Sammy’s Law of 2023

This bill requires large social media platforms to create and maintain real-time application programming interfaces (APIs) that allow children (13 or older) or their parents/guardians to delegate permission to third-party safety software providers to manage the child's online interactions, content, and account settings on the same terms as the child, and to transfer user data securely at least once per hour. The Federal Trade Commission (FTC) will enforce the law, register providers and platforms, issue guidance, and assess compliance. States cannot create their own laws on this specific topic, but other state laws are not preempted.

Sec. 3, Definitions: Defines key terms. A "child" is anyone under 17 with a platform account. A "large social media platform" is a service with over 100 million monthly global active users or over $1 billion in annual gross revenue (adjusted for inflation) that allows children to share content with other users they met through the service, excluding services primarily for professional services, commercial sales, or news without direct messaging. A "third-party safety software provider" is a commercial entity authorized by a child or parent to manage the child's account solely to protect the child from harm. "User data" is information created or sent to a child while a delegation is in effect, limited to a 30-day period.

Sec. 4, Providing access to third-party safety software: Within 30 days of the effective date (or becoming a large platform), the platform must create and maintain APIs for delegating permission to a registered third-party safety software provider. The delegation continues until revoked by the child/parent, the account is disabled, the provider rejects it, or the provider's affirmations become false. The platform must establish secure data transfer policies, disclose the delegation and a summary of transferred data to the child and parent, and update that summary as needed. Third-party safety software providers must register with the FTC, affirming they are a U.S.-based internet safety company, will use data only to protect children, and will disclose their operations to the child/parent. The FTC can deregister providers that violate these affirmations. Large platforms must also register with the FTC. The FTC will make public lists of registered providers and platforms. The FTC must issue authentication guidance within 180 days. Platforms are indemnified from damages for good-faith data transfers. Providers may only disclose user data in specific circumstances, such as lawful government requests, to the child/parent for certain harms (e.g., suicide, violence, abuse), or to prevent serious threats, and must generally inform the child/parent of such disclosures.

Sec. 5, Implementation and enforcement: Violations are treated as unfair or deceptive acts under the FTC Act, and the FTC enforces the law with its usual powers. The FTC must issue compliance guidance within 180 days, assess compliance biannually, and establish a complaint procedure.

Sec. 6, One national standard: No state or local government may maintain any law requiring large platforms to create APIs for third-party safety software as described in this bill. This does not limit enforcement of other consumer protection laws, state trespass/contract/tort law, or laws on fraud or unauthorized access.

Sec. 7, Effective date: The Act takes effect on the date the FTC issues guidance under section 5.