Sammy's Law would require very large social media services to build and keep open real-time application programming interfaces (APIs) that let a child, or a parent for children younger than 13, delegate account control to a registered third-party safety software provider. A "large social media platform" is a service that lets children share images, text, or video and that meets size or revenue thresholds in the bill. A "third-party safety software provider" must register with the Federal Trade Commission (the Commission) and certify it will use data only to protect a child from harm.
The APIs must allow the third-party safety software provider to manage a child’s online interactions, content, and account settings in the same way the child could, and to request secure transfers of user data in a common, machine-readable format at least once per hour. Platforms must make the APIs available within 180 days for existing large services (or within 30 days after a service becomes large). Platforms must apply reasonable, state-of-the-art data security to data transfers. The bill limits third-party management to actions that protect a child from harm, such as adjusting privacy, age, and marketing settings.
Third-party safety software providers must limit collection and use of user data, delete data within specified timeframes, not sell user data, undergo annual independent audits, and submit summaries of those audits to the Commission. The Commission can deny, suspend, or revoke a provider’s registration for violations. The bill also sets rules for when providers may disclose data (for example, to parents, law enforcement with lawful process, or to prevent imminent harm) and requires providers to notify the child or parent when disclosures are made except in limited circumstances. Platforms are not required to provide API access to message content that is technically inaccessible (for example, due to end-to-end encryption), but must offer a technical interface to contemporaneously transmit such communications to a user-designated recipient without the platform accessing the content.
The Commission enforces the Act under its existing authorities. The bill states that violations are treated as unfair or deceptive acts or practices. It also establishes that States may not require similar API access rules, creating a single national standard for this subject.
No publicly available information.
The bill frames its purpose as enabling parents or children to delegate account management to third-party safety software providers for the sole purpose of protecting children from harm, while setting registration, data security, and oversight rules through the Federal Trade Commission.
No publicly available information.