S. 4159 — Sammy’s Law

This section defines terms for purposes of the Act, including (1) child, as any individual who has not attained 17 years of age and has registered an account with a large social media platform; (2) commerce, as defined in section 4 of the Federal Trade Commission Act (15 U.S.C. 44); (3) Commission, meaning the Federal Trade Commission; (4) covered nation, as defined in 10 U.S.C. 4872(f); (5) large social media platform, generally as an online service (via website or app) whose terms permit child use, enables children to share images, text, or video with users met solely through the service, and has more than 100 million monthly global active users or generates more than $1 billion in gross annual revenue (adjusted for inflation)—excluding services primarily for professional/commercial sales, news dissemination without direct child messaging, or those lacking the specified sharing feature; (6) large social media platform provider, as any person providing, operating, or controlling such a platform for commercial purposes in or affecting commerce; and (7) other terms such as parent, sale (of user data, excluding certain third-party disclosures), State (including territories and tribes), third-party safety software provider (i.e., authorized to manage child accounts for safety), and user data (limited to child profile/content information created or received during a parental delegation under section 3(a)(1)(A), for a 30-day period).

This section requires large social media platform providers to create and maintain real-time application programming interfaces (APIs) for registered third-party safety software providers, enabling a child (or parent of a child under 13 years of age) to delegate permission for the third-party provider to manage the child's online interactions, content, and account settings (limited to child protection functions such as privacy, stated age, and marketing settings) and to receive secure hourly transfers of the child's user data in machine-readable format—commencing 180 days after enactment for existing platforms or 30 days after becoming a large platform for new ones. The APIs must remain available until revoked by the child or parent, account closure, third-party deregistration or rejection, certain custody changes, or the child reaching 17 years of age; platforms must also implement data security safeguards, disclose delegations and data summaries to the child or parent, and—for end-to-end encrypted messaging—provide alternative contemporaneous transmission interfaces without overriding user security controls. This section further requires third-party safety software providers to limit collection, maintenance, and processing of obtained user data to what is adequate, relevant, and reasonably necessary for the permitted functions.

This section establishes Federal Trade Commission (FTC) enforcement of the Act by treating violations as a rule defining unfair or deceptive acts or practices under FTC rule authority (15 U.S.C. 57a(a)(1)(B)), grants the FTC the same enforcement powers, jurisdiction, duties, penalties, privileges, and immunities as under the FTC Act (15 U.S.C. 41 et seq.), and preserves the FTC's other authorities. It further directs the FTC to (1) assess, on a biannual basis, compliance by large social media platform providers with the Act and (2) establish, not later than 180 days after enactment, procedures for complaints alleging violations by such providers or third-party safety software providers, which may be filed by a child (or the child's parent), a provider, or a third-party safety software provider.

This section prohibits states and their political subdivisions from enforcing any law, rule, regulation, or similar measure requiring large social media platforms to create, maintain, and provide third-party child safety software providers with real-time application programming interfaces (APIs), through which a child or parent may authorize the provider to manage the child's online interactions, content, and account settings. The preemption does not affect (1) state or local consumer protection laws of general applicability; (2) state trespass, contract, or tort laws; or (3) state laws related to fraud, unauthorized access to personal information, or notification of such access.