Sammy’s Law
- Sponsor
- Sen. Husted, Jon [R-OH]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- Mar 20, 2026
Bottom line
Sammy's Law requires large social media platforms to open their systems to FTC-regulated third-party safety software, empowering parents and children to manage online interactions and access data for protection against harm.
What it actually does
This bill mandates that large social media platforms create and maintain real-time application programming interfaces (APIs) for third-party safety software providers. These APIs would allow a child (or their parent, for those under 13) to delegate permission to a third-party provider to manage the child's online interactions, content, and account settings, and to securely transfer user data. The bill also establishes a regulatory framework for these third-party providers, requiring them to register with the Federal Trade Commission (FTC), adhere to strict data protection and deletion rules, and undergo annual audits.
Proponents argue
Proponents argue that this bill is a crucial step to protect children from the pervasive harms present on social media, such as cyberbullying, exploitation, and content that negatively impacts mental health. They contend that it empowers parents with essential tools to monitor and manage their children's online experiences, leveraging technology to create a safer digital environment. Supporters believe the bill strikes a necessary balance between platform responsibility and parental oversight, ensuring that safety features are effective and accessible.
Opponents contend
Opponents raise concerns about the technical feasibility and significant costs for social media platforms to develop and maintain these real-time APIs, particularly given the dynamic nature of platform features and security requirements. Critics also highlight potential data privacy and security risks associated with granting third-party access to sensitive user data, arguing it could create new vulnerabilities. Some may also express concerns about the potential for over-monitoring or misuse of these tools, and the broad preemption of state laws.
The bill is moderately complex due to its technical definitions and regulatory details, but it is manageable for a reader seeking to understand its core mechanisms and implications within a reasonable timeframe.
Section 2
Definitions of Key Terms
This section defines critical terms that determine the bill's scope and applicability. It specifies that a 'child' is an individual under 17 with a platform account. A 'large social media platform' is defined by user count (over 100 million monthly global active users) or revenue (over $1 billion annually), with specific exclusions for certain professional, news, or limited messaging services. A 'third-party safety software provider' is a person authorized by a child or parent to manage account settings for child protection, and who must register with the FTC. 'User data' is limited to information necessary for a profile or content created/sent by a child while a delegation is active, for a 30-day period.
Supporters argue
Proponents argue that clear and specific definitions are essential to ensure the bill's targeted application, focusing on platforms and services that pose the most significant risks to children while avoiding undue burden on smaller or non-relevant services. The definition of 'user data' is designed to provide sufficient information for safety monitoring without creating an indefinite data retention mandate.
Critics contend
Critics might argue that the definitions, particularly for 'large social media platform,' could be too narrow, allowing some platforms with significant child users to avoid compliance. Conversely, some may argue that the definition of 'user data' is too broad, potentially allowing third-party providers access to more information than strictly necessary for safety, or that the 30-day retention limit is arbitrary.
Tradeoffs
The definitions balance the desire for broad protection with the need for practical applicability, attempting to target platforms with significant reach while carving out services not primarily focused on social interaction. The 'user data' definition balances parental access for safety with data minimization principles.
Section 3(a)
Obligations of Large Social Media Platform Providers
This section mandates that large social media platforms must create and maintain real-time application programming interfaces (APIs) for registered third-party safety software providers. Through these APIs, a child (or a parent for children under 13) can delegate permission to the third-party provider to manage the child's online interactions, content, and account settings, mirroring the child's own access. Platforms must also enable secure, hourly transfers of user data to these third-party providers. They must establish robust data security policies, disclose delegations and data transfers to the child/parent, and limit third-party management to actions that protect the child from harm. A special provision addresses end-to-end encrypted messaging, requiring a technical interface for contemporaneous transmission to a designated third-party without the platform gaining access to content.
Section 3(b)
Regulation and Oversight of Third-Party Safety Software Providers
This section establishes a comprehensive regulatory framework for third-party safety software providers. They must limit user data collection to what is adequate and necessary for child protection, implement strong data security measures, and delete most user data within 5 days (with exceptions for data disclosed to parents). Critically, these providers are prohibited from selling user data. They must register with the FTC, demonstrating compliance with various conditions, including not being controlled by a covered nation, using data solely for child protection, and providing clear disclosures to users. Annual independent audits are required to verify compliance, which the FTC reviews. The FTC is granted broad oversight powers, including denying, suspending, or permanently deregistering providers for non-compliance, willful misconduct, or material misrepresentation, though providers have rights to appeal and remediate deficiencies.
Section 3(d)
Permitted User Data Disclosures by Third-Party Providers
This section strictly limits when a third-party safety software provider can disclose user data obtained under the Act. Disclosures are permitted only under specific circumstances: lawful government requests (e.g., court orders), when legally required, to the child or parent if the child is experiencing or at foreseeable risk of specific harms (e.g., suicide, violence, abuse, trafficking, severe mental health issues, sharing personal information), to prevent an imminent threat to health or safety, or to a public health authority for child abuse/neglect reports. When such disclosures are made, the provider must generally inform the child or parent, unless doing so would place the child at serious harm or is legally prohibited. The bill explicitly preserves the duty to report child exploitation under existing law.
Section 5
One National Standard (Preemption)
This section establishes a national standard by preempting any state or local laws, rules, or regulations that require large social media platform providers to create, maintain, or make available APIs for child online safety management, as defined by this Act. This means states cannot enact their own differing requirements in this specific area. However, the preemption does not limit the enforcement of general state consumer protection laws, state trespass, contract, or tort laws, or state laws related to fraud, unauthorized access to personal information, or notification of unauthorized access to personal information.
Excludes certain messaging services from the definition of 'large social media platform' if they have a feature enabling users to add other users to a message (whom the child met through the service) but lack other features for sharing images, text, or video through the internet with users met solely through the service.
Section 2(5)(B)(ii)
Why it matters:This is standard legislative practice for defining scope and exceptions, ensuring the bill targets specific types of social media interaction. It aims to prevent unintended application to services that are primarily messaging-focused rather than broad social sharing platforms.
Case for: Supporters would argue this carve-out appropriately narrows the bill's focus to platforms primarily designed for broad social interaction, where the risks of exposure to unknown users are higher, while exempting more private messaging services that operate differently.
Case against: Critics might argue that this exclusion could create a loophole for certain messaging-heavy platforms that still facilitate significant interactions among children and unknown users, potentially undermining the bill's overall goal of comprehensive child online safety.
Estimated impact: Potentially exempts a subset of messaging applications from the API mandate, depending on their specific feature sets.
Limits any management by a third-party safety software provider to actions that 'protects a child from harm,' including optimization of privacy, user age, and marketing settings.
Section 3(a)(5)
Why it matters:This is a substantive constraint on the delegated power, ensuring that third-party tools are used for their intended purpose of safety rather than broader parental control. Its placement is typical for defining the boundaries of a new authority.
Case for: Supporters would highlight this as a safeguard against overreach, ensuring that third-party software focuses strictly on mitigating harm and not on general surveillance or control beyond safety parameters, thereby protecting a child's autonomy.
Case against: Critics might argue that 'protects a child from harm' is a broad term open to interpretation, potentially allowing for varying degrees of intervention. Some parents might desire broader management capabilities, while some child advocates might find it still allows for too much monitoring.
Estimated impact: Significantly shapes the functionality and scope of third-party safety software, ensuring a focus on harm reduction.
Establishes detailed data deletion requirements for third-party safety software providers: most user data must be deleted within 5 days of receipt from a platform, but data disclosed to a parent under subsection (d)(1)(C) can be maintained until requested by the child/parent, the child turns 17, or the provider is deregistered. If a delegation is revoked, all applicable user data must be deleted within 15 days.
Section 3(b)(3)(E)
Why it matters:This is a critical privacy protection mechanism, ensuring data minimization. Its detailed nature is typical for regulatory compliance requirements, aiming to cover various scenarios for data lifecycle management.
Case for: Proponents would emphasize this provision as a strong privacy safeguard, ensuring that third-party providers do not indefinitely retain sensitive child data. The differentiated retention for disclosed data allows parents to review critical information while still enforcing strict deletion for general monitoring data.
Case against: Critics might argue that the 5-day deletion window for general data is too short for comprehensive analysis or for parents to fully review activity, potentially limiting the effectiveness of safety software. Conversely, some privacy advocates might argue that even the extended retention for disclosed data is too long.
Estimated impact: Significantly impacts the data retention policies and technical infrastructure of third-party safety software providers, ensuring data minimization.
Specifies that if a large social media platform uses messaging features with security that makes platform access to content technically infeasible (e.g., end-to-end encryption), the platform is not required to grant third-party safety software providers direct access to that content via APIs. Instead, it must provide a technical interface for contemporaneous transmission of such communications to a user-designated third-party provider, without the platform itself gaining access to the content.
Section 3(a)(6)
Why it matters:This provision is a critical compromise to address concerns about privacy and the integrity of encrypted communications while still enabling some form of parental oversight. Its technical specificity is necessary to navigate the complexities of modern messaging security.
Case for: Proponents argue this provision strikes a crucial balance, respecting the security and privacy benefits of end-to-end encryption while still providing a mechanism for parents to receive communications for safety purposes. It avoids forcing platforms to undermine their own security features.
Case against: Critics might argue that 'contemporaneous transmission' without direct API access to content could be less effective for comprehensive safety monitoring, as it might not allow for real-time analysis or intervention by third-party software. Some privacy advocates might still raise concerns about any form of mandated transmission of encrypted content.
Estimated impact: Significantly impacts how third-party safety software can interact with encrypted messaging services, preserving encryption while enabling a form of oversight.