SB0319sam002 104TH GENERAL ASSEMBLY

Sen. Willie Preston

Filed: 5/20/2026

10400SB0319sam002 LRB104 06434 SPS 38089 a

AMENDMENT TO SENATE BILL 319

AMENDMENT NO. ______. Amend Senate Bill 319 by replacing everything after the enacting clause with the following:

"Section 1. Short title. This Act may be cited as the Children's Online Safety Act.

Section 5. Definitions. As used in this Act:

"Addictive feed" means a website, online service, online application, or mobile application, or a portion thereof, as a significant part of the services offered, in which multiple pieces of media generated or shared by users of a website, online service, online application, or mobile application, either concurrently or sequentially, are recommended, selected, or prioritized for display to a user based, in whole or in part, on information associated with the user or the user's device, unless any of the following conditions are met:

(1) the recommendation, prioritization, or selection is based on information that is not persistently associated with the user's device and does not concern the user's previous interactions with media generated or shared by other users;

(2) the recommendation, prioritization, or selection is based on data controlled by user-selected privacy or accessibility settings or technical information concerning the user's device;

(3) the user expressly and unambiguously requested the specific media, media by the author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information that is not permissible under this definition;

(4) the user expressly and unambiguously requested the specific media by a specific author, creator, or poster of media the user has subscribed to, or media shared by users to a page or group the user has subscribed to as described by paragraph (3), be blocked, prioritized, or deprioritized for display, provided that the media is not recommended, selected, or prioritized based, in whole or in part, on other information associated with the user or the user's device that is not permissible under this definition;

(5) the media is direct and private communication between users;

(6) the media is recommended, selected, or prioritized only in response to a specific search inquiry by the user;

(7) the media that is recommended, selected, or prioritized for display is exclusively next in a preexisting sequence from the same author, creator, poster, or source; or

(8) the recommendation, prioritization, or selection is necessary to comply with the provisions of this Act.

"Addictive social media platform" means a covered platform that offers users or provides users with an addictive feed as a significant part of the service provided by that website, online service, online application, or mobile application.

"Age assurance" encompasses a range of methods used to determine, estimate, or communicate the age or age bracket of a user.

"Application" means a software application that may be run or directed by a user on an Internet-enabled device.

"Content" means user-to-user text or an image or video upload.

"Covered minor" means a user of an Internet-enabled device who an account holder has indicated to be under the age of 18.

"Covered operator" means any person, business, or other legal entity that owns, maintains, or controls:

(1) a covered platform; or

(2) an addictive social media platform.

"Covered user" means a user of a covered platform who is a resident of this State.

"Distribute" means to issue, sell, give, provide, deliver, transfer, transmute, circulate, or disseminate by any means.

"Gifted currency" means a currency transfer between users involving fiat currency or digital currency purchased with fiat currency and used within a covered platform whether or not it can be converted to money.

"Internet-enabled device" means a smartphone, tablet, or personal laptop or desktop computer that provides cellular or wireless connectivity, is capable of connecting to the Internet, runs an operating system, and is capable of downloading and running applications.

"Known adult" means any user that a covered platform has actual knowledge, or should have known, based on knowledge fairly implied under objective circumstances, is at least 18 years of age.

"Operating system" means the system software that manages the hardware of an Internet-enabled device and allows programs and applications to run on the device.

"Operating system provider" means a commercial or non-profit entity that controls the Internet-enabled device's operating system, including the design, programming, or supply of operating systems for the Internet-enabled devices.

"Parent" means a parent or legal guardian.

"Precise geolocation information" means information derived from technology, including, but not limited to, global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific within a radius of 1,750 feet. "Precise geolocation information" does not include the content of communications.

"Processor" means a person that processes personal data on behalf of a covered operator or another processor.

"Publish" means to communicate or make information available to another person or entity on a publicly available website, online service, online application, or mobile application.

Section 10. Age assurance requirements.

(a) An Internet-enabled device provider that offers an account setup feature for an Internet-enabled device shall:

(1) provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the primary user of that device for purposes of providing a signal regarding the primary user's age bracket to covered operators;

(2) provide a covered operator who has requested a signal with respect to a particular user with the technical ability to call a digital signal by a reasonably consistent application programming interface, where the user or account holder has agreed to share the user's age bracket data, that contains the user's age bracket data; and

(3) send only the minimum amount of information necessary to comply with this Act and not share the digital signal information, or any information that conveys the user's age bracket data, with a third party for a purpose not required by this Act, except where legally required.

(b) For all users that the covered operator under this Section has actual knowledge to be a covered minor or has received a signal indicating that the user is a covered minor, the covered operator shall use the following settings by default:

(1) The covered operator shall not display the existence of the covered minor's account on a covered platform to any known adult user unless the covered minor has expressly and unambiguously allowed a specific known adult user to view the covered minor's account or has expressly and unambiguously chosen to make the covered minor's account's existence public.

(2) The covered operator shall not display media created or posted by the covered minor on a covered platform to any known adult user unless the covered minor has expressly and unambiguously allowed a specific known adult user to view the covered minor's media or has expressly and unambiguously chosen to make the covered minor's media publicly available.

(3) The covered operator shall not permit any known adult user to like, comment on, or otherwise provide feedback on the covered minor's media on a covered platform unless the covered minor has expressly and unambiguously allowed a specific known adult user to do so.

(4) The covered operator shall not permit direct messaging on a covered platform between the covered minor and any known adult user unless the covered minor has expressly and unambiguously decided to allow direct messaging with a specific known adult user.

(5) The precise geolocation information of the minor shall not be shared with any user unless the minor has expressly and unambiguously chosen to share the covered minor's location with the specific user.

(6) No user may receive or send gifted currency to the minor unless the user is already connected to the covered minor.

(7) The covered operator shall disable search engine indexing of the covered minor's account profile.

(c) A parent of a covered minor or a covered minor determined by a covered operator to be over the age of 16 may override the default privacy settings described in subsection (b). A parent of a covered minor may override the default privacy settings described in subsection (b) for a covered minor under the age of 16. A covered operator shall not provide a covered minor with a single setting that makes all the default privacy settings less protective at once. A covered operator shall not request or prompt a covered minor to make the covered minor's privacy settings less protective, unless the change is strictly necessary for the covered minor to access a service or feature that they expressly and unambiguously requested.

(d) For all users determined by a covered operator to be a covered minor, the covered operator shall provide a mechanism that enables a parent to set a monthly limit on all gifted currency related to the covered minor's account. The covered operator shall establish a mechanism by which a parent of a covered minor may easily view a history of all gifted currency related to the covered minor's account at any time.

(e) It shall be unlawful for a covered operator under this Section to, between the hours of 10 p.m. and 7 a.m., send notifications to a covered user unless:

(1) the covered operator has actual knowledge that the covered user is not a covered minor;

(2) the covered operator has obtained verifiable parental consent to send notifications during the time restricted under this subsection; or

(3) the notification contemporaneously notifies the covered user of a direct message received from another user of the covered platform.

(f) It shall be unlawful for a covered operator of an addictive social media platform to provide an addictive feed to a covered user unless:

(1) the covered operator of the addictive social media platform has actual knowledge that the covered user is not a covered minor; or

(2) the covered operator of the addictive social media platform has obtained verifiable parental consent to provide an addictive feed to a covered minor.

(g) It shall be unlawful for a covered operator of an addictive social media platform to enable the automatic playing of media to a covered minor by default.

(h) A covered operator of an addictive social media platform may choose not to provide services to minors. A covered operator of an addictive social media platform shall not withhold, degrade, lower the quality, or increase the price of any product, service, or feature, other than as necessary for compliance with the provisions of this Act, to a covered user solely because the covered operator of the addictive social media platform is not permitted to provide an addictive feed to the covered user under this Act.

(i) All information collected from a minor for the purpose of obtaining the verifiable parental consent required under this Section shall not be used for any purpose other than obtaining verifiable parental consent and shall be deleted within a reasonable period after an attempt to obtain verifiable parental consent, except where it is necessary for compliance with any applicable provisions of State or federal law.

(j) Nothing in this Section shall be construed as requiring a covered operator to give a parent who grants verifiable parental consent any additional or special access to or control over the data or accounts of the parent's child.

(k) Nothing in this Section shall be construed to prohibit a covered operator from instituting a privacy setting for covered minors or other users that is more protective than that required by this Section.

(l) Nothing in this Section shall be construed as requiring a covered operator to remove any user-generated content or preventing access to information regarding sex, sexuality, gender, and reproductive health that is not already prohibited by existing law.

(m) Nothing in this Section shall be construed as preventing any actions taken in good faith to restrict access to or availability of any media.

Section 15. Privacy protections for age assurance data.

(a) During the process of conducting age assurance, covered operators shall:

(1) only collect personal data of a covered user that is strictly necessary for determining a covered user's age;

(2) immediately upon determining whether a covered user is a covered minor, delete any personal data collected of that covered user for age assurance, except the determination of the covered user's age;

(3) not use any personal data of a covered user collected for age assurance for any other purpose;

(4) not combine personal data of a covered user collected for age assurance, except the determination of a covered user's age, with any other personal data of the user;

(5) not disclose personal data of a covered user collected for age assurance to a third party that is not a processor; and

(6) implement a review process to allow covered users to appeal the age determination.

(b) No information collected or transmitted for purposes of age assurance under this Act may be used for any purpose other than compliance with this Act.

Section 20. Application.

(a) A covered operator that complies with the provisions of this Act shall not be held liable for any inaccuracies in a covered user's age.

(b) A covered operator that receives a digital age signal pursuant to this Act may rely upon that signal for purposes of compliance with this Act and shall not be required to independently verify the age of the user.

(c) A covered operator that reasonably relies on a digital age signal provided by an Internet-enabled device provider shall not be liable for an inaccurate age determination resulting from an erroneous signal.

(d) Nothing in this Act shall be construed to prohibit a covered operator the ability to prevent, detect, protect against or respond to security incidents, identify theft, fraud, harassment, malicious or deceptive activities or any illegal activity targeted at or involving the developer or its services, preserve the integrity or security of systems or investigate, report or prosecute those responsible for any such action.

(e) This Act does not apply to any bona fide news or public interest broadcast, website, video, report, or event and shall not be construed to affect the rights of any news-gathering organization.

(f) This Act does not apply to a broadband Internet access service provider, including any affiliate or subsidiary of the provider. This Act does not create a private right of action or cause of action to enforce any violation or alleged violation of its provisions against a broadband Internet access service provider, including any affiliate or subsidiary of the provider, when the violation is alleged to be committed by another entity using the provider's service. As used in this subsection, "broadband Internet access service provider" has the meaning set forth in 47 CFR 8.1.

Section 25. Enforcement.

(a) The Attorney General or the State's Attorney of any county in this State may bring an action in the name of the People of this State against any person to restrain and prevent any pattern or practice in violation of this Act.

(b) A violation of this Act constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act. All remedies, penalties, and authority granted to the Attorney General or the State's Attorney by the Consumer Fraud and Deceptive Business Practices Act shall be available to the Attorney General or the State's Attorney for the enforcement of this Act.

(c) Any civil penalties collected from the enforcement of this Act shall be deposited as follows: (1) if the Attorney General commenced the action, any penalty shall be deposited into the Attorney General Court Ordered and Voluntary Compliance Payment Projects Fund; and (2) if a State's Attorney commenced the action, any penalty shall be distributed to the county and deposited into a special fund in the county treasury and appropriated to the State's Attorney for use in accordance with law.

(d) Nothing in this Act shall be construed to establish a private right of action associated with violations of this Act.

Section 30. The Consumer Fraud and Deceptive Business Practices Act is amended by adding Section 2MMMM as follows:

(815 ILCS 505/2MMMM new)

Sec. 2MMMM. Violations of the Children's Online Safety Act. Any person that violates the Children's Online Safety Act commits an unlawful practice within the meaning of this Act.

Section 97. Severability. The provisions of this Act are severable under Section 1.31 of the Statute on Statutes.

Section 99. Effective date. This Act takes effect January 1, 2027.".