SB3977 104TH GENERAL ASSEMBLY

LRB104 20729 SPS 34232 b

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
SB3977

Introduced 2/6/2026, by Sen. Laura Ellman

SYNOPSIS AS INTRODUCED:

New Act
815 ILCS 505/2MMMM new

Creates the Children's Social Media Safety Act. Provides that, no later than January 1, 2028, an operating system provider shall: (1) provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both; (2) provide an operator who has requested a signal with respect to a particular user a signal that identifies the user's age by category; and (3) send only the minimum amount of information necessary to comply with the provision. Provides that an operator shall not offer a platform in the State without conducting age verification as required under the Act to determine whether a user is a minor. Provides that, for all users that the operator has actual knowledge to be a minor, the operator shall use specified default settings for the minor. Provides that a violation of the Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective January 1, 2027.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Children's Social Media Safety Act.

Section 5. Definitions. As used in this Act:

"Account holder" means an individual who is at least 18 years of age or a parent or legal guardian of a user who is under 18 years of age in the State. "Account holder" does not include a parent or legal guardian who is not associated with a user's device.

"Addictive feed" means a website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users of a website, online service, online application, or mobile application, either concurrently or sequentially, are recommended, selected, or prioritized for display to a user based, in whole or in part, on information associated with the user or the user's device, unless any of the following conditions are met, alone or in combination with one another:

(1) the recommendation, prioritization, or selection is based on information that is not persistently associated with the user's device, and does not concern the user's previous interactions with media generated or shared by other users;

(2) the recommendation, prioritization, or selection is based on user-selected privacy or accessibility settings or technical information concerning the user's device;

(3) the user expressly and unambiguously requested the specific media, media by the author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information that is not permissible under this definition;

(4) the user expressly and unambiguously requested that specific media by a specific author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to as described by paragraph (3), be blocked, prioritized, or deprioritized for display, provided that the media is not recommended, selected, or prioritized based, in whole or in part, on other information associated with the user or the user's device that is not permissible under this definition;

(5) the media is a direct and private communication;

(6) the media that is recommended, selected, or prioritized for display is exclusively next in a pre-existing sequence from the same author, creator, poster, or source; or

(7) the recommendation, prioritization, or selection is necessary to comply with the provisions of this Act.

"Age bracket data" means non-personally identifiable data derived from a user's birth date or age for the purpose of sharing with developers of applications that indicates the user's age range, including, at a minimum, the following:

(1) whether a user is under 13 years of age;

(2) whether the user is at least 13 years of age and under 16 years of age;

(3) whether the user is at least 16 years of age and under 18 years of age; or

(4) whether the user is at least 18 years of age.

"Application" means a software application that may be run or directed by a user on a computer, a mobile device, or any other general purpose computing device that can access a covered application store or download applications.

"Covered application store" means a publicly available website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users of a computer, a mobile device, or any other general purpose computing device that can access a covered application store or can download an application. "Covered application store" does not include an online service that distributes extensions, plug-ins, add-ons, or other software applications that run exclusively within a separate host application.

"Covered minor" means a user of a website, online service, online application, or mobile application in this State and the operator has actual knowledge that the user is under 18 years of age.

"Covered operator" means any person, business, or other legal entity, that owns, maintains, or controls a covered platform.

"Covered platform" means a public or semi-public website, online service, online application, or mobile application that:

(1) is used by a covered minor in this State;

(2) allows users to construct a public or semi-public profile for the purposes of using the website, service or application;

(3) allows users to create or post content that is viewable by other users, including, but not limited to, on message boards, in chat rooms, or through a landing page or main feed that presents the user with content generated by other users; and

(4) allows users to privately message each other as a part of the provision of the website, service, or application.

"Covered user" means a user of a website, online service, online application, or mobile application in this State, not acting as an operator, or agent or affiliate of the operator, or the website, online service, online application, or mobile application, or any portion thereof.

"Operating system provider" means a person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose computing device.

"Operator" means any person, business, or other legal entity that owns, maintains, or controls an application.

"Parent" means parent or legal guardian.

"Signal" means age bracket data sent by a real-time secure application programming interface or operating system to an application.

Section 10. Digital age assurance.

(a) No later than January 1, 2028, an operating system provider shall:

(1) provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device for purposes of providing a signal regarding the user's age bracket to applications available in a covered application store;

(2) provide an operator who has requested a signal with respect to a particular user with a digital signal by a reasonably consistent real-time application programming interface that identifies, at a minimum, which of the following categories pertains to the user:

(A) under 13 years of age;

(B) at least 13 years of age and under 16 years of age;

(C) at least 16 years of age and under 18 years of age; or

(D) at least 18 years of age; and

(3) send only the minimum amount of information necessary to comply with this Section and not share the digital signal information with a third party for a purpose not required by this Section.

For a device on which account setup was completed before January 1, 2028, an operating system provider shall, before July 1, 2028, provide an accessible interface that allows an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user's age bracket to applications available in a covered application store.

(b) An operator shall request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched.

An operator that receives a signal in accordance with this Section shall be deemed to have actual knowledge of the age range of the user to whom that signal pertains across all platforms of the application and points of access of the application even if the operator willfully disregards the signal.

If an application last updated with updates on or after January 1, 2027 was downloaded to a device before January 1, 2028, and the operator has not requested a signal with respect to the user of the device on which the application was downloaded, the operator shall request a signal from a covered application store with respect to that user before July 1, 2028.

(c) An operator shall treat a signal received in accordance with this Section as the primary indicator of a user's age range for purposes of determining the user's age.

If an operator has internal clear and convincing information that a user's age is different than the age indicated by a signal received in accordance with this Section, the operator shall use that information as the primary indicator of the user's age.

(d) An operator that receives a signal in accordance with this Section shall use that signal to comply with this Section but shall not:

(1) request more information from an operating system provider or a covered application store than the minimum amount of information necessary to comply with this Section; or

(2) share the signal with a third party for a purpose not required by this Section.

Section 15. Protections for covered minors.

(a) An operator shall not offer a covered platform in this State without conducting age verification as required under this Act to determine whether a user is a covered minor.

(b) For all users that the covered operator has actual knowledge to be a covered minor, the operator shall use the following settings by default for covered minors, which shall ensure that no user who is not already connected to a covered minor may:

(1) view the geographic location of the minor if a covered platform provides a mechanism by which users share their location on the platform; or

(2) engage in a financial transaction with the minor.

(c) A parent of a covered minor or a covered minor determined by a covered operator to be over the age of 16 may override the default privacy settings described in subsection (b). A parent of a covered minor may override the default privacy settings described in subsection (b) for a covered minor under the age of 16.

(d) For all covered minors determined by a covered operator to be under the age of 13, the covered operator shall require the parent of the covered minor to approve all new connections with the covered minor before the covered minor's and the other user's accounts may be connected. For covered minors under the age of 13, a covered operator shall also establish a mechanism by which a parent of the minor may easily view the list of all users currently connected with the account of the minor.

(e) For all users determined by a covered operator to be a covered minor, the covered operator shall require a parent to approve all financial transactions related to the covered minor's account. The covered operator shall establish a mechanism by which a parent of a covered minor may easily view a history of all financial transactions related to the covered minor's account at any time.

(f) It shall be unlawful for a covered operator to provide an addictive feed to a covered user unless:

(1) the covered operator has actual knowledge that the covered user is not a covered minor; or

(2) the covered operator has obtained verifiable parental consent to provide an addictive feed to a covered minor.

(g) It shall be unlawful for a covered operator of a covered platform that provides an addictive feed to, between the hours of 12 a.m. and 6 a.m., send notifications concerning an addictive feed to a covered user unless:

(1) the covered operator has actual knowledge that the covered user is not a covered minor; or

(2) the covered operator has obtained verifiable parental consent to send notifications during the time restricted under this subsection.

(h) All information collected for the purpose of obtaining the verifiable parental consent required under this Section shall not be used for any purpose other than obtaining verifiable parental consent and shall be deleted immediately after an attempt to obtain verifiable parental consent, except where it is necessary for compliance with any applicable provisions of State or federal law.

(i) A covered operator shall not withhold, degrade, lower the quality, or increase the price of any product, service, or feature, other than as necessary for compliance with the provisions of this Act to a covered user solely because the covered operator is not permitted to provide an addictive feed to the covered user under this Act.

(j) Nothing in this Section shall be construed to prohibit an operator from instituting a privacy setting for covered minors or other users that is more protective than that required by this Section.

(k) Nothing in this Section shall be construed as requiring a developer to give a parent who grants verifiable parental consent any additional or special access to or control over the data or accounts of the parent's child.

(l) Nothing in this Section shall be construed as preventing any actions taken in good faith to restrict access to or availability of media that the covered operator considers obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not the material is constitutionally protected.

Section 20. Enforcement. A violation of this Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. All remedies, penalties, and authority granted to the Attorney General by the Consumer Fraud and Deceptive Business Practices Act shall be available to the Attorney General for the enforcement of this Act.

Section 90. The Consumer Fraud and Deceptive Business Practices Act is amended by adding Section 2MMMM as follows:

(815 ILCS 505/2MMMM new)

Sec. 2MMMM. Violations of the Children's Social Media Safety Act. Any person who violates the Children's Social Media Safety Act commits an unlawful practice within the meaning of this Act.

Section 97. Severability. The provisions of this Act are severable under Section 1.31 of the Statute on Statutes.

Section 99. Effective date. This Act takes effect January 1, 2027.