Minnesota Law Requires Platforms to Monitor and Age-Estimate All Users

Governor Tim Walz signed House File 4138 on Tuesday, turning Minnesota into the latest state to demand that social media platforms profile every user who logs on.

The law, which takes effect in July 2027, forces platforms with at least 10,000 account holders or $1 billion in annual revenue to estimate the age of all Minnesota users, obtain parental consent before anyone under 16 can hold an account, and disable a list of features the legislature has labeled “addictive.” It passed the state House 132-2 and the Senate 66-0.

We obtained a copy of the bill for you here.

The bipartisan consensus is remarkable given what the bill actually requires. Buried beneath the child protection language is a surveillance apparatus that applies to every user, not just minors.

When you create an account on a covered platform, the law demands you declare your month and year of birth. That’s just the beginning. Once you’ve spent 25 hours on the platform within six months, the company has 14 days to estimate your age using “reasonable efforts, taking into consideration available technology and the data in the possession of the covered social media platform.”

If the platform can’t reach 80% confidence that you’re 16 or older, you get classified as a child and locked into restricted mode.

Hit 50 hours, and the confidence threshold rises to 90%. Still not verified? The age estimation repeats every six months for the first seven years your account exists, or more often if the platform runs any demographic analytics on your profile.

That means platforms are legally required to continuously analyze how you behave, what content you engage with, and who you communicate with for the better part of a decade. The law creates an obligation to surveil that didn’t exist before.

The mechanisms available for “verifiable parental consent” come from the COPPA 1.0 framework which speaks volumes about the privacy costs this law is willing to impose.

Parents can sign a consent form, hand over credit card information, submit a copy of a government-issued ID alongside a face scan, or verify their identity through video conferencing.

Each method requires collecting and processing sensitive personal data from both the parent and the child. Platforms now have a legal incentive to build identity verification systems that harvest government documents and biometric information from families who want nothing more than to let their kid use an app.

Sen. Erin Maye Quade, who sponsored the bill in the Senate, tried to distinguish this approach from hard ID checks, saying Minnesota relies on “age estimation” where platforms “use data points such as the content a person consumes and posts to estimate the age of users.”

That’s supposed to be the privacy-friendly alternative. Platforms watch what you read, who you talk to, and how you engage with content, then feed those behavioral signals into algorithms that guess your age. It’s behavioral surveillance dressed as something softer because it doesn’t require you to upload a driver’s license.

The content restrictions applied to child accounts strip out infinite scrolling, autoplay video, profile-based feeds, targeted advertising, and push notifications. Accounts default to maximum privacy settings with parental monitoring and usage limits. These provisions sound protective in isolation, but they only function because the law compels platforms to build the profiling systems needed to identify which users are children. You can’t restrict a child’s account without first building the apparatus to classify every account.

The law also carries a provision that has nothing to do with protecting children and everything to do with turning platforms into government informants. If a covered platform “becomes aware of any information that a mass violence event is threatened, or has taken place, is taking place, or is likely to take place” in Minnesota, it must report its suspicions to the Minnesota Fusion Center and provide “all relevant information available” within 24 hours.

The MNFC is a state-run intelligence sharing hub that coordinates between local, state, and federal law enforcement. The law now requires social media companies to scan publicly available content and funnel it directly to an intelligence apparatus that has faced years of scrutiny over its surveillance practices and lack of transparency.

Walz framed the law as parental empowerment, not government-backed mass surveillance. “As social media becomes more advanced, we need to make sure our families don’t fall victim to the powerful companies that use kids as a testing ground to make algorithms more addictive,” he said in a statement.

“Privacy and safety have to come first.” The claim that privacy comes first is difficult to reconcile with a law that mandates continuous behavioral profiling of everyone on a platform to determine whether they might be a minor.

The law gives platforms until July 2027 to comply, which is enough time to build the behavioral analysis and identity verification systems the law demands but not enough time to solve the fundamental contradiction at its core.