Governor Tim Walz signed legislation this week that orders social media platforms to guess every user's age, disable features lawmakers deem "addictive" for minors, and report potential mass-violence threats to a state intelligence center, requirements that civil liberties critics say amount to a digital surveillance mandate applied to millions of adults and children alike.
House File 3148, which the Minnesota Legislature approved with only two dissenting votes in the House and zero in the Senate, takes effect in July 2027. The near-unanimous tally might suggest the bill is modest and uncontroversial. It is neither.
Beneath the familiar banner of child safety lies a set of mandates so technically demanding, so sweeping in scope, and so indifferent to privacy trade-offs that the law deserves far more scrutiny than the Minnesota Capitol apparently gave it before sending it to Walz's desk.
The statute, as reported by Just the News, applies to any platform with as few as 10,000 users or that has earned $1 billion globally in one or more of the preceding three years. That second threshold covers the usual suspects, Meta, TikTok, YouTube. The first threshold reaches far smaller communities: niche forums, hobbyist networks, and upstart competitors with a fraction of Big Tech's resources.
Once a user has spent 25 hours on a platform within a six-month window, the company has two weeks to estimate that person's age using "reasonable efforts." If the platform is at least 80 percent confident the user is 16 or older, it may treat the account holder as an adult. If not, the platform must treat the user as a child, obtain "verifiable parental consent" before maintaining the account, and set all privacy defaults to their most restrictive levels.
The obligations escalate. At 50 hours of use within six months, the platform must re-estimate the user's age, this time with 90 percent confidence before it can classify someone as an adult.
Platforms must update those age estimates every six months, or more frequently if they apply "any form of data analytics or artificial intelligence" to update estimates of "any other demographic characteristics of the account holder for any reason, whichever period is shorter." They may stop guessing only after an account has existed for seven years.
Seven years of mandatory behavioral profiling. That is what the Minnesota Legislature voted for almost unanimously.
The civil liberties group Reclaim the Net offered a blunt assessment of what HF 3148 creates in practice. The group noted the overwhelming bipartisan support and contrasted it with the bill's actual contents:
"The bipartisan consensus is remarkable given what the bill actually requires."
Reclaim the Net went further, warning that the child-protection framing obscures a much broader surveillance architecture:
"Buried beneath the child protection language is a surveillance apparatus that applies to every user, not just minors."
That point deserves emphasis. To determine whether any given user is a child, a platform must analyze the behavior of every user, adult and minor alike. The law does not limit data collection to accounts flagged as potentially underage. It requires platforms to monitor usage hours, engagement patterns, and communication activity across their entire user base.
Reclaim the Net described the practical effect in stark terms, stating that platforms would need to "continuously analyze how you behave, what content you engage with, and who you communicate with for the better part of a decade." The group added: "The law creates an obligation to surveil that didn't exist before."
The identity-verification component raises its own concerns. Reclaim the Net flagged what it called "identity verification systems that harvest government documents and biometric information from families who want nothing more than to let their kid use an app." In other words, parents who try to comply with the law's parental-consent requirements may end up handing over driver's licenses, passports, or facial scans to the same tech companies many Americans already distrust with their data.
HF 3148 also prohibits platforms from presenting what it calls "addictive interface features" to children. The banned list includes infinite scroll, push notifications, autoplay, "personal metrics" showing engagement with a user's content, and "targeted paid commercial advertising." In an era when lawmakers increasingly pass sweeping measures with near-unanimous votes, it is worth asking whether any legislator paused to consider the technical and constitutional implications of defining product design choices as inherently addictive by statute.
Push notifications, for instance, are how platforms deliver breaking news alerts, school-closure notices, and messages from family members. Autoplay is how educational video channels keep content flowing for students. Infinite scroll is a basic interface pattern used by virtually every modern website and app, from news outlets to government portals.
Labeling these features "addictive" by legislative fiat, and banning them for anyone the platform cannot confirm with high statistical confidence is over 16, is not a surgical intervention. It is a blunt instrument that treats routine software design as a controlled substance.
Tucked into the same bill is a separate mandate: platforms that become "aware of any information that a mass violence event is threatened, or has taken place, is taking place, or is likely to take place" in Minnesota must report it within 24 hours to the Minnesota Fusion Center, a body that coordinates intelligence-sharing between local, state, and federal law enforcement.
The provision raises immediate questions about scope and liability. What constitutes "awareness"? Does a single user's hyperbolic post trigger a reporting obligation? What standard of review must the platform apply before forwarding content to a law-enforcement intelligence hub? The bill's text, at least as described in available reporting, does not appear to answer those questions with precision. And the consequences of over-reporting, flooding a fusion center with low-quality tips while conditioning platforms to act as unpaid intelligence analysts, are not trivial.
When states pass laws that attach real-world consequences to identity verification, the details of implementation matter enormously. Minnesota's Legislature does not appear to have sweated those details.
Governor Walz signed HF 3148 without any public statement quoted in available coverage. The silence is itself notable. When a governor signs a bill that imposes novel surveillance obligations on an entire industry and affects every resident who uses social media, the public deserves to hear the executive's reasoning, not just a signature.
The Legislature's near-total unanimity, only two House members voted no, and the Senate approved the bill without a single dissent, suggests either genuine consensus or a political environment in which no lawmaker wanted to be cast as soft on child safety, regardless of the bill's operational realities. The pattern is familiar: government officials routinely invoke public safety to justify expansive new powers, and legislators who raise concerns risk being accused of siding with the threat rather than the victims.
But good intentions do not make good law. A bill that compels every social media platform, down to those with just 10,000 users, to build and maintain a continuous age-estimation pipeline for seven years per account is not a targeted child-protection measure. It is an unfunded surveillance mandate dressed in the language of parental empowerment.
The law takes effect in roughly 13 months. Between now and July 2027, platforms, parents, and privacy advocates will need answers to questions the Legislature apparently did not resolve. How will small platforms with 10,000 users afford to build age-estimation systems that meet the law's confidence thresholds? What "reasonable efforts" satisfy the statute, and who decides? Will the parental-consent verification process create a honeypot of government documents and biometric data sitting on private servers? And will the mass-violence reporting requirement produce actionable intelligence or bureaucratic noise?
These are not hypothetical concerns. They are operational realities that will determine whether HF 3148 protects children or simply creates a new compliance industry while expanding the digital surveillance footprint of every Minnesotan who logs on to social media.
The debate over children's safety online is real and important. But when public figures and lawmakers wrap expansive mandates in feel-good language, voters deserve someone willing to read the fine print. In Minnesota, apparently, that someone was not in the state Senate.
Protecting kids from genuine online harm is a worthy goal. Building a seven-year surveillance machine that monitors every user on every platform to get there is not protection, it is overreach with a permission slip.
