AB1137 - Reporting mechanism: child sexual abuse material.

Amended IN Assembly April 21, 2025 Amended IN Assembly April 10, 2025 Amended IN Assembly March 24, 2025 CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION Assembly Bill No. 1137 Introduced by Assembly Members Krell and Wicks February 20, 2025 An act to amend Sections 3273.65, 3273.66, 3273.67, and 3345.1 of the Civil Code, relating to social media platforms. LEGISLATIVE COUNSEL'S DIGEST AB 1137, as amended, Krell. Reporting mechanism: child sexual abuse material. Existing law requires a social media platform to take certain actions with respect to child sexual abuse material on the social media platform, including by requiring the social media platform to provide, in a mechanism that is reasonably accessible to users, a means for a user who is a California resident to report material to the social media platform that the user reasonably believes meets certain criteria, including that the reported material is child sexual abuse material and that the reporting user is depicted in the material. Existing law also requires the social media platform to collect information reasonably sufficient to enable the social media platform to contact, as specified, a reporting user. This bill would delete the requirement for reporting material that the reporting user be depicted in the material, would require that the depicted individual be depicted as a minor, and would additionally require the mechanism to be clear and conspicuous, and conspicuous. The bill would require a social media platform to ensure that any report submitted using the reporting mechanism receives a review is reviewed through a hash matching process or, if there is not an established or known hash match to child sexual abuse material, and would require a social media company to ensure review by a natural person. person if there is not an established or known hash match to child sexual abuse material with respect to the reported material and the reported material is not otherwise blocked. Existing law makes a noncomplying social media company liable to a reporting user for actual damages and statutory damages, as specified. This bill would also impose a civil penalty on a noncomplying social media company to be collected in a civil action by certain public attorneys, including the Attorney General. The bill would make a social media company liable to a depicted individual, as defined, for specified violations. Existing law prohibits a social media platform from knowingly facilitating, aiding, or abetting commercial sexual exploitation, as defined, and exempts a social media platform from being deemed in violation of that prohibition if it instituted a specified audit program and provided to each member of its board of directors a true and correct copy of each audit, as prescribed. This bill would revise those provisions to, instead, require a social media platform to submit to third-party audits and release audit reports to the public in order to be exempt from being deemed in violation that prohibition, as prescribed. This bill would declare that its provisions are severable. Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO Bill Text The people of the State of California do enact as follows: SECTION 1. Section 3273.65 of the Civil Code is amended to read: 3273.65. As used in this title: (a) “Child pornography” has the same meaning as defined in Section 2256 of Title 18 of the United States Code, as amended from time to time. (b) “Child sexual abuse material” means either of the following: (1) Child pornography. (2) Obscene matter that depicts a minor personally engaging in, or personally simulating, sexual conduct. (c) “Clear and conspicuous” has the same meaning as defined in Section 17601 of the Business and Professions Code. (d) “Depicted individual” means a person who is depicted, including through the use of digitization or artificial intelligence, as a minor in child sexual abuse material on a social media platform. (e) “Minor” has the same meaning as defined in Section 2256 of Title 18 of the United States Code, as amended from time to time. (f) “Obscene matter” has the same meaning as defined in Section 311 of the Penal Code. (g) “Reporting user” means a natural person who reports material to a social media platform using the means provided by the social media platform pursuant to Section 3273.66. (h) (1) “Social media company” has, except as provided in paragraph (2), the same meaning as defined in Section 22675 of the Business and Professions Code. (2) “Social media company” does not include a nonprofit organization exempt from federal income tax pursuant to Section 501(c)(3) of the Internal Revenue Code. (i) (1) “Social media platform” has, except as provided in paragraph (2), the same meaning as defined in Section 22675 of the Business and Professions Code. (2) “Social media platform” does not include either of the following: (A) A stand-alone direct messaging service that provides end-to-end encrypted communication or the portion of a multiservice platform that uses end-to-end encrypted communication. (B) An internet-based service or application owned or operated by a nonprofit organization exempt from federal income tax pursuant to Section 501(c)(3) of the Internal Revenue Code. SEC. 2. Section 3273.66 of the Civil Code is amended to read: 3273.66. A social media platform shall do all of the following: (a) Provide, in a clear and conspicuous mechanism that is reasonably accessible to users, a means for a user who is a California resident to report material to the social media platform that the user reasonably believes meets both of the following criteria: (1) The reported material is child sexual abuse material. (2) The reported material is displayed, stored, or hosted on the social media platform. (b) (1) Collect information reasonably sufficient to enable the social media platform to contact, pursuant to subdivision (c), a reporting user. (2) (A) Ensure that any report submitted using the mechanism required by subdivision (a) receives a review is reviewed through a hash matching process or, if there is not an established or known hash match to child sexual abuse material, by a natural person. process. (B) A social media platform shall ensure a report submitted using the mechanism required by subdivision (a) is reviewed by a natural person if both of the following are true: (i) There is not an established or known hash match to child sexual abuse material with respect to the reported material. (ii) The reported material is not otherwise blocked. (c) Contact a reporting user in writing by a method, including, but not limited to, a telephone number for purposes of sending text messages, or an email address, that meets both of the following criteria: (1) The method is chosen by the reporting user. (2) The method is not a method that is within the control of the social media company that owns or operates the social media platform. (d) (1) Permanently block the instance of reported material from being viewable on the social media platform if the reported material meets all of the following criteria: (A) There is a reasonable basis to believe that the reported material is child sexual abuse material. (B) The reported material is displayed, stored, or hosted on the social media platform. (C) (i) The report contains basic identifying information, such as an account identifier, sufficient to permit the social media platform to locate the reported material. (ii) A social media platform shall not require a report to contain a specific piece of information for purposes of this subparagraph. (2) A social media platform shall make reasonable efforts to remove and block other instances of the same reported material blocked pursuant to this subdivision from being viewable on the social media platform. (e) Provide written confirmation to a reporting user that the social media platform received that person’s report that meets all of the following criteria: (1) The written confirmation is provided to the reporting user within 36 hours of when the material was first reported. (2) The written confirmation is provided using the information collected from the reporting user under subdivision (b). (3) The written confirmation informs the reporting user of the schedule of regular written updates that the social media platform is required to make under subdivision (f). (f) (1) Provide a written update to the reporting user as to the status of the social media platform’s handling of the reported material using the information collected from the reporting user under subdivision (b). (2) The written update required by this subdivision shall be provided seven days after the date on which the written confirmation required under subdivision (e) was provided and every seven days thereafter until the final written determination required by subdivision (g) is provided. (g) Issue a final written determination to the reporting user, using the information collected from the reporting user under subdivision (b), stating one of the following: (1) The reported material has been determined to be child sexual abuse material that was displayed, stored, or hosted on the social media platform and has been blocked on the social media platform. (2) The reported material has been determined not to be child sexual abuse material. (3) The reported material has been determined not to be displayed, stored, or hosted on the social media platform. (h) (1) Except as provided in paragraph (2), comply with subdivisions (c) to (g), inclusive, no later than 30 days after the date on which material was first reported pursuant to this section. (2) (A) If the social media platform cannot comply with subdivisions (c) to (g), inclusive, due to circumstances beyond the reasonable control of the social media platform, the social media platform shall comply with subdivisions (c) to (g), inclusive, no later than 60 days after the date on which material was first reported pursuant to this section. (B) If this paragraph applies, the social media platform shall promptly provide written notice of the delay, no later than 48 hours from the time the social media platform knew the delay was likely to occur, to the reporting user using the information collected from the reporting user under subdivision (b). SEC. 3. Section 3273.67 of the Civil Code is amended to read: 3273.67. (a) (1) A social media company that fails to comply with Section 3273.66 shall be liable in a civil action brought by the Attorney General, a district attorney, a city attorney, or a county counsel for a civil penalty not to exceed two hundred fifty thousand dollars ($250,000) for each day that the reporting mechanism is unavailable or nonfunctional and for reasonable attorney’s fees and costs. (2) For purposes of this subdivision, a reporting mechanism shall be deemed unavailable or nonfunctional if any of the following are true: (A) The reporting mechanism is inaccessible to users due to technical failures, design defects, or removal from the social media platform. (B) The reporting mechanism does not permit reporting in a manner consistent with the requirements of Section 3273.66. (C) The reporting mechanism results in the failure to confirm receipt of a report within the timeframes described in Section 3273.66. (3) The penalties described in this subdivision shall continue to accrue daily until the social media company restores full functionality of the reporting mechanism in compliance with Section 3273.66. (4) In addition to monetary penalties, the Attorney General may seek injunctive relief to compel a social media company to immediately restore and maintain a fully functional reporting mechanism in compliance with Section 3273.66. The court may issue temporary, preliminary, or permanent injunctive relief as necessary to prevent ongoing violations. (b) Subject to subdivision (c), a social media company that fails to comply with this title other than subdivision (a) of Section 3273.66 shall be liable to a depicted individual who is the reporting user for all of the following: (1) Any actual damages sustained by the depicted individual as a result of the violation. (2) (A) (i) Subject to clauses (ii) and (iii), statutory damages of no more than two hundred fifty thousand dollars ($250,000) per violation. (ii) If a social media platform has permanently blocked the instance of the reported material pursuant to subdivision (d) of Section 3273.66 before a complaint is filed for a violation of this title, the maximum statutory damages awarded pursuant to clause (i) shall be one hundred twenty-five thousand dollars ($125,000) per violation. (iii) If a social media platform meets all of the following requirements, the maximum statutory damages awarded pursuant to clause (i) for a violation of subdivisions (d) to (g), inclusive, of Section 3273.66 shall be seventy-five thousand dollars ($75,000) per violation: (I) The social media platform registers with, and participates in, the National Center for Missing and Exploited Children’s Take It Down service or its successor. (II) The social media platform receives updated hash values for identified child sexual abuse material from the National Center for Missing and Exploited Children’s Take It Down service, or its successor, at least once every 36 hours. (III) Within 36 hours of receiving updated hash values for identified child sexual abuse material from the National Center for Missing and Exploited Children’s Take It Down service, or its successor, pursuant to subclause (II), the social media platform removes child sexual abuse material identified by hash values from the social media platform. (IV) The social media platform reports identified child sexual abuse material to the National Center for Missing and Exploited Children’s CyberTipline, as required by Section 2258A of Title 18 of the United States Code. (V) The social media platform provides to a reporting user both of the following when a user reports child sexual abuse material to the platform directly: (ia) Written confirmation to the reporting user that the social media platform received that person’s report within 36 hours after the child sexual abuse material was reported. (ib) A final written determination to the reporting user within 30 days after the date on which the material was first reported. (B) In determining the amount of statutory damages pursuant to this paragraph, a court shall consider the willfulness and severity of the violation and whether the social media platform has previously violated this title. (3) Costs of the action, together with reasonable attorney’s fees, as determined by the court. (4) Any other relief that the court deems proper. (c) For a violation of subdivision (d) of Section 3273.66, a depicted individual may bring a civil action to obtain relief pursuant to subdivision (b) if the depicted individual is not a reporting user. (d) The failure of a social media company to [Text truncated for display. Full text available on Congress.gov.]