HR2657-119

What This Bill Does

Sammy's Law creates a federal access framework for child-safety software on very large social media platforms. A covered platform is an internet or mobile service that allows child users to share images, text, or video with users they know only through the service and that exceeds 100 million monthly global active users or $1 billion in annual gross revenue. Within 30 days after coverage begins, the platform provider must create and maintain real-time APIs so a child age 13 or older, or a parent or legal guardian, can delegate permission to a registered third-party safety software provider to manage the child's interactions, content, account settings, and hourly machine-readable data transfers. The FTC registers and audits safety providers, issues guidance, educates consumers, enforces violations as unfair or deceptive acts, and operates a complaint process. The bill gives compliant platforms a liability shield for data transfers and creates one national standard preempting State API-access mandates while preserving State consumer protection, trespass, contract, tort, fraud, and data-breach laws.

Who Benefits and How

Parents of child users benefit because they can authorize safety tools to manage content, settings, and online interactions on large platforms. Child users benefit because registered safety tools can detect risks such as bullying, trafficking, self-harm, substance abuse, sexual exploitation, or violence. Third-party safety software providers benefit from mandatory API access to large platforms once they satisfy FTC registration, security, and audit conditions. Federal Trade Commission enforcement staff benefit from a clear federal registration and complaint framework for child-safety software access.

Who Bears the Burden and How

Large social media platform providers must build real-time APIs, transfer user data at least hourly, disclose delegations, and implement secure-transfer practices. Third-party safety software providers must satisfy U.S.-control, domestic processing, deletion, security-review, annual audit, disclosure, and limited-use rules. The Federal Trade Commission must register providers, review audits, issue guidance, educate consumers, conduct biannual compliance assessments, and enforce violations. State legislatures bear preemption limits because they may not maintain separate API-access mandates for large social media platforms.

Key Provisions

• Requires covered large social media platforms to provide real-time APIs for delegated child-safety software access.
• Creates FTC registration, security-review, annual audit, and adverse-action rules for third-party safety software providers.
• Limits safety-provider use, disclosure, storage, and deletion of child user data.
• Provides a compliant-platform liability shield and preempts State API-access mandates while preserving other State laws.