HB5511eng 104TH GENERAL ASSEMBLY

HB5511 Engrossed LRB104 20720 SPS 34223 b

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Children's Social Media Safety Act.

Section 5. Definitions. As used in this Act:

"Account holder" means an individual who is at least 18 years of age or a parent or legal guardian of a user who is under 18 years of age in this State. "Account holder" does not include a parent or legal guardian of an emancipated minor or a parent or legal guardian who is not associated with a user's device.

"Age bracket data" means non-personally identifiable data derived from a user's birth date or age for the purpose of sharing with covered developers that indicates the user's age range, including, but not limited to, the following:

(1) whether a user is under 13 years of age;

(2) whether the user is at least 13 years of age and under 16 years of age;

(3) whether the user is at least 16 years of age and under 18 years of age; or

(4) whether the user is at least 18 years of age.

"Age bracket data" includes a range of ages but does not indicate the exact age of the user.

"Application" means a software application that may be run or directed by a user on an Internet-enabled device.

"Application programming interface" means a system that allows 2 or more software systems to communicate and exchange information, features, and functionality.

"Application store" means a publicly available website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users of an Internet-enabled device.

"Covered developer" means a person who owns or controls a website, online service, online application, or mobile application, or portion thereof, that is accessed by a user in this State.

"Covered manufacturer" means a manufacturer of an Internet-enabled device, an operating system provider, or an application store.

"Covered minor" means a user of an Internet-enabled device who an account holder has indicated to be under the age of 18.

"Family account platform" means a platform that:

(1) offers subaccounts or profiles within that platform;

(2) requires a paid subscription or account creation with payment method verification as the platform's primary business model;

(3) does not permit account creation by individuals under 18 years old; and

(4) verifies that the primary account holder is an adult using commercially available methods that are reasonably designed to ensure accuracy.

"Internet-enabled device" means a smartphone, tablet, or personal laptop or desktop computer that provides cellular or wireless connectivity, is capable of connecting to the Internet, runs an operating system, and is capable of downloading and running applications.

"Operating system provider" means a commercial or non-profit entity that controls the Internet-enabled device's operating system, including the design, programming, or supply of operating systems for the Internet-enabled devices.

"Operating system" means the system software that manages the hardware of an Internet-enabled device and allows programs and applications to run on such device.

"Parent" means parent or legal guardian.

"Signal" means age bracket data that pertains to the primary user of an Internet-enabled device sent by a real-time secure application programming interface or similar method to a website, online service, online application, or mobile application.

Section 10. Digital age assurance.

(a) No later than January 1, 2028, a covered manufacturer that has an account setup feature with respect to the use of an Internet-enabled device shall:

(1) provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the primary user of that device for purposes of providing a signal regarding the primary user's age bracket to covered developers;

(2) provide a covered developer who has requested a signal with respect to a particular user with the technical ability to call a digital signal by a reasonably consistent application programming interface, where the user or the account holder has agreed to share the user's age bracket data, that contains the user's age bracket data; and

(3) send only the minimum amount of information necessary to comply with this Act and not share the digital signal information with a third party for a purpose not required by this Act, except where legally required.

For a device on which account setup was completed before January 1, 2028, a covered manufacturer shall, before July 1, 2028, provide an accessible interface that allows an account holder to indicate the birth date, age, or both, of the primary user of that device for the purpose of providing a signal regarding the primary user's age bracket to covered developers.

(b) By July 1, 2028, a covered developer shall request a signal with respect to a particular user from a covered manufacturer that has an account setup feature with respect to the use of an Internet-enabled device when the user downloads or launches a developer's website, online service, online application, or mobile application for the first time. A covered developer that receives a signal in accordance with this Section shall be deemed to have actual knowledge of the age range of the user to whom that signal pertains only with respect to that specific device.

(c) A covered developer shall treat a signal received in accordance with this Section as the primary indicator of a user's age range for purposes of determining the user's age. If a covered developer has internal clear and convincing information that a user's age is different than the age indicated by a signal received in accordance with this Section, the covered developer may use the clear and convincing information as the primary indicator of the user's age. Notwithstanding subsections (a), (b), and (c), a covered developer of a family account platform may:

(1) use the age range of the primary account holder as the age category for purposes of applying age-related safety defaults and access to features with the platform; and

(2) permit the primary account holder to attest to the age categories of associated subaccounts.

A covered developer of a family account application remains subject to all other requirements of this Section.

(d) A covered developer that receives a signal in accordance with this Section shall use that signal to comply with this Act and may use the signal to provide age-based settings and features but shall not:

(1) request more information from a covered manufacturer than the minimum amount of information necessary to comply with this Section absent user agreement; or

(2) share the signal with a third party for a purpose not required by this Section.

(e) All digital signals transmitted pursuant to this Section shall be encrypted to ensure data integrity and security.

(f) A person who violates this Section shall be subject to an injunction and liable for a civil penalty of not more than $2,500 for each affected child for each negligent violation or not more than $7,500 for each affected child for each intentional violation, which shall be assessed and recovered only in a civil action brought in the name of the people of Illinois by the Attorney General.

(g) A covered manufacturer that makes a good faith effort to comply with this Section, taking into consideration available technology and any reasonable technical limitations or outages, shall not be liable for an erroneous signal indicating a user's age range or any conduct by a developer that receives a signal indicating a user's age range.

(h) A covered manufacturer shall comply with this Act in a nondiscriminatory manner, including, but not limited to, by complying with the following:

(1) A covered manufacturer shall impose at least the same restrictions and obligations on its own websites, applications, and online services as it does on third-party websites, applications, and online services.

(2) A covered manufacturer shall not use data collected from a third party in the course of compliance with this Act to compete against that third party, give the covered manufacturer's services preference relative to those of a third party, or to otherwise use this data or consent mechanism in an anticompetitive manner.

(i) This Section does not impose liability on a covered manufacturer or covered developer that arises from the use of a device or application by a person who is not the user to whom a signal pertains.

(j) A covered developer is not liable under this Act if the covered developer relied on age signal information provided to the covered developer by a covered manufacturer.

Section 15. Protections for covered minors.

(a) As used in this Section:

"Addictive feed" means a website, online service, online application, or mobile application, or a portion thereof, as a significant part of the services offered, in which multiple pieces of media generated or shared by users of a website, online service, online application, or mobile application, either concurrently or sequentially, are recommended, selected, or prioritized for display to a user based, in whole or in part, on information associated with the user or the user's device, unless any of the following conditions are met, alone or in combination with one another:

(1) the recommendation, prioritization, or selection is based on information that is not persistently associated with the user's device, and does not concern the user's previous interactions with media generated or shared by other users;

(2) the recommendation, prioritization, or selection is based on data controlled by user-selected privacy or accessibility settings or technical information concerning the user's device;

(3) the user expressly and unambiguously requested the specific media, media by the author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information that is not permissible under this definition;

(4) the user expressly and unambiguously requested that specific media by a specific author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to as described by paragraph (3), be blocked, prioritized, or deprioritized for display, provided that the media is not recommended, selected, or prioritized based, in whole or in part, on other information associated with the user or the user's device that is not permissible under this definition;

(5) the media is direct and private communication between users;

(6) the media is recommended, selected, or prioritized only in response to a specific search inquiry by the user;

(7) the media that is recommended, selected, or prioritized for display is exclusively next in a preexisting sequence from the same author, creator, poster, or source; or

(8) the recommendation, prioritization, or selection is necessary to comply with the provisions of this Act.

"Addictive social media platform" means a covered platform that offers users or provides users with an addictive feed as a significant part of the service provided by that website, online service, online application, or mobile application.

"Content" means user-to-user text, an image upload, or a video upload. "Content" does not include game design and editorial content, immersive gameplay environments, publicly viewable usernames, publicly viewable avatars, and their components.

"Covered operator" means any person, business, or other legal entity that owns, maintains, or controls a covered platform or addictive social media platform.

"Covered platform" means a public or semi-public website, online service, online application, or mobile application that:

(1) is used by a covered minor in this State;

(2) allows users to construct a public or semi-public profile for the purposes of using such website, service, or application; and

(3) has the primary purpose of allowing users to create or post content that is viewable by other users, including, but not limited to, on message boards, in chat rooms, or through a landing page or main feed that presents the user with content generated by other users.

"Gifted currency" means a currency transfer between users involving fiat currency or digital currency purchased with fiat currency and used within a covered platform whether or not it can be converted to money.

"Precise geolocation information" means information derived from technology, including, but not limited to, global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of a natural person with precision and accuracy within a radius of 1,750 feet. "Geographic location" does not include the content of communications.

(b) A covered operator shall not offer a website, online service, online application, or mobile application in this State if it is not in compliance with subsection (b) through (d) of Section 10.

(c) For all users that the covered operator has actual knowledge to be a covered minor, the covered operator shall use the following settings by default for covered minors, which shall ensure that no user who is not already connected to a covered minor may:

(1) view the precise geolocation information of the minor if a covered platform provides a mechanism by which users share their location on the platform; or

(2) receive or send gifted currency to the minor.

(d) A parent of a covered minor or a covered minor determined by a covered operator to be over the age of 16 may override the default privacy settings described in subsection (e). A parent of a covered minor may override the default privacy settings described in subsection (e) for a covered minor under the age of 16. A covered operator may not design the covered platform in such a way that would encourage an override of these default privacy settings.

(e) For all users determined by a covered operator to be a covered minor, the covered operator shall provide a mechanism that enables a parent to set a monthly limit on all gifted currency related to the covered minor's account. The covered operator shall establish a mechanism by which a parent of a covered minor may easily view a history of all gifted currency related to the covered minor's account at any time.

(f) It shall be unlawful for an addictive social media platform to provide an addictive feed to a covered user unless:

(1) the addictive social media platform has actual knowledge that the covered user is not a covered minor; or

(2) the addictive social media platform has obtained verifiable parental consent to provide an addictive feed to a covered minor.

(g) It shall be unlawful for an addictive social media platform to, between the hours of 10 p.m. and 7 a.m., send notifications concerning an addictive feed to a covered user unless:

(1) the addictive social media platform has actual knowledge that the covered user is not a covered minor; or

(2) the addictive social media platform has obtained verifiable parental consent to send notifications during the time restricted under this subsection.

(h) All information collected from a minor for the purpose of obtaining the verifiable parental consent required under this Section shall not be used for any purpose other than obtaining verifiable parental consent and shall be deleted within a reasonable period after an attempt to obtain verifiable parental consent, except where it is necessary for compliance with any applicable provisions of State or federal law.

(i) An addictive social media platform shall not withhold, degrade, lower the quality, or increase the price of any product, service, or feature, other than as necessary for compliance with the provisions of this Act to a covered user solely because the addictive social media platform is not permitted to provide an addictive feed to the covered user under this Act.

(j) Nothing in this Section shall be construed to prohibit a covered operator from instituting a privacy setting for covered minors or other users that is more protective than that required by this Section.

(k) Nothing in this Section shall be construed as requiring a covered operator to give a parent who grants verifiable parental consent any additional or special access to or control over the data or accounts of the parent's child.

(l) Nothing in this Section shall be construed as preventing access to information regarding sex, sexuality, gender, and reproductive health that is not already prohibited by existing law.

(m) Nothing in this Section shall be construed as preventing any actions taken in good faith to restrict access to or availability of media that the covered platform considers obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not the material is constitutionally protected.

(n) Nothing in this Act shall be construed to prohibit a covered operator the ability to prevent, detect, protect against or respond to security incidents, identify theft, fraud, harassment, malicious or deceptive activities or any illegal activity targeted at or involving the developer or its services, preserve the integrity or security of systems or investigate, report or prosecute those responsible for any such action.

Section 20. Enforcement. A violation of this Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. All remedies, penalties, and authority granted to the Attorney General by the Consumer Fraud and Deceptive Business Practices Act shall be available to the Attorney General for the enforcement of this Act.

Section 25. The Consumer Fraud and Deceptive Business Practices Act is amended by adding Section 2MMMM as follows:

(815 ILCS 505/2MMMM new)

Sec. 2MMMM. Violations of the Children's Social Media Safety Act. Any person who violates the Children's Social Media Safety Act commits an unlawful practice within the meaning of this Act.

Section 97. Severability. The provisions of this Act are severable under Section 1.31 of the Statute on Statutes.

Section 99. Effective date. This Act takes effect January 1, 2027.