Bill > HB2108

This bill, known as the Online Safety Protection Act, establishes comprehensive guidelines for online entities that provide services, products, or features likely to be accessed by children, with the primary goal of protecting children's best interests in digital spaces. The bill requires covered entities (businesses knowingly processing children's personal information) to complete data protection impact assessments within two years before launching new online services, which must systematically evaluate potential risks to children and include measures to mitigate those risks. Covered entities are prohibited from using children's personal information in ways that could cause physical, financial, psychological, or emotional harm, and they must configure default privacy settings to offer high levels of protection. The bill specifically restricts practices like profiling children by default, collecting precise geolocation information without consent, and using "dark patterns" (manipulative user interface designs) that might encourage children to compromise their privacy or take actions against their best interests. Enforcement is managed by the Office of Attorney General, which can initiate civil actions and impose significant penalties: up to $2,500 per affected child for negligent violations and up to $7,500 per affected child for intentional violations. Importantly, the bill provides a 90-day cure period for entities that receive a violation notice, allowing them to address issues before facing legal consequences, and it will not apply if conflicting federal laws are enacted. The act is scheduled to take effect on December 31, 2027, giving businesses time to prepare for compliance.

Education

https://www.palegis.us/legislation/bills/2025/hb2108