,,ii #aaith ,,congress #b;d ,session ,s4 #daei ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,march #bj1 #bjbf ,mr4 ,husted 7for himself1 ,mrs4 ,britt1 and ,mr4 ,warner7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to require large social media platform providers to create1 maintain1 and make available to third-party safety software providers a set of real-time application programming interfaces1 through which a child or a parent may delegate permission to a third-party safety software provider to manage the online interactions1 content1 and account settings of such child on the large social media platform in the same manner as is available to the child1 and for other purposes4 #a4 ,short title ,this ,act may be cited as ,sammy's ,law4 #b4 ,definitions ,in this ,act3 7#a7 ,child ,the term child means any individual who-- 7,a7 has not attained #ag years of age2 and 7,b7 has registered an account with a large social media platform4 7#b7 ,commerce ,the term commerce has the meaning given such term in section #d of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd74 7#c7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#d7 ,covered nation ,the term covered nation has the meaning given such term in section #dhgb7;f7 of title #aj1 ,united ,states ,code4 7#e7 ,large social media platform ,the term large social media platform-- 7,a7 means a service-- 7i7 provided through an internet website or a mobile application2 7ii7 the terms of service of which do not prohibit the use of the service by a child2 7iii7 with any feature that enables a child to share images1 text1 or video through the internet with other users of the service whom such child has met1 identified1 or become aware of solely through the use of the service2 and 7iv7 that has more than #ajj1jjj1jjj monthly global active users or generates more than #a1jjj1jjj1jjj in gross revenue per year1 adjusted yearly for inflation2 and 7,b7 does not include-- 7i7 a service that primarily serves-- 7,i7 to facilitate-- 7aa7 the sale or provision of a professional service2 or 7bb7 the sale of a commercial product2 or 7,,ii7 to provide news or information in a manner in which a user of the service may not send any content directly to a child through such service2 or 7ii7 a service that-- 7,i7 has a feature that enables a user who communicates directly with a child through a message 7including images1 text1 audio1 or video messages7 to add to such message other users that such child may have met1 identified1 or become aware of solely through the use of the service2 and 7,,ii7 does not have any feature described in subparagraph 7,a77iii74 7#f7 ,large social media platform provider ,the term large social media platform provider means any person who1 for commercial purposes in or affecting commerce1 provides1 manages1 operates1 owns1 or controls a large social media platform4 7#g7 ,parent ,the term parent means1 with respect to a child1 the parent or legal guardian of such child4 7#h7 ,sale ,the term sale1 with respect to user data-- 7,a7 means the exchange of user data for monetary consideration2 and 7,b7 does not include the disclosure of user data by a third-party safety software provider to a processor or service provider that processes user data on behalf of the third-party safety software provider4 7#i7 ,state ,the term ,state means each of the #ej ,states1 the ,district of ,columbia1 each commonwealth1 territory1 or possession of the ,united ,states1 and each federally recognized ,indian ,tribe4 7#aj7 ,third-party safety software provider ,the term third-party safety software provider means any person who1 for commercial purposes in or affecting commerce-- 7,a7 is authorized to interact with a relevant large social media platform to manage the online interactions1 content1 or account settings of a child for the sole purpose of protecting the child from harm1 including physical or emotional harm2 and 7,b7 has received such authorization from the child1 or in the case of a child who has not attained #ac years of age1 the parent of such child4 7#aa7 ,user data ,the term user data means any information reasonably necessary for a user to have a profile or submit content on a large social media platform 7including any image1 text1 audio1 or video7 that is created by or sent to a child through the account of the child on such platform1 but only-- 7,a7 if the information or content is created by or sent to the child while a delegation under section #c7;a77#a77;,a7 is in effect with respect to the account2 and 7,b7 during a #cj-;day period beginning on the date on which the information or content is created by or sent to such child4 #c4 ,providing access to third-party safety software providers 7a7 ,obligations of large social media platform providers 7#a7 ,availability of application programming interfaces 7,a7 ,in general ,not later than the date described in subparagraph 7,b71 a large social media platform provider shall create1 maintain1 and make available to a third-party safety software provider registered with the ,commission under subsection 7b77#c7 a set of third-party-accessible real-time application programming interfaces1 including any information necessary to use such interfaces1 by which a child 7or1 in the case of a child who has not attained #ac years of age1 a parent of the child7 may delegate permission to the third-party safety software provider to-- 7i7 manage any online interaction with or content created by or sent to the child1 as well as the account settings of the child on the large social media platform in the same manner as is available to the child2 and 7ii7 initiate a secure transfer of user data from the large social media platform in a commonly used and machine-readable format to the third-party safety software provider1 where the frequency of such transfers may not be limited by the large social media platform provider to less than once per hour4 7,b7 ,date described ,for purposes of subparagraph 7,a71 the date described in this subparagraph is-- 7i7 in the case of a service that is a large social media platform on the date of enactment of this ,act1 #ahj days after such date2 or 7ii7 in the case of a service that becomes a large social media platform after such date of enactment1 not later than #cj days after the date on which such service becomes a large social media platform4 7#b7 ,revocation ,once a child or parent makes a delegation under paragraph 7#a77;,a71 the large social media platform provider shall make the application programming interfaces and information described in such paragraph available to the relevant third-party safety software provider on an ongoing basis until-- 7,a7 the child or a parent1 as applicable1 revokes the delegation2 7,b7 the child or a parent1 as applicable1 revokes or disables the registration of the account of such child with the large social media platform2 7,c7 the third-party safety software provider-- 7i7 rejects the delegation2 7ii7 receives notice that-- 7,i7 the parent of such child who made the delegation no longer has legal parental rights over such child2 or 7,,ii7 a temporary arrangement has been put in place by a court or legal authority regarding the custody of such child2 or 7iii7 is deregistered by the ,commission2 or 7,d7 the child attains the age of #ag years old4 7#c7 ,data security 7,a7 ,in general ,a large social media platform provider shall establish1 implement1 and maintain reasonable policies1 practices1 and procedures to protect-- 7i7 the confidentiality1 integrity1 and accessibility of user data transferred from the large social media platform provider to a third-party safety software provider pursuant to a delegation under paragraph 7#a77;,a72 and 7ii7 any such user data against unauthorized access4 7,b7 ,scope ,the policies1 practices1 and procedures required by subparagraph 7,a7 shall be-- 7i7 consistent with state-of-the-art administrative1 technical1 and physical safeguards for protecting transferred user data2 and 7ii7 appropriate to the nature1 scope1 and volume of such user data4 7#d7 ,disclosure ,in the case of a delegation made by a child or a parent1 as applicable1 under paragraph 7#a77;,a71 with respect to the account of such child with a large social media platform1 the large social media platform provider shall-- 7,a7 disclose to such child or parent1 as applicable1 such delegation2 7,b7 provide to such child or parent1 as applicable1 a summary of any user data transferred to a third-party safety software provider2 and 7,c7 update such summary as necessary to reflect any change to such user data4 7#e7 ,limitation ,any management by a third-party safety software provider pursuant to paragraph 7#a77;,a77i7 shall be limited to such management that protects a child from harm1 including any such management related to the optimization of any privacy setting on an account of the child1 stated user age1 and marketing settings for the account4 7#f7 ,user control 7,a7 ,in general ,if a large social media platform uses a messaging feature or service that provides security features that give a user control over access to the content of any communication of the user in a manner that renders the access of the large social media platform to such content technically infeasible without overriding such control1 then the following shall apply3 7i7 ,the large social media platform may not be required to grant a third-party safety software provider access to such content through a set of third-party-accessible real-time application programming interfaces under paragraph 7#a77;,a74 7ii7 ,the large social media platform1 upon a delegation under paragraph 7#a77;,a71 shall-- 7,i7 make available and maintain a technical interface that enables contemporaneous transmission of such communication to a third-party safety software provider-- 7aa7 registered under subsection 7b77#c72 and 7bb7 selected by the child or parent1 as applicable1 as a user-designated recipient2 7,,ii7 maintain such security features without altering1 bypassing1 or overriding such features2 7,,iii7 permit the communicating users 7and any user-designated recipient7 to access the content through such interface2 and 7,,iv7 not gain access to the content of such communication4 7,b7 ,rule of construction ,nothing in this paragraph may be construed to limit the obligations of a large social media platform under this ,act with respect to user data other than the content of communications described in this paragraph4 7b7 ,third-,party safety software providers 7#a7 ,protection of user data ,a third-party safety software provider shall-- 7,a7 limit any collection1 maintenance1 and processing of user data the third-party safety software provider obtains pursuant to this ,act to what is adequate1 relevant1 and reasonably necessary for the purposes for which the user data is collected1 maintained1 or processed1 or disclosed to a parent under subsection 7d77#a77;,c72 7,b7 establish1 implement1 and maintain reasonable policies1 practices1 and procedures 7that are consistent with state-of-the-art administrative1 technical1 and physical safeguards related to protecting transferred user data and appropriate to the nature1 scope1 and volume of such user data7 to protect-- 7i7 the confidentiality1 integrity1 and accessibility of the user data received from a large social media platform pursuant to this ,act2 and 7ii7 the user data received from a large social media platform pursuant to this ,act against unauthorized access2 and 7,c7 upon any revocation described in subsection 7a77#b71 delete the user data of the child within #e days4 7#b7 ,prohibition on sale ,a third-party safety software provider may not sell any user data collected1 maintained1 or processed pursuant to this ,act4 7#c7 ,registration with the ,commission ,a third-party safety software provider shall register with the ,commission as a condition of accessing an application programming interface and any information under subsection 7a74 ,in order to complete such registration1 the third-party safety software provider shall demonstrate the following to the satisfaction of the ,commission3 7,a7 ,the third-party safety software provider is not operated1 directly or indirectly 7including through a parent company1 subsidiary1 or affiliate71 by a company operated or controlled by a covered nation4 7,b7 ,such software provider will collect1 process1 maintain1 or otherwise use any user data obtained under subsection 7a7 for the sole purpose of protecting a child from harm in accordance with any applicable terms of service and the provisions of this ,act4 7,c7 ,such software provider will only disclose user data obtained under subsection 7a7 as permitted by subsection 7d74 7,d7 ,such software provider will not sell1 disclose1 process1 store1 transfer1 or otherwise make available user data obtained under this ,act to a government of a covered nation or to a company operated or controlled by a covered nation4 7,e7 7i7 ,such software provider will delete any user data obtained under this ,act as soon as possible-- 7,i7 but not later than #e days after receiving such data from a large social media platform2 and 7,,ii7 not including any data the software provider discloses under subsection 7d74 7ii7 ,for any data disclosed under subsection 7d77#a77;,c71 such software provider will maintain such data until-- 7,i7 the child or parent who made a delegation under subsection 7a77#a77;,a71 and whose data is at issue1 requests that the third-party safety software provider delete such data2 7,,ii7 the child attains #ag years of age2 or 7,,iii7 the third-party safety software provider is deregistered by the ,commission4 7iii7 ,in the event that the child or parent who made a delegation under subsection 7a77#a77;,a7 revokes the delegation1 such software provider will delete all applicable user data not later than #ae days after the date of such revocation4 7,f7 ,such software provider will disclose1 in an easy-to-understand1 human-readable format1 to each child with respect to whose account with a large social media platform the service of the third-party safety software provider is operating and 7if a parent made the delegation under subsection 7a77#a77;,a7 with respect to the account7 to the parent1 sufficient information detailing the operation of the service and what information the software provider is collecting to enable such child or parent1 as applicable1 to make informed decisions regarding the use of the service4 7,g7 ,such software provider will disclose1 in an easy-to-understand format to each child or parent who made a delegation under subsection 7a77#a77;,a7 notice of any material changes in how the third-party safety software provider provides services4 7,h7 ,such software provider is able to provide services in accordance with any applicable terms of service and any relevant disclosures made to any consumer1 including by ensuring such terms and disclosures are clear and conspicuous and are written in plain and easy-to-understand ,english4 7,i7 ,such software provider has established1 implemented1 and maintained reasonable policies1 practices1 and procedures to protect the confidentiality1 integrity1 and accessibility of any user data collected or processed pursuant to this ,act and that the policies1 practices1 and procedures are appropriate to ensure a level of security appropriate to the risk to such user data1 the cost of implementing such policies1 practices1 and procedures1 and the nature1 scope1 and volume of such user data4 7,j7 ,such software provider assesses compliance with applicable ,federal law1 including the requirements of this ,act4 7,k7 ,such software provider is in compliance with the requirements of this ,act4 7#d7 ,annual audit 7,a7 ,audit process2 audit report ,for each year or partial year during which a third-party safety software provider is registered with the ,commission under paragraph 7#c71 the third-party safety software provider shall retain the services of a qualified independent auditing firm to complete an annual audit and write an audit report 7which shall be exempt from disclosure under section #eeb7;b77#c7 of title #e1 ,united ,states ,code7 that includes-- 7i7 a review and assessment of such registration and any subsequent written reports1 including whether the third-party safety software provider has remained in compliance with the conditions described in paragraph 7#c72 and 7ii7 an identification of whether the third-party safety software provider has made any material changes in how the third-party safety software provider provides services1 and in the event of any such material changes-- 7,i7 an explanation as to how such changes have impacted users2 and 7,,ii7 any information relating to whether such users were notified of the material change at the time the material change was implemented4 7,b7 ,submission to the ,commission ,not later than #cj days after the date on which an audit report is written under subparagraph 7,a71 a third-party safety software provider shall submit to the ,commission-- 7i7 a full copy of such audit report2 and 7ii7 a summary of such audit report that may contain redactions to protect the confidential business information and trade secrets of the third-party safety software provider4 7,c7 ,audit review by the ,commission ,the ,commission shall-- 7i7 review each audit report submitted by a third-party safety software provider under subparagraph 7,b77i7 to verify compliance with the requirements of this ,act2 7ii7 make a copy of the summary of such audit report submitted under subparagraph 7,b77ii7 available to the public2 and 7iii7 in the event an audit required under subparagraph 7,a7 detects an unusual finding1 and prior to any adverse action taken by the ,commission under paragraph 7#e71 direct a third-party safety software provider to promptly investigate and resolve the matter4 7#e7 ,additional oversight of third-party safety software providers ,in addition to the jurisdiction1 powers1 and duties of the ,commission otherwise provided under this ,act and any other provision of law1 the ,commission may take an adverse action against a third-party safety software provider1 including by-- 7,a7 denying registration of the third-party safety software provider under paragraph 7#c72 7,b7 permanently deregistering the third-party safety software provider2 and 7,c7 suspending the registration of the third-party safety software provider due to a finding by the ,commission of a material risk to the security of the data or safety of the public1 including for-- 7i7 willful misconduct or gross negligence by the third-party safety software provider2 7ii7 a material misrepresentation made by a third-party safety software provider to the ,commission or to any consumer2 7iii7 failure by the third-party safety software provider to comply with any requirements of this ,act or failure to operate in accordance with the affirmations1 assertions1 representations1 or terms of any security review1 audit1 terms of services1 or consumer disclosures2 or 7iv7 failure by the third-party safety software provider to respond to an unusual finding in an annual audit completed under paragraph 7#d74 7#f7 ,rights of third-party safety software providers 7,a7 ,in general ,in the event the ,commission takes an adverse action against a third-party safety software provider under paragraph 7#e71 the ,commission shall give the third-party safety software provider the opportunity to-- 7i7 appeal such adverse action2 and 7ii7 remediate any deficiency described in an annual audit completed under paragraph 7#d7 within #de days 7if the third-party safety software provider demonstrates the third-party safety software provider has remediated any such deficiency and has taken satisfactory action to ensure such deficiency shall not reoccur71 except in the case of a finding of-- 7,i7 willful misconduct2 7,,ii7 gross negligence2 or 7,,iii7 a demonstrated history of multiple failures in relation to the types of material risk described in paragraph 7#e77;,c74 7,b7 ,exception ,the rights described in subparagraph 7,a7 shall not prevent the ,commission from suspending the registration of a third-party safety software provider to protect the public from ongoing material risk for the period during which the third-party safety software provider is in the process of exercising such rights4 7c7 ,indemnification ,in any civil action in ,federal or ,state court 7other than an action brought by the ,commission71 a large social media platform provider may not be held liable for damages arising from transferring user data to a third-party safety software provider under subsection 7a7 if the large social media platform provider has complied with the requirements of this ,act in good faith4 7d7 ,user data disclosure 7#a7 ,permitted disclosures ,a third-party safety software provider may not disclose any user data obtained under subsection 7a7 to any other person1 except-- 7,a7 pursuant to a lawful request from a government body1 including for law enforcement purposes or for judicial or administrative proceedings1 by means of a court order or a court-ordered warrant1 a subpoena or summons issued by a judicial officer1 or a grand jury subpoena2 7,b7 to the extent that such disclosure is required by law and such disclosure complies with and is limited to the relevant requirements of such law2 7,c7 to a child who made a delegation under subsection 7a77#a77;,a7 and whose data is at issue1 the parent of such child1 or to a parent who made such a delegation and whose child's data is at issue1 with such third-party safety software provider making a good faith effort to ensure that such disclosure includes only the user data necessary for a reasonable parent to understand that such child is experiencing 7or is at foreseeable risk to experience7-- 7i7 suicide2 7ii7 anxiety2 7iii7 depression2 7iv7 an eating disorder2 7v7 violence1 including being the victim of or planning to commit or facilitate assault2 7vi7 substance abuse2 7vii7 fraud2 7viii7 severe forms of trafficking in persons 7as defined in section #ajc of the ,trafficking ,victims ,protection ,act of #bjjj 7#bb ,u4,s4,c4 #gajb772 7ix7 sexual abuse2 7x7 physical injury2 7xi7 harassment2 7xii7 sexually explicit conduct or child pornography 7as such terms are defined in section #bbef of title #ah1 ,united ,states ,code72 7xiii7 terrorism 7as defined in section #adj7;d7 of the ,foreign ,relations ,authorization ,act1 ,fiscal ,years #aihh and #aihi 7#bb ,u4,s4,c4 #bfef;f7d7771 including communications with or in support of a foreign terrorist organization 7as designated by the ,secretary of ,state under section #bai7;a7 of the ,immigration and ,nationality ,act 7#h ,u4,s4,c4 #aahi7;a7772 or 7xiv7 the sharing of personal information1 limited to-- 7,i7 home address2 7,,ii7 phone number2 7,,iii7 social security number2 and 7,,iv7 personal banking information2 7,d7 in the case of a good faith determination that disclosure is necessary to prevent or lessen a reasonably foreseeable serious and imminent threat to the health or safety of any individual1 if the disclosure is made to a person reasonably able to prevent or lessen the threat2 or 7,e7 to a public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect4 7#b7 ,disclosure reporting ,a third-party safety software provider that makes a disclosure permitted by subparagraphs 7,a71 7,b71 7,d71 or 7,e7 of paragraph 7#a7 shall promptly inform the child or parent who made a delegation under subsection 7a77#a77;,a7 that such a disclosure has been or will be made1 except if the third-party safety software provider-- 7,a7 in the exercise of professional judgment1 determines informing such child or parent would place such child at risk of serious harm2 or 7,b7 is prohibited by law 7including through a valid order by a court or administrative body7 from informing such child or parent4 7#c7 ,child exploitation ,nothing in this ,act shall be construed to relieve a third-party safety software provider or a large social media platform from their duty to report pursuant to section #bbeh;,a of title #ah1 ,united ,states ,code4 #d4 ,implementation and enforcement 7a7 ,enforcement 7#a7 ,unfair or deceptive acts or practices ,a violation of this ,act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#b7 ,powers of the ,commission 7,a7 ,in general ,the ,commission shall enforce this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act4 7,b7 ,privileges and immunities ,any person who violates this ,act shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#c7 ,preservation of authority ,nothing in this ,act may be construed to limit the authority of the ,commission under any other provision of law4 7b7 ,compliance assessment ,the ,commission1 on a biannual basis1 shall assess compliance by large social media platform providers with the provisions of this ,act4 7c7 ,complaints ,not later than #ahj days after the date of enactment of this ,act1 the ,commission shall establish procedures under which a child 7or the parent of such child71 a large social media platform provider1 or a third-party safety software provider may file a complaint alleging that a large social media platform provider or a third-party safety software provider has violated this ,act4 #e4 ,one national standard 7a7 ,in general ,no ,state or political subdivision of a ,state may maintain1 enforce1 prescribe1 or continue in effect any law1 rule1 regulation1 requirement1 standard1 or other provision having the force and effect of law of the ,state1 or political subdivision of a ,state1 related to requiring large social media platform providers to create1 maintain1 and make available to third-party safety software providers a set of real-time application programming interfaces for the purposes of child online safety1 through which a child or a parent of a child may delegate permission to a third-party safety software provider to manage the online interactions1 content1 and account settings of such child on a large social media platform in the same manner as is available to the child4 7b7 ,rule of construction ,this section may not be construed to-- 7#a7 limit the enforcement of any consumer protection law of general applicability of a ,state or political subdivision of a ,state2 7#b7 preempt the applicability of ,state trespass1 contract1 or tort law2 or 7#c7 preempt the applicability of any ,state law to the extent that the law relates to acts of fraud1 unauthorized access to personal information1 or notification of unauthorized access to personal information4