❌

Vue lecture

Il y a de nouveaux articles disponibles, cliquez pour rafraîchir la page.
🔲 ☆

Social media policy is evolving beyond age limits

Social media policy is evolving beyond age limits

Since Australia took up the cause of higher age limits on social media in 2024, the push for such policies has spread like wildfire. A ban on under-16s came into effect down under in December 2025, and since then another 41 countries have either implemented their own or begun taking actions in that direction.

There’s no denying the policy is a controversial one. On one side, you have parents and advocates of children’s safety pointing to the harms of social media addiction and the type of content that can be pushed at teens when they use the platforms. Pushing back against them are privacy advocates and digital rights campaigners who worry about how all that data to verify people’s ages is going to be used and whether it makes sense to limit young people’s access to online spaces altogether.

Maybe there was a day when social media was all it once claimed to be — an altruistic means of connecting people so they could keep in touch, engage with their community, be more informed, and maybe even push for positive change. But that is clearly not how these platforms operate today.

If you appreciate analysis like this of the tech industry, become a paying subscriber. I can only do this work because of the support of readers like you.

Become a subscriber

As the pressure to grow their user bases, accelerate engagement, and increase profits intensified, so too did unethical behaviors designed to keep people on the platforms for longer periods of time. It included serving users content to keep them coming back, sometimes to push them toward political extremes or even make them feel bad about themselves in relation to others.

There’s no doubt in my mind that modern social media is a toxic product that is long overdue for regulation. The question is whether higher age limits and stricter enforcement of them is the right way to achieve that.

Social media must be reined in
Countries are adopting higher age limits, but they need to tackle addictive design practices that target everyone

I’ve been quite clear from the beginning that I’m not inherently opposed to making it harder for young people to access social media platforms, given the negative personal and social effects they have. After years of handwringing, I felt we needed to start taking swings — even if they were imperfect ones. The question for me has always been more centered around whether the policy is effective and is delivering the outcomes we actually want. That’s where I’ve been worried that putting so much focus on age limits was leading us in the wrong direction.

The effectiveness of the Australian legislation so far is debatable. Young people are clearly getting around it in high numbers, but those who point to those figures often miss (or intentionally leave out) how the legislation isn’t yet fully implemented. Australia’s eSafety Commissioner is currently investigating five platforms for potential non-compliance. But even worse is how focusing on an age limits frames the problem as one that narrowly affects youth and potentially shifts energy away from forcing companies to change how platforms are designed.

So many of the features of modern social media platforms were made to keep us engaged and feed us regular dopamine hits, from the infinite scroll of content to like buttons and incessant notifications. Algorithms have been designed over many years to surface content that will keep us hooked, often pulling in things that are sensational and extreme in place of posts from friends or family to ensure we spend more time with our screens, and as a result, looking at ads. There’s no question that has negative implications for young people — but it does for everyone else too.

As I watched the effort to ban youth from social media spread around the world, this was precisely my concern: that the more effective policy would be sidelined for the easier and more populist one. That instead of targeting how the platforms function, we would simply kick off young people and call it a day. I saw that repeated as the debate around age limits finally came to Canada in recent months.

Social media causes more harm than good
We need to stop falling for anti-regulation hysteria if we’re to get control of digital harms

Media coverage made it seem that an age limit would be central to provincial and federal efforts to address the harms of social media. I began speaking out against seeing that policy as a silver bullet and the need for measures focused on platform design and algorithmic amplification in addition to the age limit, if not in place of it. But when the federal government finally rolled out its Safe Social Media Act on June 10, I was pleasantly surprised at the nuanced positions it took on the issue.

The media focused on the higher age limit — it’s been happening in other parts of the world and is easier for people not well-versed in tech policy to understand, including many journalists — but it was not really the centerpiece of the legislation. If anything, the age limit serves as a stick to get companies to comply with a broader set of design standards meant to make their platforms safer for younger users. Unlike in the Australian legislation, if platforms make those changes, they can win an exemption from the age limit.

One of the problem is that the focus is on changing how platforms operate for younger users, when many of those “safer by design” standards should apply regardless of a user’s age to reduce the addictiveness, mental health impacts, and broader antisocial nature of what we call “social” media. The Canadian legislation also targets various types of harmful content that can spread on platforms, including those that sexualize children or incite violence, proposes the creation of a Digital Safety Commission that sounds not unlike Australia’s eSafety Commissioner, and begins to extend some of those standards and responsibilities to AI chatbots.

This is not just a Canadian phenomenon. Australia, having been a pioneer on the social media age limits, is also rolling out a “digital duty of care” for social media platforms that will include an expectation that platforms be “safe by design.” Earlier this year, Brazil’s Digital Statute of Children and Adolescents came into force too, setting age limitations on social media paired with prohibitions on addictive design choices like infinite scroll and video autoplay.

X shows why stricter tech regulation is necessary
We need comprehensive rules on social media far more than age limits

These developments make me more hopeful than I expected to be upon seeing the Canadian legislation. There are still a lot of questions that need to be answered about how precisely the different aspects of the plan will work, but to me it shows that the perfect is the enemy of the good and ultimately leaves the major tech companies off the hook for the harms they’re causing.

There are clearly problems with social media age limits, but the experimentation with that policy got the ball rolling and also got the public engaged in talking about the issue. Just six months after Australia’s implementation of its age limit, we’re already seeing other countries learn from their experience and improve their own social media legislation in response, including by focusing more on those design and algorithmic interventions.

I found McGill University professor Taylor Owen’s breakdown of the Canadian legislation instructive on this front:

It brings together what has worked in peer democracies. From Britain, design rules that make products safe for kids by default and a duty of care. From the European Union, risk assessments, transparency requirements, and data access for independent researchers. From Australia, a narrow takedown obligation for child sexual abuse material and non-consensual intimate images, removed within 24 hours. And a strong independent regulator with power to enforce it all. This approach learns the right lessons from a decade of other governments’ trial and error. But this bill adds two genuinely new elements: conditional age restrictions, and the inclusion of AI chatbots.

In short, it learns from other jurisdictions while moving the ball forward in other ways for its peers to learn from too. There is still work to be done and issues to work out, but policy experimentation rather than endlessly debating the perfect solution while getting nowhere is the way to actually make progress on reining in the power of major tech companies. I feel more than ever that the voices that act primarily to criticize and delay action are helping the tech companies avoid accountability, even though they often claim to be doing otherwise.

Taking on the power of the US tech giants will be a marathon, not a sprint, but getting to the finish line requires us to actually start the race. Now that we have, we can improve as we go. Doing so requires us to push our governments to do better, but we shouldn’t ignore the signs that they are receptive to expert voices — and of learning from one another. It should have happened years ago, but we should take what we can get, and make sure we don’t make the same mistake of waiting far too long to take on the harms of AI chatbots too.

If you appreciate analysis like this of the tech industry, become a paying subscriber. I can only do this work because of the support of readers like you.

Become a subscriber
🔲 ☆

Why selling personal data is a bad idea

Prompt: “a field of many different kinds of people being harvested by machines and turned into bales of fertilizer.” Via Microsoft CoPilot | Designer.

This post is for the benefit of anyone wondering about, researching, or going into business on the proposition that selling one’s own personal data is a good idea. Here are some of my learnings from having studied this proposition myself for the last twenty years or more.

  1. The business does exist. See eleven companies in Markets for personal data listed among many other VRM-ish businesses on the ProjectVRM wiki.
  2. The business category harvesting the most personal data is adtech (aka ad tech and “programmatic”) advertising, which is the surveillance-based side of the advertising business. It is at the heart of what Shoshana Zuboff calls surveillance capitalism, and is now most of what advertising has become online. It’s roughly a trillion-dollar business. It is also nothing like advertising of the Mad Men kind. (Credit where due: old-fashioned advertising, aimed at whole populations, gave us nearly all the brand names known to the world). As I put it in Separating Advertising’s Wheat and Chaff, Madison Avenue fell asleep, direct response marketing ate its brain, and it woke up as an alien replica of itself.
  3. Adtech pays nothing to people for their data or data about them. Not personally. Google may pay carriers for traffic data harvested from phones, and corporate customers of auctioned personal data may pay publishers for moments in which ads can be placed in front of tracked individuals’ ears or eyeballs. Still, none of that money has ever gone to individuals for any reason, including compensation for the insults and inconveniences the system requires. So there is little if any existing infrastructure on which paying people for personal data can be scaffolded up. Nor are there any policy motivations. In fact,
  4. Regulations have done nothing to slow down the juggernaut of growth in the adtech industry. For Google, Facebook, and other adtech giants, paying huge fines for violations (of the GDPR, the CCPA, the DMA, or whatever) is just the cost of doing business. The GDPR compliance services business is also in the multi-$billion range, and growing fast. In fact,
  5. Regulations have made the experience of using the Web worse for everyone. Thank the GDPR for all the consent notices subtracting value from every website you visit while adding cognitive overhead and other costs to site visitors and operators. In nearly every case, these notices are ways for site operators to obey the letter of the GDPR while violating its spirit. And, although all these agreements are contracts, you have no record of what you’ve agreed to. So they are worse than worthless.
  6. Tracking people without their clear and conscious invitation or a court order is wrong on its face. Period. Full stop. That tracking is The Way Things Are Done online does not make it right, any more than driving drunk or smoking in crowded elevators was just fine in the 1950s. When the Digital Age matures, decades from now, we will look back on our current time as one thick with extreme moral compromises that were finally corrected after the downsides became clear and more ethically sound technologies and economies came along. One of those corrections will be increasing personal agency rather than just corporate capacities. In fact,
  7. Increasing personal independence and agency will be good for markets, because free customers are more valuable than captive ones. Having ways to gather, keep, and make use of personal data is an essential first step toward that goal. We have made very little progress in that direction so far. (Yes, there are lots of good projects listed here, but there we still a long way to go.)
  8. Businesses being “user-centric” will do nothing to increase customers’ value to themselves and the marketplace. First, as long as we remain mere “users” of others’ systems, we will be in a subordinate and dependent role. While there are lots of things we can do in that role, we will be able to do far more if we are free and independent agents. Because of that,
  9. We need technologies that create and increase personal independence and agency. Personal data stores (aka warehouses, vaults, clouds, life management platforms, lockers, and pods) are one step toward doing that. Many have been around for a long time: ProjectVRM currently lists thirty-three under the Personal Data Stores heading. Some have been there a long time. The problem with all of them is that they are still too focused on what people do as social beings in the Web 2.0 world, rather than on what they can do for themselves, both to become more well-adjusted human beings and more valuable customers in the marketplace. For that,
  10. It will help to have independent personal AIs. These are AI systems that work for us, exclusively. None exist yet. When they do, they  will help us manage the personal data that fully matters:
    • Contacts—records and relationships
    • Calendars—where we’ve been, what we’ve done, with whom, where, and when
    • Health records and relationships with providers, going back all the way
    • Financial records and relationships, including past and present obligations
    • Property we have and where it is, including all the small stuff
    • Shopping—what we’ve bought, plan to buy, or might be thinking about,
    • Subscriptions—what we’re paying for, when they end or renew, what kind of deal we’re locked into, and what better ones might be out there.
    • Travel—Where we’ve been, what we’ve done, with whom, and when

Personal AIs are today where personal computers were fifty years ago. Nearly all the AI news today is about modern mainframe businesses: giants with massive data centers churning away on ingested data of all kinds. But some of these models are open sourced and can be made available to any of us for our own purposes, such as dealing with the abundance of data in our own lives that is mostly out of control. Some of it has never been digitized. With AI help it could be.

I’m in a time crunch right now. So, if you’re with me this far, read We can do better than selling our data, which I wrote in 2018 and remains as valid as ever. Or dig The Intention Economy: When Customers Take Charge (Harvard Business Review Press, 2012), which Tim Berners Lee says inspired Solid. I’m thinking about following it up. If you’re interested in seeing that happen, let me know.

❌