SB3264 104TH GENERAL ASSEMBLY

LRB104 19686 SPS 33135 b

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
SB3264

Introduced 2/3/2026, by Sen. Rachel Ventura

SYNOPSIS AS INTRODUCED:

New Act
815 ILCS 505/2MMMMM new

Creates the Online Safety Act. Provides that, no later than January 1, 2027, an owner of a social media platform shall: (1) incorporate an online safety center into the social media platform that provides consumers with specified educational resources; and (2) establish a cyberbullying policy for the social media platform. Provides for restrictions on personal data processors that offers any online service, product, or feature to minors. Provides that a violation of the Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective January 1, 2027.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Online Safety Act.

Section 5. Definitions. As used in this Act:

"Consumer" means an individual who is a resident of this State and a user of an online platform.

"Controller" means a person who, alone or jointly with others, determines the purpose and means of processing personal data.

"Cyberbullying" means any act, carried out on a social media platform, that:

(1) is reasonably likely to cause physical or emotional harm to a consumer or place a consumer in fear of physical or emotional harm; or

(2) infringes on any right afforded to a consumer under State or federal law.

"Owner" means a person who owns a social media platform.

"Person" means an individual, association, corporation, limited liability company, partnership, trust, or other legal entity.

"Social media platform" means a public or semi-public Internet-based service or application that:

(1) is used by a consumer in this State;

(2) is primarily intended to connect and allow users to socially interact within the service or application; and

(3) enables a user to:

(A) construct a public or semi-public profile for the purposes of signing in to and using the service or application;

(B) populate a public list of other users with whom the user shares a social connection within the service or application; and

(C) create or post content that is viewable by other users, including, but not limited to, on message boards, in chat rooms, or through a landing page or main feed that presents the user with content generated by other users.

"Social media platform" does not include a public or semi-public Internet-based service or application that:

(1) exclusively provides electronic mail or direct messaging services;

(2) primarily consists of news, sports, entertainment, interactive video games, electronic commerce, or content that is preselected by the provider or for which any chat, comments, or interactive functionality is incidental to, directly related to, or dependent on the provision of the content; or

(3) is used by and under the direction of an educational entity, including, but not limited to, a learning management system or a student engagement program.

Section 10. Social media platform requirements.

(a) No later than January 1, 2027, an owner shall incorporate an online safety center into its social media platform. The online safety center shall, at a minimum, provide consumers with:

(1) resources for the purpose of preventing cyberbullying on the social media platform and enabling any consumer to identify available means to obtain mental health services, including, but not limited to, a website address or telephone number where the consumer may obtain mental health services for the treatment of an anxiety disorder or the prevention of suicide;

(2) an explanation of the social media platform's mechanism for reporting harmful or unwanted behavior, including, but not limited to, cyberbullying, on the social media platform; and

(3) educational information concerning the impact that social media platforms may have on the mental health of users.

(b) No later than January 1, 2027, an owner shall establish a cyberbullying policy for the social media platform. The policy shall, at a minimum, set forth the manner in which the owner handles reports of cyberbullying on the social media platform.

Section 15. Protections for minors.

(a) A controller that offers any online service, product, or feature to consumers, that the controller has actual knowledge or willfully disregards as being minors, shall not:

(1) provide any consent mechanism that is designed to substantially subvert or impair user autonomy, decision-making, or choice or that is manipulated with the effect of substantially subverting or impairing user autonomy, decision-making, or choice;

(2) except as provided in subsection (b), offer any direct messaging apparatus for use by minors unless:

(A) the controller provides readily accessible and easy-to-use safeguards to enable any minor, or any minor's parent or legal guardian, to prevent any adult from sending any unsolicited communication to the minor, unless the minor and adult are already connected on the online service, product, or feature; and

(B) the safeguards required under subparagraph (A) are a default setting; and

(3) except as provided in subsection (c), use any system design feature to significantly increase, sustain, or extend any minor's use of the online service, product, or feature.

(b) The restrictions provided for in paragraph (2) of subsection (a) do not apply to services where the predominant or exclusive function is:

(1) electronic mail; or

(2) direct messaging consisting of text, photos, or videos that are sent between devices by electronic means, if the messages are:

(A) shared only between the sender and the recipient;

(B) visible only to the sender and the recipient; and

(C) not posted publicly.

(c) The restrictions provided for in paragraph (3) of subsection (a) do not apply to any service or application that is used by and under the direction of an educational entity, including, but not limited to, a learning management system or a student engagement program.

Section 20. Enforcement. A violation of this Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. All remedies, penalties, and authority granted to the Attorney General by the Consumer Fraud and Deceptive Business Practices Act shall be available to the Attorney General for the enforcement of this Act.

Section 90. The Consumer Fraud and Deceptive Business Practices Act is amended by adding Section 2MMMMM as follows:

(815 ILCS 505/2MMMMM new)

Sec. 2MMMMM. Violations of the Online Safety Act. Any person who violates the Online Safety Act commits an unlawful practice within the meaning of this Act.

Section 97. Severability. The provisions of this Act are severable under Section 1.31 of the Statute on Statutes.

Section 99. Effective date. This Act takes effect January 1, 2027.