United States - Mississippi - Protecting Children Online (HB 1126)

Overview

Mississippi House Bill 1126, officially titled the "Walker Montgomery Protecting Children Online Act," was enacted in 2024 with the primary goal of safeguarding minor children from harmful online material and practices. The law was introduced in response to the tragic death of 16-year-old Walker Montgomery, who was a victim of sextortion. It imposes several requirements on "digital service providers," including mandating age verification for users, obtaining express parental consent for minors to create accounts, and developing strategies to prevent minors' exposure to content deemed harmful. The law also addresses the collection and use of minors' personal identifying information and includes provisions related to "morphed images" in the context of child exploitation. Importantly, despite the initial prompt's focus, this legislation does not specifically address "materially deceptive media in political campaigns." Its scope is centered on general online child safety, privacy, and protection from exploitative content. The Act initially took effect on July 1, 2024, but has been subject to extensive legal challenges, including a lawsuit filed by NetChoice, a trade association representing major tech companies. While a district court initially enjoined the law, the Fifth Circuit Court of Appeals later vacated that injunction, allowing the law to go into effect. The U.S. Supreme Court subsequently declined an emergency application to block the law, permitting it to stand while litigation on the merits proceeds, though Justice Brett Kavanaugh issued a concurring statement indicating the law is "likely unconstitutional." This ongoing legal battle highlights significant concerns regarding First Amendment rights, anonymity, and data privacy.

Definitions

Mississippi House Bill 1126 establishes several key definitions to delineate its scope and application:

• Digital service: Defined as a website, application, program, or software that collects or processes personal identifying information with Internet connectivity.
• Digital service provider: A person who owns or operates a digital service, determines the purpose of collecting and processing user personal identifying information, and determines the means used for such collection and processing.
• Harmful material: Material that is harmful to minors as defined by Section 11-77-3(d) of the Mississippi Code of 1972. This includes content that promotes or facilitates suicide, self-harm, eating disorders, substance abuse, physical violence, online bullying, harassment, grooming, trafficking, child pornography, or other sexual exploitation.
• Known minor: A child who is younger than eighteen (18) years of age, has not had the disabilities of minority removed for general purposes, and who the digital service provider knows to be a minor.
• Personal identifying information: Any information, including sensitive information, that is linked or reasonably linkable to an identified or identifiable individual.
• Identifiable child: A child who was a minor at the time an image was created, adapted, or modified, or whose image as a child was used in the creation, adaptation, or modification of the image; and is recognizable by face, likeness, or other distinguishing characteristic.
• Simulated: Any depiction of genitals or rectal areas that gives the appearance of sexual conduct or incipient sexual conduct.

Governance and Institutional Framework

The primary authority responsible for the enforcement of the Walker Montgomery Protecting Children Online Act is the Office of the Attorney General of Mississippi. The Act amends Section 75-24-5 of the Mississippi Code of 1972, specifying that a violation of HB 1126 constitutes an unfair and deceptive trade practice. This designation empowers the Attorney General's office to initiate actions against digital service providers found to be in non-compliance. The law does not establish a new specialized agency or institutional framework but rather integrates its enforcement into existing consumer protection statutes. This approach leverages the established legal and investigative capacities of the Attorney General's office for oversight and compliance. The judicial system, through federal and state courts, plays a significant role in interpreting and reviewing the constitutionality and application of the law, as evidenced by the ongoing litigation.

Key Focus Areas

• Age Verification and Parental Consent: The Act mandates that digital service providers require prospective account holders to register their age. They must employ commercially reasonable efforts to verify the age of individuals creating accounts, with a level of certainty appropriate to the risks associated with their information management practices. For users identified as minors (under 18 years of age), digital service providers are prohibited from allowing account creation without the express consent of a parent or guardian. The law outlines various methods for obtaining this consent, including signed forms, toll-free telephone numbers, video conferences, or the collection of government-issued ID information (which must later be deleted), or other commercially reasonable methods considering available technology.
• Protection from Harmful Material: Digital service providers are required to develop and implement a strategy to prevent or mitigate known minors' exposure to "harmful material." This includes content that promotes, glorifies, or facilitates suicide, self-harm, eating disorders, substance abuse or illegal drug use, stalking, physical violence, online bullying, harassment, grooming, trafficking, child pornography, other sexual exploitation or abuse, or incitement of violence, or any other illegal activity.
• Data Protection for Minors: The law places restrictions on the collection and use of personal identifying information from known minors. Digital service providers must limit the collection of such information to what is reasonably necessary to provide the digital service and limit its use to the purpose for which it was collected. Prohibited actions include collecting a known minor's precise geolocation data and using their personal information for targeted advertising involving harmful material. Sharing, disclosing, or selling a minor's personal information is generally prohibited, with exceptions for compliance with law enforcement, preventing harmful material distribution, blocking spam, preventing criminal activity, or protecting digital service security.
• Child Exploitation (Morphed Images): The Act amends Section 97-5-31 of the Mississippi Code of 1972 to include "morphed images of depicting minor children in explicit nature" within the crime of child exploitation. This provision directly addresses the use of manipulated media, specifically deepfakes or synthetic media, when they involve minors in explicit contexts. It is crucial to note that this specific provision targets child exploitation and does not extend to the broader context of materially deceptive media in political campaigns, which was the initial focus of the prompt. The bill's intent here is solely to enhance protections against child sexual abuse material, including that generated or altered by advanced technological means.

Implementation Framework

The Walker Montgomery Protecting Children Online Act was designed to take effect on July 1, 2024. However, its implementation has been significantly impacted by immediate legal challenges. NetChoice, a tech industry trade association, filed a lawsuit (NetChoice v. Fitch) challenging the law's constitutionality, primarily on First Amendment grounds, arguing it burdens free speech and privacy. A U.S. District Court initially granted a preliminary injunction, halting the law's enforcement. This injunction was subsequently vacated by the Fifth Circuit Court of Appeals on April 17, 2025, allowing the law to proceed. NetChoice then sought an emergency stay from the U.S. Supreme Court, which was denied on August 14, 2025. This denial means the law can remain in effect while the underlying litigation on its merits continues. Digital service providers are required to make "commercially reasonable efforts" to comply with the age verification and parental consent requirements, implying a degree of flexibility based on available technology and industry standards. The law does not specify a phased implementation, but rather sets out immediate requirements for compliance from its effective date, subject to judicial interventions. The ongoing legal battle creates an uncertain environment for compliance, as the law's ultimate enforceability and scope may change based on future court rulings. Some platforms, like Bluesky, have chosen to block access in Mississippi rather than attempt to comply due to the demands and privacy concerns associated with the law.

Monitoring and Evaluation

Monitoring and evaluation of compliance with the Walker Montgomery Protecting Children Online Act primarily falls under the purview of the Mississippi Attorney General's Office, which is empowered to enforce the law as an unfair and deceptive trade practice. Digital service providers are expected to self-monitor and implement the required age verification, parental consent mechanisms, and content moderation strategies. There are no explicit provisions within the Act detailing specific state-mandated reporting requirements for digital service providers regarding their compliance efforts. However, compliance would likely be assessed through investigations initiated by the Attorney General in response to complaints or observed violations. The ongoing litigation, spearheaded by NetChoice, also serves as a form of external evaluation, as it scrutinizes the practical implications, technical feasibility, and constitutional validity of the law's provisions. Court proceedings and expert testimony contribute to an ongoing assessment of how the law impacts digital services and users. The law permits a limited private right of action for individuals to seek a declaratory judgment or injunction for certain violations, which also contributes to compliance monitoring by allowing affected parties to seek judicial remedies. This mechanism provides an avenue for individuals to challenge non-compliance, thereby indirectly contributing to the law's evaluation.

Penalties, Liability, and Appeals

The Walker Montgomery Protecting Children Online Act establishes significant penalties for non-compliance by digital service providers. Civil penalties can be imposed at a rate of up to $10,000 per violation. Beyond civil fines, violations of the Act are also classified as unfair and deceptive trade practices under Section 75-24-5 of the Mississippi Code of 1972, which can lead to additional enforcement actions, including potential criminal penalties, at the discretion of the Attorney General. While the Act generally does not provide for a private right of action, it does allow for a limited exception: an individual may bring an action for damages (including court costs and reasonable attorney fees) resulting from a minor accessing harmful material, or for knowingly retaining identifying information of an individual after access has been granted. This limited private right aims to provide recourse for directly harmed individuals. The law explicitly states that a court may not certify an action brought under this section as a class action. The appeals process for this legislation has been notably active. After a U.S. District Court issued a preliminary injunction against the law's enforcement, the Fifth Circuit Court of Appeals vacated that injunction. Subsequently, an emergency application to block the law was filed with the U.S. Supreme Court, which denied the request, allowing the law to remain in effect during the ongoing litigation on its merits. This indicates that the legal challenges, and thus potential appeals, are far from over, with the constitutionality of the law still being actively litigated.

Relationship to Other Instruments

The Walker Montgomery Protecting Children Online Act operates within the broader legal landscape of the United States, interacting with both federal and state laws, most significantly the First Amendment to the U.S. Constitution. The ongoing legal challenges, particularly the lawsuit by NetChoice, center on arguments that the law's age verification and content moderation mandates infringe upon constitutionally protected rights to free speech and anonymity for both adults and minors. Justice Kavanaugh's concurring opinion in the Supreme Court's denial of an emergency stay noted that the Mississippi law is "likely unconstitutional" under existing Supreme Court precedents, highlighting a direct conflict with fundamental rights. The law also amends existing Mississippi statutes, specifically incorporating violations into the state's unfair and deceptive trade practices act (Section 75-24-5) and expanding the definition of child exploitation (Section 97-5-31) to include "morphed images" of minors in explicit contexts. This demonstrates its integration into existing legal frameworks for consumer protection and criminal law. Furthermore, HB 1126 is part of a growing trend of state-level online safety and age verification laws across the United States, with similar legislation being passed and challenged in states like Arkansas, Ohio, Utah, and Tennessee. These state laws often face similar constitutional scrutiny regarding their impact on online expression and privacy. The Act does not explicitly reference or align with federal laws like the Children's Online Privacy Protection Act (COPPA) but shares a common objective of protecting minors online, albeit through different mechanisms and with a broader scope. Its provisions regarding data collection and use for minors also touch upon general data protection principles, though it is not a comprehensive data privacy law in itself.

International Alignment

The Walker Montgomery Protecting Children Online Act does not explicitly reference or aim for alignment with specific international standards or regulations. Its focus is on establishing state-level protections for minors within Mississippi. However, the themes addressed by HB 1126—such as age verification, parental consent for online activities, and the protection of children from harmful content and exploitation—are subjects of global concern and legislative efforts in many jurisdictions. Countries worldwide are grappling with how to regulate digital services to ensure child safety, often debating similar mechanisms like age gates, parental controls, and content filtering. Discussions around the European Union's Digital Services Act (DSA) and other national online safety laws in the UK, Australia, and Canada, for example, share common ground with Mississippi's objectives, particularly concerning the safety and well-being of minors online. While Mississippi's approach is tailored to its state legal framework and constitutional considerations, the underlying policy goals resonate with international movements towards greater online accountability for platforms and enhanced protections for vulnerable users, especially children. The inclusion of "morphed images" in child exploitation laws also aligns with global efforts to combat AI-generated child sexual abuse material.

Implementation Timeline

Compliance Checklist

Sources and References