Rep. W. NEWTON proposes the following amendment (LC-3431.SA0008H):

Amend the bill, as and if amended, by striking all after the enacting words and inserting:

SECTION 1. Title 39 of the S.C. Code is amended by adding:

CHAPTER 80

Age-Appropriate Code Design

 Section 39-80-10. As used in this chapter:
  (1) "Compulsive usage" means the persistent and repetitive use of a covered online service that substantially limits one or more of a user's major life activities including, but not limited to, sleeping eating, learning, reading, concentrating, communicating, or working.
  (2) "Connected account" means an account on a covered online service that is directly connected to:
   (a) the user's account; or
   (b) an account that is directly connected to the user's account.
  (3) "Covered design feature" means any feature or component of a covered online service that will encourage or increase a minor's frequency, time spent, or activity on a covered online service including, but not limited to:
   (a) infinite scroll or any design feature that automatically loads and displays content other
than what the user prompted, requested, or searched for:
   (b) auto-playing videos or any design feature in which videos automatically begin playing when a user navigates to or scrolls through a set of videos;
   (c) gamification or any design feature that emulates gameplay including, but not limited to, streaks, badges, or rewards, that motivate or cause more frequent or more extensive use of a covered online service;
   (d) quantification of engagement including, but not limited to, providing a visible count of how many likes, comments, clicks, views, or reactions any user-generated item has received;
   (e) notifications and push alerts;
   (f) in-game purchases or any design feature in which digital items or tokens are purchased with virtual currency or other forms of payment, including where the purchased digital item can be shared with another user; or
   (g) appearance-altering filters.
  (4)(a) "Covered online service" means:
    (i) a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that owns, operates, controls, or provides an online service that conducts business in this State, is reasonably likely to be accessed by minors, determines the purposes and means of the processing of consumer's personal data alone, or jointly with its affiliates, subsidiaries, or parent company and either;
     (A) has annual gross revenues in excess of twenty-five million dollars, adjusted every odd-numbered year to reflect changes in the Consumer Price Index;
     (B) annually buys, receives, sells, or shares the personal data of fifty thousand or more consumers, households, or devices alone or in combination with its affiliates, subsidiaries, or parent company; or
     (C) derives at least fifty percent of its annual revenue from the sale or sharing of consumers' personal data; and
   (b) "Covered online services" include:
    (i) an entity that controls or is controlled by a business that shares a name, service mark, or trademark that would cause a reasonable consumer to understand that two or more entities are commonly owned; and
    (ii) a joint venture or partnership composed of businesses in which each business has at least a forty percent interest in the joint venture or partnership.
  (5) "Dark pattern" means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making, or choice.
  (6)(a) "Expressed preferences" means a freely given, considered, specific, and unambiguous indication of a user's preferences regarding the user's engagement with a covered online service.
   (b) Expressed preferences cannot be based on the user's time spent engaging on the covered online service, nor on the usage of features that do not indicate explicit preference, such as comments made, posts reshared, or similar actions that are commonly taken on disliked media.
  (7) "Known to be a minor" means the covered online service has actual knowledge that a particular consumer is a minor. For purposes of this act, actual knowledge includes all information and inferences known to the covered online service relating to the age of the individual including, but not limited to, self-identified age, and including any age the covered online service has attributed or associated with the individual for any purpose including, but not limited to, marketing, advertising, or product development purposes.
  (8) "Minor" means a consumer who is less than eighteen years of age.
  (9) "Online service" means any service, product, or feature that is accessible to the public on the internet including, but not limited to, a website or application. An online service may include any service, product, or feature that is based in part or in whole on artificial intelligence. "Online service" does not mean any of the following:
   (a) a telecommunications service, as defined in 47 U.S.C. Section 153;
   (b) a broadband internet access service as defined in 47 C.F.R. Section 54.400; or
   (c) the sale, delivery, or use of a physical product.
  (10) "Parent" has the same meaning as defined in the Children's Online Privacy Protection Act, 15 U.S.C. Sections 6501-6506 and the Federal Trade Commission rules implementing that act.
  (11)(a) "Personal data" means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more
identified or identifiable individuals in a household.
   (b) Personal data does not include publicly available data.
  (12) "Personalized recommendation system" means a fully or partially automated system used to suggest, promote, or rank content, including other users, hashtags, or material from others based on the personal data of users.
  (13)(a) "Precise geolocation information" means any data that identifies a user's present or past location within a radius of one thousand one hundred eighty feet, the present or past location of a device that links or is linkable to a user, or any data that is derived from a device that is used or intended to be used to locate a user within a radius of one thousand one hundred eighty feet by means of technology that includes a global positioning system that provides latitude and longitude coordinates.
   (b) "Precise geolocation information" does not include the content of communications or any data generated or connected to advanced utility metering infrastructure systems or equipment for use by a utility.
  (14) "Process" means the performance of an operation, or a set of operations, by manual or automated means on personal data including, but not limited to, collecting, using, storing, disclosing, analyzing, deleting, sharing, or modifying personal data.
  (15) "Profile" means any form of automated processing of personal data to evaluate, analyze, or predict certain aspects relating to a user including, but not limited to, a user's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
  (16)(a) "Publicly available data" means data that is lawfully made available from federal, state, or local government records, or data that a business has a reasonable basis to believe is lawfully made available to the general public by the individual or from widely distributed media or data made available by a person to whom the individual has disclosed the data if the individual has not restricted the data to a specific audience.
   (b) "Publicly available data" does not mean biometric data collected by a covered online service about a minor without the minor's knowledge.
  (17)(a) "Reasonably likely to be accessed by a minor" means it is reasonable to expect that the covered online service would be accessed by an individual minor or by minors based on the covered online service meeting either of the following criteria:
    (i) the individual is known to the covered online service to be a minor as defined in Section 39-80-10(7); or
    (ii) the covered online service is directed to children as defined by the Children's Online Privacy Protection Act, 15 U.S.C. Sections 6501-6506 and the Federal Trade Commission rules implementing that act.
   (b) Where subitem (a)(i) is met, the covered online service must treat the particular individual as a minor. Where subitem (a)(ii) is met, the covered online service must treat all individuals using or visiting the covered online service as minors, except where the covered online service has actual knowledge that the individual is not a minor.
  (18) "Sensitive personal data" means personal data that reveals:
   (a) an individual's social security number, driver's license, state identification card, or passport number;
   (b) an individual's account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;
   (c) an individual's precise geolocation information;
   (d) an individual's racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership;
   (e) the contents of an individual's mail, email, text messages, or other forms of communications that perform similar functions, including shared images and videos, unless the business is the intended recipient of the communication;
   (f) an individual's genetic data;
   (g) biometric data for the purpose of uniquely identifying an individual; or
   (h) personal data concerning an individual's health.
  (19)(a) "Targeted advertising" means displaying advertisements to an individual where the advertisement is selected based on personal data obtained or inferred from that individual's activities over time and across nonaffiliated websites or online applications to predict the individual's preferences or interest.
   (b) "Targeted advertising" does not include:
    (i) advertisements based on activities within a covered online service's own internet websites or online applications;
    (ii) advertisements based on the context of an individual's current search query, visit to an internet website, or use of an online application;
    (iii) advertisements directed to an individual in response to the individual's request for information or feedback; or
    (iv) processing personal data solely to measure or report advertising frequency, performance, or reach.
  (20) "User" means with respect to a covered online service an individual who uses the covered online service and who is located in South Carolina.

 Section 39-80-20. (A) A covered online service shall exercise reasonable care in the use of a minor's personal data and the design and operation of the covered online service including, but not limited to, covered design features, to prevent the following harm to minors:
  (1) compulsive usage of the covered online service;
  (2) severe psychological harm including, but not limited to, anxiety, depression, self-harm or suicidal ideations;
  (3) severe emotional distress;
  (4) highly offensive intrusions on the minor's reasonable privacy expectations;
  (5) identity theft;
  (6) discrimination against the minor on the basis of race, ethnicity, sex, disability, or national origin; and
  (7) material financial or physical injury.
 (B) "Harm" defined in this section is limited to those for which liability is permitted under 47 U.S.C Section 230, including as that provision is amended or repealed in the future.
 (C) Nothing in this section may be construed to require a covered online service to prevent or preclude any user from deliberately and independently searching for or specifically requesting content, or accessing resources and information regarding the prevention or mitigation of the harm described in this section.
 (D) The provisions contained in this chapter do not apply to:
  (1) a federal, state, tribal, or local government entity in the ordinary course of its operations;
  (2) personal data that is controlled by a covered online service that is:
   (a) required to comply with:
    (i) Title V of the federal Gramm-Leach-Bliley Act;
    (ii) the federal Health Information Technology for Economic and Clinical Health Act; or
    (iii) regulations promulgated pursuant to Section 264(C) of the Health Insurance Portability and Accountability Act of 1996;
   (b) in compliance with the information security requirements of the statutes or regulations identified in subitem (a).
  (3) information including, but not limited to, personal data collected as part of a clinical trial subject to the federal policy for the protection of human subjects pursuant to human subject protection requirements of the U.S. Food and Drug Administration;
  (4) The requirements of this chapter are in addition to and may not limit or restrict in any way the application of other laws including, but not limited to, statutes, regulations, and common law of South Carolina. In the event of a conflict between this chapter and one or more other laws, the law that affords the greatest protection to minors shall control.

 Section 39-80-30. (A) A covered online service must provide a user or visitor to the service with easily accessible and easy-to-use tools to:
  (1) disable design features including, but not limited to, all covered design features, that are not necessary to provide the covered online service by allowing users to opt-out of the use of all such design features or any combination of such design features;
  (2) limit the amount of time the user spends on the covered online service;
  (3) limits, at the level of the user's choosing, the financial value of purchases and transactions on the covered online service if such purchases and transactions have not been disabled;
  (4) block, disable, and render nonvisible messaging, requests, reactions, likes, comments, or other contact from account holders that are not already among the minor's existing connected accounts;
  (5) restrict the visibility of the minor's account and information posted by the minor to only users with connected accounts;
  (6) block, disable, and render nonvisible quantification of engagement including, but not limited to, providing a visible count of how many likes, comments, clicks, views, or reactions regarding any item generated by the user;
  (7) disable search engine indexing of a user's account profile such that the account only shows within searches initiated by a user with a connected account;
  (8) prohibit any other individual from viewing the user's connections to other users, regardless of the nature of the connection; and
  (9) restrict the visibility of the user's location information to only those with whom the user specifically shares such information and provide notice when the minor's precise geolocation information is being tracked or shared.
 (B) A covered online service must provide to a user the option to opt-out of personalized recommendation systems, except for optimizations based on the user's expressed preferences. A covered online service must establish this option as a default setting for any individual the covered online service knows to be a minor.
 (C) A covered online service must establish, implement, and maintain as default settings for any individual the covered online service knows to be a minor the safeguards described in subsection (A).

 Section 39-80-40. (A) Covered online services shall only collect, use, or share the minimum amount of a minor's personal data necessary to provide the specific elements of the covered online service with which a minor has knowingly engaged. Such personal data may not be used for reasons other than those for which it was collected. Minors' personal data collected for age verification or estimation cannot be used for other purposes and must be deleted after use.
 (B) A covered online service shall only retain a minor's personal data as long as necessary to provide the specific elements of an online service with which a minor has knowingly engaged.
 (C) Covered online services may not facilitate targeted advertising to minors.
 (D) Precise geolocation information of minors cannot be collected by default unless necessary to the provision of the covered online service. An obvious notice to the minor must be provided when precise geolocation information is being collected or used.
 (E) A covered online service must provide users with accessible and easy to use tools to prevent notifications and push alerts to an individual during specified times. To comply with this requirement, a covered online service must offer the user the option to prevent notifications and push alerts to an individual the covered online service knows is a minor between the hours of ten p.m. and six a.m. seven days a week year round and between the months of August and May between the hours of eight a.m. and three p.m. Monday through Friday in the minor's local time zone.
 (F) A covered online service shall not profile an individual the covered online service knows is a minor, unless profiling is necessary to providing the covered online service with which a minor has knowingly requested and is limited to only the aspects of the covered online service with which a minor is actively and knowingly engaged.
 (G) Settings for the protections required under this section must be set at the highest level of protection by default.
 (H) If a covered online service allows parental monitoring or is required to provide parental monitoring by law, then it must provide obvious notice to the minor when they are being monitored.

 Section 39-80-50. (A) Covered online services must provide parents with accessible and easy-to-use tools to help parents protect and support minors using the covered online services and these shall be on by default for any individual the covered online service knows to be a minor.
 (B) The parental tools provided by the covered online services shall provide to the parents the ability to:
  (1) manage the minor's account settings and change and control the minor's privacy and account settings; and
  (2) restrict a minor's purchases and other financial transactions.
 (C) Among the parental tools provided by covered online services shall be one to enable parents to view the total time spent on a covered online service by a user the covered online service knows is a minor and allow the parent to place limits on the minor's use of the covered online service. The parental tools provided by covered online services must also offer parents the ability to restrict a minor's use of the covered online service during times of day specified by the parents, including during school hours and at night.
 (D) Covered online services must notify a minor when any of the tools described in this section are in effect and what settings have been applied.

 Section 39-80-60. (A) Covered online services shall establish mechanisms for parents, minors, and schools to report harm to minors on covered online services, especially those harms that pose an imminent threat to a minor.
 (B) Covered online services are prohibited from facilitating ads directed to minors for products prohibited for minors including, but not limited to, narcotic drugs, tobacco products, gambling, and alcohol to users the covered online services know are minors.
 (C) Covered online services are prohibited from using dark patterns.
  (1) Use of dark patterns by a covered online service shall constitute an unlawful trade practice under Section 39-5-20 of the South Carolina Unfair Trade Practices Act.
  (2) A covered online service that violates the provisions of this section are subject to the provisions, penalties, and damages of the South Carolina Unfair Trade Practices Act.
 (D) Each covered online service that utilizes personalized recommendation systems is required to describe in its terms and conditions, in a clear, conspicuous, and easy-to-understand manner, how the systems are used to provide information to minors and information regarding how minors or their parents can opt-out of or control the systems.
 (E) Covered online services are required to provide comprehensive, clear, conspicuous, and easy-to-understand information in a prominent location describing the design safety for minors, the privacy protections for minors, and the parental tools that the covered online service has adopted pursuant to this chapter. Such disclosure must also include a clear, conspicuous, and easy-to-understand explanation of how minors and parents may utilize those design safety measures, privacy protections, and tools.

 Section 39-80-70. (A) Annually, on or before July first, the covered online service must issue a public report prepared by an independent third-party auditor that contains a detailed description of the covered online service as it pertains to minors, including its covered design features, its use of personal data, and its business practices as they pertain to minors. The public report must be submitted to the Attorney General who shall post it in a prominent place on his internet website. Each report must include:
  (1) the purpose of the covered online service;
  (2) the extent to which the covered online service is likely to be accessed by minors;
  (3) an accounting of the total number and types of reports generated pursuant to Section 39-80-60(A) and assessment of how those reports were handled, if known;
  (4) whether, how, and for what purpose the covered online services collects or processes minors' personal data and sensitive personal data;
  (5) the design safety for minors, the privacy protections for minors, and the parental tools that the covered online entity has adopted;
  (6) whether and how the covered online service uses covered designed features;
  (7) the covered online service's process for handling data access, deletion, and correction requests for a minor's data;
  (8) age verification or estimation methods used; and
  (9) description of algorithms used by the covered online service.
 (B) Independent auditors that prepare reports required under this section are required to follow inspection and consultation practices designed to ensure that reports are comprehensive and accurate, and that the reports are prepared in consultation with experts on minors' use of covered online services.
 (C) Covered online services are required to provide independent auditors that prepare reports required under this section full and complete cooperation and access to information and operations required to ensure that the report is comprehensive and accurate.

 Section 39-80-80. (A) The Attorney General shall enforce the provisions contained in this chapter.
 (B) A covered online service shall be liable for treble the financial damages incurred as a result of a violation of this chapter.
 (C) The officers and employees of a covered online service may be held personally liable for wilful and wanton violations of this chapter.

SECTION 2. The requirements of this act are in addition to and shall not limit or restrict in any way the application of other laws including, but not limited to, statutes, regulations, and common law of this State. In the event of a conflict between this act and one or more other laws, the law that affords the greatest protection to minors shall control.

SECTION 3. If any section, subsection, paragraph, subparagraph, sentence, clause, phrase, or word of this act is for any reason held to be unconstitutional or invalid, such holding shall not affect the constitutionality or validity of the remaining portions of this act, the General Assembly hereby declaring that it would have passed this act, and each and every section, subsection, paragraph, subparagraph, sentence, clause, phrase, and word thereof, irrespective of the fact that any one or more other sections, subsections, paragraphs, subparagraphs, sentences, clauses, phrases, or words hereof may be declared to be unconstitutional, invalid, or otherwise ineffective.

SECTION 4. This act takes effect upon approval by the Governor.

Renumber sections to conform.

Amend title to conform.