Social media activity and usage
Estimation of the population active on social media in 2023* *Source
Platforms ranked by usage in 2023*
1. Facebook
2. YouTube
3. Instagram
4. TikTok
5. SnapChat
Current laws and regulations relevant to social media
Federal Trade Commission Act (FTC Act)
Section 5 of the FTC Act is one of the Federal government’s most powerful tools to protect consumers. The law prohibits unfair or deceptive acts or practices in or affecting commerce (15 U.S.C. § 45.). With respect to social media companies, the agency’s enforcement actions have signaled a strong interest in protecting consumers’ privacy. Practices likely to be deemed unfair include failure to adequately protect consumers’ personal data or providing inadequate disclosures to the public in privacy policies. Deceptive practices can include misrepresenting the extent to which consumers can control their data and failing to comply with representations made in privacy policies.
Social Media Influencers
Using social media influencers for marketing purposes involves a mix of legal and ethical considerations. While there isn’t a specific federal law dedicated solely to influencer marketing, several regulations and guidelines come into play when US companies collaborate with social media influencers. The FTC has issued guidelines that apply to influencer marketing (Source). For example, if an influencer receives compensation (monetary or non-monetary) for promoting a product or service, they must disclose this relationship clearly and conspicuously. Misleading or deceptive practices, such as not disclosing a paid partnership, can have legal consequences and harm a company’s reputation. The FTC requires influencers to disclose any “material connection” they have with a company or brand they promote. When collaborating with influencers, companies should have well-drafted agreements that outline the scope of work, compensation, disclosure requirements, intellectual property rights, and any other relevant terms. Depending on the industry, there might be specific regulations or guidelines that influencers and companies need to follow. For example, industries like healthcare and finance have stricter regulations regarding endorsements and claims. States and local jurisdictions may have additional regulations or requirements related to influencer marketing.
Section 230 of the Communications Decency Act (Section 230)
In terms of online speech, perhaps the most significant federal law governing social media companies is Section 230 of the Communications Decency Act. Section 230 provides that no “interactive computer service” shall be treated as the publisher or speaker of any information provided by another information content provider (47 U.S.C. § 230.). Thus, subject to a few exceptions, it shields social media companies from liability based on third-party content (i.e. the content that their users post). The law also shields companies if they choose to remove content from their platforms (Id.).
Digital Millennium Copyright Act (DMCA)
Section 512 of the DMCA shields online service providers from potential legal liability for copyright infringement that occurs on their platforms (Source). In order for the safe harbor to apply, service providers must, upon becoming aware of infringing content, act expeditiously to remove it from their site. The service provider must designate an agent to receive notifications of claimed infringement, provide the agent’s contact information on its website and register the agent with the US Copyright Office (17 U.S.C. § 512(c).).
US Constitution
Social media’s popularity in the US may be due, in part, to the country’s storied commitment to free speech. While it is clear that the US Constitution protects individuals’ right to free expression, whether the First Amendment of the US Constitution protects a social media company’s ability to moderate content on its site is a more novel question that is currently being tested in federal court. This deeply held value of free speech in the US coupled with social media platforms’ desire to moderate content on their sites is sparking national conversation about how and to what extent federal and state agencies may regulate social media companies’ policies regarding users’ speech.
Data protection laws applicable to social media
Federal Privacy Law
There is currently no federal comprehensive, cross-sector data privacy law in the US.
State Privacy Laws
Individual US states have enacted their own consumer privacy laws. The following fifteen state-level laws have been passed as of the latest update to this guide:
- CCPA, as amended by the California Privacy Rights Act
- Colorado Privacy Act
- Connecticut Data Privacy Act
- Delaware Personal Data Privacy Act
- Florida Digital Bill of Rights
- Indiana Consumer Data Protection Act
- Iowa Consumer Data Protection Act
- Montana Consumer Data Protection Act
- New Hampshire Data Privacy Law (SB 255)
- New Jersey Data Privacy Law (SB 332)
- Oregon Consumer Privacy Act
- Tennessee Information Protection Act
- Texas Data Privacy and Security Act
- Utah Consumer Privacy Act
- Virginia Consumer Data Protection Act
Several of these laws are currently effective while the he rest will become effective at various times over the next few years, with the latest set to take effect in 2026. These laws are similar to the EU GDPR in that they set forth a comprehensive set of requirements related to the protection and security of consumers’ personal data as well as provide consumers with specific rights. Consumer rights generally include the right to access, right to correct, right to delete, right to portability, right to opt out of sale and right to nondiscrimination. In addition, the majority of the state laws require detailed consumer privacy notices, data processing agreements and, under specified circumstances, data protection impact assessments.
International Transfers
Unlike the EU GDPR or UK GDPR, current US state consumer privacy laws do not place restrictions on the transfer of personal data outside the US.
Children’s Online Privacy Protection Act (COPPA)
COPPA was enacted to protect children’s safety and privacy on the internet. The law requires operators of websites and online services directed to children or any operator that has actual knowledge it is collecting personal information from a child to, among other things, (1) include a privacy policy on its website explaining its data practices related to children’s data; (2) obtain verifiable parental consent for the collection, use or disclosure of children’s personal data; and (3) upon a parent’s request, disclose information about the types of personal information collected from the child (15 U.S.C. § 6502.).
Legislative developments on the horizon
In the US, social media legislative trends signal an increasing focus on online speech, youth, and a continued desire to protect consumers’ privacy.
Section 230 reform
Over the past couple of years, multiple bills have been proposed in both Congress and state legislatures seeking to regulate social media companies in general and, in particular, such companies’ content moderation policies. At the Federal level, most conversations focus on Section 230 reform, with some lawmakers calling for it to be amended or repealed due to “censorship” concerns, while others are concerned it doesn’t do enough to ensure the removal of harmful content. In a pair of opinions decided in May 2023, the US Supreme Court declined to hold technology platforms liable for aiding terrorism under the Justice Against Sponsors of Terrorism Act because of content posted by their users, but avoided analyzing Section 230’s protections for social media companies. (Twitter, Inc. v. Taamneh et al., 598 U.S. ____ (2023); Gonzalez v. Google LLC, 598 U.S. ____ (2023).)
Social Media Access by Minors
There is a growing trend among states to regulate access by minors to social media platforms. (E.g., Tex. Bus. & Com. Code §§ 509.001- 501.152; 2023 Ark. ALS 689; ORC Ann. §§1347.01- 1347.99; 2023 Bill Text LA H.B. 61; 2023 Bill Text LA S.B. 162; Utah Code Ann. Title 13, Ch. 63 §§101- 501.) These laws require social media companies (as defined by the law) to obtain parental consent before allowing minors (typically under 18 or 16 years old) to create an account. Many also impose requirements around age verification of all users on the platform. Certain of them contain a private right of action in addition to regulatory enforcement. The majority of these laws are set to take effect in 2024 although several are temporarily blocked due to legal challenges.
Age Appropriate Design Codes
California’s Age Appropriate Design Code applies to any covered businesses offering online services, products, or features likely to be accessed by children under 18 years old. (2022 Cal ALS 320.) Design obligations include, but are not limited to, configuring default privacy settings to a “high level” of privacy and providing an “obvious signal” to the child if the online service allows parents to track their online activity. The law was originally set to take effect on July 1, 2024 but its enforcement was blocked in September 2023 pending a legal challenge. Florida recently passed a similar law. (Fla. Stat. §§ 501.0001- 501.1735.)
State User Content regulation
At the state level, two laws—Florida’s SB 7072 and Texas’ HB 20—have been passed and aim to ban social media companies from regulating users’ content. In May 2022, the US Court of Appeals for the 11th Circuit decided to uphold the injunction placed on Florida’s law. In doing so, the court held that social media companies are private actors whose rights the First Amendment protects. (NetChoice, LLC v. AG, Fla., 34 F.4th 1196 (11th Cir. May 23, 2022).) In September 2022, the Fifth Circuit made an opposite ruling by rejecting the idea that the First Amendment always protects companies’ decisions regarding content moderation. (NetChoice, LLC v. Paxton, 49 F.4th 439 (5th Cir. Sept. 16, 2022).) Both cases were appealed to the Supreme Court, which heard arguments for the cases in February 2024. It remains to be seen how the Court will resolve this circuit court split.
Consumer privacy developments
In addition to online speech regulation, federal and state legislatures have demonstrated a keen interest in regulating social media companies’ processing of consumers’ personal data. As noted in the US data protection section, there are currently 15 states with consumer protection laws, with more state laws (if they are not already in draft) expected. Although the passage of a federal data privacy law does not appear imminent, businesses should stay aware of congressional and agency developments in this area, as it remains a key area of interest for regulators and consumers at all levels, both federal and state specific.
Federal data protection law
At the federal level, during the summer of 2022, some progress was made when the proposed American Data Privacy and Protection Act advanced out of the Committee on Energy and Commerce. But it failed to advance to the House or Senate floor. It remains to be seen whether any further meaningful action will be taken on this or other privacy-related bills in the near future. In the meantime, the FTC has signaled it may issue consumer data privacy regulations, but as with the federal bill, it could be years before any such regulations are promulgated.
Contributors
Michael Bahar
Partner, Co-Lead of Global Cybersecurity and Data Privacy, Washington DC
E: michaelbahar@eversheds-sutherland.com T: +1 202 383 0882
© Eversheds Sutherland. All rights reserved. Eversheds Sutherland is a global provider of legal and other services operating through various separate and distinct legal entities. Eversheds Sutherland is the name and brand under which the members of Eversheds Sutherland Limited (Eversheds Sutherland (International) LLP and Eversheds Sutherland (US) LLP) and their respective controlled, managed and affiliated firms and the members of Eversheds Sutherland (Europe) Limited (each an "Eversheds Sutherland Entity" and together the "Eversheds Sutherland Entities") provide legal or other services to clients around the world. Eversheds Sutherland Entities are constituted and regulated in accordance with relevant local regulatory and legal requirements and operate in accordance with their locally registered names. The use of the name Eversheds Sutherland, is for description purposes only and does not imply that the Eversheds Sutherland Entities are in a partnership or are part of a global LLP. The responsibility for the provision of services to the client is defined in the terms of engagement between the instructed firm and the client.
Share this