Platforms Must Open Real-Time Data To Safety Software Companies

The text as introduced · 1,084 words

89R15537 BCH-F

By: Holt
H.B. No. 4338

A BILL TO BE ENTITLED

AN ACT

relating to the use of safety management software for children on

large social media platforms.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. This Act may be cited as Sammy's Law.

SECTION 2. Chapter 509, Business & Commerce Code, as added

by Chapter 795 (H.B. 18), Acts of the 88th Legislature, Regular

Session, 2023, is amended by adding Subchapter C-1 to read as

follows:

SUBCHAPTER C-1. SAFETY MANAGEMENT SOFTWARE FOR SOCIAL MEDIA

Sec. 509.121. DEFINITIONS. In this subchapter:

(1) "Child" means an individual who is under 17 years

of age.

(2) "Department" means the Department of Information

Resources.

(3) "Large social media platform" means a social media

platform to which Chapter 120 applies.

(4) "Third-party safety software provider" means an

entity that provides software designed to manage online

interactions, content, and account settings for the safety of

children.

(5) "User data" means any information needed to have a

profile on a large social media platform or content on a large

social media platform, including images, video, audio, or text,

that is created by or sent to a child on or through the child's

account with the platform.

Sec. 509.122. REQUIREMENTS FOR LARGE SOCIAL MEDIA

PLATFORMS. (a) A large social media platform shall create,

maintain, and make available to third-party safety software

providers a set of real-time application programming interfaces

that allow a child or a parent or legal guardian of a child to

delegate permission to a third-party safety software provider to

manage the online interactions, content, and account settings of

the child on the large social media platform on the same terms as

the child.

(b) The application programming interfaces must be designed

to allow third-party safety software providers to effectively

manage and monitor a child's online activities and provide

protections against cyberbullying, human trafficking, illegal drug

distribution, sexual harassment, and violence.

(c) A large social media platform shall establish and

implement reasonable policies, practices, and procedures regarding

the secure transfer of user data to third-party safety software

providers.

(d) In the case of a delegation made by a child or a parent

or legal guardian of a child under this section, the large social

media platform shall disclose to the child and the parent or legal

guardian of the child that the delegation has been made and provide

a summary of the user data that has been transferred to the

third-party safety software provider.

Sec. 509.123. IMPLEMENTATION BY DEPARTMENT. The department

shall:

(1) oversee the implementation of this subchapter;

(2) establish guidelines and standards for the

application programming interfaces and ensure compliance by large

social media platforms;

(3) conduct regular audits and assessments to ensure

that large social media platforms are in compliance with the

requirements of this subchapter; and

(4) provide resources and support to parents and legal

guardians using third-party safety software services to effectuate

the protection of children from dangers including cyberbullying,

human trafficking, illegal drug distribution, sexual harassment,

and violence on large social media platforms.

Sec. 509.124. REPORTING REQUIREMENTS. (a) A large social

media platform shall submit an annual report not later than January

1 to the department detailing the platform's compliance with the

requirements of this subchapter.

(b) The department shall submit an annual summary of all

reports submitted by large social media platforms under this

section not later than February 1 to the governor, the lieutenant

governor, the speaker of the house of representatives, and each

standing committee of the legislature with primary jurisdiction

over large social media platforms highlighting the effectiveness of

this subchapter and any areas needing improvement.

Sec. 509.125. AUTHENTICATION. The department shall:

(1) issue guidance to facilitate the ability of a

third-party safety software provider to obtain user data or access

in a manner that ensures that a request for user data or access on

behalf of a child is a verifiable request; and

(2) issue guidance for large social media platforms

and third-party safety software providers regarding the

maintenance of reasonable safety standards to protect user data.

Sec. 509.126. LIMITATION OF LIABILITY. In any civil action

other than an action brought by the attorney general under

Subchapter D, a large social media platform provider may not be held

liable for damages arising out of the transfer of user data to a

third-party safety software provider if the large social media

platform has in good faith complied with the requirements of this

subchapter and the guidance issued by the department under this

subchapter.

Sec. 509.127. USER DATA DISCLOSURE. A third-party safety

software provider may not disclose any user data obtained under

this subchapter to another person except:

(1) under a lawful request from a governmental body,

including for law enforcement purposes or for judicial or

administrative proceedings;

(2) to the extent that the disclosure is required by

law and the disclosure complies with and is limited to the relevant

requirements of such law;

(3) to the child or a parent or legal guardian of the

child who made a delegation under this subchapter and whose data is

at issue, with the third-party safety software provider making a

good faith effort to ensure that the disclosure includes only the

user data necessary for a reasonable parent or guardian to

understand that the child is experiencing or is at foreseeable risk

to experience harm;

(4) in the case of a reasonably foreseeable serious

and imminent threat to the health or safety of any individual, if

the disclosure is made to a person or persons reasonably able to

prevent or lessen the threat; and

(5) to a public health authority or other appropriate

government authority authorized by law to receive reports of child

abuse or neglect.

Sec. 509.128. DISCLOSURE REPORTING. A third-party safety

software provider that makes a disclosure permitted by this

subchapter shall promptly inform the child with respect to whose

account the delegation was made and the parent or legal guardian

that a disclosure has been or will be made, unless:

(1) the third-party safety software provider, in the

exercise of professional judgment, believes informing the child or

parent or legal guardian would place the child at risk of serious

harm; or

(2) the third-party safety software provider is

prohibited by law from informing the child or parent or legal

guardian.

Sec. 509.129. CONFLICT WITH OTHER LAW. To the extent of any

conflict between this subchapter and another provision of this

chapter, this subchapter controls.

SECTION 3. This Act takes effect September 1, 2025.