H.R. 2657 — Sammy’s Law

This section expresses the sense of Congress that (1) parents and legal guardians should be empowered to use third-party safety software providers to protect children from harms on large social media platforms; and (2) dangers such as cyberbullying, human trafficking, illegal drug distribution, sexual harassment, and violence perpetrated, facilitated, or exacerbated on such platforms have harmed children.

This section establishes definitions for terms used in the Act. It defines (1) "child" as any individual under age 17 who has registered an account with a large social media platform; (2) "commerce" as having the meaning given in 15 U.S.C. 44; (3) "Commission" as the Federal Trade Commission; (4) "large social media platform" as an online service (via website or app) whose terms allow child use, enables children to share content with users met solely through the service, and has over 100 million monthly global active users or generates over $1 billion in annual gross revenue (adjusted yearly for inflation)—excluding services primarily for professional/commercial sales or news without direct messaging to children, or certain group-messaging services without child-sharing features; (5) "large social media platform provider" as any person providing, managing, operating, or controlling such a platform for commercial purposes in or affecting commerce; (6) "State" to include U.S. states, the District of Columbia, territories/possessions, and federally recognized Indian tribes; (7) "third-party safety software provider" as any person authorized by a child (age 13 or older) or the child's parent/guardian to manage the child's interactions, content, or settings on a large social media platform solely to protect the child from harm; and (8) "user data" as profile or content information (images, video, audio, text) created by or sent to a child on such a platform while a parental delegation is in effect, limited to a 30-day period from creation or receipt.

This section requires large social media platform providers to create and maintain, within 30 days of the Act's effective date or becoming a large platform, real-time APIs enabling children age 13 or older or their parents or legal guardians to delegate authority to registered third-party safety software providers to (1) manage the child's online interactions, content, and account settings on terms equivalent to the child's own access and limited to child protection measures (e.g., optimizing privacy, age, and marketing settings); and (2) receive secure transfers of the child's user data in machine-readable format at least hourly. The APIs must remain available until revoked by the child or parent/guardian, account deletion or disablement, third-party rejection, or failure of third-party affirmations; platforms must disclose delegations, provide data transfer summaries with updates, and implement secure transfer procedures. This section further requires third-party safety software providers to register with the Federal Trade Commission (FTC) by demonstrating they are U.S.-based and not foreign-controlled; use data solely for child protection consistent with platform terms and the Act; disclose data only as permitted; process and store data exclusively in the United States; delete data within 14 days (except disclosed data maintained until requested otherwise, with all data deleted within 30 days of account cancellation); and provide clear disclosures to children and parents/guardians.

This section establishes enforcement of the Act by (1) treating violations as a violation of a rule defining unfair or deceptive acts or practices under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B))—which authorizes the Federal Trade Commission (FTC) to promulgate such substantive rules via notice-and-comment procedures—and (2) incorporating all applicable FTC Act (15 U.S.C. 41 et seq.) enforcement powers, jurisdiction, duties, penalties, privileges, and immunities. The section further directs the FTC to (1) issue compliance guidance for large social media platform providers and third-party safety software providers not later than 180 days after enactment; (2) assess such providers' compliance with the Act on a biannual basis; and (3) establish procedures enabling a child (or such child's parent or legal guardian), a large social media platform provider, or a third-party safety software provider to file complaints alleging a violation of the Act. Nothing in the section limits other FTC authorities.

This section prohibits any state or political subdivision from enforcing any law, rule, regulation, or similar measure requiring large social media platform providers to create, maintain, and make available real-time application programming interfaces (APIs) through which a child or the child's parent or legal guardian may delegate authority to a third-party safety software provider to manage the child's online interactions, content, and account settings on the platform. This section does not limit the enforcement of state or local consumer protection laws or preempt state trespass, contract, or tort laws, or state laws related to fraud, unauthorized access to personal information, or notification of such access.