United States: Eraser Laws: Forgetting A Minor's Past To Save His Future

Hector recently graduated from UC Berkeley and is anxious about his upcoming job interview. He is about to enter the adult world. But he has also got a bigger problem: When he was 17, he was not as wise as he is now at the ripe ol' age of 22. Back then, he posted unfortunate photos of himself drinking at high school parties and made comments on the message boards of news websites that he would like to take back. These pictures and comments will be the top results when his future employers search for his name on Google's search engine. What can he do about his teenage indiscretions?

Earlier this year, California seemingly came to Hector's rescue with its Eraser Law (officially the Privacy Rights for California Minors in the Digital World, Business and Professions Code Sections 22580-22582). The law requires website and mobile app operators to provide anyone under 18 with (i) the ability to remove or request removal of content that the minor posted on the website or mobile app; (ii) notice and clear instruction on how to do so; and (iii) notice that such removal may not remove all traces of such posting.

For the removal requirement, operators can comply by making the original content invisible to other users or the public, even if it remains on the operator's servers or if a third party has copied the content and made it available elsewhere on the operator's site. Operators may not have to comply with the removal requirement if: (i) federal or state law requires maintenance of the content or information; (ii) the content was stored or posted (or reposted) by a third party other than the minor; (iii) the operator anonymizes the content or information so that the minor cannot be identified; (iv) the minor received compensation or other consideration for providing the content; or (v) the minor does not follow the instructions provided by operator to request removal of content.

While the law has understandable goals, it raises a number of uncertainties for both Hector and operators.

When can a minor request removal?

The law fails to define when a user can request removal of postings he made as a minor. Can Hector, at 22, request removal? Or has he waived any right since he's no longer a minor? The most natural reading of the law is that a user may only request removal while he is a minor. But that requires minors to make adult decisions and know what they should and should not be posting. This is contrary to the law's intent to protect minors from the mistakes of their youth.

Who can request removal?

Only "registered users" can take advantage of the law, but the law does not define what a "registered user" means. Could registered users mean someone who posts a comment on a news article and provides his real name (and email address)? Or is a more formal sign-up process required? Operators should be cautious not to read the "registered users" provision too narrowly.

Does the law apply to parties outside of California?

If non-California operators have to comply with the law, because California minors are using their websites, the law is potentially unconstitutional. This reading of the law would violate the dormant commerce clause doctrine, which says that only Congress can regulate interstate commerce. But even if the law applies only to California operators, it would still have national implications, since many of the major Internet companies are in California. The more ambiguous situation is if an operator only has a small California office not related to its website operations, or if only some of its servers - which do not contain Hector's posts - are in California. Would the law still apply in this context? Without jurisdictional guidance from the law, an operator with some California connection should evaluate the cost of compliance versus the risk and cost of a future lawsuit.

Some of these commerce clause issues may be resolved by an amendment of the Children's Online Privacy Protection Act (COPPA). Earlier this year, Sen. Robert Menendez introduced Senate Bill 547, which would amend COPPA to include notice and takedown provisions similar to California's Eraser Law. The proposed amendment also extends some COPPA protections to minors under 16. Given Menendez's recent indictment, it will be interesting to see if another senator pushes the amendment forward or if it stalls in committee. But even if these extensions become law; they would not address the commerce clause issues for 16- and 17-year-olds.

Is the law effective?

The law is likely to give minors a false sense of security and the belief that they can later remove anything they post. But the Internet never forgets. Posted comments and pictures are often reposted by others. This is especially true for the most unfortunate and viral mistakes made by a minor. None of this reposted material needs to be removed by the operator. Additionally many websites allow their materials to be archived by services like the Internet Archive. Merely removing the user's original post on one operator's site will not always remove the post from the Internet. But it may help Hector where the post was initially seen by his friends, but it did not ricochet around the Internet. In this common context, removing the original post could be enough to fix a problem with Google search results.

Is the law necessary?

Major social media providers, like Twitter and Facebook, already allow users - both young and old - to remove their content. They did not need a new law to require this existing business practice. Unfortunately, the law may have collateral and in terrorem effects beyond existing practices, similar to what we see with DMCA takedown requests. Operators may play it safe and remove content that is not required to be removed, e.g., posts about one minor by another minor or a full comment thread. This type of response stifles the variety and openness of voices that is a beneficial hallmark of the Internet.

These issues with California's Eraser Law are only a sampling of the questions the law raises. We need a willing defendant to test the limits of the statute and to answer these questions. It will, however, often be easier for operators to voluntarily comply by updating their privacy policies and removing content as needed, than to litigate.

Originally published in the Daily Journal on May 5, 2015.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.