Can Regulators Actually Deliver a Presumptive Teen Social Media Ban?

In the face of the inexorable global march of social media access restrictions for teenagers, an eye-catching alternative to the Australia-style ‘hard’ ban has begun to gain traction within tech policy advocacy circles.

This idea of a ‘presumptive’ ban on social media — whereby platforms would be banned for teenagers until and unless they can demonstrate to a regulator or similar such body that they are safe — satiates the political appetite for access restrictions while recasting them as a lever for safety-by-design.

As such, it is instinctively appealing for a policy community that has spent years advocating for platform accountability and which isn’t ready to throw in the towel.

Yet as with the policy approach that it seeks to displace, the idea of a presumptive ban has complications of its own. Most fundamentally, there are real questions as to whether the contemporary online safety regulatory apparatus is even capable of administering this policy approach in the manner envisaged by its proponents.

As it takes shape as the alternative to a ‘hard’ ban, it’s time to put this proposal under the microscope.

An idea whose time has come

In recent weeks, calls for a presumptive ban as an alternative to an Australia-style hard ban have grown louder and from more prominent places.

A coalition of over 140 civil society organizations has written to European Commission President Ursula von der Leyen, demanding ‘independent ex-ante risk assessment, age-tiered child safety pre-certification, and regular independent auditing for all services accessible to children’.

In the UK, the chair of the parliament’s digital committee has urged the country’s government to mandate that ‘any new [social media] service should demonstrate that it meets safety standards before going to market’. The Online Safety Act Network — a UK-based coalition of advocacy groups — has even developed a model ex ante framework for how such safety standards could look.

And Canada is set to become the first country to put the presumptive ban approach on a regulatory footing, with its proposed Safe Social Media Act creating a mechanism by which social media companies can avoid a teen ban by demonstrating to the regulator that they are safe for children.

A proposal made for a regulatory world that doesn’t (yet) exist

Ironically, the greatest strength of this policy approach — its focus on pre-market scrutiny of social media’s risks — is simultaneously its greatest vulnerability.

By relying on a regulator (or any other independent third-party) to assess and certify that social media platforms are safe before they are made available to teenagers, the proposal makes an ask of the online safety regulatory apparatus that it is today ill-equipped to deliver.

Let’s explore why.

Regulators’ structural aversion to risk

‘No one ever got fired for buying IBM.’

This celebrated adage, which explains how perverse organizational incentives motivate deficient decision-making in large corporations, is apt for the regulatory sphere.

The regulators responsible for administering the presumptive social media ban face a deeply skewed incentive structure that will have significant implications for how this policy would work in practice.

To see why, imagine for a moment that you are the official responsible for assessing whether a social media service should be certified as safe for use by teenagers, on the basis of a pre-defined standard for ‘safe’.

Certifying that the service is safe, when the default assumption is that it is not, is unlikely to bring any significant upshot for you or your regulatory organization — there are no brownie points for doing your job.

On the other hand, certifying a service as safe that is later found to pose unpalatable harms to children would be reputationally catastrophic for you as an official and for your organization as a publicly accountable body. It’s not the kind of achievement that will look good in an annual performance review.

Add into the mix the reality that you are unlikely to face any meaningful blowback from your superiors for not certifying a service as safe (more than most organizations, regulators struggle to quantify the cost of not taking a risk), and we begin to see why the assessment and certification process is likely to be less objective and less technocratic than assumed.

This concern is illustrative of a longstanding challenge within the discipline of risk regulation. Across other highly regulated domains — from child protection to nuclear energy — there are countless examples of how a structural aversion to risk serves to undermine the work of regulators and the achievement of public policy objectives. This phenomenon has been studied in detail in the context of banking regulation in the post-Global Financial Crisis era, and has become a central preoccupation for policymakers everywhere in the 2020s amid the elusive search for growth and productivity. Indeed, in a recent white paper on balancing risk and innovation in regulation, the UK government noted that its “[national] regulatory approach has become too risk averse. Incentives on politicians and regulators to avoid criticism when regulation fails to fully mitigate risks have encouraged excessive risk aversion in the system.

One might reasonably counter that today’s online safety regulators appear to be operating just fine, and that they are hardly laid low by chronic risk aversion — just look at all the DSA investigations that the European Commission has launched.

But that is because regulators’ responsibilities today are of a negative character — namely, to identify and punish non-compliance with a codified set of (largely procedural) rules. This work clearly entails risk for the regulator, but by focusing on outlier behavior (the frameworks assume compliance until a regulator proves otherwise) and by anchoring that compliance in a set of codified rules and procedures, the risk to the regulator itself of getting things wrong is relatively low.

The presumptive ban approach, on the other hand, would shackle regulators with a positive responsibility. Regulators themselves would be on the hook for assessing and determining whether social media platforms are safe for use by teens. No matter who codified the standards for safety, there will invariably be some degree of judgment call and assumptions on the part of the regulator in the assessment process. There’s a whole lot more jeopardy involved in that work, and as demonstrated above, the skewed incentive structure that shapes how regulators approach their work means they will face a strong bias against certification.

For those of us who would like the presumptive ban approach to provide a genuine pathway for safe social media services to be available for children, that’s a problem.

Determining ‘safe’ social media

Key to the idea of a presumptive social media ban is that services are restricted until they demonstrate that they are safe for children. For supervisors who have organized themselves for a regulatory model that focuses on non-compliance with formalized procedural rules, this would require a fundamental rethink of their technique and their tools.

When administering a presumptive ban regime, the overarching question for regulatory supervisors will no longer be ‘do we have evidence that this company is breaking the rules?’ It will instead be ‘are we sure this platform is a safe environment for teenagers?’

Answering the latter question requires a whole lot more data, understanding, and situational awareness of platforms than the former. ‘Safety’ is a holistic and outcome-focused concept, and it is unlikely to be meaningfully assured by checking whether platforms have completed a risk assessment in line with regulatory guidance or offered workable user-facing reporting tools.

Indeed, the shift in focus from non-compliance assessments to safety assessments will stretch regulators’ evaluation capacities and tools to their limits. To certify a social media service as safe, regulators will need to undertake significantly more probing of technical systems, assemble richer and more diverse trust & safety metrics, and develop a far deeper understanding of how risk manifests across different product surfaces and to different user groups.

The challenge of developing and maintaining evaluation tools and techniques is a feature of all regulatory domains that require pre-market scrutiny and authorization. But unlike sectors such as automobiles or foodstuffs, regulators in the social media space exist on the wrong side of a pronounced asymmetry of information, marked by a huge number of known unknowns and unknown unknowns. That asymmetry means it is already hard enough for regulators of social media to do their supervisory work today. But absent a suite of new and innovative tools and techniques, delivery of safety certifications under this novel regime won’t simply be hard — it will be impossible.

Is there any hope for the presumptive ban approach?

By now, a presumptive social media ban as a credible alternative to ‘hard’ access restrictions might sound fanciful. Yet while profound, the challenges facing it can be overcome.

To get there, four things need to happen:

First, we need a clear articulation of what ‘safe’ social media is and how it can be assured. Companies need to know what is required for them to demonstrate their service is safe, and regulators need a toolbox of precise metrics and performance standards to evaluate safety.

There are numerous pathways to get there, encompassing everything from platform functionality (e.g., certain functions must be restricted for a service to be considered safe); safety processes (e.g., services must complete risk assessments that meet certain substantive standards of quality and rigor); or performance outcomes (e.g., services must fall below certain quantitative thresholds for harmful content, behavior, and experiences). Advocates have already begun to spell out how that might look and there is a rich body of work from across the tech accountability community on which to build.

Second, we need an ecosystem of safety assurers beyond regulators alone. The skewed incentive structure that will lead regulators to be overly risk-averse when conducting safety assessments is difficult to design out. But it can be mitigated by introducing polycentricity to the assessment process.

These regimes should create space for independent third parties to perform assessments and review companies’ safety cases (on the basis of agreed standards), as happens in many other sectors wherein ex ante safety tests are required. This will ensure regulators – through their propensity for risk aversion – don’t become the single-point-of-failure that undermines the viability of the model. The DSA’s conception of third-party auditing, alternative dispute resolution, and its provisions on data access for researchers have created the green shoots through which this kind of polycentric oversight model could grow.

Third, transparency. Under this policy approach, regulators will have tremendous power to enable or frustrate teenagers’ access to key online services. There will be a significant public interest in the decisions that regulators make about service safety (or lack thereof) and how they make those decisions. One of the major criticisms of online safety regulatory supervision in jurisdictions like the EU and the UK today is that it is overly secretive and lacks public accountability.

That way of working will be untenable in a world where regulators are playing the role of safety certifiers and making value judgments of tremendous importance to teenagers and society. For this regime to work, regulators will need to be transparent about the safety cases companies furnish and about how they arrive at their decisions to certify or not. Meaningful transparency in this regard will help mitigate unnecessary risk aversion by regulators and the politicization of their work, and it will ensure that the value judgments and trade-offs that are inherent in these exercises can be scrutinized and challenged by experts, advocates, and those affected by them.

Fourth and finally, serious engagement with the broader policy impact. This piece has engaged with the feasibility of the presumptive social media ban policy approach, but has left the questions as to whether this approach is good in itself largely to one side. These substantive questions must sooner or later be tackled head-on. For instance, is it desirable in a liberal democracy for technocratic officials in agencies, rather than elected officials in parliaments, to be the ones deciding which social media platforms are appropriate for teenagers to use? And what about the risk that complex procedural certification processes will introduce new barriers to entry for upstart alternative social media companies, which lack the compliance, legal, and lobbying resources of today’s entrenched firms?

Where do we go from here?

The Canadian Safe Social Media Bill — that will make its way through the parliamentary process in the coming months — provides a timely impetus to engage substantively with the challenges inherent in the presumptive ban approach, and to further develop mitigations for them.

Time is of the essence. The idea of a presumptive social media ban increasingly appears to be the only viable alternative to a ‘hard’ social media ban in many regions of the world.

By taking the step of turning this alternative approach from an abstract idea to a rigorous policy proposal, we have a realistic opportunity of ensuring teenagers’ continued use of social media that is safer and more age-appropriate.

Let the hard work begin.