AN ACT to enact the let parents choose protection act of 2023 to facilitate management of the social media interactions of children.

The General Assembly of North Carolina enacts:

SECTION 1.  Chapter 75 of the General Statutes is amended by adding a new Article to read:

Article 9.

Let Parents Choose Protection Act of 2023.

§ 75‑150.  Title.

This Article shall be known and may be cited as the Let Parents Choose Protection Act of 2023 or Sammy's Law of 2023.

§ 75‑151.  Findings.

The General Assembly finds the following:

(1)        Parents and legal guardians should have the choice to use the services of third‑party safety software providers to protect their children from harm on large social media platforms.

(2)        Dangers like cyberbullying, human trafficking, illegal drug distribution, sexual harassment, and violence perpetrated, facilitated, or exacerbated through the use of certain large social media platforms have harmed social media users under the age of 18 years.

§ 75‑152.  Definitions.

The following definitions apply in this Article:

(1)        Child. – Any individual under the age of 18 years who has registered an account with a large social media platform.

(2)        Delegation. – A grant of authority from a child 13 years of age or older or the legal guardian of a child to a third‑party safety software provider to perform the functions described in G.S. 75‑153.

(3)        Department. – North Carolina Department of Commerce.

(4)        Large social media platform. – A service provided through an internet website or a mobile application, or both, to which all of the following apply:

a.         The terms of service do not prohibit use of the service by a child.

b.         The service includes any feature that enables a child to share images, text, or video through the internet with other users of the service whom the child has met, identified, or become aware of solely through the use of the service.

c.         The service has more than 30,000 monthly active users in the State or generates more than fifteen million dollars ($15,000,000) in annual gross revenue from activities in the State.

The term does not include a service that primarily serves to facilitate (i) the sale or provision of professional services, (ii) the sale of commercial products, or (iii) if the service does not include the ability for content to be sent by a user directly to a child, the provision of news or information. The term also does not include a service that both (i) includes a feature that enables a user who communicates directly with a child through a message, including a text, audio, or video message not otherwise available to other users of the service, to add to that message other users that the child may not have otherwise met, identified, or become aware of solely through the use of the service and (ii) does not include any feature described in sub‑subdivision b. of this subdivision.

(5)        Large social media platform provider. – Any person who provides, manages, operates, or controls a large social media platform. The term does not include (i) an internet service provider, electronic mail, or online service application, (ii) a website consisting primarily of news, sports, entertainment, or other information or content that is not user generated but is preselected or curated by the provider and for which chat, comment, or interactive functionality is incidental to, directly related to, or dependent on the provision of that information or content, (iii) interactive video game service, or (iv) e‑commerce or online shopping.

(6)        State. – State of North Carolina.

(7)        Third‑party safety software provider. – Any person who is authorized by a child 13 years of age or older or by the parent or legal guardian of a child to interact with a large social media platform to manage or analyze the child's online interactions, data, or account settings for the sole purpose of protecting the child from harm, including physical, emotional, or financial harm.

(8)        User data. – Any information or content, including images, video, audio, and text, that is created by or sent to a child on or through the child's social media platform account while under a delegation, but only during the 30‑day period beginning on the date the information or content is created by or sent to the child.

§ 75‑153.  Duties of large social media platform providers.

(a)        A large social media platform provider with users in this State shall create, maintain, and make available to any third‑party safety software provider registered to do business in this State a set of third‑party accessible real‑time application programming interfaces and any information necessary to use the interfaces. The interfaces shall be made available upon the request of the third‑party safety software provider and shall facilitate the ability of a child 13 years of age or older or a legal guardian of a child to delegate permission to the third‑party safety software provider to perform the following functions:

(1)        Manage the child's online interactions, content, and account settings on the large social media platform on terms designated by the child 13 years of age or older or the legal guardian of a child.

(2)        Initiate secure transfers of user data from the large social media platform in a commonly used and machine‑readable format to the third‑party safety software provider. The social media platform provider shall not limit the transfers to less than once per hour.

(b)        A large social media platform provider shall comply with the requirements of this Article beginning no later than 30 days from the date the platform first meets the definition under G.S. 75‑152 and shall continue to comply until it no longer meets that definition or until any of the following occurs:

(1)        The individual who made the delegation revokes the delegation.

(2)        The individual who made the delegation revokes or disables the registration of the account of the child with the large social media platform.

(3)        The third‑party safety software provider rejects the delegation.

§ 75‑154.  User data disclosure limitations.

(a)        A third‑party safety software provider as described in this Article shall not disclose any user data obtained under G.S. 75‑153 to any other person, except as follows:

(1)        Pursuant to a lawful request from a government body, including for law enforcement purposes or for judicial or administrative proceedings by means of a court order or a court‑ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena.

(2)        To the extent that the disclosure is required by law and complies with and is limited to the relevant requirements of the law.

(3)        To the individual who made the delegation or with the explicit consent of the individual who made the delegation.

(4)        In the case of a reasonably foreseeable serious and imminent threat to the health or safety of any individual, to a person reasonably able to prevent or lessen the threat.

(5)        To a public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect.

(b)        A third‑party safety software provider that makes a disclosure under subdivision (1), (2), (4), or (5) of subsection (a) of this section shall promptly inform a parent or legal guardian of the child who made the delegation that the disclosure has been or will be made, except in either of the following circumstances:

(1)        The third‑party safety software provider, in the exercise of professional judgment, believes informing the parent or legal guardian would place the child at risk of serious harm.

(2)        The third‑party safety software provider is prohibited by law, including a valid order by a court or administrative body, from informing the parent or legal guardian.

§ 75‑155.  Permits, rulemaking.

(a)        Every large social media platform provider must obtain a permit from the Department before operating in the State. Every large social media platform provider must pay to the Department a nonrefundable application fee of one thousand dollars ($1,000).

(b)        Every large social media platform provider must renew the permit annually and pay to the Department a nonrefundable renewal fee of one thousand dollars ($1,000).

(c)        The Department must prescribe the form of the application for a permit and renewal of a permit.

(d)       The initial application and renewal application must require information sufficient to confirm compliance with this Article.

(e)        The Department may retain the fees collected under this section and use the funds for its operations.

(f)        The Department may issue rules to implement this Article.

§ 75‑156.  Enforcement.

A violation of this Article is an unfair and deceptive trade practice under G.S. 75‑1.1.

SECTION 2.  This act is effective when it becomes law, and the requirements of this act on large social media platform providers apply beginning 30 days after that date.