H.R. 6257 — SMK Act of 2025

This section establishes definitions for 12 terms used in the Act, including (1) "minor" as an individual under 17 years old; (2) "social media platform" as a website or app allowing users to create and maintain public or semi-public profiles, connect in networks or communities, share and consume user-generated content, and engage in persistent interpersonal communication; (3) "covered user" as a minor user of a social media platform of whom the provider has actual knowledge or willful disregard; (4) "direct messaging feature," excluding posts to public/semi-public profiles or broader feeds; (5) "ephemeral messaging feature" as a function that automatically deletes communications after a set time, viewing, or exiting the interface (with specified exceptions); (6) "parental direct messaging controls" as tools allowing a parent to manage a covered user's direct messaging; and (7) "verifiable parental consent," which has the meaning given in the Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6501) and includes mechanisms to manage parental controls.

This section requires social media platforms offering direct messaging to covered users to provide easily accessible, user-friendly parental direct messaging controls that parents may activate and manage with verifiable parental consent. The controls must be accessible via user profile settings and any parental portal; prominently displayed to parents or when creating profiles for likely covered users; and, as a default, (1) notify parents of unapproved contact requests and allow approval or denial before messaging occurs, (2) enable parents to view and manage approved contacts, (3) inform parents of covered user age changes affecting controls, and (4) permit disabling direct messaging entirely. For covered users under age 13, platforms must disable direct messaging by default (though parents may enable it with consent); platforms may not degrade other features based on control use and must prevent easy circumvention by covered users.

This section requires app store providers to display a clear and conspicuous warning to a parent of a covered user when the covered user attempts to download or purchase an app for a social media platform with a direct messaging feature, if the parent has enabled a verifiable parental consent requirement through an app store setting for such transactions by the covered user.

This section establishes FTC enforcement of violations of the Act by treating them as violations of a rule under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) (i.e., FTC rules defining unfair or deceptive acts or practices) and incorporates all applicable terms, provisions, jurisdiction, powers, duties, penalties, privileges, and immunities of the FTC Act (15 U.S.C. 41 et seq.). It further authorizes state attorneys general (or state officials or agencies) to bring civil parens patriae actions in state or federal court to enjoin violations, enforce compliance, obtain damages or restitution for state residents, or secure other relief; requires prior written notice to the FTC (or immediate notice if not feasible); grants the FTC rights to intervene, be heard, and appeal; and prohibits state actions during pendency of a federal action by the FTC or DOJ against the same defendant for the same alleged violation.

This section establishes rules of construction providing that nothing in this Act requires a provider of a social media platform or other interactive computer service or electronic communication service to (1) decrypt or ensure decryptability of a user's encrypted communication; (2) preclude any form of user encryption, including end-to-end encryption; or (3) design or implement any measure to weaken, undermine, or circumvent user encryption or security controls. It further directs the Act's implementation to respect and protect user privacy and communication security without requiring or encouraging systemic surveillance or monitoring of encrypted communications or creation of such capabilities. Finally, it specifies that no Act requirement to restrict features for covered users or provide parental direct messaging controls overrides these encryption protections, and such requirements must be met, to the maximum extent technically feasible, without compromising the integrity of strong encryption for any platform user.

This section preempts any state or political subdivision law, rule, regulation, requirement, standard, or other provision having the force of law that relates to this Act.

This section establishes a severability clause, providing that if any provision of the Act or its application to any person or circumstance is held unconstitutional, the remaining provisions of the Act and their application to other persons or circumstances shall not be affected.

This section sets the effective date of the Act as 180 days after enactment, except that social media platform providers must comply with section 4 within one year after enactment and with section 5 within 18 months after enactment.