UNOFFICIAL COPY 25 RS BR 1419
Page 1 of 15
XXXX 2/19/2025 1:27 PM Jacketed
AN ACT relating to online protections for minors. 1
Be it enacted by the General Assembly of the Commonwealth of Kentucky: 2
SECTION 1. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 3
READ AS FOLLOWS: 4
As used in Sections 1 to 6 of this Act: 5
(1) "Account holder" means a resident of Kentucky who: 6
(a) Opens an account or creates a profile on a social media platform; or 7
(b) Is identified by a social media platform by a unique identifier while using or 8
accessing the social media platform when the social media platform knows 9
or has reason to believe that the individual is located in Kentucky; 10
(2) "Daily active users" means the number of unique users in the United States who 11
used a social media platform on at least eighty percent (80%) of the days during 12
the previous twelve (12) months, or during the previous thirty (30) days if the 13
social media platform did not exist for twelve (12) months; 14
(3) "Infinite scrolling" means: 15
(a) Content that loads as a user scrolls down the page without the need to open 16
a separate page; or 17
(b) The use of pages with no visible or apparent end or page breaks; 18
(4) "Resident" means a person who lives in Kentucky for more than six (6) months 19
of the year; and 20
(5) "Social media platform": 21
(a) Means any online forum, website, or application that: 22
1. Allows users to upload content or view the content or activity of other 23
users; 24
2. Ten percent (10%) or more of the daily active users of which are 25
younger than sixteen (16) years old who spend on average two (2) 26
hours per day or longer on the online forum, website, or application 27 UNOFFICIAL COPY 25 RS BR 1419
Page 2 of 15
XXXX 2/19/2025 1:27 PM Jacketed
on the days when using the online forum, website or application 1
during: 2
a. The previous twelve (12) months; or 3
b. The previous thirty (30) days if the online forum, website, or 4
application did not exist for twelve (12) months; 5
3. Employs algorithms that analyze user data or information on users to 6
select content for users; and 7
4. Has any of the following addictive features: 8
a. Infinite scrolling; 9
b. Push notifications or alerts sent by the online forum, website, or 10
application to inform the user about specific activities or events 11
related to the user's account; 12
c. Displays personal interactive metrics that indicate the number of 13
times other users have clicked a button to indicate their reaction 14
to content or have shared or reposted the content; 15
d. Video that begins to play without the user first clicking on the 16
video or on a play button for the video; or 17
e. Livestreaming or a function that allows a user or advertiser to 18
broadcast live video content in real-time; and 19
(b) Does not include an online service, website, or application where the 20
exclusive function is email or direct messaging consisting of text, 21
photographs, pictures, images, or videos shared only between the sender 22
and the recipients without displaying or posting publicly or to other users 23
not specifically identified as the recipients by the sender. 24
SECTION 2. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 25
READ AS FOLLOWS: 26
A social media platform shall: 27 UNOFFICIAL COPY 25 RS BR 1419
Page 3 of 15
XXXX 2/19/2025 1:27 PM Jacketed
(1) Prohibit a minor who is younger than fourteen (14) years old from entering into 1
a contract with the social media platform to become an account holder; 2
(2) Terminate any account held by an account holder who is younger than fourteen 3
(14) years old, including accounts that the social media platform treats or 4
categorizes as belonging to an account holder who is likely younger than 5
fourteen (14) years old for purposes of targeting content or advertising. In 6
terminating accounts under this subsection, the social media platform shall: 7
(a) Provide ninety (90) days for an account holder to dispute the termination; 8
and 9
(b) Terminate the account upon the expiration of the ninety (90) day period if 10
the account holder fails to effectively dispute the termination; 11
(3) Allow any account holder who is younger than fourteen (14) years old to request 12
to terminate his or her account. In terminating accounts under this subsection, 13
the social medial platform shall terminate the account within five (5) business 14
days after the request; 15
(4) Allow the confirmed parent or guardian of an account holder who is younger 16
than fourteen (14) years old to request that the minor's account be terminated. In 17
terminating accounts under this subsection, the social media platform shall 18
terminate the account within (10) business days after the request; and 19
(5) Unless otherwise required by law, permanently delete all personal information 20
held by the social media platform relating to an account that is terminated under 21
this section. 22
SECTION 3. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 23
READ AS FOLLOWS: 24
A social media platform shall: 25
(1) Prohibit a minor who is fourteen (14) or fifteen (15) years old from entering into 26
a contract with the social media platform to become an account holder, unless the 27 UNOFFICIAL COPY 25 RS BR 1419
Page 4 of 15
XXXX 2/19/2025 1:27 PM Jacketed
minor's parent or guardian provides consent for the minor to become an account 1
holder; 2
(2) Terminate any account held by an account holder who is fourteen (14) or fifteen 3
(15) years old, including accounts that the social media platform treats or 4
categorizes as belonging to an account holder who is likely fourteen (14) or 5
fifteen (15) years old for purposes of targeting content or advertising, unless the 6
account holder's parent or guardian has provided consent for the minor to create 7
or maintain the account. In terminating accounts under this subsection, the 8
social media platform shall: 9
(a) Provide ninety (90) days for an account holder to dispute the termination; 10
and 11
(b) Terminate the account upon the expiration of the ninety (90) day period if 12
the account holder fails to effectively dispute the termination; 13
(3) Allow any account holder who is fourteen (14) or fifteen (15) years old to request 14
to terminate his or her account. In terminating accounts under this subsection, 15
the social medial platform shall terminate the account within five (5) business 16
days after the request; 17
(4) Allow the confirmed parent or guardian of an account holder who is fourteen 18
(14) or fifteen (15) years old to request that the minor's account be terminated. In 19
terminating accounts under this subsection, the social media platform shall 20
terminate the account within (10) business days after the request; and 21
(5) Unless otherwise required by law, permanently delete all personal information 22
held by the social media platform relating to an account that is terminated under 23
this section. 24
SECTION 4. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 25
READ AS FOLLOWS: 26
(1) If a court enjoins the enforcement of Section 3 of this Act, or any other 27 UNOFFICIAL COPY 25 RS BR 1419
Page 5 of 15
XXXX 2/19/2025 1:27 PM Jacketed
provisions of Sections 1 to 6 of this Act due to Section 3 of this Act, Section 3 of 1
this Act shall be severed and subsection (2) of this section shall apply: 2
(2) A social media platform shall: 3
(a) Prohibit a minor who is fourteen (14) or fifteen (15) years old from entering 4
into a contract with the social media platform to become an account holder; 5
(b) Terminate any account held by an account holder who is fourteen (14) or 6
fifteen (15) years old, including accounts that the social media platform 7
treats or categorizes as belonging to an account holder who is likely 8
fourteen (14) or fifteen (15) years old for purposes of targeting content or 9
advertising. In terminating accounts under this subsection, the social media 10
platform shall: 11
1. Provide ninety (90) days for an account holder to dispute the 12
termination; and 13
2. Terminate the account upon the expiration of the ninety (90) day 14
period if the account holder fails to effectively dispute the termination; 15
(c) Allow any account holder who is fourteen (14) or fifteen (15) years old to 16
request to terminate his or her account. In terminating accounts under this 17
subsection, the social medial platform shall terminate the account within 18
five (5) business days after the request; 19
(d) Allow the confirmed parent or guardian of an account holder who is 20
fourteen (14) or fifteen (15) years old to request that the minor's account be 21
terminated. In terminating accounts under this subsection, the social media 22
platform shall terminate the account within (10) business days after the 23
request; and 24
(e) Unless otherwise required by law, permanently delete all personal 25
information held by the social media platform relating to an account that is 26
terminated under this section. 27 UNOFFICIAL COPY 25 RS BR 1419
Page 6 of 15
XXXX 2/19/2025 1:27 PM Jacketed
SECTION 5. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 1
READ AS FOLLOWS: 2
(1) A violation of Sections 1 to 6 of this Act shall be deemed an unfair, false, 3
misleading or deceptive act or practice in the conduct of trade or commerce in 4
violation of KRS 367.170. 5
(2) All of the remedies, powers, and duties provided to the Attorney General or any 6
other person under KRS 367.110 to 367.300, and the penalties provided in KRS 7
367.990, pertaining to acts and practices declared unlawful by KRS 367.170, shall 8
apply with equal force and effect to a violation of Sections 1 to 6 of this Act. 9
(3) This section shall not be construed to limit or restrict the remedies, powers, 10
duties, or penalties available to the Attorney General, the Commonwealth, or any 11
other person under any other statutory or common law. 12
SECTION 6. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 13
READ AS FOLLOWS: 14
(1) Any minor injured by a violation of Sections 1 to 6 of this Act shall have a civil 15
cause of action in Circuit Court to: 16
(a) Enjoin further violations; 17
(b) Recover actual damages sustained up to ten thousand dollars ($10,000); 18
and 19
(c) Recover the costs of the action including reasonable attorney's fees. 20
(2) A civil action filed under this section shall be brought within one (1) year from 21
the date the complainant knew or reasonably should have known of the alleged 22
violation. 23
SECTION 7. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 24
READ AS FOLLOWS: 25
As used in Sections 7 to 13 of this Act: 26
(1) "Age category" means a category of an individual based on age, including child, 27 UNOFFICIAL COPY 25 RS BR 1419
Page 7 of 15
XXXX 2/19/2025 1:27 PM Jacketed
younger teenager, older teenager, and adult. As used in this subsection: 1
(a) "Child" means an individual who is younger than thirteen (13) years old; 2
(b) "Younger teenager" means an individual who is thirteen (13) to fifteen (15) 3
years old; 4
(c) "Older teenager" means an individual who is sixteen (16) to eighteen (18) 5
years old; and 6
(d) "Adult" means an individual who is eighteen (18) years of age or older; 7
(2) "Age category data" means information about a user's age category that is 8
collected by an app store provider and shared with a developer; 9
(3) "Age rating" means a classification that provides an assessment of the suitability 10
of an app's content for different age groups; 11
(4) "App" means a software application or electronic service that a user may 12
operate, run, or direct on a mobile device; 13
(5) "App store" means a publicly available website, software application, or 14
electronic service that distributes apps from third-party developers to users; 15
(6) "App store provider" means a person that owns, operates, or controls an app 16
store; 17
(7) "Content description" means a description of the specific content elements that 18
informed the age rating of an app; 19
(8) "Developer" means a person that owns or controls an app made available 20
through an app store; 21
(9) "Minor" means an individual under eighteen (18) years old; 22
(10) "Minor account" means an account with an app store provider that: 23
(a) Is established by an individual who the app store provider has determined is 24
a minor through the app store provider's age verification methods; and 25
(b) Requires affiliation with a parent account; 26
(11) "Mobile device" means a portable computing device that: 27 UNOFFICIAL COPY 25 RS BR 1419
Page 8 of 15
XXXX 2/19/2025 1:27 PM Jacketed
(a) Provides cellular or wireless connectivity; 1
(b) Is capable of connecting to the internet; 2
(c) Runs a mobile operating system; and 3
(d) Is capable of operating or running apps through the mobile operating 4
system; 5
(12) "Mobile operating system" means software that: 6
(a) Manages mobile device hardware resources; 7
(b) Provides common services for mobile device programs; 8
(c) Controls memory allocation; and 9
(d) Provides interfaces for applications to access device functionality; 10
(13) "Office" means the Office of Consumer Protection in the Office of the Attorney 11
General, established by KRS 367.120; 12
(14) "Parent" means an adult who has legal authority to make decisions on behalf of 13
a minor; 14
(15) "Parent account" means an account with an app store provider that: 15
(a) Is verified to be established by an individual who the app store provider has 16
determined is at least eighteen (18) years old through the app store 17
provider's age verification methods; and 18
(b) May be affiliated with one (1) or more minor accounts; 19
(16) "Parental consent disclosure" means information that an app store provider is 20
required to provide to a parent before obtaining parental consent, and includes: 21
(a) The age rating of the app or in-app purchase, if one exists; 22
(b) The content description of the app or in-app purchase, if one exists; and 23
(c) A description of: 24
1. The personal data the app collects; 25
2. The personal data the app shares with a third party; and 26
3. The app developer's method to protect the personal data the app 27 UNOFFICIAL COPY 25 RS BR 1419
Page 9 of 15
XXXX 2/19/2025 1:27 PM Jacketed
collects; 1
(17) "Significant change" means a material modification to an app's terms of service 2
or privacy policy that: 3
(a) Changes the categories of data collected, stored, or shared; 4
(b) Alters the app's age rating or content descriptions; 5
(c) Adds new monetization features including in-app purchases or 6
advertisements; or 7
(d) Materially changes the app's functionality or user experience; and 8
(18) "Verifiable parental consent" means authorization that: 9
(a) Is provided by an individual who the app store provider has verified is at 10
least eighteen (18) years old; 11
(b) Is given after the app store provider has clearly and conspicuously provided 12
the parental consent disclosure to the individual; and 13
(c) Requires the parent to make a choice to grant or decline consent. 14
SECTION 8. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 15
READ AS FOLLOWS: 16
(1) An app store provider shall: 17
(a) At the time an individual who is located in the Commonwealth creates an 18
account with the app store provider: 19
1. Request age information from the individual; and 20
2. Verify the individual's age using: 21
a. Commercially available methods that are reasonably designed to 22
ensure accuracy; or 23
b. An age verification method or process that complies with 24
administrative regulations promulgated by the office under 25
Section 10 of this Act; 26
(b) If the age verification method or process described in paragraph (a)2 of this 27 UNOFFICIAL COPY 25 RS BR 1419
Page 10 of 15
XXXX 2/19/2025 1:27 PM Jacketed
subsection determines the individual is a minor: 1
1. Require the account to be affiliated with a parent account; and 2
2. Obtain verifiable parental consent from the holder of the affiliated 3
parent account before allowing the minor to: 4
a. Download any app; 5
b. Purchase any app; or 6
c. Make any in-app purchase; 7
(c) After receiving notice of any significant change from a developer: 8
1. Notify the user of any significant change; and 9
2. For a minor account: 10
a. Notify the holder of the affiliated parent account; and 11
b. Obtain renewed verifiable parental consent; 12
(d) Provide to a developer, in connection to a request authorized under Section 13
3 of this Act: 14
1. Age category data for a user located in the Commonwealth; and 15
2. The status of verified parental consent for a minor located in the state; 16
(e) Notify a developer when a parent revokes parental consent; and 17
(f) Protect personal age verification data by: 18
1. Limiting collection and processing to data necessary for: 19
a. Verifying a user's age; 20
b. Obtaining parental consent; or 21
c. Maintaining compliance records; and 22
2. Transmitting personal age verification data using industry standard 23
encryption protocols that ensure data integrity and data 24
confidentiality. 25
(2) An app store provider shall not: 26
(a) Enforce a contract or terms of service against a minor unless the app store 27 UNOFFICIAL COPY 25 RS BR 1419
Page 11 of 15
XXXX 2/19/2025 1:27 PM Jacketed
provider has obtained verifiable parental consent; 1
(b) Knowingly misrepresent the information in the parental consent disclosure; 2
or 3
(c) Share personal age verification data except: 4
1. Between an app store provider and a developer as required by Sections 5
7 to 13 of this Act; or 6
2. As otherwise required by law. 7
SECTION 9. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 8
READ AS FOLLOWS: 9
(1) A developer shall: 10
(a) Verify through the app store's data sharing methods: 11
1. The age category of users located in this state; and 12
2. For a minor account, whether verifiable parental consent has been 13
obtained; 14
(b) Notify app store providers of a significant change to the app; 15
(c) Only use age category data received from an app store or other entity to: 16
1. Enforce age-related restrictions and protections; 17
2. Ensure compliance with applicable laws and administrative 18
regulations; or 19
3. Implement safety-related features or defaults; and 20
(d) Request personal age verification data or parental consent: 21
1. At the time a user downloads or purchases an app; 22
2. When implementing a significant change to the app; or 23
3. To comply with any applicable law or administrative regulation. 24
(2) A developer may request personal age verification data or parental consent: 25
(a) No more than once during each one (1) year period to verify accuracy of 26
user age data and continued account use within the verified age category; 27 UNOFFICIAL COPY 25 RS BR 1419
Page 12 of 15
XXXX 2/19/2025 1:27 PM Jacketed
(b) When there is reasonable suspicion of account transfer or misuse outside 1
the verified age category; or 2
(c) At the time a user creates a new account with the developer. 3
(3) A developer shall not: 4
(a) Enforce a contract or terms of service against a minor unless the developer 5
has verified through the app store that verifiable parental consent has been 6
obtained; 7
(b) Knowingly misrepresent any information in the parental consent disclosure; 8
or 9
(c) Share age category data with any person. 10
SECTION 10. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 11
READ AS FOLLOWS: 12
Before January 1, 2027, the office shall: 13
(1) Establish the processes and means by which an app store provider may verify 14
whether an account holder is a minor in accordance with subsection(1)(a)2.b. of 15
Section 8 of this Act; and 16
(2) Promulgate administrative regulations in accordance with KRS Chapter 13A to 17
implement this section. 18
SECTION 11. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 19
READ AS FOLLOWS: 20
(1) A violation of Section 7 to 13 of this Act shall be deemed an unfair, false, 21
misleading or deceptive act or practice in the conduct of trade or commerce in 22
violation of KRS 367.170. 23
(2) All of the remedies, powers, and duties provided to the Attorney General or any 24
other person under KRS 367.110 to 367.300, and the penalties provided in KRS 25
367.990, pertaining to acts and practices declared unlawful by KRS 367.170, shall 26
apply with equal force and effect to a violation of Sections 7 to 13 of this Act. 27 UNOFFICIAL COPY 25 RS BR 1419
Page 13 of 15
XXXX 2/19/2025 1:27 PM Jacketed
(3) This section shall not be construed to limit or restrict the remedies, powers, 1
duties, or penalties available to the Attorney General, the Commonwealth, or any 2
other person under any other statutory or common law. 3
(4) Any parent of a minor injured by a violation of Sections 7 to 13 of this Act, shall 4
have a civil cause of action in Circuit Court to: 5
(a) Enjoin further violations; 6
(b) Recover actual damages sustained or up to one thousand dollars ($1,000) 7
for each violation, whichever is greater; and 8
(c) Recover the costs of the action including reasonable attorney's fees. 9
SECTION 12. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 10
READ AS FOLLOWS: 11
(1) A developer is not liable for a violation under Section 9 of this Act if the 12
developer demonstrates that the developer: 13
(a) Relied in good faith on: 14
1. Personal age verification data provided by an app store provider; and 15
2. Notification from an app store provider that verifiable parental 16
consent was obtained if the personal age verification data indicates 17
that the user is a minor; and 18
(b) Complied with Section 9 of this Act. 19
(2) Notwithstanding subsection (1) of this section, the safe harbor described in this 20
section: 21
(a) Applies only to actions brought under Sections 7 to 13 of this Act; and 22
(b) Does not limit a developer or app store provider's liability under any other 23
applicable law. 24
(3) Sections 7 to 13 of this Act shall not displace any other available remedies or 25
rights authorized under the laws of this Commonwealth or the United States. 26
SECTION 13. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 27 UNOFFICIAL COPY 25 RS BR 1419
Page 14 of 15
XXXX 2/19/2025 1:27 PM Jacketed
READ AS FOLLOWS: 1
Sections 7 to 13 of this Act shall not be construed to: 2
(1) Prevent an app store provider from taking reasonable measures to: 3
(a) Block, detect, or prevent distribution of unlawful, obscene, or harmful 4
material; 5
(b) Block of filter spam; 6
(c) Prevent criminal activity; or 7
(d) Protect app or app store security; 8
(2) Require an app store provider to disclose user information to a developer beyond 9
age category or verification of parental consent status; 10
(3) Allow an app store provider to implement measures required by Section 8 of this 11
Act in a manner that is arbitrary, capricious, anticompetitive, or unlawful; 12
(4) Require an app store provider to obtain parental consent for an app that: 13
(a) Provides direct access to emergency services including 911, crisis hotlines, 14
or any other emergency assistance services legally available to minors; 15
(b) Limits data collection to information necessary to provide emergency 16
services in compliance with the Children's Online Privacy Protection Act, 17
15 U.S.C. sec. 6501 et seq.; 18
(c) Provides access without requiring account creation or collection of 19
unnecessary personal information; or 20
(d) Is operated by or in partnership with an authorized emergency service 21
provider, governmental entity, or nonprofit organization; or 22
(5) Require a developer to collect, retain, reidentify, or link any information beyond 23
what is: 24
(a) Necessary to verify age categories and parental consent status as required 25
by this chapter; and 26
(b) Collected, retained, reidentified, or linked in the developer's ordinary course 27 UNOFFICIAL COPY 25 RS BR 1419
Page 15 of 15
XXXX 2/19/2025 1:27 PM Jacketed
of business. 1
Section 14. If any provision of this Act or the application thereof to any person 2
or circumstance is held invalid, the invalidity shall not affect other provisions or 3
applications of the Act that can be given effect without the invalid provision or 4
application, and to this end the provisions of this Act are severable. 5