Providing access to third-party safety software

(a)

Duty of large social media platform providers

(1)

In general

Not later than 30 days after the effective date of this Act (in the case of a service that is a large social media platform on such effective date) or not later than 30 days after a service becomes a large social media platform (in the case of a service that becomes a large social media platform after such effective date), the large social media platform provider shall create, maintain, and make available to any third-party safety software provider registered with the Commission under subsection (b)(1) a set of third-party-accessible real-time application programming interfaces, including any information necessary to use such interfaces, by which a child (if the child is 13 years of age or older) or a parent or legal guardian of a child may delegate permission to the third-party safety software provider to—(A)manage the online interactions, content, and account settings of such child on the large social media platform on the same terms as such child; and(B)initiate secure transfers of user data from the large social media platform in a commonly-used and machine-readable format to the third-party safety software provider, where the frequency of such transfers may not be limited by the large social media platform provider to less than once per hour.(2)

Revocation

Once a child or a parent or legal guardian of a child makes a delegation under paragraph (1), the large social media platform provider shall make the application programming interfaces and information described in such paragraph available to the third-party safety software provider on an ongoing basis until—(A)the child (if the child made the delegation) or the parent or legal guardian of such child revokes the delegation;(B)the child or a parent or legal guardian of such child revokes or disables the registration of the account of such child with the large social media platform;(C)the third-party safety software provider rejects the delegation; or(D)one or more of the affirmations made by the third-party safety software provider under subsection (b)(1)(A) is no longer true.(3)

Secure transfer of user data

A large social media platform provider shall establish and implement reasonable policies, practices, and procedures regarding the secure transfer of user data pursuant to a delegation under paragraph (1) from the large social media platform to a third-party safety software provider in order to mitigate any risks related to user data.(4)

Disclosure

In the case of a delegation made by a child or a parent or legal guardian of a child under paragraph (1) with respect to the account of such child with a large social media platform, the large social media platform provider shall—(A)disclose to such child and (if the parent or legal guardian made the delegation) the parent or legal guardian the fact that the delegation has been made;(B)provide to such child and (if such parent or legal guardian made the delegation) such parent or legal guardian a summary of the user data that is transferred to the third-party safety software provider; and(C)update the summary provided under subparagraph (B) as necessary to reflect any change to the user data that is transferred to the third-party safety software provider.(5)

Limitation

Any management by a third-party safety software provider of online interactions, content, and account settings of a child under this subsection shall be limited to such management that protects such child from harm, including the optimization of the privacy settings of the account, stated user age, and marketing settings of the child.(b)

Third-Party safety software providers

(1)

Registration with Commission

A third-party safety software provider shall register with the Commission as a condition of accessing an application programming interface and any information under subsection (a). As a condition of such registration, the third-party safety software provider shall—(A)satisfactorily demonstrate to the Commission that the third-party safety software provider—(i)is a company based in the United States;(ii)is not a subsidiary of any foreign-owned company or otherwise controlled by a foreign person or persons;(iii)will solely use any user data obtained under subsection (a) for the purpose of protecting a child from harm in accordance with any applicable terms of service and the provisions of this Act;(iv)will only disclose user data obtained under subsection (a) as permitted by subsection (f);(v)will process and maintain all user data obtained under subsection (a) and copies of any communications generated in relation thereto exclusively on hardware and devices located within the territorial boundaries of the United States;(vi)(I)will delete any user data obtained under this section as soon as possible but not later than 14 days after receiving such data from the large social media platform, not including any data the third-party safety software provider discloses under subsection (f);(II)for any data disclosed under subsection (f)(1)(C), will maintain such data until the child or a parent or legal guardian of the child who made a delegation under subsection (a) and whose data is at issue requests that the third-party safety software provider delete such data; and(III)in the event that the child or a parent or legal guardian of the child who made a delegation under subsection (a) cancels their account with the third-party safety software provider, will delete all applicable user data no later than 30 days after the request for account cancellation has been made; and(vii)will disclose, in an easy-to-understand, human-readable format, to each child with respect to whose account with a large social media platform the service of the third-party safety software provider is operating and (if a parent or legal guardian of the child made the delegation under subsection (a) with respect to the account) to the parent or legal guardian, sufficient information detailing the operation of the service and what information the third-party safety software provider is collecting to enable such child and (if applicable) such parent or legal guardian to make informed decisions regarding the use of the service; and(B)as part of the registration process, undergo a security review in such form as the Commission may proscribe but which may include requiring that a qualified independent auditing firm conduct such a review to independently verify and confirm via a written report (which shall be exempt from disclosure under section 552(b)(3) of title 5, United States Code) that the third-party safety software provider—(i)is in compliance, or has the ability to comply, with the requirements of subparagraph (A); (ii)is able to provide services in accordance with any applicable terms of service and any relevant disclosures made to any consumer, including whether such terms and disclosures are clear and conspicuous and are written in plain and easy-to-understand English;(iii)has taken appropriate steps to assess potential risks and to protect the confidentiality, integrity, and security of any user data, including a determination of the adequacy of business and technology-related controls, policies, procedures, and other safeguards employed by the third-party safety software provider based on guidance issued by the Commission and other industry standards and best practices; and(iv)assesses compliance with applicable Federal law, including the requirements of this Act.(2)

Annual audit

(A)

Audit process; audit report

For each year or partial year during which a third-party safety software provider is registered with the Commission under paragraph (1), the third-party safety software provider shall retain the services of a qualified independent auditing firm to complete an annual audit and write an audit report (which shall be exempt from disclosure under section 552(b)(3) of title 5, United States Code), and such audit report shall—(i)include a review and assessment of the third-party safety software provider’s initial security review and any subsequent written reports, including whether the third-party safety software provider has remained in compliance with the requirements described in paragraph (1)(B); and(ii)identify whether the third-party safety software provider has made any material changes in how the third-party safety software provider provides services, and in the event of any such material changes, provide an explanation as to how such changes have impacted users.(B)

Submission to Commission

Not later than 30 days after the date on which an audit report is written under subparagraph (A), a third-party safety software provider shall submit to the Commission—(i)a full copy of such audit report; and(ii)a summary of such audit report that may contain redactions to protect the proprietary information and trade secrets of the third-party safety software provider.(C)

Audit review by Commission

The Commission shall—(i)review each audit report submitted by a third-party safety software provider under subparagraph (B)(i) to verify compliance;(ii)make a copy of the summary of such audit report submitted by a third-party safety software provider under subparagraph (B)(ii) available to the public; and(iii)in the event an audit required under subparagraph (A) detects an unusual finding, direct a third-party safety software provider to promptly investigate and resolve the matter.(3)

Additional authority of Commission

In addition to the jurisdiction, powers, and duties of the Commission otherwise provided under this Act and any other provision of law, the Commission may take an adverse action against a third-party safety software provider, including by—(A)denying an initial registration for the third-party safety software provider under paragraph (1);(B)permanently de-registering the third-party safety software provider; and(C)suspending the registration of the third-party safety software provider due to an audit finding of a material risk to the security of the data or safety of the public, including for—(i)willful misconduct or gross negligence by the third-party safety software provider; (ii)a material misrepresentation made by a third-party safety software provider to the Commission or to any consumer; (iii)failure by the third-party safety software provider to comply with any requirements of this Act or failure to operate in accordance with the affirmations, assertions, representations, or terms of any security review, audit, terms of services, or consumer disclosures;(iv)failure by the third-party safety software provider to respond to an unusual finding in an annual audit completed under paragraph (2)(A); and(v)failure by the third-party safety software provider to adhere to or implement guidance issued by the Commission. (4)

Rights of third-party safety software providers

(A)

In general

In the event the Commission takes an adverse action against a third-party safety software provider under paragraph (3), the Commission shall give the third-party safety software provider—(i)the opportunity to appeal the findings of the auditor or such action of the Commission; and(ii)the opportunity to remediate any deficiencies, except in the case of a finding of—(I)willful misconduct;(II)gross negligence; or(III)a demonstrated history of multiple failures in relation to the types of material risk described in paragraph (3)(C)(ii) through (3)(C)(v).(B)

Exception

The rights described in subparagraph (A) shall not prevent the Commission from suspending the registration of a third-party safety software provider to protect the public from ongoing material risk for the period during which the third-party safety software provider is in the process of exercising the rights described in paragraph (4).(c)

Authentication

Not later than 180 days after the date of the enactment of this Act, the Commission shall issue guidance to facilitate the ability of a third-party safety software provider to obtain user data or access under subsection (a) in a manner that ensures that a request for user data or access on behalf of a child is a verifiable request.(d)

Guidance and consumer education

The Commission shall—(1)not later than 180 days after the date of the enactment of this Act, issue guidance for large social media platform providers and third-party safety software providers regarding the maintenance of reasonable safety standards to protect user data; and(2)educate consumers regarding the rights of consumers under this Act. (e)

Indemnification

In any civil action in Federal or State court (other than an action brought by the Commission), a large social media platform provider may not be held liable for damages arising out of the transfer of user data to a third-party safety software provider under subsection (a), if the large social media platform provider has in good faith complied with the requirements of this Act and the guidance issued by the Commission under this Act.(f)

User data disclosure

(1)

Permitted disclosures

A third-party safety software provider may not disclose any user data obtained under subsection (a) to any other person except—(A)pursuant to a lawful request from a government body, including for law enforcement purposes or for judicial or administrative proceedings by means of a court order or a court-ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena;(B)to the extent that such disclosure is required by law and such disclosure complies with and is limited to the relevant requirements of such law;(C)to the child or a parent or legal guardian of the child who made a delegation under such subsection and whose data is at issue, with such third-party safety software provider making a good faith effort to ensure that such disclosure includes only the user data necessary for a reasonable parent or caregiver to understand that such child is experiencing (or is at foreseeable risk to experience) the following harms—(i)suicide; (ii)anxiety; (iii)depression; (iv)eating disorders; (v)violence, including being the victim of or planning to commit or facilitate assault; (vi)substance abuse; (vii)fraud; (viii)severe forms of trafficking in persons (as defined in section 103 of the Trafficking Victims Protection Act of 2000 (22 U.S.C. 7102)); (ix)sexual abuse; (x)physical injury; (xi)harassment; (xii)sexually explicit conduct or child pornography (as defined in section 2256 of title 18, United States Code); (xiii)terrorism (as defined in section 140(d) of the Foreign Relations Authorization Act, Fiscal Years 1988 and 1989 (22 U.S.C. 2656f(d))), including communications with or in support of a foreign terrorist organization (as designated by the Secretary of State under section 219(a) of the Immigration and Nationality Act (8 U.S.C. 1189(a))); (xiv)academic dishonesty, including cheating, plagiarism, and other forms of academic dishonesty that are intended to gain an unfair academic advantage; and(xv)sharing personal information, limited to—(I)home address; (II)phone number; (III)social security number; and(IV)personal banking information;(D)in the case of a reasonably foreseeable serious and imminent threat to the health or safety of any individual, if the disclosure is made to a person or persons reasonably able to prevent or lessen the threat; or(E)to a public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect.(2)

Disclosure reporting

A third-party safety software provider that makes a disclosure permitted by paragraph (1)(A), (1)(B), (1)(D), or (1)(E) shall promptly inform the child with respect to whose account with a large social media platform the delegation was made under subsection (a) and (if a parent or legal guardian of the child made the delegation) the parent or legal guardian that such a disclosure has been or will be made, except if—(A)the third-party safety software provider, in the exercise of professional judgment, believes informing such child or parent or legal guardian would place such child at risk of serious harm; or(B)the third-party safety software provider is prohibited by law (including a valid order by a court or administrative body) from informing such child or parent or legal guardian.