Bill Text: IL HB5380 | 2023-2024 | 103rd General Assembly | Introduced

---

Bill Title: Creates the Parental Digital Choice Act. Provides that the Act may be referred to as Sammy's Law. Provides that, before August 1, 2025, or within 30 days after a service becomes a large social media platform after August 1, 2025, a large social media platform provider shall create, maintain, and make available to any third-party safety software provider a set of third-party-accessible real-time application programming interfaces, including any information necessary to use the interfaces, by which a child, if the child is 13 years of age or older, or a parent or legal guardian of a child, may delegate permission to the third-party safety software provider to: (1) manage the child's online interactions, content, and account settings on the large social media platform on the same terms as the child; and (2) initiate secure transfers of user data from the large social media platform in a commonly used and machine-readable format to the third-party safety software provider. Sets forth disclosure requirements to the child and the parents or guardians of a child; requirements of third-party safety software providers; and liability of third-party safety software providers. Provides that a violation of any of the provisions of the Act is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective June 1, 2025.

Spectrum: Moderate Partisan Bill (Democrat 17-2)

Status: (Failed) 2025-01-07 - Session Sine Die [HB5380 Detail]

Download: Illinois-2023-HB5380-Introduced.html

---

103RD GENERAL ASSEMBLY State of Illinois 2023 and 2024 HB5380 Introduced , by Rep. Jennifer Gong-Gershowitz SYNOPSIS AS INTRODUCED:
New Act
815 ILCS 505/2EEEE new
Creates the Let Parents Choose Protection Act. Provides that the Act may be referred to as Sammy's Law. Provides that, before August 1, 2025, or within 30 days after a service becomes a large social media platform after August 1, 2025, a large social media platform provider shall create, maintain, and make available to any third-party safety software provider a set of third-party-accessible real time application programming interfaces, including any information necessary to use the interfaces, by which a child, if the child is 13 years of age or older, or a parent or legal guardian of a child, may delegate permission to the third-party safety software provider to: (1) manage the child's online interactions, content, and account settings on the large social media platform on the same terms as the child; and (2) initiate secure transfers of user data from the large social media platform in a commonly used and machine-readable format to the third-party safety software provider. Sets forth disclosure requirements to the child and the parents or guardians of a child; requirements of third-party safety software providers; and liability of third-party safety software providers. Provides that a violation of any of the provisions of the Act is an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. Amends the Consumer Fraud and Deceptive Business Practices Act to make a conforming change. Effective June 1, 2025.
LRB103 38832 SPS 68969 b
A BILL FOR
HB5380 LRB103 38832 SPS 68969 b
AN ACT concerning business.
Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
Section 1. Short title; references to Act.
(a) Short title. This Act may be cited as the Parental
Digital Choice Act.
(b) References to Act. This Act may be referred to as
Sammy's Law.
Section 5. Findings and intent.
(a) The General Assembly finds and declares the following:
(1) Parents and legal guardians should be empowered to
use the services of third-party safety software providers
to protect their children from certain harms on large
social media platforms.
(2) Dangers like cyberbullying, human trafficking,
illegal drug distribution, sexual harassment, and violence
perpetrated, facilitated, or exacerbated through the use
of certain large social media platforms have harmed
children on those platforms.
(b) It is the intent of the General Assembly to require
large social media platforms to create, maintain, and make
available to third-party safety software providers a set of
real-time application programming interfaces, through which a

HB5380 - 2 - LRB103 38832 SPS 68969 b
child or a parent or legal guardian of a child may delegate
permission to a third-party safety software provider to manage
the child's online interactions, content, and account settings
on the large social media platform on the same terms as the
child, and for other purposes.
Section 10. Definitions. As used in this Act:
"Child" means any individual under 18 years of age who has
registered an account with a large social media platform.
"Large social media platform" means a service that:
(1) is provided through an Internet website, a mobile
application, or both;
(2) does not prohibit the use of the service by a
child;
(3) includes features that enable a child to share
images, text, or video through the Internet with other
users of the service whom the child has met, identified,
or become aware of solely through the use of the service;
and
(4) has more than 100,000,000 monthly global active
users or generates more than $1,000,000,000 in gross
revenue per year, adjusted yearly for inflation, or both.
"Large social media platform" does not include a service
that:
(1) primarily serves to facilitate the sale or
provision of professional services or the sale of

HB5380 - 3 - LRB103 38832 SPS 68969 b
commercial products;
(2) primarily serves to provide news or information
and the service does not offer the ability for content to
be sent by a user directly to a child; or
(3) has features that enable a user who communicates
directly with a child through a message, including a text,
audio, or video message, not otherwise available to other
users of the service, to add other users to that message
that the child may not have otherwise met, identified, or
become aware of solely through the use of the service and
does not have any features that enable a child to share
images, text, or video through the Internet with other
users of the service whom the child has met, identified,
or become aware of solely through the use of the service.
"Large social media platform provider" means any person
who, for a commercial purpose provides, manages, operates, or
controls a large social media platform.
"Third-party safety software provider" means any person
who, for a commercial purpose, is authorized by a child, if the
child is 13 years of age or older, or a parent or legal
guardian of a child, to interact with a large social media
platform to manage the child's online interactions, content,
or account settings for the sole purpose of protecting the
child from harm, including physical or emotional harm.
"User data" means any information needed to have a profile
on a large social media platform or content on a large social

HB5380 - 4 - LRB103 38832 SPS 68969 b
media platform, including images, video, audio, or text, that
is created by or sent to a child on or through the child's
account with the platform, and the information or content is
created by or sent to the child while a delegation described in
Section 15 is in effect with respect to the account. For the
purposes of this definition, information shall only be
considered "user data" for 90 days after the date the
information or content is created by or sent to the child.
Section 15. Delegation of permission to third-party
software provider.
(a) Before August 1, 2025, or within 30 days after a
service becomes a large social media platform after August 1,
2025, a large social media platform provider shall create,
maintain, and make available to any third-party safety
software provider that satisfies the requirements described in
Section 20 a set of third-party-accessible real time
application programming interfaces, including any information
necessary to use the interfaces, by which a child, if the child
is 13 years of age or older, or a parent or legal guardian of a
child, may delegate permission to the third-party safety
software provider to:
(1) manage the child's online interactions, content,
and account settings on the large social media platform on
the same terms as the child; and
(2) initiate secure transfers of user data from the

HB5380 - 5 - LRB103 38832 SPS 68969 b
large social media platform in a commonly used and
machine-readable format to the third-party safety software
provider, and the frequency of the transfers may not be
limited by the large social media platform provider to
less than once per hour.
(b) Once a child or a parent or legal guardian of a child
makes a delegation under subsection (a), the large social
media platform provider shall make the application programming
interfaces and information available to the third-party safety
software provider on an ongoing basis until one of the
following applies:
(1) the delegation is revoked by the child or the
child's parent or legal guardian;
(2) the child's account is disabled with the large
social media platform;
(3) the third-party safety software provider rejects
the delegation; or
(4) one or more of the affirmations made by the
third-party safety software provider under Section 20 is
no longer true.
(c) A large social media platform provider shall establish
and implement reasonable policies, practices, and procedures
concerning the secure transfer of user data under a delegation
as described in subsection (a) from the large social media
platform to a third-party safety software provider in order to
mitigate any risks related to user data.

HB5380 - 6 - LRB103 38832 SPS 68969 b
(d) If a delegation is made by a child or a parent or legal
guardian of a child as described in subsection (a) with
respect to the account of the child with a large social media
platform. The large social media platform provider shall:
(1) disclose to the child and, if the parent or legal
guardian made the delegation, the parent or legal guardian
the fact that the delegation has been made;
(2) provide to the child and, if the parent or legal
guardian made the delegation, the parent or legal guardian
a summary of what user data is being transferred to the
third-party safety software provider; and
(3) provide any update to the summary as described in
paragraph (2) as necessary to reflect any change to what
user data is being transferred to the third-party safety
software provider.
(e) A third-party safety software provider shall not
disclose any user data obtained under this Section to any
person except:
(1) in compliance with a lawful request from a
governmental body, including for law enforcement purposes
or for judicial or administrative proceedings by means of
a court order or a court ordered warrant, a subpoena or
summons issued by a judicial officer, or a grand jury
subpoena;
(2) to the extent that the disclosure is required by
law and the disclosure complies with and is limited to the

HB5380 - 7 - LRB103 38832 SPS 68969 b
requirements of the law;
(3) to a reasonable parent or caregiver of a child, if
the third-party safety software provider believes in good
faith that the child is at foreseeable risk or currently
experiencing any of the following harms:
(A) suicide;
(B) anxiety;
(C) depression;
(D) eating disorders;
(E) violence, including being the victim of or
planning to commit or facilitate battery under Section
12-3 of the Criminal Code of 2012 and assault under
Section 12-1 of the Criminal Code of 2012;
(F) substance abuse;
(G) fraud;
(H) trafficking in persons under Section 10-9 of
the Criminal Code of 2012;
(I)sexual abuse;
(J) physical injury;
(K) harassment, including hate-based harassment,
sexual harassment, and stalking under Section 12-7.3
of the Criminal Code of 2012;
(L) exposure to harmful material under Section
11-21 of the Criminal Code of 2012;
(M) communicating with a terrorist organization as
defined under Section 219 of the federal Immigration

HB5380 - 8 - LRB103 38832 SPS 68969 b
and Nationality Act, 8 U.S.C. 1189;
(N) academic dishonesty, including cheating,
plagiarism, or other forms of academic dishonesty that
are intended to gain an unfair academic advantage; or
(O) sharing personal information limited to:
(i) home address;
(ii) telephone number;
(iii) social security number;
(iv) username;
(v) password; and
(vi) personal banking information.
(4) to a person reasonably able to prevent or lessen
an imminent threat to the health or safety of an
individual, if there is a reasonably foreseeable serious
and imminent threat to the health or safety of an
individual;
(5) to a public health authority or other appropriate
governmental authority authorized by law to receive
reports of child abuse or neglect.
(f) A third-party safety software provider that makes a
disclosure under paragraphs (1),(2),(4), or (5) of subsection
(e) shall promptly inform the child with respect to whose
account with a large social media platform the delegation was
made and, if a parent or legal guardian of the child made the
delegation, the parent or legal guardian that the disclosure
has been or will be made, except if:

HB5380 - 9 - LRB103 38832 SPS 68969 b
(1) the third-party safety software provider, in the
exercise of professional judgment, believes informing such
child or parent or legal guardian would place such child
at risk of serious harm; or
(2) the third-party safety software provider is
prohibited by law, including a valid order by a court or
administrative body, from informing such child or parent
or legal guardian.
Section 20. Requirements of third-party safety software
providers.
(a) A third-party safety software provider is qualified to
access an application programming interface and any
information or user data as described in Section 15 if the
third-party safety software provider:
(1) is solely engaged in the business of Internet
safety;
(2) use any user data it obtains as described in
Section 15 solely for the purpose of protecting a child
from any harm;
(3) only discloses user data it obtains as described
in Section 15 as permitted by Section 15; and
(4) will disclose, in an easy-to-understand,
human-readable format, to each child with respect to whose
account with a large social media platform the service of
the third-party safety software provider is operating and

HB5380 - 10 - LRB103 38832 SPS 68969 b
if a parent or legal guardian of the child made the
delegation as described in Section 15 with respect to the
account, to the parent or legal guardian, sufficient
information detailing the operation of the service and
what information the third-party safety software provider
is collecting to enable such child and such parent or
legal guardian, if applicable, to make informed decisions
regarding the use of the service.
Section 25. Liability of third-party safety software
providers. In any civil action, other than an action brought
by the Attorney General, a large social media platform
provider shall not be held liable for damages arising out of
the transfer of user data to a third-party safety software
provider in accordance with this Act, if the large social
media platform provider has in good faith complied with the
requirements of this Act.
Section 30. Enforcement by Attorney General. A violation
of any of the provisions of this Act is an unlawful practice
under the Consumer Fraud and Deceptive Business Practices Act.
All remedies, penalties, and authority granted to the Attorney
General by that Act shall be available to him or her for the
enforcement of this Act.
Section 90. The Consumer Fraud and Deceptive Business

HB5380 - 11 - LRB103 38832 SPS 68969 b
Practices Act is amended by adding Section 2EEEE as follows:
(815 ILCS 505/2EEEE new)
Sec. 2EEEE. Violations of the Parental Digital Choice Act.
A person who violates the Parental Digital Choice Act commits
an unlawful practice within the meaning of this Act.