Section 1 Short title
This Act may be cited as the “Sammy’s Law of 2023”.
Sammy’s Law of 2023
A BILL
To require large social media platform providers to create, maintain, and make available to third-party safety software providers a set of real-time application programming interfaces, through which a child or a parent or legal guardian of a child may delegate permission to a third-party safety software provider to manage the online interactions, content, and account settings of such child on the large social media platform on the same terms as such child, and for other purposes.
Sec. 2 Sense of Congress
It is the sense of Congress that—
parents and legal guardians should be empowered to use the services of third-party safety software providers to protect the children of such parents and legal guardians from certain harms on large social media platforms; and
dangers like cyberbullying, human trafficking, illegal drug distribution, sexual harassment, and violence perpetrated, facilitated, or exacerbated through the use of certain large social media platforms have harmed children on such platforms.
Sec. 3 Definitions
In this Act:
Child— The term child means any individual under the age of 17 years who has registered an account with a large social media platform.
Commerce— The term commerce has the meaning given such term in section 4 of the Federal Trade Commission Act (15 U.S.C. 44).
Commission— The term Commission means the Federal Trade Commission.
Large social media platform— The term large social media platform—
means a service—
provided through an internet website or a mobile application (or both);
the terms of service of which do not prohibit the use of the service by a child;
with any feature or features that enable a child to share images, text, or video through the internet with other users of the service whom such child has met, identified, or become aware of solely through the use of the service; and
that has more than 100,000,000 monthly global active users or generates more than $1,000,000,000 in gross revenue per year, adjusted yearly for inflation; and
does not include—
a service that primarily serves—
to facilitate—
the sale or provision of professional services; or
the sale of commercial products; or
to provide news or information, where the service does not offer the ability for content to be sent by a user directly to a child; or
a service that—
has a feature that enables a user who communicates directly with a child through a message (including a text, audio, or video message) not otherwise available to other users of the service to add other users to that message that such child may not have otherwise met, identified, or become aware of solely through the use of the service; and
does not have any feature or features described in subparagraph (A)(iii).
Large social media platform provider— The term large social media platform provider means any person who, for commercial purposes in or affecting commerce, provides, manages, operates, or controls a large social media platform.
State— The term State means each State of the United States, the District of Columbia, each commonwealth, territory, or possession of the United States, and each federally recognized Indian Tribe.
Third-party safety software provider— The term third-party safety software provider means any person who, for commercial purposes in or affecting commerce, is authorized by a child (if the child is 13 years of age or older) or a parent or legal guardian of a child to interact with a large social media platform to manage the online interactions, content, or account settings of such child for the sole purpose of protecting such child from harm, including physical or emotional harm.
User data— The term user data means any information needed to have a profile on a large social media platform or content on a large social media platform, including images, video, audio, or text, that is created by or sent to a child on or through the account of such child with such platform, but only—
if the information or content is created by or sent to such child while a delegation under section 4(a) is in effect with respect to the account; and
during a 30-day period beginning on the date on which the information or content is created by or sent to such child.
Sec. 4 Providing access to third-party safety software
Duty of large social media platform providers—
In general— Not later than 30 days after the effective date of this Act (in the case of a service that is a large social media platform on such effective date) or not later than 30 days after a service becomes a large social media platform (in the case of a service that becomes a large social media platform after such effective date), the large social media platform provider shall create, maintain, and make available to any third-party safety software provider registered with the Commission under subsection (b)(1) a set of third-party-accessible real-time application programming interfaces, including any information necessary to use such interfaces, by which a child (if the child is 13 years of age or older) or a parent or legal guardian of a child may delegate permission to the third-party safety software provider to—
manage the online interactions, content, and account settings of such child on the large social media platform on the same terms as such child; and
initiate secure transfers of user data from the large social media platform in a commonly-used and machine-readable format to the third-party safety software provider, where the frequency of such transfers may not be limited by the large social media platform provider to less than once per hour.
Revocation— Once a child or a parent or legal guardian of a child makes a delegation under paragraph (1), the large social media platform provider shall make the application programming interfaces and information described in such paragraph available to the third-party safety software provider on an ongoing basis until—
the child (if the child made the delegation) or the parent or legal guardian of such child revokes the delegation;
the child or a parent or legal guardian of such child revokes or disables the registration of the account of such child with the large social media platform;
the third-party safety software provider rejects the delegation; or
one or more of the affirmations made by the third-party safety software provider under subsection (b)(1)(A) is no longer true.
Secure transfer of user data— A large social media platform provider shall establish and implement reasonable policies, practices, and procedures regarding the secure transfer of user data pursuant to a delegation under paragraph (1) from the large social media platform to a third-party safety software provider in order to mitigate any risks related to user data.
Disclosure— In the case of a delegation made by a child or a parent or legal guardian of a child under paragraph (1) with respect to the account of such child with a large social media platform, the large social media platform provider shall—
disclose to such child and (if the parent or legal guardian made the delegation) the parent or legal guardian the fact that the delegation has been made;
provide to such child and (if such parent or legal guardian made the delegation) such parent or legal guardian a summary of the user data that is transferred to the third-party safety software provider; and
update the summary provided under subparagraph (B) as necessary to reflect any change to the user data that is transferred to the third-party safety software provider.
Registration with Commission—
Third-party safety software providers—
Registration— A third-party safety software provider shall register with the Commission as a condition of accessing an application programming interface and any information under subsection (a). Such registration shall require the third-party safety software provider to affirm that the third-party safety software provider—
is a company based in the United States;
is solely engaged in the business of internet safety;
will use any user data obtained under subsection (a) solely for the purpose of protecting a child from harm;
will only disclose user data obtained under subsection (a) as permitted by subsection (f); and
will disclose, in an easy-to-understand, human-readable format, to each child with respect to whose account with a large social media platform the service of the third-party safety software provider is operating and (if a parent or legal guardian of the child made the delegation under subsection (a) with respect to the account) to the parent or legal guardian, sufficient information detailing the operation of the service and what information the third-party safety software provider is collecting to enable such child and (if applicable) such parent or legal guardian to make informed decisions regarding the use of the service.
Notification of changes— Not later than 30 days after the date on which there is a change to an affirmation made under subparagraph (A) by a third-party safety software provider that is registered under such subparagraph, the provider shall notify the following about such change:
The Commission.
Each child with respect to whose account with a large social media platform the service of the third-party safety software provider is operating and (if a parent or legal guardian of the child made the delegation under subsection (a) with respect to the account) the parent or legal guardian.
Deregistration by Commission— The Commission shall establish a process to deregister a third-party safety software provider that the Commission determines—
has violated or misrepresented the affirmations made under subparagraph (A); or
has not notified the Commission, a child, or a parent or legal guardian of a child of a change to such an affirmation as required by subparagraph (B).
Notification of deregistration—
Notification of large social media platform providers by Commission— If the Commission deregisters a third-party safety software provider under subparagraph (C), the Commission shall notify each large social media platform provider of—
the deregistration of the third-party safety software provider; and
the specific reason for the deregistration.
Notification of children and parents or legal guardians by large social media platform providers— A large social media platform provider that receives a notification from the Commission under clause (i) that a third-party safety software provider has been deregistered by the Commission under subparagraph (C) shall notify each child with respect to whose account with the large social media platform the service of the third-party safety software provider was operating and (if a parent or legal guardian of the child made the delegation under subsection (a) with respect to the account) the parent or legal guardian of—
the deregistration of such third-party safety software provider; and
the specific reason for such deregistration provided by the Commission under clause (i)(II).
Large social media platforms—
Registration— Not later than 30 days after the effective date of this Act (in the case of a service that is a large social media platform on such effective date) or not later than 30 days after a service becomes a large social media platform (in the case of a service that becomes a large social media platform after such effective date), the large social media platform provider of the platform shall register the platform with the Commission by submitting to the Commission a statement indicating that the platform is a large social media platform.
Deregistration by Commission— The Commission shall establish a process to deregister a service registered under subparagraph (A) if the service is no longer a large social media platform. The Commission shall permit the person who provides, manages, operates, or controls a service registered under subparagraph (A) to submit to the Commission information indicating that the service is no longer a large social media platform.
Public availability of registration lists— The Commission shall make publicly available on the internet website of the Commission a list of the third-party safety software providers registered under paragraph (1), a list of the large social media platforms registered under paragraph (2), and a list of the third-party safety software providers deregistered by the Commission under paragraph (1)(C).
Authentication— Not later than 180 days after the date of the enactment of this Act, the Commission shall issue guidance to facilitate the ability of a third-party safety software provider to obtain user data or access under subsection (a) in a manner that ensures that a request for user data or access on behalf of a child is a verifiable request.
Guidance and consumer education— The Commission shall—
not later than 180 days after the date of the enactment of this Act, issue guidance for large social media platform providers and third-party safety software providers regarding the maintenance of reasonable safety standards to protect user data; and
educate consumers regarding the rights of consumers under this Act.
Indemnification— In any civil action in Federal or State court (other than an action brought by the Commission), a large social media platform provider may not be held liable for damages arising out of the transfer of user data to a third-party safety software provider under subsection (a), if the large social media platform provider has in good faith complied with the requirements of this Act and the guidance issued by the Commission under this Act.
User data disclosure—
Permitted disclosures— A third-party safety software provider may not disclose any user data obtained under subsection (a) to any other person except—
pursuant to a lawful request from a government body, including for law enforcement purposes or for judicial or administrative proceedings by means of a court order or a court-ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena;
to the extent that such disclosure is required by law and such disclosure complies with and is limited to the relevant requirements of such law;
to the child or a parent or legal guardian of the child who made a delegation under such subsection and whose data is at issue, with such third-party safety software provider making a good faith effort to ensure that such disclosure includes only the user data necessary for a reasonable parent or caregiver to understand that such child is experiencing (or is at foreseeable risk to experience) the following harms—
suicide;
anxiety;
depression;
eating disorders;
violence, including being the victim of or planning to commit or facilitate assault;
substance abuse;
fraud;
severe forms of trafficking in persons (as defined in section 103 of the Trafficking Victims Protection Act of 2000 (22 U.S.C. 7102));
sexual abuse;
physical injury;
harassment;
sexually explicit conduct or child pornography (as defined in section 2256 of title 18, United States Code);
terrorism (as defined in section 140(d) of the Foreign Relations Authorization Act, Fiscal Years 1988 and 1989 (22 U.S.C. 2656f(d))), including communications with or in support of a foreign terrorist organization (as designated by the Secretary of State under section 219(a) of the Immigration and Nationality Act (8 U.S.C. 1189(a)));
academic dishonesty, including cheating, plagiarism, and other forms of academic dishonesty that are intended to gain an unfair academic advantage; and
sharing personal information, limited to—
home address;
phone number;
social security number; and
personal banking information;
in the case of a reasonably foreseeable serious and imminent threat to the health or safety of any individual, if the disclosure is made to a person or persons reasonably able to prevent or lessen the threat; or
to a public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect.
Disclosure reporting— A third-party safety software provider that makes a disclosure permitted by paragraph (1)(A), (1)(B), (1)(D), or (1)(E) shall promptly inform the child with respect to whose account with a large social media platform the delegation was made under subsection (a) and (if a parent or legal guardian of the child made the delegation) the parent or legal guardian that such a disclosure has been or will be made, except if—
the third-party safety software provider, in the exercise of professional judgment, believes informing such child or parent or legal guardian would place such child at risk of serious harm; or
the third-party safety software provider is prohibited by law (including a valid order by a court or administrative body) from informing such child or parent or legal guardian.
Sec. 5 Implementation and enforcement
Enforcement—
Unfair or deceptive acts or practices— A violation of this Act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
Powers of Commission—
In general— The Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act.
Privileges and immunities— Any person who violates this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).
Preservation of authority— Nothing in this Act may be construed to limit the authority of the Commission under any other provision of law.
FTC guidance— Not later than 180 days after the date of the enactment of this Act, the Commission shall issue guidance to assist large social media platform providers and third-party safety software providers in complying with this Act.
Compliance assessment— The Commission, on a biannual basis, shall assess compliance by large social media platform providers and third-party safety software providers with the provisions of this Act.
Complaints— The Commission shall establish procedures under which a child, or the parent or legal guardian of such child, a large social media platform provider, or a third-party safety software provider may file a complaint alleging that a large social media platform provider or a third-party safety software provider has violated this Act.
Sec. 6 One national standard
In general— No State or political subdivision of a State may maintain, enforce, prescribe, or continue in effect any law, rule, regulation, requirement, standard, or other provision having the force and effect of law of the State, or political subdivision of a State, related to requiring large social media platform providers to create, maintain, and make available to third-party safety software providers a set of real-time application programming interfaces, through which a child or a parent or legal guardian of a child may delegate permission to a third-party safety software provider to manage the online interactions, content, and account settings of such child on a large social media platform on the same terms as such child.
Rule of construction— This section may not be construed to—
limit the enforcement of any consumer protection law of a State or political subdivision of a State;
preempt the applicability of State trespass, contract, or tort law; or
preempt the applicability of any State law to the extent that the law relates to acts of fraud, unauthorized access to personal information, or notification of unauthorized access to personal information.
Sec. 7 Effective date
This Act shall take effect on the date on which the Commission issues guidance under section 5(b).