The Honorable John McCain
United States Senate
Washington, DC 20510

Re: H.R. 3783


Dear Mr. Chairman:

I note that the Senate passed a version of Congressman Oxley's H.R. 3783 earlier this year. On September 11, I testified before the Subcommittee on Telecommunications, Trade, and Consumer Protection, of the House Committee on Commerce, at a hearing devoted to various proposals for regulating access to material deemed "harmful to minors." Subsequent developments have convinced me that the approach presently being considered is unconstitutional.

My view at that time, with respect to H.R. 3783, was that while the idea of require adult IDs could in principle be constitutional, the existing ID technologies would be constitutionally too burdensome. Given other adult ID technologies, the requirement (predominate in the statute) that adult turn credit numbers over to pornographers in order to get access to constitutionally protected speech struck me as too great a burden.

Since my testimony, an argument by Professor Mark Lemley of The University of Texas Law School, has strengthened my view that there are serious constitutional problems with this approach. Lemley proposes that rather than requiring adult IDs, a less restrictive alternative would be a statute that facilitated the development of kid IDs — digital certificates that would be bound to a user's browser, but that would simply identify the user as a minor. A law could then require that servers with material deemed "harmful to minors" block access by users with such certificates. Such certificates, again, would reveal no information except that a user was a minor.

Such a proposal, in my view, would be seen by a court to be a clearly less restrictive alternative under First Amendment jurisprudence. If so, the proposal would then render the means proposed in H.R. 3873 unconstitutional.

While there are important details to be worked out in the "kid IDs" alternative, I will note one other feature that might be of interest. If kid IDs were generally available, then Congress could more easily require commercial sites not to gather data from kids. As it is, any rule that commercial sites not gather data from kids would be hard to enforce. But if such IDs became common, these other regulatory purposes would be more easily achieved.

If there is more information that I can provide, please let me know.


                                                                                                With kind regards,