Hector recently graduated from UC Berkeley and is anxious about his upcoming job interview. He is about to enter the adult world. But he has also got a bigger problem: When he was 17, he was not as wise as he is now at the ripe ol' age of 22. Back then, he posted unfortunate photos of himself drinking at high school parties and made comments on the message boards of news websites that he would like to take back. These pictures and comments will be the top results when his future employers look for his name on Google search. What can he do about his teenage indiscretions?
Earlier this year, California seemingly came to Hector's rescue with its Eraser Law (officially the Privacy Rights for California Minors in the Digital World, Business and Professions Code Sections 22580-22582). The law requires website and mobile app operators to provide anyone under 18 with (i) the ability to remove or request removal of content that the minor posted on the website or mobile app; (ii) notice and clear instruction on how to do so; and (iii) notice that such removal may not remove all traces of such posting.
For the removal requirement, operators can comply by making the original content invisible to other users or the public, even if it remains on the operator's servers or if a third party has copied the content and made it available elsewhere on the operator's site. Operators may not have to comply with the removal requirement if: (i) federal or state law requires maintenance of the content or information; (ii) the content was stored or posted (or reposted) by a third party other than the minor; (iii) the operator anonymizes the content or information so that the minor cannot be identified; (iv) the minor received compensation or other consideration for providing the content; or (v) the minor does not follow the instructions provided by the operator to request removal of content.
While the law has understandable goals, it raises a number of uncertainties for both Hector and operators. The Eraser Law has a number of parallels with existing intellectual property laws that can guide interpretation and application of the law, and that may also be of interest to intellectual property lawyers and owners.
Where should an operator post the notice of its takedown procedures? The most common place to add the required notice and clear instruction on how to take down a minor's posting is either on an operator's privacy page or its terms of service page. If the operator already has a Digital Millennium Copyright Act (DMCA) notice procedure in place, the operator can either add the Eraser Law notice under the DMCA notice, or the operator can fold the Eraser Law notice into the existing DMCA notice procedures.
Who can request removal? Only "registered users" can take advantage of the law, but the law does not define what a "registered user" means. Could "registered users" include someone who posts a comment on a news article and provides his real name (and email address)? Or is a more formal sign-up process required? Operators should be cautious not to read the "registered users" provision too narrowly. But because of this "registered users" definition, the applicability of the law is narrower than the DMCA, which any copyright owner could utilize. (Under the DMCA, even non-users of an operator's website can demand the takedown of allegedly infringing material.)
When can a minor request removal? The law fails to define when a user can request removal of postings he made as a minor. Can Hector, at 22, request removal? Or has he waived any right since he's no longer a minor? The most natural reading of the law is that a user may only request removal while he is a minor. But that requires minors to make adult decisions and to know what they should and should not be posting. This reading is contrary to the law's intent to protect minors from the mistakes of their youth.
Is the law a DMCA side door? Ordinarily, if a minor voluntarily posts a picture, in which the minor owns a copyright, the operator is allowed to host and publish that picture. This use is normally covered by the terms of service of the operator's website and the license granted by the minor to the operator. In this situation, the operator may not be required to take down the picture in response to a DMCA notice. But under California's Eraser Law, even if the minor previously agreed that the operator could host and publish the picture, the operator may still be required to remove the minor's picture from its service.
Additionally, if an operator receives a DMCA takedown notice from a minor (or one regarding a minor's copyrighted content), it should assess whether the notice also complies with its takedown instructions under California's Eraser Law (and vice-versa). There are enough similarities in the takedown procedures that a request under one law may also be sufficient under the other.
Does the law apply to parties outside of California? If non-California operators have to comply with the law because California minors are using their websites, the law is potentially unconstitutional. This reading of the law would violate the Dormant Commerce Clause doctrine, which says that only Congress can regulate interstate commerce. But even if the law applies only to California operators, it would still have national implications, since many of the major Internet companies are in California. The more ambiguous situation arises if an operator has only a small California office not related to its website operations, or if only some of its servers — which do not contain Hector's posts — are in California. Would the law still apply in this context? Without jurisdictional guidance from the law, an operator with some California connection should evaluate the cost of compliance versus the risk and cost of a future lawsuit.
Some of these Commerce Clause issues may be resolved by an amendment of the Children's Online Privacy Protection Act (COPPA). Earlier this year, Senator Robert Menendez introduced Senate Bill 547, which would amend COPPA to include notice and takedown provisions similar to those in California's Eraser Law. The proposed amendment also extends some COPPA protections to minors under 16. Given Menendez's recent indictment, it will be interesting to see if another senator pushes the amendment forward or if it stalls in committee. But even if these extensions become law they would not address the Commerce Clause issues for 16- and 17-year-olds.
Is the law effective? The Eraser Law is likely to give minors a false sense of security and the belief that they can later remove anything they post. But the Internet never forgets. Posted comments and pictures are often reposted by others. This is especially true of the most unfortunate and viral mistakes made by a minor. None of this reposted material needs to be removed by an operator. Additionally, many websites allow their materials to be archived by services like the Internet Archive. Merely removing the user's original post on one operator's site will not always remove the post from the Internet. Similar then to the disclosure of a party's trade secrets, once the information has been publicly disclosed, it is hard to pull it back. Even more, even if an operator failed to comply with California's Eraser Law there may be limited damages to the minor due to this failure to comply. If the post is otherwise readily available through other Internet sources, the operator's continued publishing of the minor's posting does not add that much more damage. But taking down the minor's post may still help Hector where the post was initially seen by his friends, yet it did not ricochet around the Internet. In this common context, removing the original post could be enough to fix a problem with Google search results.
Is the law necessary? Major social media providers, like Twitter and Facebook, already allow users — both young and old — to remove their content. They did not need a new law to require this existing business practice. Unfortunately, the law may have collateral and in terrorem effects beyond existing practices, similar to what we see with DMCA takedown requests. Operators may play it safe and remove content that is not required to be removed, (e.g., posts about one minor by another minor, or a full comment thread). This type of response stifles the variety and openness of voices that is a beneficial hallmark of the Internet.
These issues with California's Eraser Law are only a sampling of the questions the law raises. We need a willing defendant to test the limits of the statute and to answer these questions. It will, however, often be easier for operators to voluntarily comply by updating their privacy policies and removing content as needed, than to litigate.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
