HB5380 103RD GENERAL ASSEMBLY

LRB103 38832 SPS 68969 b

103RD GENERAL ASSEMBLY
State of Illinois
2023 and 2024
HB5380

Introduced 2/9/2024, by Rep. Jennifer Gong-Gershowitz

SYNOPSIS AS INTRODUCED:

New Act
815 ILCS 505/2EEEE new

Creates the Let Parents Choose Protection Act. Provides that the Act may be referred to as Sammy's Law. Provides that, before August 1, 2025, or within 30 days after a service becomes a large social media platform after August 1, 2025, a large social media platform provider shall create, maintain, and make available to any third-party safety software provider a set of third-party-accessible real time application programming interfaces, including any information necessary to use the interfaces, by which a child, if the child is 13 years of age or older, or a parent or legal guardian of a child, may delegate permission to the third-party safety software provider to: (1) manage the child's online interactions, content, and account settings on the large social media platform on the same terms as the child; and (2) initiate secure transfers of user data from the large social media platform in a commonly used and machine-readable format to the third-party safety software provider. Sets forth disclosure requirements to the child and the parents or guardians of a child; requirements of third-party safety software providers; and liability of third-party safety software providers. Provides that a violation of any of the provisions of the Act is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective June 1, 2025.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title; references to Act.

(a) Short title. This Act may be cited as the Parental Digital Choice Act.

(b) References to Act. This Act may be referred to as Sammy's Law.

Section 5. Findings and intent.

(a) The General Assembly finds and declares the following:

(1) Parents and legal guardians should be empowered to use the services of third-party safety software providers to protect their children from certain harms on large social media platforms.

(2) Dangers like cyberbullying, human trafficking, illegal drug distribution, sexual harassment, and violence perpetrated, facilitated, or exacerbated through the use of certain large social media platforms have harmed children on those platforms.

(b) It is the intent of the General Assembly to require large social media platforms to create, maintain, and make available to third-party safety software providers a set of real-time application programming interfaces, through which a child or a parent or legal guardian of a child may delegate permission to a third-party safety software provider to manage the child's online interactions, content, and account settings on the large social media platform on the same terms as the child, and for other purposes.

Section 10. Definitions. As used in this Act:

"Child" means any individual under 18 years of age who has registered an account with a large social media platform.

"Large social media platform" means a service that:

(1) is provided through an Internet website, a mobile application, or both;

(2) does not prohibit the use of the service by a child;

(3) includes features that enable a child to share images, text, or video through the Internet with other users of the service whom the child has met, identified, or become aware of solely through the use of the service; and

(4) has more than 100,000,000 monthly global active users or generates more than $1,000,000,000 in gross revenue per year, adjusted yearly for inflation, or both.

"Large social media platform" does not include a service that:

(1) primarily serves to facilitate the sale or provision of professional services or the sale of commercial products;

(2) primarily serves to provide news or information and the service does not offer the ability for content to be sent by a user directly to a child; or

(3) has features that enable a user who communicates directly with a child through a message, including a text, audio, or video message, not otherwise available to other users of the service, to add other users to that message that the child may not have otherwise met, identified, or become aware of solely through the use of the service and does not have any features that enable a child to share images, text, or video through the Internet with other users of the service whom the child has met, identified, or become aware of solely through the use of the service.

"Large social media platform provider" means any person who, for a commercial purpose provides, manages, operates, or controls a large social media platform.

"Third-party safety software provider" means any person who, for a commercial purpose, is authorized by a child, if the child is 13 years of age or older, or a parent or legal guardian of a child, to interact with a large social media platform to manage the child's online interactions, content, or account settings for the sole purpose of protecting the child from harm, including physical or emotional harm.

"User data" means any information needed to have a profile on a large social media platform or content on a large social media platform, including images, video, audio, or text, that is created by or sent to a child on or through the child's account with the platform, and the information or content is created by or sent to the child while a delegation described in Section 15 is in effect with respect to the account. For the purposes of this definition, information shall only be considered "user data" for 90 days after the date the information or content is created by or sent to the child.

Section 15. Delegation of permission to third-party software provider.

(a) Before August 1, 2025, or within 30 days after a service becomes a large social media platform after August 1, 2025, a large social media platform provider shall create, maintain, and make available to any third-party safety software provider that satisfies the requirements described in Section 20 a set of third-party-accessible real time application programming interfaces, including any information necessary to use the interfaces, by which a child, if the child is 13 years of age or older, or a parent or legal guardian of a child, may delegate permission to the third-party safety software provider to:

(1) manage the child's online interactions, content, and account settings on the large social media platform on the same terms as the child; and

(2) initiate secure transfers of user data from the large social media platform in a commonly used and machine-readable format to the third-party safety software provider, and the frequency of the transfers may not be limited by the large social media platform provider to less than once per hour.

(b) Once a child or a parent or legal guardian of a child makes a delegation under subsection (a), the large social media platform provider shall make the application programming interfaces and information available to the third-party safety software provider on an ongoing basis until one of the following applies:

(1) the delegation is revoked by the child or the child's parent or legal guardian;

(2) the child's account is disabled with the large social media platform;

(3) the third-party safety software provider rejects the delegation; or

(4) one or more of the affirmations made by the third-party safety software provider under Section 20 is no longer true.

(c) A large social media platform provider shall establish and implement reasonable policies, practices, and procedures concerning the secure transfer of user data under a delegation as described in subsection (a) from the large social media platform to a third-party safety software provider in order to mitigate any risks related to user data.

(d) If a delegation is made by a child or a parent or legal guardian of a child as described in subsection (a) with respect to the account of the child with a large social media platform. The large social media platform provider shall:

(1) disclose to the child and, if the parent or legal guardian made the delegation, the parent or legal guardian the fact that the delegation has been made;

(2) provide to the child and, if the parent or legal guardian made the delegation, the parent or legal guardian a summary of what user data is being transferred to the third-party safety software provider; and

(3) provide any update to the summary as described in paragraph (2) as necessary to reflect any change to what user data is being transferred to the third-party safety software provider.

(e) A third-party safety software provider shall not disclose any user data obtained under this Section to any person except:

(1) in compliance with a lawful request from a governmental body, including for law enforcement purposes or for judicial or administrative proceedings by means of a court order or a court ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena;

(2) to the extent that the disclosure is required by law and the disclosure complies with and is limited to the requirements of the law;

(3) to a reasonable parent or caregiver of a child, if the third-party safety software provider believes in good faith that the child is at foreseeable risk or currently experiencing any of the following harms:

(A) suicide;

(B) anxiety;

(C) depression;

(D) eating disorders;

(E) violence, including being the victim of or planning to commit or facilitate battery under Section 12-3 of the Criminal Code of 2012 and assault under Section 12-1 of the Criminal Code of 2012;

(F) substance abuse;

(G) fraud;

(H) trafficking in persons under Section 10-9 of the Criminal Code of 2012;

(I)sexual abuse;

(J) physical injury;

(K) harassment, including hate-based harassment, sexual harassment, and stalking under Section 12-7.3 of the Criminal Code of 2012;

(L) exposure to harmful material under Section 11-21 of the Criminal Code of 2012;

(M) communicating with a terrorist organization as defined under Section 219 of the federal Immigration and Nationality Act, 8 U.S.C. 1189;

(N) academic dishonesty, including cheating, plagiarism, or other forms of academic dishonesty that are intended to gain an unfair academic advantage; or

(O) sharing personal information limited to:

(i) home address;

(ii) telephone number;

(iii) social security number;

(iv) username;

(v) password; and

(vi) personal banking information.

(4) to a person reasonably able to prevent or lessen an imminent threat to the health or safety of an individual, if there is a reasonably foreseeable serious and imminent threat to the health or safety of an individual;

(5) to a public health authority or other appropriate governmental authority authorized by law to receive reports of child abuse or neglect.

(f) A third-party safety software provider that makes a disclosure under paragraphs (1),(2),(4), or (5) of subsection (e) shall promptly inform the child with respect to whose account with a large social media platform the delegation was made and, if a parent or legal guardian of the child made the delegation, the parent or legal guardian that the disclosure has been or will be made, except if:

(1) the third-party safety software provider, in the exercise of professional judgment, believes informing such child or parent or legal guardian would place such child at risk of serious harm; or

(2) the third-party safety software provider is prohibited by law, including a valid order by a court or administrative body, from informing such child or parent or legal guardian.

Section 20. Requirements of third-party safety software providers.

(a) A third-party safety software provider is qualified to access an application programming interface and any information or user data as described in Section 15 if the third-party safety software provider:

(1) is solely engaged in the business of Internet safety;

(2) use any user data it obtains as described in Section 15 solely for the purpose of protecting a child from any harm;

(3) only discloses user data it obtains as described in Section 15 as permitted by Section 15; and

(4) will disclose, in an easy-to-understand, human-readable format, to each child with respect to whose account with a large social media platform the service of the third-party safety software provider is operating and if a parent or legal guardian of the child made the delegation as described in Section 15 with respect to the account, to the parent or legal guardian, sufficient information detailing the operation of the service and what information the third-party safety software provider is collecting to enable such child and such parent or legal guardian, if applicable, to make informed decisions regarding the use of the service.

Section 25. Liability of third-party safety software providers. In any civil action, other than an action brought by the Attorney General, a large social media platform provider shall not be held liable for damages arising out of the transfer of user data to a third-party safety software provider in accordance with this Act, if the large social media platform provider has in good faith complied with the requirements of this Act.

Section 30. Enforcement by Attorney General. A violation of any of the provisions of this Act is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. All remedies, penalties, and authority granted to the Attorney General by that Act shall be available to him or her for the enforcement of this Act.

Section 90. The Consumer Fraud and Deceptive Business Practices Act is amended by adding Section 2EEEE as follows:

(815 ILCS 505/2EEEE new)

Sec. 2EEEE. Violations of the Parental Digital Choice Act. A person who violates the Parental Digital Choice Act commits an unlawful practice within the meaning of this Act.

Section 99. Effective date. This Act takes effect June 1, 2025.