HB2991 - 572R - Senate Fact Sheet

Purpose

Effective one year after the general effective date, prescribes duties for a covered company, developer or social media platform to provide for user age verification and related online content safeguards for the protection of minors. Outlines enforcement and penalties for a violation of the prescribed duties. Establishes the Technology Content Protection for Minors Grant Fund (Fund).

Background

In 2025, the Legislature enacted the requirement for a commercial entity that knowingly and intentionally publishes or distributes material on an internet website, including a social media platform, of which more than one-third is sexual material that is harmful to minors to use reasonable age verification methods to verify that an individual who attempts to access the material is 18 years of age or older. A commercial entity or a third-party that performs the age verification must not: 1) retain any identifying information of the individual; or 2) cause or allow any identifying information to be directly or indirectly transmitted to any government entity. A parent or guardian of a minor who accesses material harmful to minors, and a person whose identifying information was unlawfully retained or transmitted, have a right of action against the offending entity (Laws 2025, Ch. 193; A.R.S. § 18-701).

In 2025, the Legislature also enacted content restrictions on digital advertising directed towards children. Beginning January 1, 2027, a child-directed application must take appropriate measures to prevent the display of inappropriate and mature advertisements on child-directed applications. Inappropriate and mature advertisement is an advertisement that sells or promotes: 1) violence; 2) explicit language; 3) sexual content; or 4) alcohol or drug use. A child-directed application that does not comply with the content restrictions is subject to a civil penalty of up to $100,000 per violation. The Attorney General must enforce the child-directed application content restrictions (Laws 2025, Ch. 198; A.R.S. § 44-1483).

There is no anticipated fiscal impact to the state General Fund associated with this legislation.

Provisions

Duties for Covered Companies

1. Requires a covered company to:

a) take commercially reasonable steps to determine or estimate the age for:

i. new users, at account creation; and

ii. existing users, within six months after the effective date;

b) obtain parental or guardian consent before allowing a child to either:

i. download an application distributed or made accessible through the covered company's application store, if the covered company provides an application store; or

ii. access an application pre-loaded onto a device for the first time, if the covered company provides an operating system;

c) if the covered company provides an application store, connect the developer of an application that a child downloads from the covered company's application store with the child's approving parent or guardian to notify the parent or guardian of the prescribed features for parents to oversee their child's use of the application; and

d) on request, provide a developer, including a developer of the pre-loaded application, with an age signal through a real-time application programming interface on an ongoing basis regarding whether parental or guardian consent has been provided and whether an individual is:

i. less than 13 years of age;

ii. at least 13 years of age but less than 16 years of age;

iii. at least 16 years of age but less than 18 years of age; or

iv. at least 18 years of age.

Duties of Developers and Social Media Platforms

2. Requires a developer to:

a) on an individual's account creation or first access, request from a covered company an age signal and, if the individual is a child, a parental consent signal for the individual and may subsequently request additional age signals; and

b) use the age signal and parental consent signal from a covered company to:

i. enforce legally required minimum age restrictions;

ii. ensure compliance with all laws; and

iii. provide any age-appropriate defaults, safeguards or experiences as required by statute.

3. Requires a developer, if it operates a social media platform, to comply with the additional requirements prescribed for a social media platform.

4. Requires a social media platform, if applicable and technically feasible, to provide readily available features for a parent or guardian to oversee the parent's or guardian's child's use of the application as appropriate to the risks that arise from the child's use of the developer's application.

5. Requires the features to include:

a) the ability to view metrics reflecting the amount of time that the child is using the application and set daily time limits on the child's use;

b) the ability to see which individuals or accounts are affirmatively linked to the child's account, including the child's friends, followers or accounts that the child is following;

c) the ability to determine whether the child has limited the public visibility of the child's account or information and content that is uploaded to the application;

d) the ability to see which individuals the child has blocked;

e) the ability to submit a report to the application concerning a potential violation of the developer's terms and policies; and

f) the ability to disable the display of personalized recommendation systems for a child.

6. Requires a social media platform to implement minor account default settings for a user that the developer knows is a minor.

7. Allows only the child's parent or guardian, for a minor user who is a child, to modify the minor account default settings.

8. Allows the minor user or the minor's parent, for a minor user who is at least 16 years of age, to modify the minor account default settings.

9. Requires the minor account default settings to:

a) display a notification to a user whom the social media platform knows is a minor if the user has spent one cumulative hour on the application during one calendar day and that informs the minor user of the cumulative daily time spent on the application;

b) limit the visibility of a minor's account or profile to connected users other than the minor's name, username and primary display picture;

c) maintain reasonable policies addressing exposure to sexually or violently explicit material on the platform;

d) silence notifications between 10:00 p.m. and 6:00 a.m. local time;

e) prohibit an unconnected user from sending private or direct messages to a minor user, including through video, voice, text or other messaging;

f) prohibit a minor user from sharing the minor user's real-time precise geolocation with any other user and establish a feature for the minor's parent or guardian to allow the minor to share the minor's precise geolocation with connected users and users who are approved by the parent; and

g) disable the automatic playing of video content without user action in a personalized recommendation system.

Age Signal Conflicts

10. Allows a developer, if it determines that an internal age signal conflicts with the age signal from a covered company, to rely on the age signal from the covered company unless the developer has clear and convincing evidence that an internal age signal is more accurate.

11. Requires a developer, if it has clear and convincing evidence that the developer's internal age signal is more accurate, including if the user provided proof of age to the developer, to use the developer's internal signal.

12. Requires a developer, if applicable and technically feasible, to transmit the conflicting internal age signal back to a covered company through a mechanism that is provided by the covered company if the developer has clear and convincing evidence that an internal age signal is more accurate.

13. Requires a covered company, on receipt of a conflicting internal age signal from a developer, to take steps to reverify the user's age and update the age signal to provide developers with the newly verified age.

Material That is Harmful to Minors

14. Requires a commercial entity that knowingly and intentionally publishes or distributes material that is harmful to minors on application, if the application contains a substantial portion of material that is harmful to minors, to do all of the following:

a) use either anonymous age verification or standard age verification to verify that the person attempting to access the material that is harmful to minors is at least 18 years of age;

b) prevent access to the material that is harmful to minors by a person who is less than 18 years of age;

c) offer anonymous age verification and standard age verification and allow a person attempting to access the material that is harmful to minors to select which method will be used to verify the person's age; and

d) ensure that a third party conducting anonymous age verification:

i. does not retain personal identifying information used to verify age when the age of a person seeking access has been verified;

ii. does not use personal identifying information that is used to verify age for any other purpose;

iii. keeps anonymous any personal identifying information used to verify age and does not share or otherwise communicate the information to any person; and

iv. protects personal identifying information used to verify age from unauthorized or illegal access, destruction, use, modification or disclosure through reasonable security procedures and practices appropriate to the nature of the personal information.

Civil Action

15. Allows a minor or the minor's parent who has been harmed by a violation of the technology content protection for minors requirements to bring a civil action against the covered company, developer or commercial entity.

16. Allows a court of competent jurisdiction to award a prevailing plaintiff any or all of the following:

a) actual damages or $1,000 for each violation, whichever is greater;

b) punitive damages if the violation was egregious;

c) reasonable attorney fees; and

d) litigation costs.

17. Requires a civil action for a claim to be brought within one year after the date that the complainant knew or reasonably should have known of the violation.

Enforcement and Penalties

18. Allows the Attorney General, in addition to any other remedy available under state law, to bring an action against a covered company, developer or commercial entity to:

a) recover a civil penalty of no more than $75,000 for each violation;

b) restrain or enjoin the covered company, developer or commercial entity from violating the technology content protection for minors requirements;

c) seek injunctive relief;

d) recover reasonable attorney fees; and

e) recover litigation costs and reasonable costs for investigating the violation.

19. Requires the Attorney General to deposit monies collected from an action brought by the Attorney General in the Fund.

Immunity from Liability

20. Grants a developer or covered company immunity from liability for a violation of the technology content protection for minors requirements if the developer or covered company demonstrates that the developer or covered company:

a) relied in good faith on both:

i. the applicable age signal and, age signal indicates that the user is a child and the parental or guardian consent information received through the covered company's data sharing methods; and

ii. the notification provided by the covered company that verifiable parental or guardian consent was obtained if the age signal indicated that the user is a child; and

b) if a developer, complied with the default account settings requirements.

21. States that a developer, in determining an application's age rating and content description, is not liable for a violation of the technology content protection for minors requirements if the developer uses widely adopted industry standards to determine the application's age category and content description and applies those standards consistently and in good faith.

22. States that a developer is not liable for transmitting an internal age signal to a covered company for the purposes of reconciling conflicting age signals.

23. States that the immunity from liability both:

a) applies only to actions brought under the technology content protection for minor statutes; and

b) does not limit a developer or covered company's liability under any other applicable law.

24. States that the immunity from liability does not replace any other available remedy or right in state or federal law.

Compliance and Nondiscrimination

25. States that the technology content protection for minors requirements do not modify, impair or supersede the operation of any antitrust laws, unless otherwise specified.

26. Requires a covered company to comply with the technology content protection for minors requirements in a nondiscriminatory manner, including by complying with both of the following:

a) a covered company must impose the same restrictions and obligations on its own applications and application distribution as the covered company imposes on third-party applications and application distributors; and

b) a covered company may not use data that is collected from third parties, or consent mechanisms deployed for third parties, in the course of compliance with the technology content protection for minors requirements to compete against those third parties, give the covered company's services preference relative to those of third parties or to otherwise use this data or consent mechanism in an anticompetitive manner.

The Fund

27. Establishes the Fund consisting of monies from civil penalties, attorney fees and litigation costs that are recovered by the Attorney General from action against a covered company, developer or commercial entity for violation of the technology content protection for minors requirements.

28. Requires the Attorney General to administer the Fund.

29. States that monies in the Fund are continuously appropriated and are exempt from lapsing.

30. Prohibits monies in the Fund from being transferred to or otherwise made available to any other state fund or account or from being used for operating expenses of the Attorney General's Office or staff salaries.

31. Requires the Attorney General to use the monies in the Fund solely to award grants to nonprofit organizations for the following:

a) outreach programs that provide education to parents, guardians and minors about online safety, digital literacy and the effects of social media on the mental health of minors;

b) programs that provide resources or services to minors who have experienced harm as a result of violations of the technology content protection for minors requirements;

c) research on the effects of social media on the mental and physical health of minors;

d) law enforcement programs that investigate violations of the technology content protection for minors requirements and technology-facilitated harm to minors;

e) programs that provide mental health counseling, treatment or support services to minors who have experienced psychological or emotional harm as a result of using social media and violations of the technology content protection for minors requirements; and

f) programs that provide prevention education, victim services or law enforcement support related to the human trafficking or sexual exploitation of minors facilitated through social media platforms.

32. Requires the Attorney General to establish grant eligibility criteria, application procedures and reporting requirements for recipients of grants awarded subject to Joint Legislative Budget Committee (JLBC) approval.

33. Requires the Attorney General, by January 15, April 15, July 15 and October 15 of each year, to compile a report that includes an accounting of all the monies spent from the Fund, including:

a) receipts;

b) disbursements;

c) the current balance of the Fund;

d) the name of each grant recipient;

e) the amount awarded to each grant recipient; and

f) the purpose for each grant awarded.

34. Requires the Attorney General to submit the report to all of the following:

a) the Governor;

b) the President of the Senate;

c) the Speaker of the House of Representatives;

d) the Minority Leader of the Senate;

e) the Minority Leader of the House of Representatives;

f) the JLBC Director; and

g) the Secretary of State.

Definitions

35. Defines anonymous age verification as a commercially reasonable method that is used by a government agency or a business for the purpose of age verification that is conducted by a nongovernmental, independent third party that is organized under the laws of any state of the United States that both:

a) has its principal place of business in any state of the United States; and

b) is not owned or controlled by a company that is formed in a foreign country, a government of a foreign country or any other entity formed in a foreign country.

36. Defines application as a software application or electronic service that a user may run or direct on a computer, a mobile device or any other general purpose computing device.

37. Defines application store as a publicly available website, software application, electronic service or platform that distributes and facilitates the download of applications from third-party developers to users of a computer, a mobile device or any other general purpose computing device.

38. Defines child as an individual who is less than 16 years of age.

39. Defines commercial entity as including a corporation, a limited liability company, a partnership, a limited partnership, a sole proprietorship and any other legally recognized entity.

40. Defines covered company as a person that owns, controls or operates an application store or operating system that services customers in Arizona.

41. Defines daily active users as the number of unique users in the United States who used the social media platform at least 80 percent of the days during either:

a) the previous 12-month period; or

b) the previous one-month period if the social media platform did not exist during the previous 12-month period.

42. Defines developer as a person that creates, owns or controls a public-facing website, online service, online application or mobile application.

43. Defines distribute as issuing, selling, giving, providing, delivering, transferring, transmitting, circulating or disseminating by any means.

44. Defines harmful to minors as that quality of any description or representation, in whatever form, of nudity, sexual activity, sexual conduct, sexual excitement or sadomasochistic abuse, when both:

a) to the average adult applying contemporary state standards with respect to what is suitable for minors, it both:

i. appeals to the prurient interest, when taken as a whole; and

ii. portrays the description or representation in a patently offensive way; and

b) taken as a whole does not have serious literary, artistic, political, or scientific value for minors.

45. Defines infinite scrolling as content that is continuously loading or content that loads as the user scrolls down the webpage without the need to open a separate webpage.

46. Defines operating system as an entity that develops, maintains or distributes an operating system on a computer, a mobile device or any other general purpose computing device.

47. Defines personalized recommendation system as a fully or partially automated system used to suggest, promote or rank a feed of a user-generated content based on the user's activity on the covered platform, excluding a recommendation system that suggests, promotes or ranks content based solely on the user's language, city or town or age.

48. Defines precise geolocation as information derived from technology, including global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of a natural person with precision and accuracy within a radius of 1,750 feet.

49. Excludes from the definition of precise geolocation, the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.

50. Defines publish as communicating or making information available to another person on a publicly available website or application.

51. Defines social media platform as an online forum, website or application that satisfies each of the following criteria:

a) allows a user to upload content or view the content or activity of other users;

b) employs algorithms that analyze user data or information on users to select content for users;

c) has infinite scrolling or seamless content or the use of webpages with no visible or apparent end or page breaks;

d) has push notifications or alerts sent by an online forum, website or application to inform a user about specific activities or events related to the user's account;

e) displays personal interactive metrics that indicate the number of times other users have clicked a button to indicate the users' reactions to content or have shared or reposted the content;

f) has auto-play video or video that begins to play without the user first clicking on the video or on a play button for that video; and

g) has live-streaming or has a function that allows a user or advertiser to broadcast live video content in real-time.

52. Excludes, from the definition of social media platform, an online service, website or application where the exclusive function is email or direct messaging consisting of text, photographs, pictures, images or videos that are shared only between the sender and the recipients and that are not displayed or posted publicly or to other users that are not specifically identified by the sender as the recipients.

53. Defines standard age verification as any commercially reasonable method of age verification that is approved by the commercial entity.

54. Defines substantial portion as more than 33 and one-third percent of the total material on a website or application.

Miscellaneous

55. Contains a severability clause.

56. Becomes effective one year after the general effective date.