South Carolina Becomes Fifth State to Enact an Age-Appropriate Design Code

This week South Carolina enacted the Age-Appropriate Design Code (AADC), which went into effect immediately. South Carolina is the fifth state to adopt an AADC, and many other state legislatures are currently considering AADC-style bills or other models of platform regulation that focus on privacy and safety by design, like the New York SAFE for Kids Act. Bills that focus on mitigating harm from platform design wisely avoid the pitfalls of other models that would, for example, require parental consent for a minor to access social media or force all users to undergo age verification as a condition to gaining access to an online platform.

Significant provisions of the South Carolina AADC include:

• Duty of care. The law requires covered online services to exercise reasonable care in platform design and use of minors’ personal data.
• Audit requirement. Covered online services must annually issue a public, independent third-party audit describing the covered online service as it pertains to minors.
• Prohibitions. The law prohibits dark patterns, profiling minors, and facilitating targeted advertising to minors.
• Data minimization. Data minimization requirements in the law enhance minors’ privacy protections and lessen data security risks.
• Enforcement. The South Carolina Attorney General will enforce the South Carolina AADC. Additionally, there is a narrow private right of action under the South Carolina Unfair Trade Practice Act to enforce the law’s prohibition on dark patterns.
• Opt outs. The law requires covered online services to provide users with tools to disable certain design features and opt out of personalized recommendation systems.

EPIC recently published the EPIC Model Age-Appropriate Design Code that shares many similar provisions with the South Carolina AADC. Both require covered entities to minimize data collection and use. Both also require businesses to anticipate and minimize the risk of harm from certain design features. While the South Carolina AADC does so through a duty of care, the EPIC Model AADC outlines a specific procedure that companies must undertake to assess and mitigate compulsive use and prohibits high-risk personal data processing and design features for minors. Learn more about EPIC’s Model AADC here.

EPIC regularly advocates for privacy for minors online and platform accountability and governance policies that protect the speech, privacy, anti-discrimination, and safety rights of internet users, including minors. In court, EPIC has filed amicus briefs in cases involving the intersection of privacy, kids’ safety, and First Amendment.