HB 5357

HOUSE BILL NO. 5357
A bill to establish standards and practices relating to
certain online services, products, and features that are accessed by known
minors; to prohibit certain acts and practices related to certain online
services, products, and features; to prescribe civil sanctions; to create a
fund; and to provide for the powers and duties of certain state and local
governmental officers and entities.
the people of the state of michigan enact:
Sec. 1. This act may be
cited as the "age-appropriate design code act".
Sec. 2. For purposes of
this act, the words and phrases defined in sections 3 and 4 have the meanings
ascribed to them in those sections.
Sec. 3. (1) "Actual knowledge" means all information and
inferences known to a business relating to the age of an individual, including,
but not limited to, self-identified age and any age the business has attributed
to or associated with the individual for any purpose, including, but not
limited to, marketing, advertising, or product design. If a business's
classification of an individual for purposes of marketing, advertising, or
product design is inconsistent with the individual's self-identified age, a business
shall disregard self-identified age for the purposes of having actual
knowledge. As used in this subsection, "marketing" and
"advertising" include marketing or advertising a business's own
products or services and facilitating another entity's advertising or
marketing.
(2) "Adult" means a
consumer who is more than 17 years of age.
(3) "Business"
means either of the following:
(a) A sole proprietorship, partnership, limited liability
company, corporation, association, or other legal entity to which all of the
following apply:
(i)
It is organized or operated for the profit or financial benefit of its
shareholders or other owners.
(ii)
It collects personal information of consumers or has personal information of
consumers collected on its behalf.
(iii)
It alone, or jointly with others, determines the purpose and means of
processing the personal information of consumers.
(iv)
It does business in this state.
(v)
It satisfies at least 1 of the following:
(A) It has an annual gross revenue in excess of $25,000,000.00. Beginning January 1, 2028, and every 2 years thereafter, the department of treasury shall adjust
the amount of annual gross revenue to reflect the percentage change in
the Consumer Price Index.
(B) It annually buys, receives for a commercial purpose,
sells, or shares for a commercial purpose, or any combination thereof, the
personal information of not less than 50,000
consumers or households.
(b) A person that controls or is controlled by a legal entity
described in subdivision (a) and that shares common branding with the legal
entity. As used in this subdivision, "controls" or
"controlled" means any of the
following:
(i)
Ownership of, or the power to vote, more than 50% of
the outstanding shares of any class of voting security of the legal entity.
(ii)
Control in any manner over the election of a majority of the directors of the
legal entity, or of individuals exercising similar functions in the legal
entity.
(iii)
Power to exercise a controlling influence over the management of the legal
entity.
(4) "Collects"
means buying, renting, gathering, obtaining, receiving, or accessing any
personal information pertaining to a consumer by any means. Collects includes,
but is not limited to, receiving information from a consumer, either actively
or passively, or by observing the consumer's behavior.
(5) "Common
branding" means a shared name, service mark, or trademark for which the
average consumer would understand that 2 or more entities are commonly owned.
(6) "Consumer"
means an individual who is a resident of this state. Consumer does not include
an individual acting in a commercial or employment context or as an employee,
owner, director, officer, or contractor of a business whose communications or
transactions with the business occur solely within the context of the
individual's role with the business.
(7) "Consumer Price
Index" means the most comprehensive index of consumer prices available for
this state from the Bureau of Labor Statistics of the United States Department
of Labor.
(8) "Dark pattern"
means a user interface designed or manipulated with the purpose of subverting
or impairing user autonomy, decision making, or choice,
including, but not limited to, any practice identified as a dark pattern by the
Federal Trade Commission.
(9) "Default" means
a preselected option adopted by a business for an online service, product, or
feature.
(10) "Deidentified
data" means data that cannot reasonably be used to infer information
about, or otherwise be linked to, an identified or identifiable minor or a device linked to a minor, if the business that possesses the data does
all of the following:
(a) Takes reasonable measures
to ensure that the data cannot be associated with an individual.
(b) Publicly commits to
process the data only in a deidentified fashion and to not attempt to
reidentify the data.
(c) Contractually obligates
each recipient of the data to satisfy the criteria described in subdivisions (a) and (b).
(11) "Known minor" or
"knows to be an adult" means having actual knowledge that the
consumer is a minor or an adult, as applicable.
(12) "Minor" means a
consumer who is less than 18 years of age.
Sec. 4. (1) "Online service, product, or feature"
means an online service, product, or feature that is offered to the public.
Online service, product, or feature does not include any
of the following:
(a) A telecommunications service, as that term is defined in
47 USC 153.
(b) The sale, delivery, or use of a physical product.
(c) A broadband internet access
service, as that term is defined in 47 CFR 8.1.
(d) An online service, product, or
feature that the business has actual knowledge or should know that not more
than 2% of consumers are minors.
(2) "Parent" means that
term as described in the children's online privacy protection act of 1998, 15
USC 6501 to 6506.
(3) "Personal
information" means information that is linked or reasonably linkable to an
identified or identifiable individual. Personal information does not include
deidentified data or publicly available information.
(4) "Precise geolocation
information" means information that is derived from a device and that is
used or intended to be used to locate a consumer within a geographic area that
is not more than the area of a circle with a radius of 1,850 feet.
(5) "Process" means to
perform an operation or set of operations by manual or automated means on
personal information, including by collecting, using, storing, disclosing,
analyzing, deleting, or modifying personal information.
(6) "Processor"
means a person or automated system that
processes personal information on behalf of a business.
(7) "Profiling"
means any form of automated processing of personal information that uses the
personal information to evaluate an individual, including, but not limited to,
analyzing or predicting an individual's performance at work, economic situation,
health, personal preferences, interests, reliability, behavior, location, or
movements. Profiling does not include automated processing that does not result
in an assessment or judgment about an individual.
(8) "Rights and freedoms
of minors" means rights
afforded to minors under the United States Constitution and the laws of this
state.
(9) "Sell" means to
exchange personal information for monetary or other
valuable consideration. Sell does not include any of the following:
(a) Disclosing personal information to a processor that
processes the personal information on behalf of the business.
(b) Disclosing personal information to a third party for the
purpose of providing a product or service that was requested by a consumer.
(c) Disclosing or transferring personal information to an
affiliate of the business, except for an affiliate
marketer that is paid a commission by the business.
(d) Disclosing personal information to which both of the
following apply:
(i)
The consumer intentionally made the personal information available to the
general public via a channel of mass media.
(ii)
The consumer did not restrict the personal information to a specific audience.
(e) Disclosing or transferring personal information to a third
party as an asset that is part of a merger, acquisition, bankruptcy, or other
transaction in which the third party assumes control of all or part of the
business's assets.
(10) "Targeted
advertising" means displaying advertisements to an individual when the
advertisement is selected based on personal information obtained or inferred
from that individual's activities over time and across nonaffiliated websites
or online applications to predict the individual's preferences or interest.
Targeted advertising does not include any of the following:
(a) Advertisements based on
activities within a business's own online services, products, or features.
(b) Advertisements based on the
context of an individual's current search query, visit to a website, or use of
an online application.
(c) Advertisements directed to an
individual in response to the individual's request for information or feedback.
(d) Processing personal information
solely to measure or report advertising frequency, performance, or reach.
(11) "Third party"
means a person, other than a consumer, business, or processor, or an affiliate marketer, that is paid a commission by a business.
Sec. 5. This act does not
apply to any of the following information:
(a) Protected health information that is collected by a
covered entity or business associate governed by the privacy, security, and
breach notification rules under the health insurance portability and
accountability act of 1996, Public Law 104-191, and the regulations promulgated
under that act, 45 CFR parts 160 and 164, and the health information technology
for economic and clinical health act, Public Law 111-5.
(b) Information that is collected as part of a clinical trial
that is subject to the federal policy for the protection of human subjects
under 45 CFR part 46.
(c) Information that is collected in accordance with the
"Good Clinical Practice Guidelines" issued by the International
Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human
Use.
(d) Information that is collected in accordance with the human
subject protection requirements of the United States Food
and Drug Administration under 21 CFR part 50.
(e) Information that is collected in
accordance with title V of the Gramm-Leach-Bliley act, 15 USC 6801 to 6809.
Sec.
9. (1) The requirements of this act are in addition to and do not limit or
restrict the application of any other law of this state.
(2) If this act conflicts with 1 or
more federal laws or laws of this state, the law that affords the greatest
protection from harm to minors controls.
Sec. 11. (1) A business
that provides an online service, product, or feature shall configure all
default privacy and safety settings provided
to known minors by the online service,
product, or feature to settings that offer the
highest level of privacy and safety,
including, but not limited to, all of the following default settings:
(a) Not displaying the existence of
the known minor's account to any consumer the business knows to be an adult
unless 1 or more of the following applies:
(i)
The known minor has expressly and unambiguously allowed the adult to view the
known minor's account.
(ii)
The known minor has expressly and unambiguously chosen to make the known
minor's account's existence public.
(b) Not displaying media created or
posted by the known minor to another consumer the business knows to be an adult
unless 1 or more of the following applies:
(i)
The known minor has expressly and unambiguously chosen to allow the adult to
view the known minor's media.
(ii)
The known minor has expressly and unambiguously chosen to make the known
minor's media publicly available.
(c) Not permitting a consumer the
business knows to be an adult to like, comment on, or otherwise provide
feedback on the known minor's media unless the known minor has expressly and
unambiguously chosen to allow the adult to do so.
(d) Not permitting direct messaging
between the known minor and another consumer the business knows to be an adult
unless the known minor has expressly and unambiguously chosen to allow direct
messaging with the adult.
(e) Not displaying the known minor's
location to other consumers unless the known minor has expressly and
unambiguously chosen to share the known minor's location with a specific
consumer.
(f) Not displaying the consumers
connected to the known minor on an online service, product, or feature unless
the known minor has expressly and unambiguously chosen to share the information
with a specific consumer.
(g) Disabling search engine indexing
of the known minor's account profile.
(2) A business shall not do either
of the following:
(a) Provide a known minor with a
single setting that makes all of the default privacy settings less protective
at once.
(b) Request or prompt a known minor
to make the known minor's privacy settings less protective unless the change is
strictly necessary for the known minor to access a service or feature the known
minor has expressly and unambiguously requested.
(3) A default privacy and safety setting under
subsection (1) or (2) is not a dark pattern.
Sec. 13. A business that
provides an online service, product, or feature to
known minors shall provide privacy
information, terms of service, policies, and community standards concisely,
prominently, and using clear language suited to the age of minors who are likely to access the online service,
product, or feature.
Sec. 15. If a business
provides an online service, product, or feature that allows a known minor's parent or any other consumer to monitor the known
minor's online activity or track any precise
geolocation information of the known minor, the business must provide an
obvious signal to the known minor when the known minor is being monitored or tracked.
Sec. 17. A business that
provides an online service, product, or feature to
known minors shall provide a prominent, accessible, and responsive tool
to help a known minor, or, if applicable, the parents of the known
minor, exercise the known minor's privacy
rights and report concerns about the online service, product, or feature to the business.
Sec. 19. (1) A business that provides an online service,
product, or feature to known minors shall do both of the following:
(a) Collect, retain, or process only
the minimum amount of a known minor's personal information that is necessary to provide the specific elements of an
online service, product, or feature with which
the known minor is actively and knowingly engaged. A business shall not use
personal information collected, retained, or processed under this subdivision
for any reason other than those for which the personal information was
collected.
(b) Establish mechanisms to enable
minors and parents to report harms experienced by minors on the online service,
product, or feature.
(2) A business that provides an
online service, product, or feature to known minors shall not do any of the
following:
(a) Profile a known minor unless profiling is necessary to
provide the online service, product, or feature requested
by the known minor and only with respect to the aspects of the online service,
product, or feature with which the known minor is actively and knowingly
engaged.
(b) Sell the personal information of
a known minor.
(c) Process any precise
geolocation information of a known minor by default unless
both of the following apply:
(i)
The collection of the precise geolocation information is strictly necessary for
the business to provide the online service, product, or feature requested by
the known minor and only with respect to the online service, product, or
feature with which the known minor is actively and knowingly engaged.
(ii)
The precise geolocation information is processed only for the limited time that
is necessary to provide the online service, product, or feature.
(d) Process the precise
geolocation information of a known minor without
providing an obvious signal to the known minor for
the duration that the precise geolocation data is being collected.
(e) Use dark patterns.
(f) Allow a person other than a
parent or guardian of a known minor to monitor the known minor's online activity.
(g) Facilitate targeted advertising
to a known minor.
(h) Allow the use of sending
notifications and push alerts to a known minor between the hours of 10 p.m. and
6 a.m. and between 8 a.m. and 4 p.m. on a week day during the school year in
the known minor's local time zone.
(i) Facilitate advertisements for
prohibited products, such as narcotic drugs, tobacco products, gambling, and
alcohol, to known minors.
(j) Use the personal information of
a known minor to select, recommend, or prioritize media for the known minor
unless the personal information is based on any of the following:
(i)
The known minor's express and unambiguous request to receive any of the
following types of media:
(A) Media from a specific account,
feed, or consumer, or to receive more or less media from that account, feed, or
consumer.
(B) A specific category of media
from that account, feed, or consumer.
(C) More or less media with similar
characteristics as the media the known minor is currently viewing.
(ii)
User-selected privacy or accessibility settings.
(iii)
A search query by the known minor if the search query is used only to select
and prioritize media in response to the search.
(3) A business that provides an
online service, product, or feature to known minors is not required to collect
the personal information of a consumer to comply with this act. A business that
collects personal information of a consumer to determine a consumer's age shall
not use that personal information for any other purpose and shall delete that
personal information after using the personal information to determine the
consumer's age.
Sec. 21. (1) The age-appropriate design code enforcement fund is
created in the state treasury.
(2) The state treasurer shall deposit money and other assets
received from civil fines collected under section 23 or from any other source
in the age-appropriate design code enforcement fund.
The state treasurer shall direct the investment of money in the age-appropriate design code enforcement fund and
credit interest and earnings from the investments to the age-appropriate design code enforcement fund.
(3) The department of attorney general is the administrator of
the age-appropriate design code enforcement fund
for audits of the age-appropriate design code
enforcement fund.
(4) The department of attorney general shall expend money from
the age-appropriate design code enforcement fund
on appropriation only to enforce this act.
Sec. 23. (1) Before
initiating a civil action under subsection (3), if the attorney general
believes that a business is engaged in a violation of this act, the attorney
general shall provide the business with a written notice of the alleged
violation, including the specific provision of this
act that the attorney general alleges has been or is being violated, and
shall grant the business a 90-day period to cure the alleged violation.
(2) If, not later than 90
days after receiving the written notice under
subsection (1), the business cures the noticed violation and provides the
attorney general with a written statement that the violation has been cured and sufficient measures have been
taken to prevent future violations, the attorney general shall not initiate a
civil action under subsection (3).
(3) Subject to subsection (1), if a business violates this
act, the attorney general may bring a civil action
seeking a civil fine of not more than
$2,500.00 per affected minor for each
negligent violation, or not more than $7,500.00 per affected minor for each intentional violation.
(4) A civil fine collected under this section must be
deposited in the age-appropriate design code
enforcement fund created in section 21.
(5) This act does not do any of the
following:
(a) Impose liability in a manner
that is inconsistent with 47 USC 230.
(b) Serve as the basis for a private
right of action under this act or any other law.
(c) Infringe on the existing rights
and freedoms of minors.
Enacting section 1.
This act takes effect 18 months after the date it is enacted into law.