Technology (Online Safety)

Under the bill, a "covered business" is defined as a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate of such a legal entity, that:Conducts business in the state and generates a majority of its annual revenue from online services;Makes available online gaming services, products, or features that are reasonably likely to be accessed by a user who is a minor or who the covered business labels as a minor (covered minor);Collects users' personal data or has users' personal data collected on its behalf by a processor; andSolely or jointly with others determines the purposes and means of the processing of users' personal data.     The bill states that a covered business that processes the personal data of a covered minor owes a minimum duty of care to the covered minor. The bill also requires a covered business to:Configure default privacy settings provided to a covered minor to the highest level of privacy and to include certain default settings;Provide a prominent, accessible, and responsive tool to allow a covered minor to request that the covered minor's account be unpublished or deleted and, if the business receives such a request, to honor it within 15 days; andImmediately delete all data that relates to the determination of a user's age after it is determined that the user is a covered minor.     The bill prohibits a covered business from:Providing a covered minor with a single setting that makes all of the default privacy settings less protective at once;Requesting or prompting a covered minor to make their privacy settings less protective;Collecting, selling, sharing, or retaining personal data of a covered minor that is not necessary to provide an online gaming service, product, or feature with which the covered minor is actively and knowingly engaged;Using previously collected personal data of a covered minor for any purpose other than a purpose for which the personal data was collected;Permitting an individual to monitor the online activity of a covered minor or to track the location of the covered minor without providing a conspicuous signal to the covered minor when the covered minor is being monitored or tracked;Using the personal data of a covered minor to select, recommend, or prioritize media for the covered minor unless the covered minor makes certain requests or takes certain actions warranting such conduct by the covered business; orSending push notifications to a covered minor between 12 midnight and 6 a.m.     The bill imposes additional specific requirements and prohibitions for a covered business that collects users' personal data for the purpose of conducting age assurance.     The bill requires a covered business to ensure that the purchase price for an online gaming service, product, or feature that is made available through the covered business's online gaming service, product, or feature and that is reasonably likely to be accessed by a covered minor is listed in United States dollars at the point of sale.     A covered business shall impose and collect a fee on each add-on transaction that is conducted by a covered minor through the covered business's online gaming service, product, or feature. The amount of the fee is 5% of the amount of the transaction. Money collected as such fees is credited to the state public school fund.     The bill requires a social media platform to provide certain information on its website or mobile application concerning privacy policies and the use of algorithms. A social media platform is prohibited from using an algorithmic recommendation system to sell or otherwise distribute an illicit substance to a covered minor.(Note: This summary applies to this bill as introduced.)

The act creates new requirements and civil remedies beginning June 1, 2027, related to individuals under 18 years old (minors) who are featured in compensated content on online hosting platforms (online content).     A minor is considered to be engaged in content creation work if, over a 12-month period, the following 3 criteria are met:At least 30% of a content creator's online content produced within a 30-day period includes the minor's likeness, name, or photograph;The number of views of the online content meets the online hosting platform's compensation threshold or the content creator receives $0.10 or more per view, including compensation from sponsorships; andThe content creator receives at least $40,000 in actual compensation from the online content.     Content creators whose online content features a minor engaged in content creation work must maintain specific records, including:Proof of the minor's age;The total compensation generated; andThe total number of minutes the minor was featured in posts featuring online content.     A content creator shall compensate a minor engaged in content creation work by setting aside a portion of the gross earnings into a trust account for the minor until the minor reaches the age of majority or is declared emancipated. A court may distribute money from the trust account to the minor before the minor reaches the age of majority or is declared emancipated upon petition from the trustee and a finding that the money will only be used for specific expenses that solely benefit the minor.     An adult or an emancipated minor who was featured as a uniquely identifiable minor in a content creator's post featuring online content on or after June 1, 2027, may request that the content creator delete the post or remove the uniquely identifiable information. The content creator must comply with the request within 72 hours. If the content creator fails to comply after 30 days, the individual may sue for various types of relief, and the online hosting platform must review and take reasonable steps to remove the content unless certain exceptions apply.     The act prohibits a person from financially benefiting from knowingly producing or distributing online content of a minor with the intent to sexually gratify or elicit a sexual response in the viewer. Exceptions apply for law enforcement, reporting unlawful activity, legal proceedings, and certain actions engaged in by online hosting platforms. Online hosting platforms are required to develop and implement a risk-based strategy to help mitigate risks related to the monetization of the intentional sexualization of known minors.     A civil action may be filed on behalf of a minor for damages, including actual damages, punitive damages, and attorney fees, if a content creator fails to comply with specified provisions of the act.(Note: This summary applies to this bill as enacted.)

The act requires an operating system provider that operates a publicly available internet website, software application, online service, or platform that distributes and facilitates, on a commercial basis, the download of applications from third-party developers to users of devices (covered application store) or makes a covered application store available preinstalled on an operating system to:Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or age bracket of the user of that device in order to provide a signal regarding the user's age (age signal) to applications available in the covered application store;Provide application developers with a reasonably consistent, real-time application programming interface to request and receive an age signal; andSend only the minimum amount of information necessary to comply with the act. An operating system provider or covered application store shall not share an age signal with a third party for a purpose not required by the act.     The act requires a consumer software application that is accessed through a covered application store and that may be run or directed by a user on a device (covered application) to request an age signal with respect to a particular user when the covered application is initially launched or when a user first creates an account. A covered application that receives an age signal is deemed to have knowledge of the age range of the user to whom that age signal pertains across all platforms of the application and points of access of the application. However, if a developer has clear and convincing information that a user's age is different than the age indicated by an age signal, the developer shall use that information as the primary indicator of the user's age range.     A developer shall ensure that a covered application that receives an age signal does not:Request more information concerning a user from an operating system provider or a covered application store than is necessary to comply with the act; orCommunicate an age signal to a third party for a purpose not required by the act.     With respect to a device for which account setup was completed before July 1, 2028, the act requires an operating system provider to provide, before January 1, 2029, an accessible interface that allows an account holder to indicate the birth date or age of the user of that device for the purpose of providing an age signal regarding the user's age-bracket data to covered applications available in the operating system provider's covered application store. If a covered application last updated on or after July 1, 2027, was downloaded to a device before July 1, 2028, and the covered application has not requested an age signal with respect to the user of the device on which the covered application was downloaded, the covered application must request an age signal from the covered application store from which the covered application was downloaded with respect to that user before January 1, 2029.     A person that violates the act must pay a civil penalty of not more than $2,500 for each minor affected by each negligent violation or not more than $7,500 for each minor affected by each intentional violation. The penalty is assessed and recovered in a civil action brought by the attorney general. An operating system provider or covered application store that makes a good faith effort to comply with the act is not liable for an erroneous age signal or for conduct by a covered application that receives an age signal.(Note: This summary applies to this bill as enacted.)