Text of KY HB 463 (2024)

UNOFFICIAL COPY 24 RS BR 1082 Page 1 of 10 XXXX 2/5/2024 11:18 AM Jacketed AN ACT relating to the protection of children using social media. 1 Be it enacted by the General Assembly of the Commonwealth of Kentucky: 2 SECTION 1. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 3 READ AS FOLLOWS: 4 As used in Sections 1 to 12 of this Act: 5 (1) "Digital service" means a website, an application, a program, or software that 6 collects or processes personally identifying information using internet 7 connectivity; 8 (2) "Digital service provider" means a person who: 9 (a) Owns or operates a digital service; and 10 (b) Determines the means or purpose of collecting and processing the 11 personally identifying information of users of the digital services; 12 (3) "Known minor" means an individual that a digital service provider knows to be a 13 minor; 14 (4) "Matter" has the same meaning as in KRS 531.010; 15 (5) "Minor" means a child who is younger than eighteen (18) years of age, who is 16 not otherwise emancipated; 17 (6) "Obscene" has the same meaning as in KRS 531.010; 18 (7) "Personally identifying information" has the same meaning as in KRS 525.085; 19 and 20 (8) "Verified caregiver" means the parent or guardian of a known minor whose 21 identity and relationship to the minor have been verified by a digital service 22 provider under Section 9 of this Act. 23 SECTION 2. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 24 READ AS FOLLOWS: 25 (1) Sections 1 to 12 of this Act: 26 (a) Apply only to a digital service provider who provides a digital service that: 27 UNOFFICIAL COPY 24 RS BR 1082 Page 2 of 10 XXXX 2/5/2024 11:18 AM Jacketed 1. Connects users in a manner that allows users to socially interact with 1 other users on the digital service; 2 2. Allows a user to create a public or semi-public profile for purposes of 3 signing into and using the digital service; and 4 3. Allows a user to create or post content that may be viewed by other 5 users of the digital service, including sharing content on a message 6 board, chat room, landing page, video channel, or feed that presents to 7 a user content created and posted by other users; and 8 (b) Do not apply to any: 9 1. State agency or political subdivision of this state; 10 2. Financial institution, including its affiliate, or data subject to Title V 11 of the Federal Gramm-Leach-Bliley Act, 15 U.S.C. sec. 6801 et seq.; 12 3. Covered entity or business associate governed by the privacy, security, 13 and breach notification rules issued by the United States Department 14 of Health and Human Services, 45 C.F.R. pts. 160 and 164; 15 4. Small business, as determined under the applicable United States 16 Small Business Administration regulations in effect on the effective 17 date of this Act; 18 5. Institution of higher education; 19 6. Digital service provider that processes or maintains user data in 20 connection with the employment, promotion, reassignment, or 21 retention of the user as an employee or independent contractor, to the 22 extent that the user's data is processed or maintained for that purpose; 23 7. Digital service provider that provides career development 24 opportunities, including professional networking, job skills, learning 25 certifications, and job posting and application services; 26 8. Educational agency or institution that is subject to the Family 27 UNOFFICIAL COPY 24 RS BR 1082 Page 3 of 10 XXXX 2/5/2024 11:18 AM Jacketed Educational Rights and Privacy Act, 20 U.S.C. sec. 1232g, that 1 operates a digital service and primarily provides educational services 2 to students or other educational institutions; 3 9. Digital service provider's provision of a digital service that facilitates 4 email or direct messaging services, to the extent the digital service 5 facilitates those services; 6 10. Media company that exclusively offers subscription content in which 7 users follow or subscribe unilaterally and whose platforms' primary 8 purpose is not social interaction; or 9 11. Digital service provider's provision of a digital service that: 10 a. Primarily functions to provide a user with access to news, sports, 11 commerce, or content primarily generated or selected by the 12 digital service provider; and 13 b. Includes any chat, comment, or other interactive functionality 14 incidental to the digital service. 15 (2) An internet service provider, internet service provider's affiliate or subsidiary, 16 search engine, or cloud service provider shall not be considered a digital service 17 provider or to offer a digital service to the extent it provides access or connection, 18 including through transmission, download, intermediate storage, access software, 19 or other service, to an internet website or to other information or content on: 20 (a) The internet; or 21 (b) A facility, system, or network not under the control of the internet service 22 provider, provider's affiliate or subsidiary, search engine, or cloud service 23 provider. 24 SECTION 3. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 25 READ AS FOLLOWS: 26 (1) A digital service provider shall not enter into an agreement with an individual to 27 UNOFFICIAL COPY 24 RS BR 1082 Page 4 of 10 XXXX 2/5/2024 11:18 AM Jacketed create an account with a digital service unless the individual has registered his or 1 her age with the digital service provider. 2 (2) An individual who registers his or her age as younger than eighteen (18) years of 3 age shall be considered a known minor until after he or she reaches eighteen (18) 4 years of age or provides the digital service provider with proof of emancipation. 5 (3) A digital service provider shall not allow an individual who registers his or her 6 age to alter that registered age unless the alteration process involves a 7 commercially reasonable review process. 8 (4) Absent proof of emancipation, a minor shall be considered a known minor if: 9 (a) The minor registers his or her age as younger than eighteen (18) years of 10 age; or 11 (b) The minor's verified caregiver notifies the digital service provider that the 12 minor is younger than eighteen (18) years of age. 13 (5) If a minor is a known minor, a digital service provider shall: 14 (a) Be considered to have actual knowledge that the minor is younger than 15 eighteen (18) years of age; and 16 (b) Treat the minor as a known minor under Sections 1 to 12 of this Act. 17 SECTION 4. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 18 READ AS FOLLOWS: 19 (1) Unless a verified caregiver provides otherwise under Section 10 of this Act, a 20 digital service provider that enters into an agreement with a known minor for 21 access to a digital service shall: 22 (a) Limit its collection of the known minor's personally identifying information 23 to information reasonably necessary to provide the digital service; and 24 (b) Limit its use of the known minor's personally identifying information to the 25 purpose for which the information was collected. 26 (2) Unless a verified caregiver provides otherwise under Section 10 of this Act, a 27 UNOFFICIAL COPY 24 RS BR 1082 Page 5 of 10 XXXX 2/5/2024 11:18 AM Jacketed digital service provider that enters into an agreement with a known minor for 1 access to a digital service shall not: 2 (a) Allow the known minor to make purchases or engage in other financial 3 transactions through the digital service, apart from items protected by the 4 First Amendment of the Constitution of the United States; 5 (b) Share, disclose, or sell the known minor's personally identifying 6 information; 7 (c) Use the digital service to collect the known minor's precise geolocation 8 data; or 9 (d) Use the digital service to display targeted advertising to the known minor. 10 SECTION 5. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 11 READ AS FOLLOWS: 12 (1) In relation to a known minor's use of a digital service, a digital service provider 13 shall develop and implement internal controls to prevent the known minor's 14 exposure to obscene matter. 15 (2) Internal controls developed under this section: 16 (a) Shall include: 17 1. Using commercially reasonable efforts to prevent targeted displays of 18 obscene material to known minors; 19 2. Using filtering technology and other protocols to block obscene 20 matter; 21 3. Using hash sharing technology and other protocols to identify 22 recurring obscene matter; 23 4. Using commercially reasonable efforts to identify keywords used for 24 filter evasion, including identifiable misspellings, hashtags, or 25 identifiable homoglyphs; 26 5. Undertaking standard human-performed monitoring reviews to ensure 27 UNOFFICIAL COPY 24 RS BR 1082 Page 6 of 10 XXXX 2/5/2024 11:18 AM Jacketed efficacy of filtering technology; and 1 6. Making available to users a comprehensive description of the 2 categories of obscene matter that will be filtered; and 3 (b) May include: 4 1. Engaging a third party to rigorously review the digital service 5 provider's content filtering technology; 6 2. Participating in industry-specific partnerships to share best practices 7 in preventing access to obscene matter; and 8 3. Conducting periodic independent audits to ensure: 9 a. Continued compliance with digital service provider's strategy; 10 and 11 b. Efficacy of filtering technology and protocols used by the digital 12 service provider. 13 SECTION 6. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 14 READ AS FOLLOWS: 15 (1) A digital service provider shall create and provide to a verified caregiver tools to 16 allow the verified caregiver to supervise the verified caregiver's known minor's 17 use of a digital service. 18 (2) Tools provided under this section shall allow a verified caregiver to: 19 (a) Control the known minor's privacy and account settings; 20 (b) Alter the duties of a digital service provider under Section 4 of this Act with 21 regard to the verified caregiver's known minor; 22 (c) Restrict the ability of the known minor to make purchases or engage in 23 financial transactions if the verified caregiver alters the duty of a digital 24 service provider under subsection (2)(a) of Section 4 this Act; 25 (d) Monitor and limit the amount of time the known minor spends using the 26 digital service; and 27 UNOFFICIAL COPY 24 RS BR 1082 Page 7 of 10 XXXX 2/5/2024 11:18 AM Jacketed (e) Deactivate the known minor's account either temporarily or permanently. 1 SECTION 7. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 2 READ AS FOLLOWS: 3 (1) A digital service provider shall make a commercially reasonable effort to prevent 4 advertisers on the digital service provider's digital service from targeting a known 5 minor with advertisements that facilitate, promote, or offer a product, service, or 6 activity that is unlawful for a minor in this state to use or engage in. 7 (2) A digital service provider that uses algorithms to automate the suggestion, 8 promotion, or ranking of information to known minors on the digital service 9 shall: 10 (a) Make a commercially reasonable effort to ensure that the algorithm does 11 not interfere with the digital service provider's duties under Section 5 of this 12 Act; and 13 (b) Disclose in the digital service provider's terms of service, privacy policy, or 14 similar document, in a clear and accessible manner, an overview of: 15 1. The manner in which the digital service uses algorithms to provide 16 information or content; 17 2. The manner in which algorithms promote, rank, or filter information 18 or content; and 19 3. The personally identifying information used as inputs to provide 20 information or content. 21 SECTION 8. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 22 READ AS FOLLOWS: 23 Nothing in Sections 1 to 12 of this Act shall be construed to prohibit a digital service 24 provider from collecting, processing, or sharing a known minor's personal identifying 25 information in a manner necessary to: 26 (1) Comply with a state or federal law; 27 UNOFFICIAL COPY 24 RS BR 1082 Page 8 of 10 XXXX 2/5/2024 11:18 AM Jacketed (2) Comply with a law enforcement investigation; 1 (3) Detect, block, or prevent the distribution of unlawful or obscene matter to a 2 known minor; 3 (4) Block or filter spam; 4 (5) Prevent criminal activity; or 5 (6) Protect the security of a digital service. 6 SECTION 9. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 7 READ AS FOLLOWS: 8 (1) A digital service provider shall verify, using a commercially reasonable method 9 and for each individual seeking to perform an action on a digital service as a 10 known minor's verified caregiver: 11 (a) The individual's identity; and 12 (b) The relationship of the individual to the known minor. 13 (2) A digital service provider shall provide a process by which an individual who has 14 been verified under this section as the verified caregiver of a known minor may 15 participate in the digital service as the known minor's verified caregiver. 16 (3) A digital service provider or third party shall not retain any personally identifying 17 information after making a decision under subsection (1) of this section. 18 SECTION 10. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 19 READ AS FOLLOWS: 20 (1) A verified caregiver may alter the duties of a digital service provider under 21 Section 4 of this Act with regard to the verified caregiver's known minor. 22 (2) A verified caregiver may supervise the verified caregiver's known minor's use of a 23 digital service using tools provided by a digital service provider under Section 6 of 24 this Act. 25 (3) (a) A known minor's verified caregiver may submit a request to a digital service 26 provider to: 27 UNOFFICIAL COPY 24 RS BR 1082 Page 9 of 10 XXXX 2/5/2024 11:18 AM Jacketed 1. Review and download any personally identifying information 1 associated with the known minor in the possession of the digital 2 service provider; and 3 2. Delete any personally identifying information associated with the 4 known minor collected or processed by the digital service provider. 5 (b) A digital service provider shall establish and make available on its digital 6 service a method by which a verified caregiver may make a request for 7 access under this subsection. 8 (4) If a known minor is in the temporary custody of the Department for Community 9 Based Services, the department may designate the minor's parent or guardian, or 10 a member of the department's staff to perform the functions of the known minor's 11 verified caregiver under Sections 1 to 12 of this Act. 12 SECTION 11. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 13 READ AS FOLLOWS: 14 (1) A violation of Sections 1 to 12 of this Act shall constitute an unfair, false, 15 misleading, or deceptive act or practice in the conduct of trade or commerce 16 under KRS 367.170. 17 (2) Nothing in Sections 1 to 12 of this Act shall be construed to require a digital 18 service provider to disclose a trade secret as defined in KRS 365.880. 19 (3) All of the remedies, powers, and duties provided to the Attorney General by the 20 Consumer Protection Act, KRS 367.110 to 367.300, appertaining to acts declared 21 unlawful by KRS 367.170 shall apply with equal force and effect to acts or 22 practices declared unlawful by Sections 1 to 12 of this Act. 23 (4) Nothing in Sections 1 to 12 of this Act shall be construed to limit or restrict the 24 exercise of powers or the performance of duties of the Attorney General 25 authorized under any provision of law. 26 SECTION 12. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 27 UNOFFICIAL COPY 24 RS BR 1082 Page 10 of 10 XXXX 2/5/2024 11:18 AM Jacketed READ AS FOLLOWS: 1 (1) Except as provided in this section, Sections 1 to 12 of this Act shall not be 2 construed as providing a basis for, or being subject to, a private right of action for 3 a violation of Sections 1 to 12 of this Act. 4 (2) If a digital service provider violates Sections 1 to 12 of this Act, the parent or 5 guardian of a known minor affected by that violation may bring a cause of action 6 seeking: 7 (a) A declaratory judgment under KRS 418.055; or 8 (b) An injunction against the digital service provider. 9 (3) A court shall not certify an action brought under this section as a class action. 10 Section 13. If any provision of this Act or the application thereof to any 11 person or circumstance is held invalid, the invalidity shall not affect other provisions 12 or applications of the Act that can be given effect without the invalid provision or 13 application, and to this end the provisions of this Act are severable. 14