Operates a social platform, in Ohio

Ohio Rev. Code sections 1354.01 to 1354.05 (enacted by Senate Bill 220, 132nd General Assembly, effective November 2, 2018; section 1354.01 last amended by House Bill 66, 132nd General Assembly, effective April 5, 2019) · Read the law's page

• This is an optional safe harbor, not a mandatory duty: this chapter requires no business to create a cybersecurity program (other Ohio laws, such as Chapter 3965 for insurance licensees, do bind particular sectors), and this chapter reaches only a covered entity, any business that accesses, maintains, communicates, or processes personal information (as defined by Ohio Revised Code 1349.19) or restricted information in or through a system, network, or service located inside or outside Ohio, that chooses to seek the affirmative defense described below.
• To seek that defense, create, maintain, and comply with a written cybersecurity program with administrative, technical, and physical safeguards, covering personal information alone or personal information together with restricted information, and scale the program to the covered entity's size and complexity, the nature and scope of its activities, the sensitivity of the information protected, the cost and availability of security tools, and the resources available to it.
• Make the program reasonably conform to the current version of the NIST Cybersecurity Framework, NIST Special Publication 800-171, NIST Special Publications 800-53 and 800-53A, the FedRAMP security assessment framework, the CIS Critical Security Controls, or the ISO/IEC 27000 family, alone or in combination, or, if already regulated under it, reasonably conform to the entirety of the HIPAA security rule, Gramm-Leach-Bliley Act Title V, the Federal Information Security Modernization Act, or HITECH, or comply with the PCI Data Security Standard together with one of the first group's frameworks.
• To keep the program's reasonable conformance current, adopt a revised version of a chosen framework in the first group, or of the PCI standard, no later than one year after the publication date stated in the revision, and an amended version of the HIPAA security rule, Gramm-Leach-Bliley Act Title V, the Federal Information Security Modernization Act or HITECH no later than one year after the effective date of the amended framework.
• A covered entity that does this earns an affirmative defense to a tort claim under Ohio law alleging that its failure to implement reasonable information security controls caused a data breach concerning the information its program covers; the chapter creates no cause of action of its own, and nothing in it may be read to create a private right of action, including a class action.

Ohio Rev. Code section 1349.09 · Read the law's page

• Obtain verifiable parental consent before allowing a child under 16 to create an account on a social media platform directed to children or reasonably expected to be accessed by them. Accepted methods include a signed form, credit card verification, a phone or video call, or government ID.
• Disclose the content moderation features and parental control features your platform makes available.