A Joint Interim Committees hearing on children's data privacy heard two researchers and a policy expert warn that current digital practices create persistent profiles and new persuasive risks for minors. Presenters described legal uncertainty around data-protection impact assessments and urged state-level work on transparency, parental tools and education.
The committee heard that courts have scrutinized data-protection impact assessment provisions that could force companies to stop offering a product and that enforcement models vary by state. Presenter Andrew Kingman said the Connecticut and Colorado frameworks use an "actual knowledge" standard and require mitigation plans rather than outright prohibitions, while other models have faced stricter constitutional review.
"If you get to a certain point in this assessment ... you are not permitted to offer the product or service," one presenter explained of contentious DPIA provisions, but he added that Colorado and Connecticut frameworks do not ban an offering and instead require risk-mitigation plans.
University of Alabama researcher Dr. Nancy Brennen described how AI aggregates explicit and implicit data from smartphones, wearables, smart TVs, connected toys and school technologies to form persistent "digital dossiers." She cited a study estimating roughly 72 million data points by age 13 and about 650 million by age 18 and warned those profiles can follow children into adulthood.
"Children are especially vulnerable when promotional messaging is personalized, interactive and conversational," Dr. Brennen said, describing experiments in which addressable TV and voice-assistant recommendations significantly increased children's receptivity to advertised products.
A separate presenter who identified himself as Dr. E (Dr. Epstein) described a monitoring system his team developed to capture ephemeral, personalized experiences such as search answers and recommended videos and said his archive has preserved more than 100 million such exposures. He showed examples he described as violent or sexual content recommended to children on platform feeds and urged a two-pronged response: robust, anonymous monitoring of platform output and an education-first approach to teach "digital hygiene" in schools.
"The real protections here will come from monitoring and education," Dr. E told the committee, recommending a short digital-hygiene test and curricula aimed at building competencies so children and families can better protect themselves.
Committee members pressed presenters on practical concerns including how age verification could increase data collection, how programmatic ad systems and data brokers assemble deidentified profiles, and what enforcement tools states have against platforms. Presenters generally agreed that state action is warranted but should be careful to avoid unintended harms, and several members said Alabama could pilot education or monitoring initiatives.
The committee scheduled a follow-up meeting to focus on algorithms and how they work.
Next steps: presenters offered to provide source studies and curriculum materials to the committee; no formal motions or votes were recorded at the hearing.