Illinois 2023-2024 Regular Session

Illinois House Bill HB5380 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB5380 Introduced , by Rep. Jennifer Gong-Gershowitz SYNOPSIS AS INTRODUCED: New Act815 ILCS 505/2EEEE new Creates the Let Parents Choose Protection Act. Provides that the Act may be referred to as Sammy's Law. Provides that, before August 1, 2025, or within 30 days after a service becomes a large social media platform after August 1, 2025, a large social media platform provider shall create, maintain, and make available to any third-party safety software provider a set of third-party-accessible real time application programming interfaces, including any information necessary to use the interfaces, by which a child, if the child is 13 years of age or older, or a parent or legal guardian of a child, may delegate permission to the third-party safety software provider to: (1) manage the child's online interactions, content, and account settings on the large social media platform on the same terms as the child; and (2) initiate secure transfers of user data from the large social media platform in a commonly used and machine-readable format to the third-party safety software provider. Sets forth disclosure requirements to the child and the parents or guardians of a child; requirements of third-party safety software providers; and liability of third-party safety software providers. Provides that a violation of any of the provisions of the Act is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective June 1, 2025. LRB103 38832 SPS 68969 b A BILL FOR 103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB5380 Introduced , by Rep. Jennifer Gong-Gershowitz SYNOPSIS AS INTRODUCED: New Act815 ILCS 505/2EEEE new New Act 815 ILCS 505/2EEEE new Creates the Let Parents Choose Protection Act. Provides that the Act may be referred to as Sammy's Law. Provides that, before August 1, 2025, or within 30 days after a service becomes a large social media platform after August 1, 2025, a large social media platform provider shall create, maintain, and make available to any third-party safety software provider a set of third-party-accessible real time application programming interfaces, including any information necessary to use the interfaces, by which a child, if the child is 13 years of age or older, or a parent or legal guardian of a child, may delegate permission to the third-party safety software provider to: (1) manage the child's online interactions, content, and account settings on the large social media platform on the same terms as the child; and (2) initiate secure transfers of user data from the large social media platform in a commonly used and machine-readable format to the third-party safety software provider. Sets forth disclosure requirements to the child and the parents or guardians of a child; requirements of third-party safety software providers; and liability of third-party safety software providers. Provides that a violation of any of the provisions of the Act is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective June 1, 2025. LRB103 38832 SPS 68969 b LRB103 38832 SPS 68969 b A BILL FOR
2	2	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB5380 Introduced , by Rep. Jennifer Gong-Gershowitz SYNOPSIS AS INTRODUCED:
3	3	New Act815 ILCS 505/2EEEE new New Act 815 ILCS 505/2EEEE new
4	4	New Act
5	5	815 ILCS 505/2EEEE new
6	6	Creates the Let Parents Choose Protection Act. Provides that the Act may be referred to as Sammy's Law. Provides that, before August 1, 2025, or within 30 days after a service becomes a large social media platform after August 1, 2025, a large social media platform provider shall create, maintain, and make available to any third-party safety software provider a set of third-party-accessible real time application programming interfaces, including any information necessary to use the interfaces, by which a child, if the child is 13 years of age or older, or a parent or legal guardian of a child, may delegate permission to the third-party safety software provider to: (1) manage the child's online interactions, content, and account settings on the large social media platform on the same terms as the child; and (2) initiate secure transfers of user data from the large social media platform in a commonly used and machine-readable format to the third-party safety software provider. Sets forth disclosure requirements to the child and the parents or guardians of a child; requirements of third-party safety software providers; and liability of third-party safety software providers. Provides that a violation of any of the provisions of the Act is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective June 1, 2025.
7	7	LRB103 38832 SPS 68969 b LRB103 38832 SPS 68969 b
8	8	LRB103 38832 SPS 68969 b
9	9	A BILL FOR
10	10	HB5380LRB103 38832 SPS 68969 b HB5380 LRB103 38832 SPS 68969 b
11	11	HB5380 LRB103 38832 SPS 68969 b
12	12	1 AN ACT concerning business.
13	13	2 Be it enacted by the People of the State of Illinois,
14	14	3 represented in the General Assembly:
15	15	4 Section 1. Short title; references to Act.
16	16	5 (a) Short title. This Act may be cited as the Parental
17	17	6 Digital Choice Act.
18	18	7 (b) References to Act. This Act may be referred to as
19	19	8 Sammy's Law.
20	20	9 Section 5. Findings and intent.
21	21	10 (a) The General Assembly finds and declares the following:
22	22	11 (1) Parents and legal guardians should be empowered to
23	23	12 use the services of third-party safety software providers
24	24	13 to protect their children from certain harms on large
25	25	14 social media platforms.
26	26	15 (2) Dangers like cyberbullying, human trafficking,
27	27	16 illegal drug distribution, sexual harassment, and violence
28	28	17 perpetrated, facilitated, or exacerbated through the use
29	29	18 of certain large social media platforms have harmed
30	30	19 children on those platforms.
31	31	20 (b) It is the intent of the General Assembly to require
32	32	21 large social media platforms to create, maintain, and make
33	33	22 available to third-party safety software providers a set of
34	34	23 real-time application programming interfaces, through which a
35	35
36	36
37	37
38	38	103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB5380 Introduced , by Rep. Jennifer Gong-Gershowitz SYNOPSIS AS INTRODUCED:
39	39	New Act815 ILCS 505/2EEEE new New Act 815 ILCS 505/2EEEE new
40	40	New Act
41	41	815 ILCS 505/2EEEE new
42	42	Creates the Let Parents Choose Protection Act. Provides that the Act may be referred to as Sammy's Law. Provides that, before August 1, 2025, or within 30 days after a service becomes a large social media platform after August 1, 2025, a large social media platform provider shall create, maintain, and make available to any third-party safety software provider a set of third-party-accessible real time application programming interfaces, including any information necessary to use the interfaces, by which a child, if the child is 13 years of age or older, or a parent or legal guardian of a child, may delegate permission to the third-party safety software provider to: (1) manage the child's online interactions, content, and account settings on the large social media platform on the same terms as the child; and (2) initiate secure transfers of user data from the large social media platform in a commonly used and machine-readable format to the third-party safety software provider. Sets forth disclosure requirements to the child and the parents or guardians of a child; requirements of third-party safety software providers; and liability of third-party safety software providers. Provides that a violation of any of the provisions of the Act is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective June 1, 2025.
43	43	LRB103 38832 SPS 68969 b LRB103 38832 SPS 68969 b
44	44	LRB103 38832 SPS 68969 b
45	45	A BILL FOR
46	46
47	47
48	48
49	49
50	50
51	51	New Act
52	52	815 ILCS 505/2EEEE new
53	53
54	54
55	55
56	56	LRB103 38832 SPS 68969 b
57	57
58	58
59	59
60	60
61	61
62	62
63	63
64	64
65	65
66	66	HB5380 LRB103 38832 SPS 68969 b
67	67
68	68
69	69	HB5380- 2 -LRB103 38832 SPS 68969 b HB5380 - 2 - LRB103 38832 SPS 68969 b
70	70	HB5380 - 2 - LRB103 38832 SPS 68969 b
71	71	1 child or a parent or legal guardian of a child may delegate
72	72	2 permission to a third-party safety software provider to manage
73	73	3 the child's online interactions, content, and account settings
74	74	4 on the large social media platform on the same terms as the
75	75	5 child, and for other purposes.
76	76	6 Section 10. Definitions. As used in this Act:
77	77	7 "Child" means any individual under 18 years of age who has
78	78	8 registered an account with a large social media platform.
79	79	9 "Large social media platform" means a service that:
80	80	10 (1) is provided through an Internet website, a mobile
81	81	11 application, or both;
82	82	12 (2) does not prohibit the use of the service by a
83	83	13 child;
84	84	14 (3) includes features that enable a child to share
85	85	15 images, text, or video through the Internet with other
86	86	16 users of the service whom the child has met, identified,
87	87	17 or become aware of solely through the use of the service;
88	88	18 and
89	89	19 (4) has more than 100,000,000 monthly global active
90	90	20 users or generates more than $1,000,000,000 in gross
91	91	21 revenue per year, adjusted yearly for inflation, or both.
92	92	22 "Large social media platform" does not include a service
93	93	23 that:
94	94	24 (1) primarily serves to facilitate the sale or
95	95	25 provision of professional services or the sale of
96	96
97	97
98	98
99	99
100	100
101	101	HB5380 - 2 - LRB103 38832 SPS 68969 b
102	102
103	103
104	104	HB5380- 3 -LRB103 38832 SPS 68969 b HB5380 - 3 - LRB103 38832 SPS 68969 b
105	105	HB5380 - 3 - LRB103 38832 SPS 68969 b
106	106	1 commercial products;
107	107	2 (2) primarily serves to provide news or information
108	108	3 and the service does not offer the ability for content to
109	109	4 be sent by a user directly to a child; or
110	110	5 (3) has features that enable a user who communicates
111	111	6 directly with a child through a message, including a text,
112	112	7 audio, or video message, not otherwise available to other
113	113	8 users of the service, to add other users to that message
114	114	9 that the child may not have otherwise met, identified, or
115	115	10 become aware of solely through the use of the service and
116	116	11 does not have any features that enable a child to share
117	117	12 images, text, or video through the Internet with other
118	118	13 users of the service whom the child has met, identified,
119	119	14 or become aware of solely through the use of the service.
120	120	15 "Large social media platform provider" means any person
121	121	16 who, for a commercial purpose provides, manages, operates, or
122	122	17 controls a large social media platform.
123	123	18 "Third-party safety software provider" means any person
124	124	19 who, for a commercial purpose, is authorized by a child, if the
125	125	20 child is 13 years of age or older, or a parent or legal
126	126	21 guardian of a child, to interact with a large social media
127	127	22 platform to manage the child's online interactions, content,
128	128	23 or account settings for the sole purpose of protecting the
129	129	24 child from harm, including physical or emotional harm.
130	130	25 "User data" means any information needed to have a profile
131	131	26 on a large social media platform or content on a large social
132	132
133	133
134	134
135	135
136	136
137	137	HB5380 - 3 - LRB103 38832 SPS 68969 b
138	138
139	139
140	140	HB5380- 4 -LRB103 38832 SPS 68969 b HB5380 - 4 - LRB103 38832 SPS 68969 b
141	141	HB5380 - 4 - LRB103 38832 SPS 68969 b
142	142	1 media platform, including images, video, audio, or text, that
143	143	2 is created by or sent to a child on or through the child's
144	144	3 account with the platform, and the information or content is
145	145	4 created by or sent to the child while a delegation described in
146	146	5 Section 15 is in effect with respect to the account. For the
147	147	6 purposes of this definition, information shall only be
148	148	7 considered "user data" for 90 days after the date the
149	149	8 information or content is created by or sent to the child.
150	150	9 Section 15. Delegation of permission to third-party
151	151	10 software provider.
152	152	11 (a) Before August 1, 2025, or within 30 days after a
153	153	12 service becomes a large social media platform after August 1,
154	154	13 2025, a large social media platform provider shall create,
155	155	14 maintain, and make available to any third-party safety
156	156	15 software provider that satisfies the requirements described in
157	157	16 Section 20 a set of third-party-accessible real time
158	158	17 application programming interfaces, including any information
159	159	18 necessary to use the interfaces, by which a child, if the child
160	160	19 is 13 years of age or older, or a parent or legal guardian of a
161	161	20 child, may delegate permission to the third-party safety
162	162	21 software provider to:
163	163	22 (1) manage the child's online interactions, content,
164	164	23 and account settings on the large social media platform on
165	165	24 the same terms as the child; and
166	166	25 (2) initiate secure transfers of user data from the
167	167
168	168
169	169
170	170
171	171
172	172	HB5380 - 4 - LRB103 38832 SPS 68969 b
173	173
174	174
175	175	HB5380- 5 -LRB103 38832 SPS 68969 b HB5380 - 5 - LRB103 38832 SPS 68969 b
176	176	HB5380 - 5 - LRB103 38832 SPS 68969 b
177	177	1 large social media platform in a commonly used and
178	178	2 machine-readable format to the third-party safety software
179	179	3 provider, and the frequency of the transfers may not be
180	180	4 limited by the large social media platform provider to
181	181	5 less than once per hour.
182	182	6 (b) Once a child or a parent or legal guardian of a child
183	183	7 makes a delegation under subsection (a), the large social
184	184	8 media platform provider shall make the application programming
185	185	9 interfaces and information available to the third-party safety
186	186	10 software provider on an ongoing basis until one of the
187	187	11 following applies:
188	188	12 (1) the delegation is revoked by the child or the
189	189	13 child's parent or legal guardian;
190	190	14 (2) the child's account is disabled with the large
191	191	15 social media platform;
192	192	16 (3) the third-party safety software provider rejects
193	193	17 the delegation; or
194	194	18 (4) one or more of the affirmations made by the
195	195	19 third-party safety software provider under Section 20 is
196	196	20 no longer true.
197	197	21 (c) A large social media platform provider shall establish
198	198	22 and implement reasonable policies, practices, and procedures
199	199	23 concerning the secure transfer of user data under a delegation
200	200	24 as described in subsection (a) from the large social media
201	201	25 platform to a third-party safety software provider in order to
202	202	26 mitigate any risks related to user data.
203	203
204	204
205	205
206	206
207	207
208	208	HB5380 - 5 - LRB103 38832 SPS 68969 b
209	209
210	210
211	211	HB5380- 6 -LRB103 38832 SPS 68969 b HB5380 - 6 - LRB103 38832 SPS 68969 b
212	212	HB5380 - 6 - LRB103 38832 SPS 68969 b
213	213	1 (d) If a delegation is made by a child or a parent or legal
214	214	2 guardian of a child as described in subsection (a) with
215	215	3 respect to the account of the child with a large social media
216	216	4 platform. The large social media platform provider shall:
217	217	5 (1) disclose to the child and, if the parent or legal
218	218	6 guardian made the delegation, the parent or legal guardian
219	219	7 the fact that the delegation has been made;
220	220	8 (2) provide to the child and, if the parent or legal
221	221	9 guardian made the delegation, the parent or legal guardian
222	222	10 a summary of what user data is being transferred to the
223	223	11 third-party safety software provider; and
224	224	12 (3) provide any update to the summary as described in
225	225	13 paragraph (2) as necessary to reflect any change to what
226	226	14 user data is being transferred to the third-party safety
227	227	15 software provider.
228	228	16 (e) A third-party safety software provider shall not
229	229	17 disclose any user data obtained under this Section to any
230	230	18 person except:
231	231	19 (1) in compliance with a lawful request from a
232	232	20 governmental body, including for law enforcement purposes
233	233	21 or for judicial or administrative proceedings by means of
234	234	22 a court order or a court ordered warrant, a subpoena or
235	235	23 summons issued by a judicial officer, or a grand jury
236	236	24 subpoena;
237	237	25 (2) to the extent that the disclosure is required by
238	238	26 law and the disclosure complies with and is limited to the
239	239
240	240
241	241
242	242
243	243
244	244	HB5380 - 6 - LRB103 38832 SPS 68969 b
245	245
246	246
247	247	HB5380- 7 -LRB103 38832 SPS 68969 b HB5380 - 7 - LRB103 38832 SPS 68969 b
248	248	HB5380 - 7 - LRB103 38832 SPS 68969 b
249	249	1 requirements of the law;
250	250	2 (3) to a reasonable parent or caregiver of a child, if
251	251	3 the third-party safety software provider believes in good
252	252	4 faith that the child is at foreseeable risk or currently
253	253	5 experiencing any of the following harms:
254	254	6 (A) suicide;
255	255	7 (B) anxiety;
256	256	8 (C) depression;
257	257	9 (D) eating disorders;
258	258	10 (E) violence, including being the victim of or
259	259	11 planning to commit or facilitate battery under Section
260	260	12 12-3 of the Criminal Code of 2012 and assault under
261	261	13 Section 12-1 of the Criminal Code of 2012;
262	262	14 (F) substance abuse;
263	263	15 (G) fraud;
264	264	16 (H) trafficking in persons under Section 10-9 of
265	265	17 the Criminal Code of 2012;
266	266	18 (I)sexual abuse;
267	267	19 (J) physical injury;
268	268	20 (K) harassment, including hate-based harassment,
269	269	21 sexual harassment, and stalking under Section 12-7.3
270	270	22 of the Criminal Code of 2012;
271	271	23 (L) exposure to harmful material under Section
272	272	24 11-21 of the Criminal Code of 2012;
273	273	25 (M) communicating with a terrorist organization as
274	274	26 defined under Section 219 of the federal Immigration
275	275
276	276
277	277
278	278
279	279
280	280	HB5380 - 7 - LRB103 38832 SPS 68969 b
281	281
282	282
283	283	HB5380- 8 -LRB103 38832 SPS 68969 b HB5380 - 8 - LRB103 38832 SPS 68969 b
284	284	HB5380 - 8 - LRB103 38832 SPS 68969 b
285	285	1 and Nationality Act, 8 U.S.C. 1189;
286	286	2 (N) academic dishonesty, including cheating,
287	287	3 plagiarism, or other forms of academic dishonesty that
288	288	4 are intended to gain an unfair academic advantage; or
289	289	5 (O) sharing personal information limited to:
290	290	6 (i) home address;
291	291	7 (ii) telephone number;
292	292	8 (iii) social security number;
293	293	9 (iv) username;
294	294	10 (v) password; and
295	295	11 (vi) personal banking information.
296	296	12 (4) to a person reasonably able to prevent or lessen
297	297	13 an imminent threat to the health or safety of an
298	298	14 individual, if there is a reasonably foreseeable serious
299	299	15 and imminent threat to the health or safety of an
300	300	16 individual;
301	301	17 (5) to a public health authority or other appropriate
302	302	18 governmental authority authorized by law to receive
303	303	19 reports of child abuse or neglect.
304	304	20 (f) A third-party safety software provider that makes a
305	305	21 disclosure under paragraphs (1),(2),(4), or (5) of subsection
306	306	22 (e) shall promptly inform the child with respect to whose
307	307	23 account with a large social media platform the delegation was
308	308	24 made and, if a parent or legal guardian of the child made the
309	309	25 delegation, the parent or legal guardian that the disclosure
310	310	26 has been or will be made, except if:
311	311
312	312
313	313
314	314
315	315
316	316	HB5380 - 8 - LRB103 38832 SPS 68969 b
317	317
318	318
319	319	HB5380- 9 -LRB103 38832 SPS 68969 b HB5380 - 9 - LRB103 38832 SPS 68969 b
320	320	HB5380 - 9 - LRB103 38832 SPS 68969 b
321	321	1 (1) the third-party safety software provider, in the
322	322	2 exercise of professional judgment, believes informing such
323	323	3 child or parent or legal guardian would place such child
324	324	4 at risk of serious harm; or
325	325	5 (2) the third-party safety software provider is
326	326	6 prohibited by law, including a valid order by a court or
327	327	7 administrative body, from informing such child or parent
328	328	8 or legal guardian.
329	329	9 Section 20. Requirements of third-party safety software
330	330	10 providers.
331	331	11 (a) A third-party safety software provider is qualified to
332	332	12 access an application programming interface and any
333	333	13 information or user data as described in Section 15 if the
334	334	14 third-party safety software provider:
335	335	15 (1) is solely engaged in the business of Internet
336	336	16 safety;
337	337	17 (2) use any user data it obtains as described in
338	338	18 Section 15 solely for the purpose of protecting a child
339	339	19 from any harm;
340	340	20 (3) only discloses user data it obtains as described
341	341	21 in Section 15 as permitted by Section 15; and
342	342	22 (4) will disclose, in an easy-to-understand,
343	343	23 human-readable format, to each child with respect to whose
344	344	24 account with a large social media platform the service of
345	345	25 the third-party safety software provider is operating and
346	346
347	347
348	348
349	349
350	350
351	351	HB5380 - 9 - LRB103 38832 SPS 68969 b
352	352
353	353
354	354	HB5380- 10 -LRB103 38832 SPS 68969 b HB5380 - 10 - LRB103 38832 SPS 68969 b
355	355	HB5380 - 10 - LRB103 38832 SPS 68969 b
356	356	1 if a parent or legal guardian of the child made the
357	357	2 delegation as described in Section 15 with respect to the
358	358	3 account, to the parent or legal guardian, sufficient
359	359	4 information detailing the operation of the service and
360	360	5 what information the third-party safety software provider
361	361	6 is collecting to enable such child and such parent or
362	362	7 legal guardian, if applicable, to make informed decisions
363	363	8 regarding the use of the service.
364	364	9 Section 25. Liability of third-party safety software
365	365	10 providers. In any civil action, other than an action brought
366	366	11 by the Attorney General, a large social media platform
367	367	12 provider shall not be held liable for damages arising out of
368	368	13 the transfer of user data to a third-party safety software
369	369	14 provider in accordance with this Act, if the large social
370	370	15 media platform provider has in good faith complied with the
371	371	16 requirements of this Act.
372	372	17 Section 30. Enforcement by Attorney General. A violation
373	373	18 of any of the provisions of this Act is an unlawful practice
374	374	19 under the Consumer Fraud and Deceptive Business Practices Act.
375	375	20 All remedies, penalties, and authority granted to the Attorney
376	376	21 General by that Act shall be available to him or her for the
377	377	22 enforcement of this Act.
378	378	23 Section 90. The Consumer Fraud and Deceptive Business
379	379
380	380
381	381
382	382
383	383
384	384	HB5380 - 10 - LRB103 38832 SPS 68969 b
385	385
386	386
387	387	HB5380- 11 -LRB103 38832 SPS 68969 b HB5380 - 11 - LRB103 38832 SPS 68969 b
388	388	HB5380 - 11 - LRB103 38832 SPS 68969 b
389	389	1 Practices Act is amended by adding Section 2EEEE as follows:
390	390	2 (815 ILCS 505/2EEEE new)
391	391	3 Sec. 2EEEE. Violations of the Parental Digital Choice Act.
392	392	4 A person who violates the Parental Digital Choice Act commits
393	393	5 an unlawful practice within the meaning of this Act.
394	394
395	395
396	396
397	397
398	398
399	399	HB5380 - 11 - LRB103 38832 SPS 68969 b