I 

118TH CONGRESS 

1ST SESSION H. R. 5778 

To require large social media platform providers to create, maintain, and 

make available to third-party safety software providers a set of realtime application programming interfaces, through which a child or a 

parent or legal guardian of a child may delegate permission to a thirdparty safety software provider to manage the online interactions, content, 

and account settings of such child on the large social media platform 

on the same terms as such child, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

SEPTEMBER 28, 2023 

Ms. WASSERMAN SCHULTZ (for herself, Mr. CARTER of Georgia, Ms. 

SCHRIER, and Mrs. MILLER-MEEKS) introduced the following bill; which 

was referred to the Committee on Energy and Commerce 

A BILL 

To require large social media platform providers to create, 

maintain, and make available to third-party safety software providers a set of real-time application programming interfaces, through which a child or a parent or 

legal guardian of a child may delegate permission to 

a third-party safety software provider to manage the 

online interactions, content, and account settings of such 

child on the large social media platform on the same 

terms as such child, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
2 

•HR 5778 IH

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Sammy’s Law of 

3 2023’’. 

4 SEC. 2. SENSE OF CONGRESS. 

5 It is the sense of Congress that— 

6 (1) parents and legal guardians should be em7 powered to use the services of third-party safety 

8 software providers to protect the children of such 

9 parents and legal guardians from certain harms on 

10 large social media platforms; and 

11 (2) dangers like cyberbullying, human traf12 ficking, illegal drug distribution, sexual harassment, 

13 and violence perpetrated, facilitated, or exacerbated 

14 through the use of certain large social media plat15 forms have harmed children on such platforms. 

16 SEC. 3. DEFINITIONS. 

17 In this Act: 

18 (1) CHILD.—The term ‘‘child’’ means any indi19 vidual under the age of 17 years who has registered 

20 an account with a large social media platform. 

21 (2) COMMERCE.—The term ‘‘commerce’’ has 

22 the meaning given such term in section 4 of the 

23 Federal Trade Commission Act (15 U.S.C. 44). 

24 (3) COMMISSION.—The term ‘‘Commission’’ 

25 means the Federal Trade Commission. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
3 

•HR 5778 IH

1 (4) LARGE SOCIAL MEDIA PLATFORM.—The 

2 term ‘‘large social media platform’’— 

3 (A) means a service— 

4 (i) provided through an internet 

5 website or a mobile application (or both); 

6 (ii) the terms of service of which do 

7 not prohibit the use of the service by a 

8 child; 

9 (iii) with any feature or features that 

10 enable a child to share images, text, or 

11 video through the internet with other users 

12 of the service whom such child has met, 

13 identified, or become aware of solely 

14 through the use of the service; and 

15 (iv) that has more than 100,000,000 

16 monthly global active users or generates 

17 more than $1,000,000,000 in gross rev18 enue per year, adjusted yearly for inflation; 

19 and 

20 (B) does not include— 

21 (i) a service that primarily serves— 

22 (I) to facilitate— 

23 (aa) the sale or provision of 

24 professional services; or 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
4 

•HR 5778 IH

1 (bb) the sale of commercial 

2 products; or 

3 (II) to provide news or informa4 tion, where the service does not offer 

5 the ability for content to be sent by a 

6 user directly to a child; or 

7 (ii) a service that— 

8 (I) has a feature that enables a 

9 user who communicates directly with 

10 a child through a message (including 

11 a text, audio, or video message) not 

12 otherwise available to other users of 

13 the service to add other users to that 

14 message that such child may not have 

15 otherwise met, identified, or become 

16 aware of solely through the use of the 

17 service; and 

18 (II) does not have any feature or 

19 features described in subparagraph 

20 (A)(iii). 

21 (5) LARGE SOCIAL MEDIA PLATFORM PRO22 VIDER.—The term ‘‘large social media platform pro23 vider’’ means any person who, for commercial pur24 poses in or affecting commerce, provides, manages, 

25 operates, or controls a large social media platform. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
5 

•HR 5778 IH

1 (6) STATE.—The term ‘‘State’’ means each 

2 State of the United States, the District of Columbia, 

3 each commonwealth, territory, or possession of the 

4 United States, and each federally recognized Indian 

5 Tribe. 

6 (7) THIRD-PARTY SAFETY SOFTWARE PRO7 VIDER.—The term ‘‘third-party safety software pro8 vider’’ means any person who, for commercial pur9 poses in or affecting commerce, is authorized by a 

10 child (if the child is 13 years of age or older) or a 

11 parent or legal guardian of a child to interact with 

12 a large social media platform to manage the online 

13 interactions, content, or account settings of such 

14 child for the sole purpose of protecting such child 

15 from harm, including physical or emotional harm. 

16 (8) USER DATA.—The term ‘‘user data’’ means 

17 any information needed to have a profile on a large 

18 social media platform or content on a large social 

19 media platform, including images, video, audio, or 

20 text, that is created by or sent to a child on or 

21 through the account of such child with such plat22 form, but only— 

23 (A) if the information or content is created 

24 by or sent to such child while a delegation 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
6 

•HR 5778 IH

1 under section 4(a) is in effect with respect to 

2 the account; and 

3 (B) during a 30-day period beginning on 

4 the date on which the information or content is 

5 created by or sent to such child. 

6 SEC. 4. PROVIDING ACCESS TO THIRD-PARTY SAFETY SOFT7 WARE. 

8 (a) DUTY OF LARGE SOCIAL MEDIA PLATFORM PRO9 VIDERS.— 

10 (1) IN GENERAL.—Not later than 30 days after 

11 the effective date of this Act (in the case of a service 

12 that is a large social media platform on such effec13 tive date) or not later than 30 days after a service 

14 becomes a large social media platform (in the case 

15 of a service that becomes a large social media plat16 form after such effective date), the large social 

17 media platform provider shall create, maintain, and 

18 make available to any third-party safety software 

19 provider registered with the Commission under sub20 section (b)(1) a set of third-party-accessible real21 time application programming interfaces, including 

22 any information necessary to use such interfaces, by 

23 which a child (if the child is 13 years of age or 

24 older) or a parent or legal guardian of a child may 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
7 

•HR 5778 IH

1 delegate permission to the third-party safety soft2 ware provider to— 

3 (A) manage the online interactions, con4 tent, and account settings of such child on the 

5 large social media platform on the same terms 

6 as such child; and 

7 (B) initiate secure transfers of user data 

8 from the large social media platform in a com9 monly-used and machine-readable format to the 

10 third-party safety software provider, where the 

11 frequency of such transfers may not be limited 

12 by the large social media platform provider to 

13 less than once per hour. 

14 (2) REVOCATION.—Once a child or a parent or 

15 legal guardian of a child makes a delegation under 

16 paragraph (1), the large social media platform pro17 vider shall make the application programming inter18 faces and information described in such paragraph 

19 available to the third-party safety software provider 

20 on an ongoing basis until— 

21 (A) the child (if the child made the delega22 tion) or the parent or legal guardian of such 

23 child revokes the delegation; 

24 (B) the child or a parent or legal guardian 

25 of such child revokes or disables the registraVerDate Sep 11 2014 02:02 Oct 01, 2023 Jkt 039200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H5778.IH H5778

kjohnson on DSK7ZCZBW3PROD with $$_JOB
8 

•HR 5778 IH

1 tion of the account of such child with the large 

2 social media platform; 

3 (C) the third-party safety software pro4 vider rejects the delegation; or 

5 (D) one or more of the affirmations made 

6 by the third-party safety software provider 

7 under subsection (b)(1)(A) is no longer true. 

8 (3) SECURE TRANSFER OF USER DATA.—A 

9 large social media platform provider shall establish 

10 and implement reasonable policies, practices, and 

11 procedures regarding the secure transfer of user 

12 data pursuant to a delegation under paragraph (1) 

13 from the large social media platform to a third-party 

14 safety software provider in order to mitigate any 

15 risks related to user data. 

16 (4) DISCLOSURE.—In the case of a delegation 

17 made by a child or a parent or legal guardian of a 

18 child under paragraph (1) with respect to the ac19 count of such child with a large social media plat20 form, the large social media platform provider 

21 shall— 

22 (A) disclose to such child and (if the par23 ent or legal guardian made the delegation) the 

24 parent or legal guardian the fact that the dele25 gation has been made; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
9 

•HR 5778 IH

1 (B) provide to such child and (if such par2 ent or legal guardian made the delegation) such 

3 parent or legal guardian a summary of the user 

4 data that is transferred to the third-party safe5 ty software provider; and 

6 (C) update the summary provided under 

7 subparagraph (B) as necessary to reflect any 

8 change to the user data that is transferred to 

9 the third-party safety software provider. 

10 (b) REGISTRATION WITH COMMISSION.— 

11 (1) THIRD-PARTY SAFETY SOFTWARE PRO12 VIDERS.— 

13 (A) REGISTRATION.—A third-party safety 

14 software provider shall register with the Com15 mission as a condition of accessing an applica16 tion programming interface and any informa17 tion under subsection (a). Such registration 

18 shall require the third-party safety software 

19 provider to affirm that the third-party safety 

20 software provider— 

21 (i) is a company based in the United 

22 States; 

23 (ii) is solely engaged in the business 

24 of internet safety; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
10 

•HR 5778 IH

1 (iii) will use any user data obtained 

2 under subsection (a) solely for the purpose 

3 of protecting a child from harm; 

4 (iv) will only disclose user data ob5 tained under subsection (a) as permitted 

6 by subsection (f); and 

7 (v) will disclose, in an easy-to-under8 stand, human-readable format, to each 

9 child with respect to whose account with a 

10 large social media platform the service of 

11 the third-party safety software provider is 

12 operating and (if a parent or legal guard13 ian of the child made the delegation under 

14 subsection (a) with respect to the account) 

15 to the parent or legal guardian, sufficient 

16 information detailing the operation of the 

17 service and what information the third18 party safety software provider is collecting 

19 to enable such child and (if applicable) 

20 such parent or legal guardian to make in21 formed decisions regarding the use of the 

22 service. 

23 (B) NOTIFICATION OF CHANGES.—Not 

24 later than 30 days after the date on which 

25 there is a change to an affirmation made under 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
11 

•HR 5778 IH

1 subparagraph (A) by a third-party safety soft2 ware provider that is registered under such sub3 paragraph, the provider shall notify the fol4 lowing about such change: 

5 (i) The Commission. 

6 (ii) Each child with respect to whose 

7 account with a large social media platform 

8 the service of the third-party safety soft9 ware provider is operating and (if a parent 

10 or legal guardian of the child made the del11 egation under subsection (a) with respect 

12 to the account) the parent or legal guard13 ian. 

14 (C) DEREGISTRATION BY COMMISSION.— 

15 The Commission shall establish a process to 

16 deregister a third-party safety software provider 

17 that the Commission determines— 

18 (i) has violated or misrepresented the 

19 affirmations made under subparagraph 

20 (A); or 

21 (ii) has not notified the Commission, 

22 a child, or a parent or legal guardian of a 

23 child of a change to such an affirmation as 

24 required by subparagraph (B). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
12 

•HR 5778 IH

1 (D) NOTIFICATION OF

2 DEREGISTRATION.— 

3 (i) NOTIFICATION OF LARGE SOCIAL

4 MEDIA PLATFORM PROVIDERS BY COMMIS5 SION.—If the Commission deregisters a 

6 third-party safety software provider under 

7 subparagraph (C), the Commission shall 

8 notify each large social media platform 

9 provider of— 

10 (I) the deregistration of the 

11 third-party safety software provider; 

12 and 

13 (II) the specific reason for the 

14 deregistration. 

15 (ii) NOTIFICATION OF CHILDREN AND

16 PARENTS OR LEGAL GUARDIANS BY LARGE

17 SOCIAL MEDIA PLATFORM PROVIDERS.—A 

18 large social media platform provider that 

19 receives a notification from the Commis20 sion under clause (i) that a third-party 

21 safety software provider has been 

22 deregistered by the Commission under sub23 paragraph (C) shall notify each child with 

24 respect to whose account with the large so25 cial media platform the service of the 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
13 

•HR 5778 IH

1 third-party safety software provider was 

2 operating and (if a parent or legal guard3 ian of the child made the delegation under 

4 subsection (a) with respect to the account) 

5 the parent or legal guardian of— 

6 (I) the deregistration of such 

7 third-party safety software provider; 

8 and 

9 (II) the specific reason for such 

10 deregistration provided by the Com11 mission under clause (i)(II). 

12 (2) LARGE SOCIAL MEDIA PLATFORMS.— 

13 (A) REGISTRATION.—Not later than 30 

14 days after the effective date of this Act (in the 

15 case of a service that is a large social media 

16 platform on such effective date) or not later 

17 than 30 days after a service becomes a large so18 cial media platform (in the case of a service 

19 that becomes a large social media platform 

20 after such effective date), the large social media 

21 platform provider of the platform shall register 

22 the platform with the Commission by submit23 ting to the Commission a statement indicating 

24 that the platform is a large social media plat25 form. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
14 

•HR 5778 IH

1 (B) DEREGISTRATION BY COMMISSION.— 

2 The Commission shall establish a process to 

3 deregister a service registered under subpara4 graph (A) if the service is no longer a large so5 cial media platform. The Commission shall per6 mit the person who provides, manages, oper7 ates, or controls a service registered under sub8 paragraph (A) to submit to the Commission in9 formation indicating that the service is no 

10 longer a large social media platform. 

11 (3) PUBLIC AVAILABILITY OF REGISTRATION

12 LISTS.—The Commission shall make publicly avail13 able on the internet website of the Commission a list 

14 of the third-party safety software providers reg15 istered under paragraph (1), a list of the large social 

16 media platforms registered under paragraph (2), and 

17 a list of the third-party safety software providers 

18 deregistered by the Commission under paragraph 

19 (1)(C). 

20 (c) AUTHENTICATION.—Not later than 180 days 

21 after the date of the enactment of this Act, the Commis22 sion shall issue guidance to facilitate the ability of a third23 party safety software provider to obtain user data or ac24 cess under subsection (a) in a manner that ensures that 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
15 

•HR 5778 IH

1 a request for user data or access on behalf of a child is 

2 a verifiable request. 

3 (d) GUIDANCE AND CONSUMER EDUCATION.—The 

4 Commission shall— 

5 (1) not later than 180 days after the date of 

6 the enactment of this Act, issue guidance for large 

7 social media platform providers and third-party safe8 ty software providers regarding the maintenance of 

9 reasonable safety standards to protect user data; 

10 and 

11 (2) educate consumers regarding the rights of 

12 consumers under this Act. 

13 (e) INDEMNIFICATION.—In any civil action in Fed14 eral or State court (other than an action brought by the 

15 Commission), a large social media platform provider may 

16 not be held liable for damages arising out of the transfer 

17 of user data to a third-party safety software provider 

18 under subsection (a), if the large social media platform 

19 provider has in good faith complied with the requirements 

20 of this Act and the guidance issued by the Commission 

21 under this Act. 

22 (f) USER DATA DISCLOSURE.— 

23 (1) PERMITTED DISCLOSURES.—A third-party 

24 safety software provider may not disclose any user 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
16 

•HR 5778 IH

1 data obtained under subsection (a) to any other per2 son except— 

3 (A) pursuant to a lawful request from a 

4 government body, including for law enforcement 

5 purposes or for judicial or administrative pro6 ceedings by means of a court order or a court7 ordered warrant, a subpoena or summons 

8 issued by a judicial officer, or a grand jury sub9 poena; 

10 (B) to the extent that such disclosure is re11 quired by law and such disclosure complies with 

12 and is limited to the relevant requirements of 

13 such law; 

14 (C) to the child or a parent or legal guard15 ian of the child who made a delegation under 

16 such subsection and whose data is at issue, with 

17 such third-party safety software provider mak18 ing a good faith effort to ensure that such dis19 closure includes only the user data necessary 

20 for a reasonable parent or caregiver to under21 stand that such child is experiencing (or is at 

22 foreseeable risk to experience) the following 

23 harms— 

24 (i) suicide; 

25 (ii) anxiety; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
17 

•HR 5778 IH

1 (iii) depression; 

2 (iv) eating disorders; 

3 (v) violence, including being the victim 

4 of or planning to commit or facilitate as5 sault; 

6 (vi) substance abuse; 

7 (vii) fraud; 

8 (viii) severe forms of trafficking in 

9 persons (as defined in section 103 of the 

10 Trafficking Victims Protection Act of 2000 

11 (22 U.S.C. 7102)); 

12 (ix) sexual abuse; 

13 (x) physical injury; 

14 (xi) harassment; 

15 (xii) sexually explicit conduct or child 

16 pornography (as defined in section 2256 of 

17 title 18, United States Code); 

18 (xiii) terrorism (as defined in section 

19 140(d) of the Foreign Relations Authoriza20 tion Act, Fiscal Years 1988 and 1989 (22 

21 U.S.C. 2656f(d))), including communica22 tions with or in support of a foreign ter23 rorist organization (as designated by the 

24 Secretary of State under section 219(a) of 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
18 

•HR 5778 IH

1 the Immigration and Nationality Act (8 

2 U.S.C. 1189(a))); 

3 (xiv) academic dishonesty, including 

4 cheating, plagiarism, and other forms of 

5 academic dishonesty that are intended to 

6 gain an unfair academic advantage; and 

7 (xv) sharing personal information, 

8 limited to— 

9 (I) home address; 

10 (II) phone number; 

11 (III) social security number; and 

12 (IV) personal banking informa13 tion; 

14 (D) in the case of a reasonably foreseeable 

15 serious and imminent threat to the health or 

16 safety of any individual, if the disclosure is 

17 made to a person or persons reasonably able to 

18 prevent or lessen the threat; or 

19 (E) to a public health authority or other 

20 appropriate government authority authorized by 

21 law to receive reports of child abuse or neglect. 

22 (2) DISCLOSURE REPORTING.—A third-party 

23 safety software provider that makes a disclosure per24 mitted by paragraph (1)(A), (1)(B), (1)(D), or 

25 (1)(E) shall promptly inform the child with respect 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
19 

•HR 5778 IH

1 to whose account with a large social media platform 

2 the delegation was made under subsection (a) and 

3 (if a parent or legal guardian of the child made the 

4 delegation) the parent or legal guardian that such a 

5 disclosure has been or will be made, except if— 

6 (A) the third-party safety software pro7 vider, in the exercise of professional judgment, 

8 believes informing such child or parent or legal 

9 guardian would place such child at risk of seri10 ous harm; or 

11 (B) the third-party safety software pro12 vider is prohibited by law (including a valid 

13 order by a court or administrative body) from 

14 informing such child or parent or legal guard15 ian. 

16 SEC. 5. IMPLEMENTATION AND ENFORCEMENT. 

17 (a) ENFORCEMENT.— 

18 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC19 TICES.—A violation of this Act shall be treated as 

20 a violation of a rule defining an unfair or deceptive 

21 act or practice prescribed under section 18(a)(1)(B) 

22 of the Federal Trade Commission Act (15 U.S.C. 

23 57a(a)(1)(B)). 

24 (2) POWERS OF COMMISSION.— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
20 

•HR 5778 IH

1 (A) IN GENERAL.—The Commission shall 

2 enforce this Act in the same manner, by the 

3 same means, and with the same jurisdiction, 

4 powers, and duties as though all applicable 

5 terms and provisions of the Federal Trade 

6 Commission Act (15 U.S.C. 41 et seq.) were in7 corporated into and made a part of this Act. 

8 (B) PRIVILEGES AND IMMUNITIES.—Any 

9 person who violates this Act shall be subject to 

10 the penalties and entitled to the privileges and 

11 immunities provided in the Federal Trade Com12 mission Act (15 U.S.C. 41 et seq.). 

13 (3) PRESERVATION OF AUTHORITY.—Nothing 

14 in this Act may be construed to limit the authority 

15 of the Commission under any other provision of law. 

16 (b) FTC GUIDANCE.—Not later than 180 days after 

17 the date of the enactment of this Act, the Commission 

18 shall issue guidance to assist large social media platform 

19 providers and third-party safety software providers in 

20 complying with this Act. 

21 (c) COMPLIANCE ASSESSMENT.—The Commission, 

22 on a biannual basis, shall assess compliance by large social 

23 media platform providers and third-party safety software 

24 providers with the provisions of this Act. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
21 

•HR 5778 IH

1 (d) COMPLAINTS.—The Commission shall establish 

2 procedures under which a child, or the parent or legal 

3 guardian of such child, a large social media platform pro4 vider, or a third-party safety software provider may file 

5 a complaint alleging that a large social media platform 

6 provider or a third-party safety software provider has vio7 lated this Act. 

8 SEC. 6. ONE NATIONAL STANDARD. 

9 (a) IN GENERAL.—No State or political subdivision 

10 of a State may maintain, enforce, prescribe, or continue 

11 in effect any law, rule, regulation, requirement, standard, 

12 or other provision having the force and effect of law of 

13 the State, or political subdivision of a State, related to 

14 requiring large social media platform providers to create, 

15 maintain, and make available to third-party safety soft16 ware providers a set of real-time application programming 

17 interfaces, through which a child or a parent or legal 

18 guardian of a child may delegate permission to a third19 party safety software provider to manage the online inter20 actions, content, and account settings of such child on a 

21 large social media platform on the same terms as such 

22 child. 

23 (b) RULE OF CONSTRUCTION.—This section may not 

24 be construed to— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
22 

•HR 5778 IH

1 (1) limit the enforcement of any consumer pro2 tection law of a State or political subdivision of a 

3 State; 

4 (2) preempt the applicability of State trespass, 

5 contract, or tort law; or 

6 (3) preempt the applicability of any State law 

7 to the extent that the law relates to acts of fraud, 

8 unauthorized access to personal information, or noti9 fication of unauthorized access to personal informa10 tion. 

11 SEC. 7. EFFECTIVE DATE. 

12 This Act shall take effect on the date on which the 

13 Commission issues guidance under section 5(b). 

Æ 


kjohnson on DSK7ZCZBW3PROD with $$_JOB