H.R. 7757 — KIDS Act

This section defines terms for purposes of this subtitle, as follows: (1) child, as an individual under the age of 13; (2) compulsive usage, as persistent and repetitive use of a covered platform that substantially limits one or more major life activities (as described in 42 U.S.C. 12102); (3) geolocation information, as information sufficient to identify a street name and name of a city or town; (4) processor, as a person who processes personal information on behalf of a covered platform without determining the purpose and means of such processing; (5) sexual exploitation and abuse, as specified offenses under 18 U.S.C. 2422 (coercion and enticement), 2251 (trafficking for production of images), 2256 (child pornography), or 1591 (sex trafficking); and (6) user, as an individual who registers an account or creates a profile on a covered platform.

This section requires providers of covered platforms to establish, implement, maintain, and enforce reasonable policies, practices, and procedures addressing specified harms to minors, including (1) threats of physical violence so severe, pervasive, or objectively offensive as to impact a major life activity; (2) sexual exploitation and abuse; (3) distribution, sale, or use of narcotic drugs, tobacco products, cannabis products, gambling, or alcohol; and (4) financial harm from deceptive practices. Such policies must be appropriate to the platform's size and complexity and the technical feasibility of mitigation. The section clarifies that these requirements do not prohibit minors from deliberately searching for or requesting such content or accessing preventive resources and do not impose a duty of care.

This section requires providers of covered platforms to offer minors (i.e., users or visitors known to be under 17) readily accessible safeguards—including limits on communications from others, restrictions on profile recommendations to non-minors, controls on compulsive usage features, geolocation sharing limits with notice, and options to opt out of or limit personalized recommendations—with default settings at the most protective privacy and safety levels. The section further requires such providers to offer parents of minor users easy-to-use tools to manage privacy and account settings (including safeguards), restrict purchases and financial transactions, and view or limit platform time spent; for children (i.e., under 13), parental tools must default to most protective settings, with notice to the child of their activation and an exception for pre-existing accounts where parents previously opted out. Additionally, the section mandates age-appropriate, conspicuous information and controls in the user's language without encouraging weakened protections; applies changes upon next internet connection; and prohibits user interfaces designed to impair safeguard or tool use. It includes rules of construction preserving providers' abilities to block harmful content for minors or partner with third-party safeguard/tool providers.

This section requires providers of a covered platform to maintain (1) a readily accessible means for users and visitors to report harms to a minor related to platform use, (2) a dedicated electronic point of contact for such matters, and (3) confirmation of receipt plus a substantive response within 10 days (or as promptly as needed for imminent threats to a minor's safety).

This section requires providers of covered platforms, before any known minor registers or makes a purchase, to provide clear, conspicuous, and easy-to-understand notice describing the platform's safeguards policies for minors and how to access safeguards under section 214(a)(1) or parental tools under section 214(b)(1). For known minor users or visitors, the section further requires providers to notify parents of such safeguards or tools and obtain verifiable parental consent—which is deemed satisfied through reasonable efforts compliant with the Children’s Online Privacy Protection Act of 1998 (COPPA)—and permits consolidation of these processes with COPPA obligations.

This section requires providers of a covered platform to provide clear, conspicuous, and easy-to-understand labels or information—potentially via links or disclosures—to users or visitors known to be minors on advertisements disclosing endorsements of products, services, or brands made for commercial consideration by other users of the platform.

This section prohibits a provider of a covered platform from facilitating the advertising of narcotic drugs, cannabis products, tobacco products, gambling, or alcohol to a user or visitor the provider knows is a minor.

This section requires each provider of a covered platform to ensure an independent third-party auditor conducts an audit of the platform not later than 18 months after enactment of this subtitle and annually thereafter. The audit must (1) apply evidence-based best practices and consult parents, public health organizations, and experts on safeguards for minors (sec. 214(a)(1)), parental tools (sec. 214(b)(1)), and harms to minors (sec. 213(a)); (2) assess the platform's likely access by minors (including differences between children and teens), account for U.S. minor users, time spent, safeguard/parental tool usage, harm reports (sec. 215(a)(1)), and describe related policies, data practices, and design processes; and (3) be supported by the provider's full cooperation, including data access and disclosure. The provider must submit audit results to the Federal Trade Commission within 30 days of completion and publicly release a report within 45 days disclosing specified user metrics.

This section preempts state and local laws, rules, regulations, requirements, standards, or other provisions that conflict with this subtitle.

This section defines terms used in the subtitle, including (1) "app," as a software application run on a computer, mobile device, or other general-purpose computing device; (2) "app store," as a software application distributing third-party apps for download onto mobile devices; (3) "covered user," as a minor user of a covered platform; (4) "direct messaging feature," generally as a platform function for private user-to-user or group communications (excluding public or semi-public posts); (5) "ephemeral messaging feature," as a platform function automatically deleting or rendering communications inaccessible after a set time, viewing, or exiting the chat (with specified exceptions); (6) "mobile device," as a phone or tablet with cellular/wireless connectivity, internet access, and app-running capability; (7) "parental direct messaging controls," as tools allowing parents to manage a covered user's direct messaging; (8) "teen covered user," as a covered user aged 13 or older; (9) "unapproved contact," as a user a teen covered user may not message without verifiable parental consent when controls are activated; and (10) "verifiable parental consent," as defined in section 2 of the Act (including mechanisms to activate and manage parental direct messaging controls).

This section requires providers of covered platforms to provide easily accessible and usable parental direct messaging controls for teen covered users, activated and managed by verifiable parental consent through the teen's profile settings or any parental portal. As a default (unless adjusted by parental consent), the controls enable parents to (1) receive timely notifications of and approve or deny unapproved contact requests before messaging occurs, (2) view and manage approved contacts, (3) be informed of teen age changes affecting controls, (4) disable direct messaging features, (5) prevent specific users, groups, or others from initiating or continuing messaging, and (6) hide the teen's profile from searches, status visibility, and messaging initiation. Providers must not degrade other platform features due to these controls (except as necessary to implement them) and must take reasonable measures to prevent teen circumvention.

This section establishes a rule of construction clarifying that no requirement under this subtitle to restrict features for a covered user or provide parental direct messaging controls on a covered platform may override encryption protections for covered communications. Providers of covered platforms must comply with such requirements, to the maximum extent technically feasible, without compromising the integrity of strong encryption offered to any user.

This section preempts any state or local law, rule, regulation, requirement, standard, or similar provision that (1) directly prohibits ephemeral or direct messaging on a covered platform for users under 13 or (2) regulates parental direct messaging controls on covered platforms for teen covered users. It does not preempt state laws with respect to trespass, contract, tort, or product liability; statutory remedies or penalties for criminal conduct; or laws of general applicability with respect to consumer protection.

This section establishes an effective date for this subtitle of 180 days after enactment, except with respect to section 235.

This section prohibits a provider of a covered platform from conducting market or product-focused research on a known minor user or visitor except when (1) the research is used solely to improve the platform's privacy, security, transparency, or safety, including related design features, safeguards, settings, or tools offered to the minor or their parent; or (2) the research is necessary for compliance with federal or state law. It clarifies that nothing in this subtitle limits processing of personal information solely for measuring or reporting advertising or content performance, reach, or frequency, including through an independent measurement.

This section preempts any state or local law, rule, regulation, requirement, standard, or similar provision that regulates a covered platform's ability to conduct market or product-focused research on a minor. It specifies that such preemption does not affect (1) state laws on trespass, contract, tort, or product liability; (2) state statutory laws creating remedies or penalties for criminal conduct; or (3) state laws of general applicability on consumer protection.

This section establishes definitions for purposes of this subtitle, including (1) "fentanyl" as encompassing any fentanyl analogue or fentanyl-related substance; (2) "fentanyl-related substance" as having the meaning given in schedule I(e) of section 202(c) of the Controlled Substances Act (21 U.S.C. 812(c)); (3) "relevant congressional committees" as the House Committee on Energy and Commerce and the Senate Committee on Commerce, Science, and Transportation; and (4) "social media platform" as a public-facing website, internet application, or mobile application (e.g., social network or video sharing service) primarily enabling user-generated content, excluding broadband internet access service providers and electronic mail.

This section establishes the Kids Internet Safety Partnership within the Department of Commerce, to be headed by a director appointed by the Secretary of Commerce, with a sunset five years after establishment. The Partnership must (1) coordinate with federal agencies including the Federal Communications Commission (FCC) and specified stakeholders (e.g., academics, parents, online platforms, privacy experts, and state attorneys general) to identify online risks and benefits for minors, as well as age-appropriate best practices; (2) publish a public report on these findings and the efficacy and adoption of minor safeguards and parental tools within one year of establishment and biennially thereafter; and (3) publish a public playbook within two years of establishment to guide websites, online services, applications, and mobile apps in implementing best practices on age verification, design features, parental tools (i.e., tools enabling parents to manage privacy settings, time limits, purchases, and recommendations for known minor users), default settings, reporting, third-party safety software, and opt-outs from recommendation systems and chatbots.