HB5511: DIGITAL AGE ASSURANCE

HB5511 Enrolled LRB104 20720 SPS 34223 b 1 AN ACT concerning business. 2 Be it enacted by the People of the State of Illinois, 3 represented in the General Assembly: 4 Section 1. Short title. This Act may be cited as the 5 Children's Online Social Media Safety Act. 6 Section 5. Definitions. As used in this Act: 7 "Account holder" means an individual who is at least 18 8 years of age or a parent or legal guardian of a user who is 9 under 18 years of age in this State. "Account holder" does not 10 include a parent or legal guardian of an emancipated minor or a 11 parent or legal guardian who is not associated with a user's 12 device. 13 "Addictive feed" means a website, online service, online 14 application, or mobile application, or a portion thereof, in 15 which multiple pieces of media generated or shared by users of 16 a website, online service, online application, or mobile 17 application, either concurrently or sequentially, are 18 recommended, selected, or prioritized for display to a user 19 based, in whole or in part, on information associated with the 20 user or the user's device, unless any of the following 21 conditions are met: 22 (1) the recommendation, prioritization, or selection 23 is based on information that is not persistently HB5511 Enrolled - 2 - LRB104 20720 SPS 34223 b 1 associated with the user's device and does not concern the 2 user's previous interactions with media generated or 3 shared by other users; 4 (2) the recommendation, prioritization, or selection 5 is based on data controlled by user-selected privacy or 6 accessibility settings or technical information concerning 7 the user's device; 8 (3) the user expressly and unambiguously requested the 9 specific media, media by the author, creator, or poster of 10 media the user has subscribed to, or media shared by users 11 to a page or group the user has subscribed to, provided 12 that the media is not recommended, selected, or 13 prioritized for display based, in whole or in part, on 14 other information that is not permissible under this 15 definition; 16 (4) the user expressly and unambiguously requested the 17 specific media by a specific author, creator, or poster of 18 media the user has subscribed to, or media shared by users 19 to a page or group the user has subscribed to as described 20 by paragraph (3), be blocked, prioritized, or 21 deprioritized for display, provided that the media is not 22 recommended, selected, or prioritized based, in whole or 23 in part, on other information associated with the user or 24 the user's device that is not permissible under this 25 definition; 26 (5) the media is direct and private communication HB5511 Enrolled - 3 - LRB104 20720 SPS 34223 b 1 between users; 2 (6) the media is recommended, selected, or prioritized 3 only in response to a specific search inquiry by the user; 4 (7) the media that is recommended, selected, or 5 prioritized for display is exclusively next in a 6 preexisting sequence from the same author, creator, 7 poster, or source; or 8 (8) the recommendation, prioritization, or selection 9 is necessary to comply with the provisions of this Act. 10 "Addictive social media platform" means a covered platform 11 that offers users or provides users with an addictive feed as a 12 part of the service provided by that website, online service, 13 online application, or mobile application. 14 "Age bracket" means a user's age range, including, but not 15 limited to, the following: 16 (1) whether a user is under 13 years of age; 17 (2) whether the user is at least 13 years of age and 18 under 16 years of age; 19 (3) whether the user is at least 16 years of age and 20 under 18 years of age; or 21 (4) whether the user is at least 18 years of age. 22 "Age bracket data" means non-personally identifiable data 23 derived from a user's birth date or age for the purpose of 24 sharing with covered operators that indicates the user's age 25 bracket. "Age bracket data" includes a range of ages but does 26 not indicate the exact age of the user. HB5511 Enrolled - 4 - LRB104 20720 SPS 34223 b 1 "Application" means a software application that may be run 2 or directed by a user on an Internet-enabled device. 3 "Application programming interface" means a system that 4 allows 2 or more software systems to communicate and exchange 5 information, features, and functionality. 6 "Application store" means a publicly available website, 7 software application, online service, or platform that 8 distributes and facilitates the download of applications from 9 third-party developers to users of an Internet-enabled device. 10 "Content" means user-to-user text, audio, or an image or 11 video upload. 12 "Covered manufacturer" means a manufacturer of an 13 Internet-enabled device, an operating system provider, or an 14 application store. 15 "Covered minor" means any user that a covered platform has 16 actual knowledge, or should have known, based on knowledge 17 fairly implied under objective circumstances, is under 18 18 years of age. 19 "Covered operator" means any person, business, or other 20 legal entity that owns, maintains, or controls: 21 (1) a covered platform; or 22 (2) an addictive social media platform. 23 "Covered platform" means a public or semipublic website, 24 online service, online application, or mobile application 25 that: 26 (1) is used by a covered minor in this State; and HB5511 Enrolled - 5 - LRB104 20720 SPS 34223 b 1 (2) is intended to connect and allow a user to 2 socially interact within the website, service, or 3 application and enables a user to: 4 (A) construct a public or semipublic profile for 5 the purposes of signing into and using the service or 6 application; 7 (B) populate a public list of other users with 8 whom the user shares a social connection within the 9 service or application; or 10 (C) create or post content that is viewable by 11 other users, including content on message boards and 12 in chat rooms, and that presents the user with content 13 generated by other users. 14 "Covered platform" does not include a public or semipublic 15 Internet-based service or application that: 16 (1) exclusively provides email or direct messaging 17 services; and 18 (2) is used by and under the direction of an 19 educational entity, including a learning management system 20 or a student engagement program. 21 "Covered user" means a user of a covered platform who is a 22 resident of this State. 23 "Direct messaging" means sending private one-on-one or 24 group messages to other users that are separate from public 25 posts. 26 "Distribute" means to issue, sell, give, provide, deliver, HB5511 Enrolled - 6 - LRB104 20720 SPS 34223 b 1 transfer, transmit, circulate, or disseminate by any means. 2 "Gifted currency" means a currency transfer between users 3 involving fiat currency or digital currency purchased with 4 fiat currency and used within a covered platform whether or 5 not it can be converted to money. 6 "Internet-enabled device" means a smartphone, tablet, or 7 personal laptop or desktop computer that provides cellular or 8 wireless connectivity, is capable of connecting to the 9 Internet, runs an operating system, and is capable of 10 downloading and running applications. 11 "Known adult" means any user that a covered platform has 12 actual knowledge, or should have known, based on knowledge 13 fairly implied under objective circumstances, is at least 18 14 years of age. 15 "News media" means personnel of a newspaper or other 16 periodical issued at regular intervals, whether in print or 17 electronic format, a news service, whether in print or 18 electronic format, a radio station, a television station, a 19 television network, a community antenna television service, or 20 a person or corporation engaged in making news reels or other 21 motion picture news for public showing. 22 "Operating system" means the system software that manages 23 the hardware of an Internet-enabled device and allows programs 24 and applications to run on the device. 25 "Operating system provider" means a commercial or 26 non-profit entity that controls the Internet-enabled device's HB5511 Enrolled - 7 - LRB104 20720 SPS 34223 b 1 operating system, including the design, programming, or supply 2 of operating systems for the Internet-enabled devices. 3 "Parent" means a parent or legal guardian. 4 "Precise geolocation information" means information 5 derived from technology, including, but not limited to, global 6 positioning system level latitude and longitude coordinates or 7 other mechanisms, that directly identifies the specific 8 location within a radius of 1,750 feet. 9 "Precise geolocation information" does not include the 10 content of communications. 11 "Processor" means a person that processes personal data on 12 behalf of a covered operator or another processor. 13 "Publish" means to communicate or make information 14 available to another person or entity on a publicly available 15 website, online service, online application, or mobile 16 application. 17 "Verifiable parental consent" has the meaning set forth in 18 the Children's Online Privacy Protection Act, 15 U.S.C. 19 6501(9), and its implementing regulations under 16 CFR 312.5. 20 Section 10. Age assurance requirements. 21 (a) No later than January 1, 2028, a covered manufacturer 22 that offers an account setup feature for an Internet-enabled 23 device shall: 24 (1) provide an accessible interface at account setup 25 that requires an account holder to indicate the birth HB5511 Enrolled - 8 - LRB104 20720 SPS 34223 b 1 date, age, or both, of the primary user of that device for 2 purposes of providing a signal regarding the primary 3 user's age bracket to covered operators; 4 (2) upon receiving separate prior consent of the user 5 to share the user's age bracket data with a specific 6 covered operator, provide the covered operator with the 7 technical ability to call a digital signal that contains 8 the user's age bracket data by a reasonably consistent 9 application programming interface; and 10 (3) send only the minimum amount of information 11 necessary to comply with this Act and not share the 12 digital signal information, or any information that 13 conveys the user's age bracket data, with a third party 14 for a purpose not required by this Act, except where 15 legally required. 16 For a device on which account setup was completed before 17 January 1, 2028, a covered manufacturer shall, before July 1, 18 2028, provide an accessible interface that allows an account 19 holder to indicate the birth date, age, or both, of the primary 20 user of that device for the purpose of providing a signal 21 regarding the primary user's age bracket to covered operators. 22 (b) By July 1, 2028, a covered operator shall request from 23 a covered manufacturer an age bracket signal for the primary 24 user of an Internet-enabled device when the user downloads or 25 launches a covered platform. If the signal indicates that a 26 user is under 18, then the covered operator shall treat the HB5511 Enrolled - 9 - LRB104 20720 SPS 34223 b 1 signal as an authoritative indicator of the user's age bracket 2 and the covered operator shall be deemed to have actual 3 knowledge that a user is a covered minor only with respect to 4 that specific device; provided, however, that a covered 5 operator shall not willfully disregard clear and convincing 6 information otherwise available to the covered operator that 7 indicates a user's age is different than that indicated by the 8 age bracket signal provided by a covered manufacturer. 9 (c) A covered operator that receives a signal in 10 accordance with this Section shall not: 11 (1) request more information from a covered 12 manufacturer than the minimum amount of information 13 necessary to determine the user's age bracket; 14 (2) request a signal from a covered manufacturer more 15 than once each year, unless in response to a request by the 16 user to update the person's age bracket; 17 (3) use any personal data of a user collected for age 18 assurance for any purpose except to comply with this Act 19 or to provide age-based settings and features; or 20 (4) disclose the age bracket data of a user to a third 21 party for a purpose not required by this Section. 22 (d) All digital signals transmitted in accordance with 23 this Section shall be encrypted to ensure data integrity and 24 security. 25 (e) A covered manufacturer that makes a good faith effort 26 to comply with this Section, taking into consideration HB5511 Enrolled - 10 - LRB104 20720 SPS 34223 b 1 available technology and reasonable technical limitations or 2 outages, shall not be liable for an erroneous signal 3 indicating a user's age bracket data or any conduct by a 4 covered operator that receives a signal indicating a user's 5 age bracket data. 6 (f) A covered manufacturer shall comply with this Act in a 7 nondiscriminatory manner, including, but not limited to, by 8 complying with the following: 9 (1) A covered manufacturer shall impose at least the 10 same restrictions and obligations on its own websites, 11 applications, and online services as it does on 12 third-party websites, applications, and online services. 13 (2) A covered manufacturer shall not use non-publicly 14 available data collected from a third party in the course 15 of compliance with this Act to compete against that third 16 party, give the covered manufacturer's services preference 17 relative to those of a third party, or to otherwise use 18 this non-publicly available data in a manner unavailable 19 to that third party. 20 (g) This Section does not impose liability on a covered 21 manufacturer or covered operator that arises from the use of a 22 device or application by a person who is not the user to whom a 23 signal pertains. 24 Section 15. Protections for covered minors. 25 (a) For all users that the covered operator has determined HB5511 Enrolled - 11 - LRB104 20720 SPS 34223 b 1 to be a covered minor, the covered operator shall use the 2 following settings by default: 3 (1) The covered operator shall not display the 4 existence of the covered minor's account on a covered 5 platform to any known adult user unless the covered minor 6 has expressly and unambiguously allowed a specific known 7 adult user to view the covered minor's account or has 8 expressly and unambiguously chosen to make the covered 9 minor's account's existence public. 10 (2) The covered operator shall not display media 11 created or posted by the covered minor on a covered 12 platform to any known adult user unless the covered minor 13 has expressly and unambiguously allowed a specific known 14 adult user to view the covered minor's media or has 15 expressly and unambiguously chosen to make the covered 16 minor's media publicly available. 17 (3) The covered operator shall not permit any known 18 adult user to like, comment on, or otherwise provide 19 feedback on the covered minor's media on a covered 20 platform unless the covered minor has expressly and 21 unambiguously allowed a specific known adult user to do 22 so. 23 (4) The covered operator shall not permit direct 24 messaging on a covered platform between the covered minor 25 and any known adult user unless the covered minor has 26 expressly and unambiguously decided to allow direct HB5511 Enrolled - 12 - LRB104 20720 SPS 34223 b 1 messaging with a specific known adult user. 2 (5) The precise geolocation information of the minor 3 shall not be shared with any user unless the minor has 4 expressly and unambiguously chosen to share the covered 5 minor's location with the specific user. 6 (6) No user may receive or send gifted currency to the 7 minor unless the user is already connected to the covered 8 minor. 9 (7) The covered operator shall disable search engine 10 indexing of the covered minor's account profile. 11 (b) A parent of a covered minor or a covered minor 12 determined by a covered operator to be over the age of 16 may 13 override the default privacy settings described in subsection 14 (a). A parent of a covered minor may override the default 15 privacy settings described in subsection (a) for a covered 16 minor under the age of 16. A covered operator shall not provide 17 a covered minor with a single setting that makes all the 18 default privacy settings less protective at once. A covered 19 operator shall not request or prompt a covered minor to make 20 the covered minor's privacy settings less protective unless 21 the change is strictly necessary for the covered minor to 22 access a service or feature that they expressly and 23 unambiguously requested. 24 (c) For all users that the covered operator has determined 25 to be a covered minor, the covered operator shall provide a 26 mechanism that enables a parent to set a monthly limit on all HB5511 Enrolled - 13 - LRB104 20720 SPS 34223 b 1 gifted currency related to the covered minor's account. The 2 covered operator shall establish a mechanism by which a parent 3 of a covered minor may easily view a history of all gifted 4 currency related to the covered minor's account at any time. 5 (d) It shall be unlawful for a covered operator under this 6 Section to, between the hours of 10 p.m. and 7 a.m., send 7 notifications to a covered minor unless: 8 (1) the covered operator has obtained verifiable 9 parental consent to send notifications during the time 10 restricted under this subsection; or 11 (2) the notification contemporaneously notifies the 12 covered user of a direct message received from another 13 user of the covered platform. 14 (e) It shall be unlawful for a covered operator of an 15 addictive social media platform to provide an addictive feed 16 to a covered minor unless the covered operator of the 17 addictive social media platform has obtained verifiable 18 parental consent to provide an addictive feed to a covered 19 minor. 20 (f) It shall be unlawful for a covered operator of an 21 addictive social media platform to enable the automatic 22 playing of media to a covered minor by default. 23 (g) A covered operator of an addictive social media 24 platform may choose not to provide services to minors. A 25 covered operator of an addictive social media platform shall 26 not withhold, degrade, lower the quality, or increase the HB5511 Enrolled - 14 - LRB104 20720 SPS 34223 b 1 price of any product, service, or feature, other than as 2 necessary for compliance with the provisions of this Act, to a 3 covered user solely because the covered operator of the 4 addictive social media platform is not permitted to provide an 5 addictive feed to the covered user under this Act. 6 (h) All information collected for the purpose of obtaining 7 verifiable parental consent required under this Section shall 8 not be used for any purpose other than obtaining verifiable 9 parental consent and shall be deleted within a reasonable 10 period after an attempt to obtain verifiable parental consent, 11 except where it is necessary for the compliance with any 12 applicable provisions of State or federal law. 13 (i) Nothing in this Section shall be construed as 14 requiring a covered operator to give a parent who grants 15 verifiable parental consent any additional or special access 16 to or control over the data or accounts of the parent's child. 17 (j) Nothing in this Section shall be construed to prohibit 18 a covered operator from instituting a privacy setting for 19 covered minors or other users that is more protective than 20 that required by this Section. 21 (k) Nothing in this Section shall be construed as 22 requiring a covered operator to remove any user-generated 23 content or preventing access to information regarding sex, 24 sexuality, gender, and reproductive health that is not already 25 prohibited by existing law. 26 (l) Nothing in this Section shall be construed as HB5511 Enrolled - 15 - LRB104 20720 SPS 34223 b 1 preventing any actions taken in good faith to restrict access 2 to or availability of any media. 3 Section 20. Application. 4 (a) A covered operator that complies with the provisions 5 of this Act shall not be held liable for any inaccuracies in 6 the covered user's age bracket data. 7 (b) A covered operator that receives a digital signal in 8 accordance with this Act may rely on that signal for purposes 9 of compliance with this Act and shall not be required to 10 independently verify the age of the user. 11 (c) A covered operator that reasonably relies on a digital 12 signal provided by a covered manufacturer shall not be liable 13 for an inaccurate age determination resulting from an 14 erroneous signal. 15 (d) Nothing in this Act shall be construed to prohibit a 16 covered operator from the ability to prevent, detect, protect 17 against, or respond to security incidents, identity theft, 18 fraud, harassment, malicious or deceptive activities, or any 19 illegal activity targeted at or involving the developer or its 20 services, preserve the integrity or security of systems, or 21 investigate, report, or prosecute those responsible for any 22 such action. 23 (e) This Act does not apply to any entity whose primary 24 purpose is news media and that has a majority of its workforce 25 consisting of individuals engaging in news media. HB5511 Enrolled - 16 - LRB104 20720 SPS 34223 b 1 (f) This Act does not apply to a broadband Internet access 2 service provider, including any affiliate or subsidiary of the 3 provider. This Act does not create a private right of action or 4 cause of action to enforce any violation or alleged violation 5 of its provisions against a broadband Internet access service 6 provider, including any affiliate or subsidiary of the 7 provider, when the violation is alleged to be committed by 8 another entity using the provider's service. As used in this 9 subsection, "broadband Internet access service provider" has 10 the meaning set forth in 47 CFR 8.1. 11 Section 25. Enforcement by the Attorney General. 12 (a) When it appears to the Attorney General that a person 13 has engaged in, is engaging in, or is about to engage in any 14 act declared to be unlawful by this Act, or when the Attorney 15 General believes it to be in the public interest that an 16 investigation should be made to ascertain whether a person in 17 fact has engaged in, is engaging in, or is about to engage in 18 any practice declared to be unlawful under this Act, the 19 Attorney General may: 20 (1) require that person to file, on the terms the 21 Attorney General prescribes, a statement or report in 22 writing, under oath or otherwise, as to all information as 23 the Attorney General may consider necessary; 24 (2) examine under oath any person in connection with 25 the conduct; HB5511 Enrolled - 17 - LRB104 20720 SPS 34223 b 1 (3) examine any merchandise or sample thereof, record, 2 book, document, account, or paper as the Attorney General 3 may consider necessary; and 4 (4) pursuant to an order of a circuit court, impound 5 any record, book, document, account, paper, or sample of 6 merchandise that is produced in accordance with this Act 7 and retain it in the Attorney General's possession until 8 the completion of all proceedings in connection with which 9 it is produced. 10 (b) To accomplish the objectives and to carry out the 11 duties prescribed by this Act, the Attorney General, in 12 addition to other powers conferred upon the Attorney General 13 by this Act, may issue subpoenas to any person, administer an 14 oath or affirmation to any person, conduct hearings in aid of 15 any investigation or inquiry, prescribe forms, and adopt rules 16 as may be necessary. 17 (c) Service by the Attorney General of any notice 18 requiring a person to file a statement or report, or of a 19 subpoena upon any person, shall be made: 20 (1) personally by delivery of a duly executed copy of 21 the subpoena to the person to be served, or if a person is 22 not a natural person, in the manner provided in the Code of 23 Civil Procedure when a complaint is filed, or 24 (2) by mailing by certified mail a duly executed copy 25 of the subpoena to the person to be served at the person's 26 last known abode or principal place of business within HB5511 Enrolled - 18 - LRB104 20720 SPS 34223 b 1 this State. 2 (d) If any person fails or refuses to file any statement or 3 report or obey any subpoena issued by the Attorney General, 4 the Attorney General may file a complaint in the circuit court 5 for the following, until the person files the statement or 6 report or obeys the subpoena: 7 (1) the granting of injunctive relief or the 8 restraining of the sale or advertisement of any 9 merchandise by the person or the conduct that is involved; 10 (2) the vacating, annulling, or suspending of the 11 corporate charter of a corporation created by or under the 12 laws of this State, the revoking or suspending of the 13 certificate of authority to do business in this State of a 14 foreign corporation, or the revoking or suspending of any 15 other licenses, permits, or certificates issued under the 16 laws of this State to the person that are used to further 17 the allegedly unlawful practice; and 18 (3) the granting of other relief as may be required. 19 (e) In the administration of this Act, the Attorney 20 General may accept an Assurance of Voluntary Compliance with 21 respect to any act deemed to be violative of this Act from any 22 person who has engaged in, is engaging in, or was about to 23 engage in the act. Evidence of a violation of an Assurance of 24 Voluntary Compliance shall be prima facie evidence of a 25 violation of this Act in any subsequent proceeding brought by 26 the Attorney General against the alleged violator. HB5511 Enrolled - 19 - LRB104 20720 SPS 34223 b 1 (f) Whenever the Attorney General has reason to believe 2 that any person is using, has used, or is about to use any act 3 declared by this Act to be unlawful, and that proceedings 4 would be in the public interest, the Attorney General may 5 bring an action in the name of the People of the State against 6 the person to restrain by preliminary or permanent injunction 7 the use of the act. The court, in its discretion, may exercise 8 all powers necessary, including, but not limited to: (i) 9 injunction; (ii) revocation, forfeiture, or suspension of any 10 license, charter, franchise, certificate, or other evidence of 11 authority of any person to do business in this State; (iii) 12 appointment of a receiver; (iv) dissolution of domestic 13 corporations or associations; (v) suspension or termination of 14 the right of foreign corporations or associations to do 15 business in this State; and (vi) restitution. 16 (g) In addition to the remedies provided in this Section, 17 the Attorney General exclusively may request, and a court may 18 award, a civil penalty of $50,000 for each violation against a 19 covered manufacturer or a covered operator found by the court 20 to have engaged in any act declared unlawful under this Act. 21 Any moneys paid under this Act shall be deposited into the 22 Attorney General Court Ordered and Voluntary Compliance 23 Payment Projects Fund. Moneys in the Fund shall be used, 24 subject to appropriation, for the performance of any function 25 pertaining to the exercise of the duties of the Attorney 26 General, including, but not limited to, enforcement of any law HB5511 Enrolled - 20 - LRB104 20720 SPS 34223 b 1 of this State; however, any moneys in the Fund that are 2 required by the court or by an agreement to be used for a 3 particular purpose shall be used for that purpose. 4 (h) When a receiver is appointed by the court under this 5 Act, the receiver shall have the power to sue for, collect, 6 receive and take into the receiver's possession all the goods 7 and chattels, rights and credits, moneys and effects, lands 8 and tenements, books, records, documents, papers, choses in 9 action, bills, notes, and property of every description, 10 derived by means of any practice declared to be illegal and 11 prohibited by this Act, including property with which the 12 property has been mingled if it cannot be identified in kind 13 because of the commingling, and to sell, convey, and assign 14 the same and hold and dispose of the proceeds thereof under the 15 direction of the court. Any person who has suffered damages as 16 a result of the use or employment of any unlawful practices and 17 submits proof to the satisfaction of the court that the person 18 has in fact been damaged, may participate with general 19 creditors in the distribution of the assets to the extent the 20 person has sustained out-of-pocket losses. In the case of a 21 partnership or business entity, the receiver shall settle the 22 estate and distribute the assets under the direction of the 23 court. The court shall have jurisdiction of all questions 24 arising in the proceedings and may make such orders and 25 judgments as may be required. 26 (i) Subject to an order of the court terminating the HB5511 Enrolled - 21 - LRB104 20720 SPS 34223 b 1 business affairs of any person after receivership proceedings 2 held under this Act, the provisions of this Act shall not bar 3 any claims against any person who has acquired any moneys or 4 property, real or personal, by means of any act declared to be 5 unlawful under this Act. 6 (j) Nothing in this Act is intended to limit the remedies 7 available under any other law, including the Consumer Fraud 8 and Deceptive Business Practices Act. 9 (k) Except as otherwise expressly provided for in this 10 Act, nothing in this Act shall be construed to grant any person 11 a private right of action for damages or to enforce the 12 provisions of this Act. 13 Section 97. Severability. The provisions of this Act are 14 severable under Section 1.31 of the Statute on Statutes. 15 Section 99. Effective date. This Act takes effect January 1, 16 2028.