SB3510 103RD GENERAL ASSEMBLY

LRB103 37990 SPS 68122 b

103RD GENERAL ASSEMBLY
State of Illinois
2023 and 2024
SB3510

Introduced 2/9/2024, by Sen. Laura Fine

SYNOPSIS AS INTRODUCED:

New Act

Creates the Minor User of Social Media Protection Act. Provides that a social media company that has Illinois account holders shall develop a written policy, made available to the public, that complies with the procedures set forth in the Act and establish a reporting function that permits account holders to report that an Illinois account holder is a minor. Provides that a social media company that receives a report that an Illinois account holder is a minor shall verify the age of that account holder and, if a reasonable age verification reveals that the reported account holder is a minor, the social media company shall take down the reported account holder's account. Sets forth provisions concerning liability for social media companies and liability for commercial entities or third-party vendors.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Minor User of Social Media Protection Act.

Section 5. Definitions. As used in this Act:

"Account holder" means an individual who creates an account or a profile to use a social media platform.

"Account holder age report" means a report to a social media company from another account holder that a specified Illinois account holder is a minor.

"Commercial entity" means a corporation, limited liability company, partnership, limited partnership, sole proprietorship, or other legally recognized entity. "Commercial entity" includes a third-party vendor.

"Credible" means the data collected for targeted advertising purposes indicates, to a reasonable person, that the account holder is, more likely than not, a minor under the age of 13 from the user's digital footprint and data from the user's conduct on the social media platform to curate advertisements based on the user's demographics.

"Digital footprint" means the body of data or information that a particular person creates through the person's actions online or exists as a result of the person's online activity.

"Infinite scroll" means a design feature with the hallmark of displaying additional content at the bottom of the user's screen, such that the user is typically unable to look at a single social media post.

"Minor" means an individual under the age of 13.

"Preference amplification" means using algorithms and recommender systems to increase the user's engagement by recommending content based on how the user interacts with the social media platform.

"Push notifications" means the delivery of information from a social media platform to a computing device without a specific request from the client.

"Reasonable age verification" means to confirm that a person seeking to access a social media platform is at least 13 years old.

"Reported account holder" means an Illinois account holder who is the subject of an account holder age report.

"Reported presumed minor account holder" means an Illinois account holder who is the subject account holder age report that is determined to be credible based on the data the social media company collects for targeted advertising purposes.

"Social media company" means a media company that designs an online forum for an account holder to:

(1) create a public profile, establish an account, or register as a user for the primary purpose of interacting socially with other profiles and accounts;

(2) upload or create posts or content;

(3) view posts or content of other account holders; and

(4) interact with other account holders or users, including, without limitation, establishing mutual connections through request and acceptance.

"Social media company" does not include:

(1) a media company that exclusively offers subscription content to which users follow or subscribe unilaterally and whose platforms' primary purpose is not social interaction, unless that media company allows a user to generate short video clips of dancing, voice overs, or other acts of entertainment in which the primary purpose is not educational or informative;

(2) a media company that exclusively offers interacting gaming, virtual gaming, or an online service, that allows the creation and uploading of content for the purpose of interacting gaming, entertainment, or associated entertainment, and the communication related to that content;

(3) a company that:

(A) offers cloud storage services, enterprise cybersecurity services, educational devices, or enterprise collaboration tools for K-12 schools; and

(B) derives less than 25% of the company's revenue from operating a social media platform, including games and advertising; or

(4) a company that provides career development opportunities, including professional networking, job skills, learning certifications, and job posting and application services.

"Social media platform" means a public or semi-public Internet-based service or application that has users in Illinois and on which a substantial function of the service or application is to connect users in order to allow users to interact socially with each other within the service or application. A service or application that provides email or direct messaging shall not be considered to a "social media platform" on the basis of that function alone.

"Social media platform" does not include an online service, a website, or an application if the predominant or exclusive function is:

(1) email;

(2) direct messaging consisting of messages, photos, or videos that are sent between devices by electronic means if messages are:

(A) shared between the sender and the recipient or recipients;

(B) only visible to the sender and the recipient or recipients; and

(C) are not posted publicly;

(3) a streaming service that:

(A) provides only licensed media in a continuous flow from the service, website, or application to the end user; and

(B) does not obtain a license to the media from a user or account holder by agreement of the streaming service's terms of service;

(4) providing news, sports, entertainment, or other content that is preselected by the provider and not user generated, including, without limitation, if any chat, comment, or interactive functionality that is provided is incidental to, directly related to, or dependent upon provision of the content;

(5) online shopping or e-commerce, if the interaction with other users or account holders is generally limited to:

(A) the ability to post and comment on reviews;

(B) the ability to display lists or collections of goods for sale or wish lists; and

(C) other functions that are focused on online shopping or e-commerce rather than interaction between users or account holders;

(6) business-to-business software that is not accessible to the general public;

(7) cloud storage;

(8) shared document collaboration;

(9) providing access to or interacting with data visualization platforms, libraries, or hubs;

(10) permitting comments on a digital news website, if the news content is posted only by the provider of the digital news website;

(11) providing or obtaining technical support for a social media company's platform, products, or services;

(12) academic or scholarly research; and

(13) other research if the majority of the content is posted or created by the provider of the online service, website, or application and the ability to chat, comment, or interact with other users is directly related to the provider's content:

(A) that is a classified advertising service that only permits the sale of goods and prohibits the solicitation of personal services; or

(B) that is used by and under the direction of an educational entity, including, without limitation:

(i) a learning management system;

(ii) a student engagement program; and

(iii) a subject-specific or skill-specific program.

"Social media platform" does not include a social media platform that is controlled by a business entity that has generated less than $100,000,000 in annual gross revenue.

"Targeted advertising purposes" means behavior-based advertising that takes into account data from a user's digital footprint and data from the user's conduct on the social media platform to curate advertisements based on a user's demographics, including, but not limited to, who the user is, what the user likes, and what the user is likely to purchase.

"User" means a person who has access to view all or some of the posts and content on a social media platform but is not an account holder.

Section 10. Requirements for social media companies.

(a) A social media company that has Illinois account holders shall develop a written policy, made available to the public, that complies with the procedures set forth in this Act and establish a reporting function that permits account holders to report that an Illinois account holder is a minor.

(b) A social media company that receives an account holder age report that an Illinois account holder is a minor shall determine whether the account holder age report is credible. An account holder age report is credible when a social media company has reason to believe the reported account holder is a minor under the age of 13 based on the data the social media company collects for targeted advertising purposes.

(c) If the social media company has reason to believe the reported account holder is under the age of 13 based on the data the social media company collects for targeted advertising purposes, the social media company shall verify the age of the reported presumed minor account holder in accordance with Section 20.

(d) If the social media company does not have reason to believe the reported account holder is under the age of 13 based on the data the social media company collects for targeted advertising purposes, the social media company is not required to take any additional action on the account holder age report.

Section 15. Age verification of reported presumed minor account holders.

(a) When a reported account holder is considered to be a reported presumed minor account holder as described in subsection (c) of Section 10, the social media company shall verify the age of the reported presumed minor account holder within 30 days after receiving the account holder age report.

(b) A social media company shall use a third-party vendor to perform reasonable age verification. Reasonable age verification methods under subsection (b) include providing:

(1) government-issued identification; or

(2) any commercially reasonable age verification method.

(c) If, within 30 days after receiving the account holder age report, a reasonable age verification reveals that the reported account holder:

(1) is a minor, the social media company shall take down the reported account holder's account; or

(2) is not a minor, the social media company shall leave the reported account holder's social media account active and open and the social media company shall not be required to take any additional action on the account holder age report.

(d) If, within 30 days after receiving the account holder age report, a reasonable age verification is not conducted by a third party for any reason, the social media company shall restrict the following design features from the reported presumed minor account holder until reasonable age verification is performed:

(1) the ability of any other account holder to contact or direct message with a presumed minor account holder;

(2) the ability of any other account holder to engage with a presumed minor account holder, including, but not limited to liking, commenting or sharing a presumed minor account holder's content posted to the social media platform;

(3) infinite scroll;

(4) push notifications;

(5) the ability for a presumed minor account holder to see preference amplification on the presumed minor account holder's social media content;

(6) the ability of the presumed minor account holder to access the social media platform between the hours of 10 p.m. to 6 a.m.; and

(7) face and body image manipulation filters.

Section 20. Liability for social media companies.

(a) A social media company that knowingly violates this Act is liable if the social media company fails to:

(1) perform a reasonable age verification for a reported presumed minor account holder;

(2) restrict the design features from the reported presumed minor account holder until reasonable age verification is performed; or

(3) take down the account of a reported presumed minor account holder if age verification reveals the reported presumed minor account holder is a minor, unless parental consent is provided.

(b) If a social media company performs a reasonable age verification, the social media company shall not retain any identifying information of the individual after access to the social media platform has been granted.

(c) The Attorney General may conduct an investigation of an alleged violation of this Act and initiate an enforcement action against a social media company on behalf of the State to assess civil penalties. Prior to asserting a cause of action, the Attorney General shall provide a social media company with a period of time of not less than 30 days to comply with this Act

(d) A social media company that is found to have violated this Act shall be liable for a civil penalty, to be assessed by a court of competent jurisdiction, of not more than $2,500 per violation and court costs and reasonable attorney's fees as ordered by the court.

(e) This Section does not:

(1) apply to a news or public interest broadcast, website video, report, or event;

(3) apply to cloud service providers; or

(2) affect the rights of a news-gathering organization.

(f) An Internet service provider, or any of its affiliates or subsidiaries, or search engines, does not violate this Act solely by providing access, connection to or from a website, or other information or content on the Internet, or a facility, system, or network that is not under that Internet service provider's control, including transmission, downloading, intermediate storage, access software, or other service that provides access or connectivity, to the extent the Internet service provider is not responsible for the creation of the content or the communication on a social media platform.

Section 25. Liability for commercial entities or third-party vendors.

(a) A commercial entity or third-party vendor shall not retain any identifying information of an individual after access to the social media platform has been granted.

(b) The Attorney General may conduct an investigation of an alleged violation of this Act and initiate an enforcement action on behalf of the State to assess civil penalties. Prior to asserting a cause of action, the Attorney General shall provide a commercial entity or third party vendor with a period of time of not less than 30 days to comply with this Act.

(c) A commercial entity or third-party vendor that is found to have knowingly retained identifying information of an individual after access to the material is granted shall be liable for a civil penalty, to be assessed by a court of competent jurisdiction, of not more than $2,500 per violation and court costs and reasonable attorney's fees as ordered by the court.