103RD GENERAL ASSEMBLY
State of Illinois
2023 and 2024
HB5380

 

Introduced 2/9/2024, by Rep. Jennifer Gong-Gershowitz

 

SYNOPSIS AS INTRODUCED:
 
New Act
815 ILCS 505/2EEEE new

    Creates the Let Parents Choose Protection Act. Provides that the Act may be referred to as Sammy's Law. Provides that, before August 1, 2025, or within 30 days after a service becomes a large social media platform after August 1, 2025, a large social media platform provider shall create, maintain, and make available to any third-party safety software provider a set of third-party-accessible real time application programming interfaces, including any information necessary to use the interfaces, by which a child, if the child is 13 years of age or older, or a parent or legal guardian of a child, may delegate permission to the third-party safety software provider to: (1) manage the child's online interactions, content, and account settings on the large social media platform on the same terms as the child; and (2) initiate secure transfers of user data from the large social media platform in a commonly used and machine-readable format to the third-party safety software provider. Sets forth disclosure requirements to the child and the parents or guardians of a child; requirements of third-party safety software providers; and liability of third-party safety software providers. Provides that a violation of any of the provisions of the Act is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective June 1, 2025.


LRB103 38832 SPS 68969 b

 

 

A BILL FOR

 

HB5380LRB103 38832 SPS 68969 b

1    AN ACT concerning business.
 
2    Be it enacted by the People of the State of Illinois,
3represented in the General Assembly:
 
4    Section 1. Short title; references to Act.
5    (a) Short title. This Act may be cited as the Parental
6Digital Choice Act.
7    (b) References to Act. This Act may be referred to as
8Sammy's Law.
 
9    Section 5. Findings and intent.
10    (a) The General Assembly finds and declares the following:
11        (1) Parents and legal guardians should be empowered to
12    use the services of third-party safety software providers
13    to protect their children from certain harms on large
14    social media platforms.
15        (2) Dangers like cyberbullying, human trafficking,
16    illegal drug distribution, sexual harassment, and violence
17    perpetrated, facilitated, or exacerbated through the use
18    of certain large social media platforms have harmed
19    children on those platforms.
20    (b) It is the intent of the General Assembly to require
21large social media platforms to create, maintain, and make
22available to third-party safety software providers a set of
23real-time application programming interfaces, through which a

 

 

HB5380- 2 -LRB103 38832 SPS 68969 b

1child or a parent or legal guardian of a child may delegate
2permission to a third-party safety software provider to manage
3the child's online interactions, content, and account settings
4on the large social media platform on the same terms as the
5child, and for other purposes.
 
6    Section 10. Definitions. As used in this Act:
7    "Child" means any individual under 18 years of age who has
8registered an account with a large social media platform.
9    "Large social media platform" means a service that:
10        (1) is provided through an Internet website, a mobile
11    application, or both;
12        (2) does not prohibit the use of the service by a
13    child;
14        (3) includes features that enable a child to share
15    images, text, or video through the Internet with other
16    users of the service whom the child has met, identified,
17    or become aware of solely through the use of the service;
18    and
19        (4) has more than 100,000,000 monthly global active
20    users or generates more than $1,000,000,000 in gross
21    revenue per year, adjusted yearly for inflation, or both.
22    "Large social media platform" does not include a service
23that:
24        (1) primarily serves to facilitate the sale or
25    provision of professional services or the sale of

 

 

HB5380- 3 -LRB103 38832 SPS 68969 b

1    commercial products;
2        (2) primarily serves to provide news or information
3    and the service does not offer the ability for content to
4    be sent by a user directly to a child; or
5        (3) has features that enable a user who communicates
6    directly with a child through a message, including a text,
7    audio, or video message, not otherwise available to other
8    users of the service, to add other users to that message
9    that the child may not have otherwise met, identified, or
10    become aware of solely through the use of the service and
11    does not have any features that enable a child to share
12    images, text, or video through the Internet with other
13    users of the service whom the child has met, identified,
14    or become aware of solely through the use of the service.
15    "Large social media platform provider" means any person
16who, for a commercial purpose provides, manages, operates, or
17controls a large social media platform.
18    "Third-party safety software provider" means any person
19who, for a commercial purpose, is authorized by a child, if the
20child is 13 years of age or older, or a parent or legal
21guardian of a child, to interact with a large social media
22platform to manage the child's online interactions, content,
23or account settings for the sole purpose of protecting the
24child from harm, including physical or emotional harm.
25    "User data" means any information needed to have a profile
26on a large social media platform or content on a large social

 

 

HB5380- 4 -LRB103 38832 SPS 68969 b

1media platform, including images, video, audio, or text, that
2is created by or sent to a child on or through the child's
3account with the platform, and the information or content is
4created by or sent to the child while a delegation described in
5Section 15 is in effect with respect to the account. For the
6purposes of this definition, information shall only be
7considered "user data" for 90 days after the date the
8information or content is created by or sent to the child.
 
9    Section 15. Delegation of permission to third-party
10software provider.
11    (a) Before August 1, 2025, or within 30 days after a
12service becomes a large social media platform after August 1,
132025, a large social media platform provider shall create,
14maintain, and make available to any third-party safety
15software provider that satisfies the requirements described in
16Section 20 a set of third-party-accessible real time
17application programming interfaces, including any information
18necessary to use the interfaces, by which a child, if the child
19is 13 years of age or older, or a parent or legal guardian of a
20child, may delegate permission to the third-party safety
21software provider to:
22        (1) manage the child's online interactions, content,
23    and account settings on the large social media platform on
24    the same terms as the child; and
25        (2) initiate secure transfers of user data from the

 

 

HB5380- 5 -LRB103 38832 SPS 68969 b

1    large social media platform in a commonly used and
2    machine-readable format to the third-party safety software
3    provider, and the frequency of the transfers may not be
4    limited by the large social media platform provider to
5    less than once per hour.
6    (b) Once a child or a parent or legal guardian of a child
7makes a delegation under subsection (a), the large social
8media platform provider shall make the application programming
9interfaces and information available to the third-party safety
10software provider on an ongoing basis until one of the
11following applies:
12        (1) the delegation is revoked by the child or the
13    child's parent or legal guardian;
14        (2) the child's account is disabled with the large
15    social media platform;
16        (3) the third-party safety software provider rejects
17    the delegation; or
18        (4) one or more of the affirmations made by the
19    third-party safety software provider under Section 20 is
20    no longer true.
21    (c) A large social media platform provider shall establish
22and implement reasonable policies, practices, and procedures
23concerning the secure transfer of user data under a delegation
24as described in subsection (a) from the large social media
25platform to a third-party safety software provider in order to
26mitigate any risks related to user data.

 

 

HB5380- 6 -LRB103 38832 SPS 68969 b

1    (d) If a delegation is made by a child or a parent or legal
2guardian of a child as described in subsection (a) with
3respect to the account of the child with a large social media
4platform. The large social media platform provider shall:
5        (1) disclose to the child and, if the parent or legal
6    guardian made the delegation, the parent or legal guardian
7    the fact that the delegation has been made;
8        (2) provide to the child and, if the parent or legal
9    guardian made the delegation, the parent or legal guardian
10    a summary of what user data is being transferred to the
11    third-party safety software provider; and
12        (3) provide any update to the summary as described in
13    paragraph (2) as necessary to reflect any change to what
14    user data is being transferred to the third-party safety
15    software provider.
16    (e) A third-party safety software provider shall not
17disclose any user data obtained under this Section to any
18person except:
19        (1) in compliance with a lawful request from a
20    governmental body, including for law enforcement purposes
21    or for judicial or administrative proceedings by means of
22    a court order or a court ordered warrant, a subpoena or
23    summons issued by a judicial officer, or a grand jury
24    subpoena;
25        (2) to the extent that the disclosure is required by
26    law and the disclosure complies with and is limited to the

 

 

HB5380- 7 -LRB103 38832 SPS 68969 b

1    requirements of the law;
2        (3) to a reasonable parent or caregiver of a child, if
3    the third-party safety software provider believes in good
4    faith that the child is at foreseeable risk or currently
5    experiencing any of the following harms:
6            (A) suicide;
7            (B) anxiety;
8            (C) depression;
9            (D) eating disorders;
10            (E) violence, including being the victim of or
11        planning to commit or facilitate battery under Section
12        12-3 of the Criminal Code of 2012 and assault under
13        Section 12-1 of the Criminal Code of 2012;
14            (F) substance abuse;
15            (G) fraud;
16            (H) trafficking in persons under Section 10-9 of
17        the Criminal Code of 2012;
18            (I)sexual abuse;
19            (J) physical injury;
20            (K) harassment, including hate-based harassment,
21        sexual harassment, and stalking under Section 12-7.3
22        of the Criminal Code of 2012;
23            (L) exposure to harmful material under Section
24        11-21 of the Criminal Code of 2012;
25            (M) communicating with a terrorist organization as
26        defined under Section 219 of the federal Immigration

 

 

HB5380- 8 -LRB103 38832 SPS 68969 b

1        and Nationality Act, 8 U.S.C. 1189;
2            (N) academic dishonesty, including cheating,
3        plagiarism, or other forms of academic dishonesty that
4        are intended to gain an unfair academic advantage; or
5            (O) sharing personal information limited to:
6                (i) home address;
7                (ii) telephone number;
8                (iii) social security number;
9                (iv) username;
10                (v) password; and
11                (vi) personal banking information.
12        (4) to a person reasonably able to prevent or lessen
13    an imminent threat to the health or safety of an
14    individual, if there is a reasonably foreseeable serious
15    and imminent threat to the health or safety of an
16    individual;
17        (5) to a public health authority or other appropriate
18    governmental authority authorized by law to receive
19    reports of child abuse or neglect.
20    (f) A third-party safety software provider that makes a
21disclosure under paragraphs (1),(2),(4), or (5) of subsection
22(e) shall promptly inform the child with respect to whose
23account with a large social media platform the delegation was
24made and, if a parent or legal guardian of the child made the
25delegation, the parent or legal guardian that the disclosure
26has been or will be made, except if:

 

 

HB5380- 9 -LRB103 38832 SPS 68969 b

1        (1) the third-party safety software provider, in the
2    exercise of professional judgment, believes informing such
3    child or parent or legal guardian would place such child
4    at risk of serious harm; or
5        (2) the third-party safety software provider is
6    prohibited by law, including a valid order by a court or
7    administrative body, from informing such child or parent
8    or legal guardian.
 
9    Section 20. Requirements of third-party safety software
10providers.
11    (a) A third-party safety software provider is qualified to
12access an application programming interface and any
13information or user data as described in Section 15 if the
14third-party safety software provider:
15        (1) is solely engaged in the business of Internet
16    safety;
17        (2) use any user data it obtains as described in
18    Section 15 solely for the purpose of protecting a child
19    from any harm;
20        (3) only discloses user data it obtains as described
21    in Section 15 as permitted by Section 15; and
22        (4) will disclose, in an easy-to-understand,
23    human-readable format, to each child with respect to whose
24    account with a large social media platform the service of
25    the third-party safety software provider is operating and

 

 

HB5380- 10 -LRB103 38832 SPS 68969 b

1    if a parent or legal guardian of the child made the
2    delegation as described in Section 15 with respect to the
3    account, to the parent or legal guardian, sufficient
4    information detailing the operation of the service and
5    what information the third-party safety software provider
6    is collecting to enable such child and such parent or
7    legal guardian, if applicable, to make informed decisions
8    regarding the use of the service.
 
9    Section 25. Liability of third-party safety software
10providers. In any civil action, other than an action brought
11by the Attorney General, a large social media platform
12provider shall not be held liable for damages arising out of
13the transfer of user data to a third-party safety software
14provider in accordance with this Act, if the large social
15media platform provider has in good faith complied with the
16requirements of this Act.
 
17    Section 30. Enforcement by Attorney General. A violation
18of any of the provisions of this Act is an unlawful practice
19under the Consumer Fraud and Deceptive Business Practices Act.
20All remedies, penalties, and authority granted to the Attorney
21General by that Act shall be available to him or her for the
22enforcement of this Act.
 
23    Section 90. The Consumer Fraud and Deceptive Business

 

 

HB5380- 11 -LRB103 38832 SPS 68969 b

1Practices Act is amended by adding Section 2EEEE as follows:
 
2    (815 ILCS 505/2EEEE new)
3    Sec. 2EEEE. Violations of the Parental Digital Choice Act.
4A person who violates the Parental Digital Choice Act commits
5an unlawful practice within the meaning of this Act.
 
6    Section 99. Effective date. This Act takes effect June 1,
72025.