US SB4159

Large social media platforms (100+ million monthly users or $1+ billion annual revenue) must create real-time APIs allowing parents or children under 17 to delegate account management to FTC-registered third-party safety software providers within 180 days of enactment

Third-party safety providers can manage a child's online interactions, content, and account settings, and receive secure data transfers at least hourly; providers must register with the FTC, undergo annual audits, and delete user data within 5 days of receiving it

Safety providers may only disclose child data to parents when detecting risks including suicide, violence, substance abuse, trafficking, sexual exploitation, terrorism, or sharing of personal information like home addresses or social security numbers

Platforms cannot be held liable for damages from transferring user data to compliant third-party providers; violations are treated as unfair or deceptive practices under the FTC Act

Preempts state laws specifically requiring platforms to provide APIs for child safety purposes, while preserving state consumer protection, tort, contract, and fraud laws