Law / United States / 
Illinois
HB 5511 (2026), Children's Online Social Media Safety Act
Illinois Public Act 104-0664 (2026), enrolled as HB 5511, 104th General Assembly
An app store age verification (AV) rule binding private bodies.
- Age threshold
- 18
- How the hook was established
- express
- What makes it apply
- User location
- Verification methods
- Device signal, Self declaration
- Audit expectation
- none
What it requires
- If you make an operating system for internet enabled devices, offer an age signal at device setup and pass an age category to apps and social media platforms on request.NIST Privacy FrameworkCT.PO-P2
- If your app or social media platform receives an age category, apply default protections for minors, such as restricting algorithmic recommendations and notification hours.no control in the NIST Privacy Framework
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Illinois Attorney General
Settledness
- As of
- Open questions
- Where no age bracket signal is received for a user, what facts show that a covered operator 'should have known, based on knowledge fairly implied under objective circumstances' that the user is a covered minor under Section 5 of Public Act 104-0664?
- Does a service that is 'intended to connect and allow a user to socially interact' within the Section 5 definition of 'covered platform' include a game, marketplace or workplace tool in which users can create or post content viewable by other users?
What it makes you log
Who may demand the log
Data subject
Log retention
- As of
- Basis
- Unspecified
- Prohibits retaining
- Information collected to obtain verifiable parental consent, which may not be used for any other purpose and must be deleted within a reasonable period after an attempt to obtain the consent, except where needed to comply with State or federal law
Logging duty
Section 15(c) requires a covered operator to give a parent a mechanism to view a history of all gifted currency tied to the covered minor's account at any time, which presupposes a kept record of those transfers. The Act's age assurance duties in Section 10 rest on a device-level age bracket signal and name no log or record of the age check; Section 20(b) lets an operator rely on the signal without independently verifying age.
- Kind
- Explicit
- As of
- Provision
- Children's Online Social Media Safety Act, Section 15(c)
- Trigger
- personal_data_processing
What this law does
Requires internet enabled device operating systems to offer an age signal at device setup and pass an age category to apps and social media platforms on request, which must then apply default protections such as restricting algorithmic recommendations and notification hours for minors. Passed the House , passed the Senate 57 to 0 with a 113 to 0 House concurrence on , was sent to the Governor on , and was signed as Public Act 104-0664. It was introduced as the Digital Age Assurance Act.
When LexLint raises it
When your app profile says your app operates an app store or ships a mobile app.
Back to the example · Lint your app
Page updated .