New law opens child social media accounts to law enforcement surveillance
H.R. 2657 — Sammy’s Law · Filed by Debbie Wasserman Schultz (D-FL) · 22 cosponsors · Introduced Apr 3, 2025 · Markup held
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
Sammy's Law requires large social media platforms (those with over 100 million monthly users or $1 billion annual revenue) to create APIs that allow parents, guardians, or teens aged 13+ to delegate account management to third-party safety software providers. These providers can monitor interactions, adjust settings, and receive user data to detect harms like cyberbullying, trafficking, and abuse. The bill establishes FTC registration and annual audits for safety providers, requires data deletion within 14 days, and permits disclosure only to law enforcement, the child/parent, or in imminent safety threats.
Why we flagged it
The bill's core mechanism is a mandatory API for third-party parental monitoring, but its operative effect extends to creating a data-collection and disclosure regime that permits law enforcement access to child communications with minimal procedural protection—making it simultaneously a child-safety tool and a surveillance infrastructure.
What the text implies
- Law enforcement can obtain child communications and account data via subpoena or court order with no heightened standard or notice requirement to the child or parent, potentially enabling surveillance of political speech, activism, or protected expression by minors.
- Third-party safety providers become custodians of sensitive child data (location, contacts, messages, browsing) and are permitted to disclose it to government on demand—creating a new surveillance intermediary with minimal transparency or oversight.
The full analysis lists 5 implications of this text.
Who stands to gain
third-party safety software providers (parental monitoring companies); large social media platforms (liability shield for data transfers); law enforcement agencies (access to child data without warrant requirement)