Sammy’s Law
- Sponsor
- Rep. Wasserman Schultz, Debbie [D-FL-25]
- Committees
- Energy and Commerce Committee (primary)
- Last action
- Dec 11, 2025
Bottom line
This bill aims to empower parents and children with third-party tools to enhance child safety on large social media platforms by mandating API access and establishing a regulatory framework for safety software providers.
What it actually does
This bill mandates that large social media platforms create real-time application programming interfaces (APIs) accessible to registered third-party safety software providers. Through these APIs, a child (age 13 or older) or their parent/guardian can delegate permission to the third-party provider to manage the child's online interactions, content, and account settings, including initiating secure, hourly data transfers. It also establishes a robust regulatory framework for these third-party providers, requiring FTC registration, security reviews, and strict data handling rules.
Proponents argue
Supporters argue that children face significant dangers online, including cyberbullying, human trafficking, illegal drug distribution, sexual harassment, and violence. They contend that parents need more effective tools to protect their children, and this bill provides a crucial mechanism by enabling specialized third-party safety software to monitor and manage children's online experiences, thereby mitigating these harms and giving parents greater control over their children's digital lives.
Opponents contend
Critics might argue that mandating API access could inadvertently create new privacy and security vulnerabilities, as third-party providers would handle sensitive user data, potentially becoming targets for malicious actors. They may also contend that the bill imposes significant compliance burdens on social media platforms and third-party developers, potentially stifling innovation or leading to unintended consequences regarding data access and parental oversight.
The bill is moderately detailed but clearly structured, allowing an informed reader to understand its core provisions within a reasonable timeframe.
Section 4(a)(1)
Mandated API Access for Third-Party Safety Software
This provision requires large social media platforms to create and maintain real-time application programming interfaces (APIs) that third-party safety software providers can access. Through these APIs, a child (13 or older) or their parent/guardian can grant permission to a third-party provider to manage the child's online interactions, content, and account settings on the platform, including initiating secure, hourly data transfers of user data. This aims to give parents more control over their children's online environment.
Supporters argue
Supporters argue this provision is essential for empowering parents and children to protect themselves from online harms by enabling specialized safety tools to function effectively across platforms. It addresses the current lack of interoperability that hinders comprehensive parental control and proactive intervention against online dangers.
Critics contend
Critics might argue that mandating API access could create new attack vectors for malicious actors, increasing the risk of data breaches if third-party software providers are compromised. They may also contend that it forces platforms to expose proprietary systems, potentially undermining their security infrastructure and intellectual property.
Tradeoffs
This provision balances the desire for enhanced child safety and parental control with potential concerns about data security, privacy, and the technical burden on social media platforms.
Section 4(b)(1)
FTC Registration and Security Requirements for Third-Party Providers
This section requires third-party safety software providers to register with the Federal Trade Commission (FTC) as a condition of accessing platform APIs. Registration is contingent on demonstrating U.S. company status, absence of foreign control, strict data usage limitations (solely for child protection), adherence to specific data disclosure rules, U.S.-based data processing, rapid data deletion policies (within 14 days, with exceptions), and clear disclosures to users. Providers must also undergo a security review and annual audits to maintain registration.
Section 4(f)
Strict Rules for Third-Party Disclosure of User Data
This section outlines the very limited circumstances under which a third-party safety software provider may disclose user data obtained through the APIs. Permitted disclosures include lawful government requests, legally required disclosures, disclosures to the child/parent for specific listed harms (e.g., suicide, trafficking, sexual abuse, sharing personal information), imminent threats to health/safety, and reports to child abuse authorities. Providers must generally inform the child/parent of disclosures, with exceptions for serious harm risk or legal prohibition.
Section 6
Federal Preemption of State Laws
This section establishes a national standard for requiring large social media platform providers to create and make available APIs for third-party safety software, thereby preempting any conflicting state or local laws on this specific matter. However, it explicitly states that this preemption does not limit state consumer protection, trespass, contract, tort, fraud, unauthorized access to personal information, or notification of unauthorized access laws.
Defines "child" as any individual under the age of 17 years who has registered an account with a large social media platform.
Section 3(1)
Why it matters:Standard legislative practice to define terms upfront for clarity and precision.
Case for: Supporters would argue that setting a clear age limit (under 17) ensures that the protections of "Sammy's Law" apply to a broad range of minors who are actively using social media and are vulnerable to online harms, extending beyond the typical COPPA age of 13.
Case against: Critics might argue that extending the definition to under 17 could create practical challenges for platforms in verifying ages and implementing parental controls for older teenagers who may desire more autonomy. Some might also argue that 16-year-olds have different privacy expectations than younger children.
Estimated impact: Expands the scope of protections and parental oversight to a larger demographic of minors than typically covered by child online privacy laws.
Excludes services primarily for professional services, commercial product sales, or news/information (without direct user-to-child content sharing), and certain messaging services from the definition of "large social media platform."
Section 3(4)(B)
Why it matters:Standard legislative practice to precisely delineate scope and avoid unintended consequences or overreach, ensuring the bill targets specific types of platforms.
Case for: Supporters would argue these exclusions are necessary to focus the bill on platforms that pose the most significant risks to children through social interaction features, avoiding undue burden on services not primarily designed for social networking or direct child interaction.
Case against: Critics might argue that some excluded services, particularly those with messaging features, could still pose risks to children, and these exclusions might create loopholes that platforms could exploit to avoid compliance.
Estimated impact: Narrows the scope of platforms subject to the bill's requirements, focusing on traditional social media and exempting other digital services.
Requires third-party safety software providers to delete user data obtained under the Act as soon as possible, but no later than 14 days after receiving such data from the large social media platform, with exceptions for data disclosed to parents for specific harms or if the account is cancelled (30 days).
Section 4(b)(1)(A)(vi)
Why it matters:This is a technical detail within a larger regulatory framework, specifying data governance requirements for registered entities.
Case for: Proponents would argue that this strict data retention limit minimizes the risk of long-term data exposure and breaches by third-party providers, enhancing privacy protections for children. It ensures that sensitive information is not held indefinitely, reducing the potential impact of a security incident.
Case against: Opponents might argue that a 14-day retention limit is too short for some advanced safety software features, such as identifying long-term behavioral patterns indicative of grooming or chronic cyberbullying, which might require more extended data analysis to be effective.
Estimated impact: Significantly limits the data storage capabilities and analytical scope of third-party safety software, while enhancing user privacy.