LCO 5327 1 of 7
General Assembly Committee Bill No. 5474
January Session, 2025
LCO No. 5327
Referred to Committee on COMMITTEE ON CHILDREN
Introduced by:
(KID)
AN ACT CONCERNING SOCIAL MEDIA PLATFORMS AND MINORS.
Be it enacted by the Senate and House of Representatives in General
Assembly convened:
Section 1. (NEW) (Effective October 1, 2025) (a) As used in this section: 1
(1) "Consumer" means an individual who is a resident of this state 2
and a user of a social media platform; 3
(2) "Cyberbullying" means any unwanted and aggressive behavior on 4
a social media platform; 5
(3) "Mental health services" has the same meaning as provided in 6
section 19a-498c of the general statutes; 7
(4) "Owner" means a person who owns a social media platform; 8
(5) "Person" means an individual, association, corporation, limited 9
liability company, partnership, trust or other legal entity; and 10
(6) "Social media platform" has the same meaning as provided in 11
section 42-528 of the general statutes. 12 Committee Bill No. 5474
LCO 5327 2 of 7
(b) Not later than January 1, 2026, each owner of a social media 13
platform shall incorporate an online safety center into the social media 14
platform. Each online safety center shall, at a minimum, provide the 15
consumers who use such social media platform with: 16
(1) Resources for the purposes of (A) preventing cyberbullying on 17
such social media platform, and (B) enabling each consumer to identify 18
any means available to such consumer to obtain mental health services, 19
including, but not limited to, an Internet web site address or telephone 20
number where such consumer may obtain mental health services for the 21
treatment of an anxiety disorder or the prevention of suicide; 22
(2) An explanation of such social media platform's mechanism for 23
reporting harmful or unwanted behavior, including, but not limited to, 24
cyberbullying, on such social media platform; and 25
(3) Educational information concerning the impact that social media 26
platforms have on users' mental health. 27
(c) Not later than January 1, 2026, each owner of a social media 28
platform shall establish a cyberbullying policy for the social media 29
platform. Such policy shall, at a minimum, set forth the manner in which 30
such owner handles reports of cyberbullying on such social media 31
platform. 32
Sec. 2. Section 42-529 of the general statutes is repealed and the 33
following is substituted in lieu thereof (Effective October 1, 2025): 34
For the purposes of this section and sections 42-529a to 42-529e, 35
inclusive, as amended by this act: 36
(1) "Adult" means any individual who is at least eighteen years of age; 37
(2) "Consent" has the same meaning as provided in section 42-515; 38
(3) "Consumer" has the same meaning as provided in section 42-515; 39
(4) "Controller" has the same meaning as provided in section 42-515; 40 Committee Bill No. 5474
LCO 5327 3 of 7
(5) "Heightened risk of harm to minors" means processing minors' 41
personal data in a manner that presents any reasonably foreseeable risk 42
of (A) any unfair or deceptive treatment of, or any unlawful disparate 43
impact on, minors, (B) any financial, physical or reputational injury to 44
minors, [or] (C) any physical or other intrusion upon the solitude or 45
seclusion, or the private affairs or concerns, of minors if such intrusion 46
would be offensive to a reasonable person, or (D) any harm to the 47
physical or mental health of minors; 48
(6) "HIPAA" has the same meaning as provided in section 42-515; 49
(7) "Minor" means any consumer who is younger than eighteen years 50
of age; 51
(8) "Online service, product or feature" means any service, product or 52
feature that is provided online. "Online service, product or feature" does 53
not include any (A) telecommunications service, as defined in 47 USC 54
153, as amended from time to time, (B) broadband Internet access 55
service, as defined in 47 CFR 54.400, as amended from time to time, or 56
(C) delivery or use of a physical product; 57
(9) "Person" has the same meaning as provided in section 42-515; 58
(10) "Personal data" has the same meaning as provided in section 42-59
515; 60
(11) "Precise geolocation data" has the same meaning as provided in 61
section 42-515; 62
(12) "Process" and "processing" have the same meaning as provided 63
in section 42-515; 64
(13) "Processor" has the same meaning as provided in section 42-515; 65
(14) "Profiling" has the same meaning as provided in section 42-515; 66
(15) "Protected health information" has the same meaning as 67
provided in section 42-515; 68 Committee Bill No. 5474
LCO 5327 4 of 7
(16) "Sale of personal data" has the same meaning as provided in 69
section 42-515; 70
(17) "Targeted advertising" has the same meaning as provided in 71
section 42-515; and 72
(18) "Third party" has the same meaning as provided in section 42-73
515. 74
Sec. 3. Subsections (b) and (c) of section 42-529a of the general statutes 75
are repealed and the following is substituted in lieu thereof (Effective 76
October 1, 2025): 77
(b) (1) Subject to the consent requirement established in subdivision 78
(3) of this subsection, no controller that offers any online service, 79
product or feature to consumers whom such controller has actual 80
knowledge, or wilfully disregards, are minors shall [: (A) Process] 81
process any minor's personal data: [(i) for] (A) For the purposes of [(I)] 82
(i) targeted advertising, [(II)] (ii) any sale of personal data, or [(III)] (iii) 83
profiling in furtherance of any fully automated decision made by such 84
controller that produces any legal or similarly significant effect 85
concerning the provision or denial by such controller of any financial or 86
lending services, housing, insurance, education enrollment or 87
opportunity, criminal justice, employment opportunity, health care 88
services or access to essential goods or services; [, (ii)] (B) unless such 89
processing is reasonably necessary to provide such online service, 90
product or feature; [, (iii)] (C) for any processing purpose [(I)] (i) other 91
than the processing purpose that the controller disclosed at the time 92
such controller collected such personal data, or [(II)] (ii) that is 93
reasonably necessary for, and compatible with, the processing purpose 94
described in subparagraph [(A)(iii)(I)] (C)(i) of this subdivision; [,] or 95
[(iv)] (D) for longer than is reasonably necessary to provide such online 96
service, product or feature. [; or (B) use any system design feature to 97
significantly increase, sustain or extend any minor's use of such online 98
service, product or feature.] The provisions of this subdivision shall not 99
apply to any service or application that is used by and under the 100 Committee Bill No. 5474
LCO 5327 5 of 7
direction of an educational entity, including, but not limited to, a 101
learning management system or a student engagement program. 102
(2) Subject to the consent requirement established in subdivision (3) 103
of this subsection, no controller that offers an online service, product or 104
feature to consumers whom such controller has actual knowledge, or 105
wilfully disregards, are minors shall collect a minor's precise 106
geolocation data unless: (A) Such precise geolocation data is reasonably 107
necessary for the controller to provide such online service, product or 108
feature and, if such data is necessary to provide such online service, 109
product or feature, such controller may only collect such data for the 110
time necessary to provide such online service, product or feature; and 111
(B) the controller provides to the minor a signal indicating that such 112
controller is collecting such precise geolocation data, which signal shall 113
be available to such minor for the entire duration of such collection. 114
(3) No controller shall engage in the activities described in 115
subdivisions (1) and (2) of this subsection unless the controller obtains 116
the minor's consent or, if the minor is younger than thirteen years of age, 117
the consent of such minor's parent or legal guardian. A controller that 118
complies with the verifiable parental consent requirements established 119
in the Children's Online Privacy Protection Act of 1998, 15 USC 6501 et 120
seq., and the regulations, rules, guidance and exemptions adopted 121
pursuant to said act, as said act and such regulations, rules, guidance 122
and exemptions may be amended from time to time, shall be deemed to 123
have satisfied any requirement to obtain parental consent under this 124
subdivision. 125
(c) (1) No controller that offers any online service, product or feature 126
to consumers whom such controller has actual knowledge, or wilfully 127
disregards, are minors shall: (A) Provide any consent mechanism that is 128
designed to substantially subvert or impair, or is manipulated with the 129
effect of substantially subverting or impairing, user autonomy, decision-130
making or choice; [or] (B) except as provided in subdivision (2) of this 131
subsection, offer any direct messaging apparatus for use by minors 132
[without providing] unless (i) such controller provides readily 133 Committee Bill No. 5474
LCO 5327 6 of 7
accessible and easy-to-use safeguards to limit the ability of adults to 134
send unsolicited communications to minors with whom they are not 135
connected, and (ii) such online service, product or feature includes a 136
default setting that prevents adults from sending unsolicited 137
communications to minors with whom they are not connected; or (C) 138
except as provided in subdivision (3) of this subsection, use any system 139
design feature to significantly increase, sustain or extend any minor's 140
use of such online service, product or feature. 141
(2) The provisions of subparagraph (B) of subdivision (1) of this 142
subsection shall not apply to services where the predominant or 143
exclusive function is: (A) Electronic mail; or (B) direct messaging 144
consisting of text, photos or videos that are sent between devices by 145
electronic means, where messages are (i) shared between the sender and 146
the recipient, (ii) only visible to the sender and the recipient, and (iii) not 147
posted publicly. 148
(3) The provisions of subparagraph (C) of subdivision (1) of this 149
subsection shall not apply to any service or application that is used by 150
and under the direction of an educational entity, including, but not 151
limited to, a learning management system or a student engagement 152
program. 153
Sec. 4. Subsection (e) of section 42-529b of the general statutes is 154
repealed and the following is substituted in lieu thereof (Effective October 155
1, 2025): 156
(e) If any controller conducts a data protection assessment pursuant 157
to subsection (a) of this section and determines that the online service, 158
product or feature that is the subject of such assessment poses a 159
heightened risk of harm to minors, such controller shall establish and 160
implement a plan to mitigate or eliminate such risk. The Attorney 161
General may require a controller to disclose to the Attorney General a 162
plan established and implemented pursuant to this subsection if the 163
plan is relevant to an investigation conducted by the Attorney General. 164 Committee Bill No. 5474
LCO 5327 7 of 7
This act shall take effect as follows and shall amend the following
sections:
Section 1 October 1, 2025 New section
Sec. 2 October 1, 2025 42-529
Sec. 3 October 1, 2025 42-529a(b) and (c)
Sec. 4 October 1, 2025 42-529b(e)
KID Joint Favorable