addictive social media feeds (Senate, No. 30), - reports, recommending 
that the same ought to pass with an amendment substituting a new draft with the same title 
(Senate, No. 3164).  
 
For the committee, 
 Michael J. Rodrigues 
 

1 of 11 
        FILED ON: 7/2/2026 
SENATE  .  .  .  .  .  .  .  .  .  .  .  .  .  .  No. 3164 
 
 
The Commonwealth of Massachusetts 
 
_______________
 
In the One Hundred and Ninety-Fourth General Court 
(2025-2026) 
_______________
 
 
An Act protecting children from addictive social media feeds. 
 
 Be it enacted by the Senate and House of Representatives in General Court assembled, and by the authority 
of the same, as follows: 
 
1 SECTION 1. The General Laws are hereby further amended by inserting after chapter 
293L the following chapter:- 
3 Chapter 93M 
4 ONLINE PROTECTION 
5 Section 1. As used in this chapter, the following words shall have the following meanings 
6unless the context clearly requires otherwise: 
7 “Account”, a unique profile for a user of a social media platform. 
8 “Addictive social media feed”, a website, online service, online application or mobile 
9application, or a portion thereof, in which multiple pieces of content generated or shared by users 
10of a website, online service, online application or mobile application, either concurrently or 
11sequentially, are recommended, selected or prioritized for display to a user based, in whole or in 
12part, on information associated with the user or the user’s device unless, for each such 

2 of 11 
13recommendation, selection or prioritization, any of the following conditions are met, alone or in 
14combination with one another: 
15 (i) the recommendation, prioritization or selection is based on information that is not 
16persistently associated with the user or user’s device and does not concern the user’s previous 
17interactions with content generated or shared by other users unless the content was explicitly 
18saved by the user; 
19 (ii) the recommendation, prioritization or selection is based on user-selected privacy or 
20accessibility settings or technical information concerning the user’s device; 
21 (iii) the user expressly and unambiguously: (1) requested the specific content; (2) 
22subscribed to content by the author, creator or poster of the content; or (3) subscribed to the page 
23or group to which the content is shared by users; provided, however, that the content is not 
24recommended, selected or prioritized for display based, in whole or in part, on other information 
25associated with the user or the user’s device that is not otherwise permissible under this section; 
26provided further, that “subscribed to” shall include friending, joining or otherwise affirmatively 
27requesting content from; 
28 (iv) the user expressly and unambiguously requested that specific content, content by a 
29specified author, creator or poster of content to which the user has subscribed or content shared 
30by users to a page or group to which the user has subscribed pursuant to clause (iii) be blocked, 
31prioritized or deprioritized for display; provided, however, that the content is not recommended, 
32selected or prioritized for display based, in whole or in part, on other information associated with 
33the user or the user’s device that is not otherwise permissible under this section; 
34 (v) the content is a direct or private communication; 

3 of 11 
35 (vi) the content is recommended, selected or prioritized only in direct response to a 
36specific search inquiry by the user at the time such search inquiry is made; 
37 (vii) the content recommended, selected or prioritized for display is exclusively next in a 
38pre-existing sequence from the same author, creator, poster or source; or 
39 (viii) the recommendation, prioritization or selection is necessary to comply with the 
40provisions of this chapter and any regulations promulgated pursuant to this chapter. 
41 “Age signal”, a device-level transmission from an operating system provider or 
42application distribution provider to a covered operator of a categorical age range applicable to 
43the user of the device that does not require the transmission to the covered operator of such 
44user’s date of birth, legal name, government-issued identification or biometric identifier. 
45 “Application distribution provider”, a person, business or legal entity that owns, controls 
46or operates a platform through which software applications are made available for download or 
47installation by users in the commonwealth. 
48 “Autoplay”, a feature of a social media feed or landing page where content is 
49automatically played in