The Bill Isn't Ready, Rep. Rader Votes "NO" on HB 84

COLUMBUS — State Rep. Tristan Rader (D-Lakewood) today voted “NO” on House Bill (HB) 84 to send a clear message to the Ohio Senate: this bill is not ready.

“The Innocence Act has real merit,” said Rep. Rader. “I’m a strong supporter of the deepfake provisions and protecting kids from harmful content online. But we cannot mandate that organizations collect sensitive personal data from millions of Ohioans and say nothing about how to protect it. That’s not protecting people. That’s creating a new problem.”

HB 84 requires age verification for access to certain online content but includes no encryption requirements, no data retention limits, no breach notification obligations, and no restrictions on how that data can be used once collected. Rep. Rader argues these omissions are disqualifying.

“This bill passed the House with broad support, and I understand why-the goal is right,” added Rep. Rader. “But broad support doesn’t mean the job is done. The Senate’s job now is to fix it.”

Rep. Rader mentions data security concerns are not the only red flag.

The ACLU of Ohio raised serious First Amendment concerns about the age verification provisions during committee testimony on predecessor legislation, warning that laws of this type are routinely struck down by courts when they burden adults’ access to constitutionally protected speech in order to restrict minors.

The ACLU also cautioned that the vague “harmful to juveniles” standard-requiring providers to assess what is “patently offensive to prevailing standards in the adult community as a whole”- is nearly impossible to comply with in practice, and that the threat of felony-level penalties will drive widespread self-censorship well beyond what the law intends.

“The ACLU’s concerns deserve a serious answer,” concluded Rep. Rader. “If we send this bill to the governor as written, we risk passing something that won’t survive a court challenge. The Senate should address the constitutional questions at the same time it fixes the data security gaps. Do it right or don’t do it.”

Rep. Rader suggests the Senate add the following provisions:

• Encryption standards: Collected data must be encrypted at rest and in transit per NIST guidelines;
• Retention limits: Data must be deleted within 30 days of verification with no exceptions;
• Vendor accountability: Third-party verification providers must meet the same security standards as the organizations themselves;
• Breach notification mandates: Ohioans must be notified within 72 hours if their verification data is compromised; and
• No secondary use: Verification data cannot be sold, shared, or used for advertising.
• Annual audits: Independent security audits, the same standard we already require of Ohio’s local governments.

HB 84 has passed the House and now heads to the Senate for consideration.