On May 8, 2024, House Bill 2017 on providing for protection of minors on social media, was passed by the Pennsylvania House of Representatives after passing its third passage.

Definitions and scope

The bill defines terms such as 'dark patterns,' 'personalized recommendation system,' and 'targeted advertising,' and applies to 'social media platforms:' a public or semipublic internet-based service, application, or online video game that has users in Pennsylvania and that meets all of the following:

• its primary function is to connect users in order to allow users to interact socially with each other within the service; and
• the service, application, or online video game allows users to do all of the following:
  • construct a public or semi-public profile for purposes of signing into and using the service, application, or online video game;
  • populate a list of other users with whom an individual shares a social connection; and
  • create or post content viewable by other users.

Key provisions

Regarding hateful conduct, the bill outlines that a social media platform must, among other things, put in place a clearly accessible and direct mechanism for reporting incidents of hateful conduct, as well as a clear, concise, and easily accessible policy on its website.

Regarding obtaining consent to open an account, the bill states that a social media platform must, among other things:

• make commercially reasonable efforts to verify the age of users upon the creation of an account, with a level of certainty appropriate to the risks;
• not permit a minor to become an account holder unless the minor has the express consent of the minor's parent or legal guardian, and document such consent;
• after discovery of the failure to obtain the express consent suspend the social media account and notify the minor's parent or legal guardian;
• allow the minor's parent or legal guardian to become an account holder with a means to initiate account supervision, and provide clear notice to the minor on the features that would be accessible to the parent;
• take reasonable steps to provide a parent or legal guardian who has provided express consent with the ability to revoke the consent at any time; and
• within a reasonable time frame from receipt of the revocation, suspend, delete, or disable the minor's account for whom consent was revoked.

Regarding the management of data, the bill outlines that a social media platform must not, among other things:

• mine data related to a minor who has opened a social media account;
• use a personalized recommendation system unless a minor opts-in using a prominent, accessible, and responsible tool;
• process the precise geolocation information of a minor by default unless the processing of the precise geolocation information:
  • is strictly necessary for the social media company to provide the service requested by the minor; or
  • is only for the amount of time necessary to provide the service, product, or feature;
• process the precise geolocation information of a minor without providing a conspicuous signal;
• use dark patterns; and
• not permit, by default, an unknown adult to contact a minor consumer on the social media platform.

Regarding requests from an individual to correct or delete personal information held by the social media platform, the social media platform must:

• display on its website how such a request can be made; and
• upon deletion request, delete personal information within 90 days, and provide further confirmation of said deletion, upon request.

Violations and entry into force

The bill states that the Attorney General (AG) has jurisdiction to bring an action against a social media platform for violation of one of the provisions of the bill. Depending on the section violated, the penalties can vary from $1,000 to $10,000 for first offenses.

The bill will enter into force 18 months after its enactment.

You can read the bill as passed here and view its progress here.