Written by Sally Vazquez-Castellanos, Esq., Shareholder and Attorney at Castellanos & Associates, APLC, located in Los Angeles, California.
Published, March 26, 2025. Revised, May 13, 2025.
“Newsom Signs Bill That Adds Protections for Children on Social Media,” a New York Times article written by Shawn Hubler and Amy Qin, published on September 21, 2024, reports on a legislative attempt to deal with concerns over cell phone and social media usage and their impact on adolescents’ mental health.
The law tackles important societal harms caused by the products and services of technology companies. These concerns are as monstrous as the individuals intentionally engaging in predatory behavior.
According to the article, the law signed by Governor Newsom requires technology companies to make posts on the feeds of children’s social media accounts appear in chronological order by default, rather than permitting the algorithm on a child’s feed to curate them for maximum engagement.
The law imposes a time limitation that gives technology companies until 2027 to make a determination on whether a user is a minor, and to then apply the required protections. The article states further that the bill also makes notices prohibitive during specific hours of the day.
Hate and violence is spread like wildfires throughout online communities. This is resulting in the imposition of massive fines and equally massive burdens worldwide for many technology giants. The law appears to be part of a nationwide effort to deal with sensitive issues concerning cell phone and social media usage among adolescents. These issues include addiction and the associated psychological impacts on some children.
We must be careful not to blame children and their parents for the reckless predatory behavior of criminal hackers and others who intentionally commit acts of psychological terror and other socially damaging behaviors and acts of violence. These behaviors include spear phishing and hacktivism, harassment and cyberbullying, and so-called ‘anonymous’ mud-slinging that destroys people’s lives and reputations without the intended targets having direct knowledge that they are being destroyed online.
This is today’s internet and it is causing devastating psychological and other harmful societal impacts on people from all walks of life. In some instances, the level of deceit and criminal behavior involved results in real life threats, suicide, violence and doxxing that threatens public safety.
Businesses are uniquely positioned to contribute to communities and to our nation. When your company’s products and services target children on the internet, innovation and product design does not absolve your company or organization from taking all reasonable and appropriate measures to at minimum protect children. In today’s digital economy, large companies are required to protect the personal information of consumers, patients, employees, and children. There may also be a standard for information security that needs to be met. This includes guidelines and regulations across sectors that impose a minimum level of security that meets the ‘reasonableness’ standard for your organization.
As data breaches are increasing, so are costs associated with ransomware and other attacks. According to Verizon’s 2024 Data Breach Investigations report, which I reviewed on BigID’s website, the average cost of a data breach for small business is between $120,000 to $1.24 million. These numbers are staggering and they are enough to cripple most small to mid-size business. The numbers for the so-called big guys and gals are even more frightening. Based on numbers from IBM Security, the global average cost of a data breach in 2024 falls somewhere around $4.88 Million — a 10% increase from 2023 and the highest total reported.
This leads one to conclude that at the very least you should have some idea of what’s ‘reasonable’ for your industry, your IT department, and for your business. It also strongly suggests that you should know what steps to take to make business operations more secure. This includes designing a plan for dealing with a data breach that includes training employees on how to report network intrusions. This also includes making sure employees are aware of the rules of engagement for your business.
Preparation may include reading your insurance policy so that you understand what is and what is not covered. In most instances, businesses are not adequately covered and you need to explore obtaining a separate cyber-insurance policy to protect your company. There may also be other important concerns such as access control and management, website compliance for the collection of personal information online in accordance with the ADA or meeting COPPA guidelines for children, as well as encryption and other new technologies or systems architecture intended to protect consumers.
Most companies are investing in personnel and technology like artificial intelligence to deal with these problems. This resoundingly calls out for the rise of the Chief Privacy Officer or some similar role in many corporations today. Sadly, for small businesses one begins to understand the severity of the problem. It’s really important for everyone to understand that ‘reasonableness’ applied to information security and management does not apply equally among businesses and that criminals (and others) are exploiting these problems.
This is especially true for smaller businesses. These vulnerabilities will continue to impact economies around the world. It’s a global crisis that not only requires a good deal of patience, but it must cause us to consider the efficacy of rushing towards innovation without understanding the ramifications of new technologies like artificial intelligence.
This does beg the question — when was your last privacy impact assessment conducted?
The failure to provide a reasonable level of security to protect personal information has resulted in several high profile consent decrees and large-scale fines for companies worldwide. Clearly, the message for many companies is that how you collect, use, store, share, and how you dispose of personal information matters.
Many large organizations may not be able to escape legal challenges when their products or services are the cause of some harm or injury to an individual’s personal information. Determining the legal standard of ‘reasonableness’ is another important aspect of this problem because in most instances small businesses do not have the knowledge, financing, or the will to meet these challenges in comparison to their much wealthier brethren.
Coincidentally, many large-scale for-profit organizations are struggling to become organized to meet these challenges in an economy that handsomely rewards the motto of “moving fast and breaking things.” As businesses rush towards the implementation of artificial intelligence, we are beginning to see some individuals within organizations stepping up to make the critically important business case for dealing with ethical, moral and other issues before they find themselves reacting to a problem that could cripple an organization or a nation in several important ways.
Brexit, the UK’s withdrawal from the European Union, ushered in a new economic structure throughout Europe. This included the entry of a wave of regulations that included General Data Protection Regulation (GDPR) in the United Kingdom. The significance of GDPR is that the regulation does make privacy a fundamental human right and imposes privacy and data regulations for large-scale businesses.
In the United States, the Constitution envisages privacy differently. In the United States there is also a complicated regulatory scheme where regulations are found across sectors that include banking and finance, healthcare, and telecommunications. California’s Constitution expressly and unequivocally states that privacy is a fundamental right. In a nation with a patchwork of regulations in privacy and data protection, U.S. businesses operate under a regulatory scheme that differs from the United Kingdom.
These laws, regulations and guidelines and increased business risk threaten global operations and place a microscope on all business transactions involving the transfer of data worldwide and among all segments of business operations and transactions. This includes most contractual agreements. There are additional priorities and changes to operations at the U.S. Department of Commerce that must also be considered by multinational corporations, this includes the invalidation of Privacy Shield.
Cross-border transfers of data are also forcing many corporations such as Meta and X to address privacy and data protection issues resulting from FTC consent decrees and enormous fines imposed by overseas regulators and federal and state agencies in the United States. The reality is that companies like Google, X, LinkedIn, Meta, Instagram and others have no choice but to confront many unique challenges while operating globally.
As businesses continue to associate with affiliates, service providers and other online providers and properties, the stakes get higher for many organizations operating in the digital economy making it important to train business units such as human resources, legal, IT, employees and corporate stakeholders on areas such as privacy and data protection law, cyber-hygiene and cyber-incident planning, data breach response, and other sensitive issues concerning cross-border transfers.
In the early days of the internet, Section 230 of the Communications Decency Act provided (and still provides) an important shield to internet platforms enabling a breathtaking global economic expansion around the world. It also may have contributed to a staggering bust in our nation’s economy.
Connecting Consumers, employees, corporations, affiliates, partners, and service providers poses many unique challenges in today’s digital economy. The business risks can’t be ignored and with the emergence of artificial intelligence comes greater moral and social imperatives not just for U.S. companies but also for society.
In the middle of all of this wonderful technological innovation, we as a society must address the moral dilemma of how parents can raise healthy children in an information age that is outpacing traditional legal jurisprudence. If your children are attending an educational institution requiring a smart device; And, even if they do not, you may understand some of the moral and societal dilemmas we are facing.
The reality is that we are dealing with far more than a child’s physical safety on and offline. There is something far more dangerous that parents, educators, and others have not considered. We must also consider the ramifications of failing to safeguard children’s data online and understand how that information could be used to inflict psychological harm to a child at a time of critical development leading to a national crisis such as Columbine or Sandy Hook.
Corporate responsibility and privacy by design are all wonderful concepts but they are rendered meaningless in a society where there is no consensus on how to deal with these problems. In fact, when we are dealing with anonymous mud-slinging and other rather serious issues that include spear-phishing and other targeting of individuals online, how can we begin to address the issues that go beyond the obvious of blaming technology and the innovators.
I do believe that we need to begin an important conversation with many technology leaders to find solutions that can address safety for children and others with respect to the use of many new and high technologies. Perhaps, civility is a good place to start. I would go even further to say that many parents, educators, prosecutors, law enforcement and others need to have a better understanding of technology and innovation before they use and promote these products and services for their respective institutions.
We are all beholden to the smart phone and other innovative new technologies. In many instances, our children and economy will be lost without technological change and innovation. At the same time, we cannot ignore the important psychological and other societal harms that can be caused using these technologies.