This bill mandates that large social media platforms develop and maintain real-time application programming interfaces (APIs) for use by registered third-party safety software providers. The primary goal is to empower children under 17, or their parents, to delegate control over their online interactions, content, and account settings to these safety tools. A large social media platform is defined by its user base (over 100 million monthly global active users or $1 billion in annual revenue) and features allowing child interaction. Platforms must make these APIs available within 180 days of the bill's enactment, or 30 days if they later meet the criteria, enabling third-party software to manage accounts and securely transfer user data at least hourly. Delegations can be revoked by the child or parent, or automatically cease when the child turns 17 or the third-party provider is deregistered. Platforms are also required to implement robust data security measures for transferred user data and disclose delegation details and data transfer summaries to the child or parent. Third-party safety software providers must register with the Federal Trade Commission (FTC) and adhere to strict rules, including limiting data collection to what is necessary for child protection, maintaining high security standards, and promptly deleting user data upon revocation. Crucially, these providers are prohibited from selling any user data obtained under this Act. Registration requires demonstrating that the provider is not controlled by a covered nation and will use data solely for child protection. The bill outlines specific conditions for third-party providers regarding data retention and disclosure, allowing data to be shared with parents or in cases of serious harm or legal requests, such as preventing suicide, abuse, or fraud. Providers must also undergo annual audits to ensure compliance, with reports submitted to the FTC. The FTC has the authority to deny, suspend, or permanently deregister providers for non-compliance, willful misconduct, or material misrepresentation. Violations of this Act are considered unfair or deceptive acts under the Federal Trade Commission Act, granting the FTC broad enforcement powers. The Commission will biannually assess platform compliance and establish procedures for complaints. The bill establishes a national standard , preempting state laws that would require similar API access for child online safety, but it does not limit state consumer protection, trespass, contract, tort, or fraud laws.
Subcommittee Consideration and Mark-up Session Held
Introduced in Senate
Read twice and referred to the Committee on Commerce, Science, and Transportation.
Science, Technology, Communications
Sammy’s Law
USA119th CongressS-4159| Senate
| Updated: 3/20/2026
This bill mandates that large social media platforms develop and maintain real-time application programming interfaces (APIs) for use by registered third-party safety software providers. The primary goal is to empower children under 17, or their parents, to delegate control over their online interactions, content, and account settings to these safety tools. A large social media platform is defined by its user base (over 100 million monthly global active users or $1 billion in annual revenue) and features allowing child interaction. Platforms must make these APIs available within 180 days of the bill's enactment, or 30 days if they later meet the criteria, enabling third-party software to manage accounts and securely transfer user data at least hourly. Delegations can be revoked by the child or parent, or automatically cease when the child turns 17 or the third-party provider is deregistered. Platforms are also required to implement robust data security measures for transferred user data and disclose delegation details and data transfer summaries to the child or parent. Third-party safety software providers must register with the Federal Trade Commission (FTC) and adhere to strict rules, including limiting data collection to what is necessary for child protection, maintaining high security standards, and promptly deleting user data upon revocation. Crucially, these providers are prohibited from selling any user data obtained under this Act. Registration requires demonstrating that the provider is not controlled by a covered nation and will use data solely for child protection. The bill outlines specific conditions for third-party providers regarding data retention and disclosure, allowing data to be shared with parents or in cases of serious harm or legal requests, such as preventing suicide, abuse, or fraud. Providers must also undergo annual audits to ensure compliance, with reports submitted to the FTC. The FTC has the authority to deny, suspend, or permanently deregister providers for non-compliance, willful misconduct, or material misrepresentation. Violations of this Act are considered unfair or deceptive acts under the Federal Trade Commission Act, granting the FTC broad enforcement powers. The Commission will biannually assess platform compliance and establish procedures for complaints. The bill establishes a national standard , preempting state laws that would require similar API access for child online safety, but it does not limit state consumer protection, trespass, contract, tort, or fraud laws.