AN ACT to enact the let parents choose protection act of 2022 to facilitate management of the social media interactions of children.

The General Assembly of North Carolina enacts:

SECTION 1.  Chapter 75 of the General Statutes is amended by adding a new Article to read:

Article 9.

Let Parents Choose Protection Act of 2022.

§ 75‑150.  Title.

This Article shall be known and may be cited as the Let Parents Choose Protection Act of 2022 or Sammy's Law of 2022.

§ 75‑151.  Findings.

The General Assembly finds the following:

(1)        Parents and legal guardians should have the choice to use the services of third‑party safety software providers to protect their children from harm on large social media platforms.

(2)        Dangers like cyberbullying, human trafficking, illegal drug distribution, sexual harassment, and violence perpetrated, facilitated, or exacerbated through the use of certain large social media platforms have harmed social media users under the age of 18 years.

§ 75‑152.  Definitions.

The following definitions apply in this Article:

(1)        Child. – Any individual under the age of 18 years who has registered an account with a large social media platform.

(2)        Commerce. – As defined in section 4 of the Federal Trade Commission Act (15 U.S.C. § 44).

(3)        Delegation. – A grant of authority from a child 13 years of age or older or the legal guardian of a child to a third‑party safety software provider to perform the functions described in G.S. 75‑153.

(4)        Large social media platform. – A service provided through an internet website or a mobile application, or both, to which all of the following applies:

a.         The terms of service do not prohibit use of the service by a child.

b.         The service includes any feature that enables a child to share images, text, or video through the internet with other users of the service whom the child has met, identified, or become aware of solely through the use of the service.

c.         The service has more than 1,000,000 monthly active users in the United States or generates more than five hundred million dollars ($500,000,000) in annual gross revenue, adjusted annually for inflation.

The term does not include a service that primarily serves to facilitate (i) the sale or provision of professional services, (ii) the sale of commercial products, or (iii) if the service does not include the ability for content to be sent by a user directly to a child, the provision of news or information. The term also does not include a service that both (i) includes a feature that enables a user who communicates directly with a child through a message, including a text, audio, or video message not otherwise available to other users of the service, to add to that message other users that the child may not have otherwise met, identified, or become aware of solely through the use of the service and (ii) does not include any feature described in sub‑subdivision b. of this subdivision.

(5)        Large social media platform provider. – Any person who, for commercial purposes in or affecting commerce, provides, manages, operates, or controls a large social media platform.

(6)        Third‑party safety software provider. – Any person who, for commercial purposes in or affecting commerce, is authorized by a child 13 years of age or older or by the parent or legal guardian of a child to interact with a large social media platform to manage or analyze the child's online interactions, data, or account settings for the sole purpose of protecting the child from harm, including physical, emotional, or financial harm.

(7)        User data. – Any information or content, including images, video, audio, and text, that is created by or sent to a child on or through the child's social media platform account while under a delegation, but only during the 30‑day period beginning on the date the information or content is created by or sent to the child.

§ 75‑153.  Duties of large social media platform providers.

(a)        A large social media platform provider with users in this State shall create, maintain, and make available to any third‑party safety software provider registered to do business in this State a set of third‑party accessible real‑time application programming interfaces and any information necessary to use the interfaces. The interfaces shall be made available upon the request of the third‑party safety software provider and shall facilitate the ability of a child 13 years of age or older or a legal guardian of a child to delegate permission to the third‑party safety software provider to perform the following functions:

(1)        Manage the child's online interactions, content, and account settings on the large social media platform on terms designated by the child 13 years of age or older or the legal guardian of a child.

(2)        Initiate secure transfers of user data from the large social media platform in a commonly used and machine‑readable format to the third‑party safety software provider. The social media platform provider shall not limit the transfers to less than once per hour.

(b)        A large social media platform provider shall comply with the requirements of this Article beginning no later than 30 days from the date the platform first meets the definition under G.S. 75‑152(4) and shall continue to comply until it no longer meets that definition or until any of the following occurs:

(1)        The individual who made the delegation revokes the delegation.

(2)        The individual who made the delegation revokes or disables the registration of the account of the child with the large social media platform.

(3)        The third‑party safety software provider rejects the delegation.

§ 75‑154.  User data disclosure limitations.

(a)        A third‑party safety software provider as described in this Article shall not disclose any user data obtained under G.S. 75‑153 to any other person, except as follows:

(1)        Pursuant to a lawful request from a government body, including for law enforcement purposes or for judicial or administrative proceedings by means of a court order or a court‑ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena.

(2)        To the extent that the disclosure is required by law and complies with and is limited to the relevant requirements of the law.

(3)        To the individual who made the delegation or with the explicit consent of the individual who made the delegation.

(4)        In the case of a reasonably foreseeable serious and imminent threat to the health or safety of any individual, to a person reasonably able to prevent or lessen the threat.

(5)        To a public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect.

(b)        A third‑party safety software provider that makes a disclosure under subdivision (1), (2), (4), or (5) of subsection (a) of this section shall promptly inform a parent or legal guardian of the child who made the delegation that the disclosure has been or will be made, except in either of the following circumstances:

(1)        The third‑party safety software provider, in the exercise of professional judgment, believes informing the parent or legal guardian would place the child at risk of serious harm.

(2)        The third‑party safety software provider is prohibited by law, including a valid order by a court or administrative body, from informing the parent or legal guardian.

§ 75‑155.  Enforcement.

A violation of this Article is an unfair and deceptive trade practice under G.S. 75‑1.1.

SECTION 2.  There is appropriated from the General Fund to the Division of Child and Family Well‑Being of the Department of Health and Human Services the sum of ten thousand dollars ($10,000) in nonrecurring funds for the 2022‑2023 fiscal year for the creation and dissemination of educational materials concerning the importance of monitoring social media usage for children.

SECTION 3.  This act becomes effective July 1, 2022, and the requirements of this act on large social media platform providers apply beginning 30 days after that date.