2025 Legislation on Internet Use by Children. According to the National Conference of State Legislatures, as of October 2025, 45 states and Puerto Rico introduced over 300 bills and measures relating to children while using the Internet and Internet-based forms of communication, including social media, and at least 20 states enacted new laws in 2025.

Such legislation included, in part, the creation of study commissions and task forces; establishing age-appropriate design codes and requiring impact assessments; requiring age verification or parental consent to open social media accounts; adding digital and media literacy courses or curriculum for K-12 students; and regulating the use of cellphones in schools.

2024 Mississippi Law and Litigation. In 2024, Mississippi enacted HB 1126, entitled the Walker Montgomery Protecting Children Online Act (Mississippi Act). The Mississippi Act contains provisions substantially similar to the current bill.

In June 2024, NetChoice, LLC (NetChoice), a trade association for Internet companies, filed a complaint and request for preliminary injunction in the United States District Court for the Southern District of Mississippi (District Court) against the Attorney General of Mississippi, seeking to enjoin enforcement of the Mississippi Act on First Amendment protected speech grounds, as well as alleging that the Mississippi Act was unconstitutionally vague under the First and Fourteenth Amendments and preempted by Section 230 of the federal Communications Act of 1934.

In July 2024, the District Court granted NetChoice's request for preliminary injunction. Mississippi appealed the District Court's ruling to the United States District Court of Appeals for the Fifth Circuit (Fifth DCA). In April 2025, the Fifth DCA vacated the preliminary injunction and remanded the case back to the District Court, finding it did not conduct an analysis required by a United States Supreme Court decision and Fifth Circuit precedent.

In June 2025, the District Court again granted NetChoice a preliminary injunction. Mississippi again appealed to the Fifth DCA, which in July 2025 granted Mississippi's request to stay NetChoice's preliminary injunction.

In August 2025, NetChoice filed an emergency application to the United States Supreme Court to reinstate the preliminary injunction. In the same month, the United States Supreme Court denied NetChoice's application. The Mississippi Act currently remains in effect, pending judicial review.

Digital Service Providers. A digital service is defined as a website, an application, a program, or software that collects or processes personal identifying information with Internet connectivity. A digital service provider is defined as a person who:

• owns or operates a digital service;
• determines the purpose of collecting and processing the personal identifying information of users of the digital service; and
• determines the means used to collect and process the personal identifying information of users of the digital service.

Personal identifying information means any information, including sensitive information, that is linked or reasonably linkable to an identified or identifiable individual. It includes pseudonymous information when the information is used by a controller or processor in conjunction with additional information that reasonably links the information to an identified or identifiable individual. It does not include de-identified information or publicly available information.

The bill states it applies only to a digital service provider who provides a digital service that:

• connects users in a manner that allows users to socially interact with other users on the digital service;
• allows a user to create a public, semipublic, or private profile for purposes of signing into and using the digital service; and
• allows a user to create or post content that can be viewed by other users of the digital service, including sharing content on a message board, a chat room, or a landing page, video channel, or main feed that presents to a user content created and posted by other users.

The bill states it does not apply to:

• a digital service provider who processes or maintains user data in connection with the employment, promotion, reassignment, or retention of the user as an employee or independent contractor, to the extent that the user's data is processed or maintained for that purpose;
• a digital service provider's provision of a digital service that facilitates e-mail or direct messaging services, if the digital service facilitates only those services;
• a digital service provider's provision of a digital service that primarily functions to provide a user with access to news, sports, commerce, online video games, or content primarily generated or selected by the digital service provider; and allows chat, comment, or other interactive functionality that is incidental to the digital service; or
• a digital service provider's provision of a digital service that primarily functions to provide a user with access to career development opportunities, including professional networking, job skills, learning certifications; job posting, and application services.

The bill further excludes from a digital service provider an Internet service provider, Internet service provider's affiliate or subsidiary, search engine, or cloud service provider that solely provides access or connection, including through transmission, download, intermediate storage, access software or other service, to an Internet website or to other information or content on the Internet or on a facility, system, or network not under the control of the Internet service provider, provider's affiliate or subsidiary, search engine, or cloud service provider.

Age Registration and Verification for Creating an Account with a Digital Service Provider. A digital service provider may not enter into an agreement with a person to create an account with a digital service unless the person has registered the person's age with the digital service provider.

A digital service provider shall make commercially reasonable efforts to verify the age of the person creating an account with a level of certainty appropriate to the risks that arise from the information management practices of the digital service provider.

Parental Consent for Minors Under the Age of 17.  A digital service provider may not permit an account holder who is a known minor to be an account holder unless the known minor has the express consent from a parent or legal guardian of the known minor.

Acceptable methods of obtaining express consent of a parent or legal guardian include the following:

• coordinating a call with a known minor's parent or legal guardian over videoconferencing technology; or
• any other method of obtaining express consent as defined in rule adopted by the attorney general.

A known minor is defined as a child who is 16 years of age or younger and who the digital service provider knows to be under the age of 17 years.

Restrictions on the Use of Information of a Known Minor. A digital service provider that enters into an agreement with a known minor for access to a digital service must limit:

• collection of the known minor's personal identifying information to information reasonably necessary to provide the digital service; and
• use of the known minor's personal identifying information to the purpose for which the information was collected.

A digital service provider that enters into an agreement with a known minor for access to a digital service may not:

• use the digital service to collect the known minor's precise geolocation data;
• use the digital service to display targeted advertising involving unlawful material to the known minor; or
• share, disclose, or sell the known minor's personal identifying information unless required to:
  1. comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a governmental entity;
  2. comply with a law enforcement investigation;
  3. detect, block, or prevent the distribution of unlawful or obscene material to a known minor;
  4. block or filter spam;
  5. prevent criminal activity; or
  6. protect the security of a digital service.

Requirement to Develop and Implement a Harm Mitigation Strategy. In relation to a known minor's use of a digital service, a digital service provider must make commercially reasonable efforts to develop and implement a strategy to prevent or mitigate the known minor's exposure to content that promotes or facilitates the following harms to minors:

• consistent with evidence-informed medical information, self-harm, eating disorders, substance use disorders, and suicidal behaviors;
• patterns of use that indicate or encourage substance abuse or use of illegal drugs;
• stalking, physical violence, online bullying, or harassment;
• grooming, trafficking, child pornography, or other sexual exploitation or abuse;
• incitement of violence; or
• any other illegal activity.

The bill states this requirement does not require a digital service provider to prevent or preclude:

• any minor from deliberately and independently searching for, or specifically requesting, content; or
• the digital service provider or individuals on the digital service from providing resources for the prevention or mitigation of the above-described harms, including evidence-informed information and clinical resources.

Enforcement. The Office of the Attorney General may investigate violations and bring actions to enforce compliance and enjoin further violations. If a court finds a person violates the terms of an injunction issued pursuant to this section, it must impose a civil penalty of not more than $10,000 per violation.

The bill specifies it does not provide a private right of action for violations, except that if a digital service provider violates provisions created by the bill, the parent or legal guardian of a known minor affected by the violation may bring a cause of action seeking declaratory or injunctive relief against the digital service provider.

Short Title. The chapter created by the bill may be known and cited as the Washington Protecting Children Online Act.

Severability. The bill provides that if any of its provisions or its application to any person or circumstance is held invalid, the remainder of the bill or the application of the provision to other persons or circumstances is not affected.