wa-law.org > bill > 2025-26 > SB 6111 > Original Bill

SB 6111 - Minors/digital services

Source

Section 1

The definitions in this section apply throughout this chapter unless the context clearly requires otherwise.

  1. "Digital service" means a website, an application, a program, or software that collects or processes personal identifying information with internet connectivity.

  2. "Digital service provider" means a person who:

    1. Owns or operates a digital service;

    2. Determines the purpose of collecting and processing the personal identifying information of users of the digital service; and

    3. Determines the means used to collect and process the personal identifying information of users of the digital service.

  3. "Known minor" means a child who is 16 years of age or younger and who the digital service provider knows to be under the age of 17 years.

  4. "Personal identifying information" means any information, including sensitive information, that is linked or reasonably linkable to an identified or identifiable individual. "Personal identifying information" includes pseudonymous information when the information is used by a controller or processor in conjunction with additional information that reasonably links the information to an identified or identifiable individual. "Personal identifying information" does not include deidentified information or publicly available information.

Section 2

  1. This chapter applies only to a digital service provider who provides a digital service that:

    1. Connects users in a manner that allows users to socially interact with other users on the digital service;

    2. Allows a user to create a public, semipublic, or private profile for purposes of signing into and using the digital service; and

    3. Allows a user to create or post content that can be viewed by other users of the digital service, including sharing content on:

      1. A message board;

      2. A chat room; or

      3. A landing page, video channel, or main feed that presents to a user content created and posted by other users.

  2. This chapter does not apply to:

    1. A digital service provider who processes or maintains user data in connection with the employment, promotion, reassignment, or retention of the user as an employee or independent contractor, to the extent that the user's data is processed or maintained for that purpose;

    2. A digital service provider's provision of a digital service that facilitates email or direct messaging services, if the digital service facilitates only those services;

    3. A digital service provider's provision of a digital service that:

      1. Primarily functions to provide a user with access to news, sports, commerce, online video games, or content primarily generated or selected by the digital service provider; and

      2. Allows chat, comment, or other interactive functionality that is incidental to the digital service; or

    4. A digital service provider's provision of a digital service that primarily functions to provide a user with access to career development opportunities, including:

      1. Professional networking;

      2. Job skills;

      3. Learning certifications;

      4. Job posting; and

    5. Application services.

  3. An internet service provider, internet service provider's affiliate or subsidiary, search engine, or cloud service provider is not considered to be a digital service provider or to offer a digital service if the internet service provider or provider's affiliate or subsidiary, search engine, or cloud service provider solely provides access or connection, including through transmission, download, intermediate storage, access software or other service, to an internet website or to other information or content:

    1. On the internet; or

    2. On a facility, system, or network not under the control of the internet service provider, provider's affiliate or subsidiary, search engine, or cloud service provider.

Section 3

  1. A digital service provider may not enter into an agreement with a person to create an account with a digital service unless the person has registered the person's age with the digital service provider. A digital service provider shall make commercially reasonable efforts to verify the age of the person creating an account with a level of certainty appropriate to the risks that arise from the information management practices of the digital service provider.

  2. A digital service provider may not permit an account holder who is a known minor to be an account holder unless the known minor has the express consent from a parent or legal guardian of the known minor. Acceptable methods of obtaining express consent of a parent or legal guardian include the following:

    1. Coordinating a call with a known minor's parent or legal guardian over videoconferencing technology; or

    2. Any other method of obtaining express consent as defined in rule adopted by the attorney general.

Section 4

  1. A digital service provider that enters into an agreement with a known minor for access to a digital service shall limit:

    1. Collection of the known minor's personal identifying information to information reasonably necessary to provide the digital service; and

    2. Use of the known minor's personal identifying information to the purpose for which the information was collected.

  2. A digital service provider that enters into an agreement with a known minor for access to a digital service may not:

    1. Use the digital service to collect the known minor's precise geolocation data;

    2. Use the digital service to display targeted advertising involving unlawful material to the known minor; or

    3. Share, disclose, or sell the known minor's personal identifying information unless required to:

      1. Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a governmental entity;

      2. Comply with a law enforcement investigation;

      3. Detect, block, or prevent the distribution of unlawful or obscene material to a known minor;

      4. Block or filter spam;

    4. Prevent criminal activity; or

    1. Protect the security of a digital service.

Section 5

  1. In relation to a known minor's use of a digital service, a digital service provider shall make commercially reasonable efforts to develop and implement a strategy to prevent or mitigate the known minor's exposure to content that promotes or facilitates the following harms to minors:

    1. Consistent with evidence-informed medical information, self-harm, eating disorders, substance use disorders, and suicidal behaviors;

    2. Patterns of use that indicate or encourage substance abuse or use of illegal drugs;

    3. Stalking, physical violence, online bullying, or harassment;

    4. Grooming, trafficking, child pornography, or other sexual exploitation or abuse;

    5. Incitement of violence; or

    6. Any other illegal activity.

  2. The requirement in subsection (1) of this section may not be construed to require a digital service provider to prevent or preclude:

    1. Any minor from deliberately and independently searching for, or specifically requesting, content; or

    2. The digital service provider or individuals on the digital service from providing resources for the prevention or mitigation of the harms described in subsection (1) of this section, including evidence-informed information and clinical resources.

Section 6

  1. The office of the attorney general may investigate violations of this chapter and may bring actions to enforce compliance and enjoin further violations. If a court finds a person violates the terms of an injunction issued pursuant to this section, it must impose a civil penalty of not more than $10,000 per violation.

  2. Except as provided in subsection (3) of this section, this chapter may not be construed as providing a basis for, or being subject to, a private right of action for a violation of this chapter.

  3. If a digital service provider violates this chapter, the parent or legal guardian of a known minor affected by the violation may bring a cause of action seeking declaratory or injunctive relief against the digital service provider.

Section 7

This chapter may be known and cited as the Washington protecting children online act.

Section 8

If any provision of this act or its application to any person or circumstance is held invalid, the remainder of the act or the application of the provision to other persons or circumstances is not affected.

Created by @tannewt. Contribute on GitHub.