Sammy’s Law

• Families and children: Parents or children aged 13 or older can authorize a U.S. third‑party safety app to manage a child’s account. The bill defines a child as anyone under 17.
• Third‑party providers: Must be U.S.‑based, store and process data in the United States, pass an initial security review, submit annual audits, disclose practices to users, and can be denied, suspended, or de‑registered by the FTC for material risks.
• Large social media platforms: Platforms with more than 100 million monthly users or over $1 billion in annual revenue must offer continuously available APIs and machine‑readable, secure data transfers at least hourly, and get indemnity if they comply in good faith.
• Privacy and data limits: Certain received data must be deleted within 14 days and delegation‑period data has a 30‑day retention window. Third‑party disclosures are sharply limited to caregivers or lawful process and to narrowly defined serious harms.
• Federal oversight: The FTC must issue compliance and authentication guidance within 180 days, assess covered providers at least every two years, and enforce the rules under its unfair or deceptive practices authority.

The law creates a single national standard for delegation APIs while preserving state consumer protection and other specified state laws.