Read the full stored bill text
SB-758, As Passed Senate, April 29, 2026
VMP S03831'25 (S-2)_SB758_APS_1 szkiex
SUBSTITUTE FOR
SENATE BILL NO. 758
A bill to establish standards and practices relating to
certain online services; to prohibit certain acts and practices by
covered online service providers related to certain online
services; to provide for the powers and duties of certain state and
local governmental officers and entities; to require the
promulgation of rules; and to prescribe civil sanctions.
THE PEOPLE OF THE STATE OF MICHIGAN ENACT:
Sec. 1. This act may be cited as the "kids code act". 1
Sec. 3. As used in this act: 2
(a) "Actual knowledge" means all information and inferences 3
known to the covered online service provider relating to the age of 4
an individual, including, but not limited to, self-identified age 5
and any age the covered online service provider has attributed or 6
2
VMP S03831'25 (S-2)_SB758_APS_1 szkiex
associated with the individual for any purpose, including, but not 1
limited to, marketing, advertising, or product development. If a 2
covered online service provider's classification of an individual 3
for purposes of marketing or advertising is inconsistent with the 4
individual's self-identified age, a covered online service provider 5
shall disregard self-identified age for the purposes of having 6
actual knowledge. 7
(b) "Adult" means an individual who is 18 years of age or 8
older. 9
(c) "Biometric data" means, except as otherwise provided in 10
subdivision (d), data that is generated from the technological 11
processing of an individual's unique biological, physical, or 12
physiological characteristics that is used to allow or confirm the 13
unique identification of the consumer, including, but not limited 14
to, all of the following: 15
(i) Iris or retina scans. 16
(ii) Fingerprints. 17
(iii) Facial or hand mapping, geometry, or templates. 18
(iv) Vein patterns. 19
(v) Voice prints or vocal biomarkers. 20
(vi) Gait or personally identifying physical movement or 21
patterns. 22
(d) Biometric data does not include any of the following: 23
(i) A digital or physical photograph. 24
(ii) An audio or video recording. 25
(iii) Any data generated from a digital or physical photograph, 26
or an audio or video recording, unless that data is generated to 27
identify a specific individual. 28
(e) "Collect" means buying, renting, gathering, obtaining, 29
3
VMP S03831'25 (S-2)_SB758_APS_1 szkiex
receiving, or accessing any personal data pertaining to a consumer 1
by any means. Collect includes, but is not limited to, receiving 2
information from a consumer, either actively or passively, or by 3
observing the consumer's behavior. 4
(f) "Common branding" means a shared name, service mark, or 5
trademark for which the average consumer would understand that 2 or 6
more entities are commonly owned. 7
(g) "Consumer" means an individual who is a resident of this 8
state. 9
(h) "Consumer Price Index" means the most comprehensive index 10
of consumer prices available for this state from the Bureau of 11
Labor Statistics of the United States Department of Labor. 12
(i) "Covered child" means a consumer who a covered online 13
service provider has actual knowledge is less than 13 years of age. 14
(j) "Covered design feature" means a feature or component of 15
an online service that is designed primarily to encourage or 16
increase the frequency, time spent, or activity of a user on the 17
online service. Covered design feature includes, but is not limited 18
to, all of the following features: 19
(i) Infinite scroll or a design feature where content 20
automatically and continuously loads at the bottom of a screen, 21
other than what the user explicitly prompted, requested, or 22
searched for. 23
(ii) Auto-playing video or audio, or a design feature in which 24
a video or audio automatically begins playing when a user navigates 25
to or scrolls through a set of videos without any explicit action 26
on the part of a user indicating the user's desire to watch that 27
specific video or listen to that audio. 28
(iii) Quantification of engagement, including, but not limited 29
4
VMP S03831'25 (S-2)_SB758_APS_1 szkiex
to, providing a visible count of how many likes, comments, clicks, 1
views, or reactions a user-generated item has received. 2
(iv) Gamification, or a design feature that emulates gameplay, 3
including, but not limited to, a streak, badge, or reward that 4
motivates or causes more frequent or more extensive use of an 5
online service through incentives or frequency of use. 6
(v) The use of clustering, timing, or volume of notifications 7
or push alerts, irrespective of content. 8
(vi) A design feature in which virtual currencies are used or 9
where digital items are purchased. 10
(vii) Image-altering filters or a design feature that 11
facilitates a false perception of an image. 12
(viii) Requiring or repeatedly prompting for account creation in 13
order to access publicly available user-generated content. 14
(ix) Using ephemerality to prompt the urgent use of an online 15
service. 16
(x) Creating barriers to deleting an account or to removing 17
connections to other users of the service. 18
(xi) A feature that increases usage through the illusion of 19
talking with a human being that seeks to elicit feelings of 20
intimacy from the user. 21
(k) "Covered minor" means a consumer who a covered online 22
service provider has actual knowledge is a minor. Covered minor 23
includes a covered child. 24
(l) "Covered online service provider" means, except as 25
otherwise provided in subdivision (m), either of the following: 26
(i) A sole proprietorship, partnership, limited liability 27
company, corporation, association, or other legal entity to which 28
all of the following apply: 29
5
VMP S03831'25 (S-2)_SB758_APS_1 szkiex
(A) The entity owns, operates, controls, or provides an online 1
service. 2
(B) The entity conducts business in this state. 3
(C) The entity generates a majority of its annual revenue from 4
online services. 5
(D) The entity alone, or jointly with the entity's affiliates, 6
subsidiaries, or parent companies, determines the purposes and 7
means of the processing of personal data of users. 8
(E) The entity satisfies at least 1 of the following: 9
(I) The entity has gross revenue in excess of $25,000,000.00. 10
Beginning on January 1, 2029, and every 2 years thereafter, the 11
department of treasury shall adjust the amount of annual gross 12
revenue to reflect the percentage change in the Consumer Price 13
Index. 14
(II) The entity annually processes the personal data of not 15
less than 50,000 consumers or households. 16
(ii) A person that controls or is controlled by a legal entity 17
described in subparagraph (i) and that shares common branding with 18
the legal entity. As used in this subparagraph, "controls" or 19
"controlled" means any of the following: 20
(A) Ownership of, or the power to vote, more than 50% of the 21
outstanding shares of any class of voting security of the legal 22
entity. 23
(B) Control in any manner over the election of a majority of 24
the directors of the legal entity, or of individuals exercising 25
similar functions in the legal entity. 26
(C) Power to exercise a controlling influence over the 27
management of the legal entity. 28
(m) Covered online service provider does not include a 29
6
VMP S03831'25 (S-2)_SB758_APS_1 szkiex
provider of an online service where the account owners of the 1
online service who are known to be adults make up more than 98% of 2
the online service's users. 3
(n) "Dark pattern" means a user interface designed or 4
manipulated with the effect of substantially impairing a covered 5
minor's autonomy, decision making, or choice. 6
(o) "Derived data" means data that is created by the 7
derivation of information, data, assumptions, correlations, 8
inferences, predictions, or conclusions from facts, evidence, or 9
another source of information or data about a covered minor or a 10
covered minor's device. 11
(p) "Device" means any electronic equipment capable of 12
collecting, processing, retaining, or transferring personal data. 13
(q) "Knows to be an adult" means having actual knowledge that 14
a user is an adult. 15
(r) "Minor" means an individual who is less than 18 years of 16
age. 17
(s) "Online service" means a service, product, or feature that 18
is accessible to the public via the internet. Online service 19
includes a website or application. Online service does not include 20
any of the following: 21
(i) A telecommunications service as that term is defined in 47 22
USC 153. 23
(ii) A broadband internet access service as that term is 24
defined in 47 CFR 8.1. 25
(iii) The sale, delivery, or use of a physical device. 26
(t) "Parent" includes a legal guardian. 27
(u) "Personal data" means information, including derived data 28
and unique identifiers, that is linked or reasonably linkable, 29
7
VMP S03831'25 (S-2)_SB758_APS_1 szkiex
alone or in combination with other information, to an identified or 1
identifiable individual or to a device that identifies, is linked 2
to, or is reasonably linkable to 1 or more identified or 3
identifiable individuals in a household. Personal data includes, 4
but is not limited to, a user's history of interactions with the 5
covered online service provider. Personal data does not include 6
publicly available data. 7
(v) "Precise geolocation information" means information that, 8
by means of technology such as a global positioning system that 9
provides latitude and longitude coordinates, identifies the 10
specific location of an individual within a radius of 1,750 feet. 11
Precise geolocation information does not include the content of 12
communications or any data generated or connected to advanced 13
utility metering infrastructure systems or equipment for use by a 14
utility. 15
(w) "Process" means to perform an operation or set of 16
operations by manual or automated means on personal data. Process 17
includes using, storing, disclosing, sharing, analyzing, selling, 18
or modifying personal data. 19
(x) "Profile" means a form of automated processing of personal 20
data to evaluate, analyze, or predict certain aspects relating to a 21
covered minor, including, but not limited to, a covered minor's 22
economic situation, health, personal preferences, interests, 23
reliability, behavior, location, or movements. 24
(y) "Publicly available data" means, except as otherwise 25
provided in subdivision (z), data that is any of the following: 26
(i) That is lawfully made available from federal, state, or 27
local government records. 28
(ii) That a business has a reasonable basis to believe is 29
8
VMP S03831'25 (S-2)_SB758_APS_1 szkiex
lawfully made available to the general public by the individual or 1
from widely distributed media. 2
(iii) That is made available by a person that the individual has 3
disclosed that data to if the individual has not restricted the 4
data to a specific audience. 5
(z) Publicly available data does not include biometric data 6
collected by a covered online service provider about a covered 7
minor without the covered minor's knowledge. 8
(aa) "Sensitive personal data" means personal data that 9
includes any of the following: 10
(i) An individual's Social Security, driver license, state 11
identification card, or passport number. 12
(ii) An individual's account log-in, financial account, debit 13
card, or credit card number in combination with any required 14
security of access code, password, or credentials allowing access 15
to an account. 16
(iii) An individual's precise geolocation information. 17
(iv) An individual's racial or ethnic origin, citizenship, 18
immigration status, religious or philosophical beliefs, or union 19
membership. 20
(v) The contents of an individual's mail, email, text 21
messages, prompts, or other form of communication that performs 22
similar functions, including shared images and videos, unless the 23
recipient is the intended recipient of the communication. 24
(vi) An individual's genetic data. 25
(vii) Biometric data for the purpose of uniquely identifying an 26
individual. 27
(viii) Personal data that concerns an individual's health. 28
(ix) Personal data that reveals information on an individual's 29
9
VMP S03831'25 (S-2)_SB758_APS_1 szkiex
sex, sex life, sexual orientation, gender, or gender identity. 1
(bb) "Targeted advertising" means displaying advertisements to 2
an individual when the advertisement is selected based on personal 3
data obtained or inferred from that individual's activities over 4
time and across nonaffiliated websites or online applications to 5
predict the individual's preferences or interest. Targeted 6
advertising does not include any of the following: 7
(i) Advertisements based on activities within a covered online 8
service provider's own online services. 9
(ii) Advertisements based on the context of an individual's 10
current search query, visit to an internet website, or use of an 11
online application. 12
(iii) Advertisements directed to an individual in response to 13
the individual's request for information or feedback. 14
(iv) Processing personal data solely to measure or report 15
advertising frequency, performance, or reach. 16
Sec. 5. This act does not apply to any of the following: 17
(a) A federal, state, tribal, or local government entity in 18
the ordinary course of operations. 19
(b) Personal data that is subject to a statute or regulation 20
identified under this subdivision that is controlled by a covered 21
online service provider that is in compliance with the information 22
security requirements and required to comply with 1 of the 23
following: 24
(i) Title V of the Gramm-Leach-Bliley act, 15 USC 6801 to 6809. 25
(ii) The health information technology for economic and 26
clinical health act, Public Law 111-5. 27
(iii) Regulations promulgated under section 264(c) of the health 28
insurance portability and accountability act of 1996, Public Law 29
10
VMP S03831'25 (S-2)_SB758_APS_1 szkiex
104-191. 1
(c) Information, including, but not limited to, personal data, 2
that is collected as part of a clinical trial that is subject to 3
the federal policy for the protection of human subjects under 45 4
CFR Part 46. 5
(d) Information that is collected in accordance with the "Good 6
Clinical Practice Guidelines" issued by the International Council 7
for Harmonisation of Technical Requirements for Pharmaceuticals for 8
Human Use. 9
(e) Information that is collected in accordance with the human 10
subject protection requirements of the United States Food and Drug 11
Administration under 21 CFR part 50. 12
Sec. 7. (1) This act does not limit or restrict in any way the 13
application of other laws, statutes, rules, or regulations of this 14
state. 15
(2) In the event of a conflict between this act and 1 or more 16
other laws of this state, the law that affords the greatest 17
protection from harm to minors controls. 18
Sec. 9. (1) A covered online service provider shall configure 19
all default privacy settings provided for a covered minor to the 20
highest level of privacy, including, but not limited to, all of the 21
following default settings: 22
(a) Not displaying the existence of the covered minor's 23
account to any user the covered online service provider knows to be 24
an adult unless 1 or more of the following applies: 25
(i) The covered minor has expressly and unambiguously allowed 26
the adult user to view the covered minor's account. 27
(ii) The covered minor has expressly and unambiguously chosen 28
to make the covered minor's account's existence public. 29
11
VMP S03831'25 (S-2)_SB758_APS_1 szkiex
(b) Not displaying media created or posted by the covered 1
minor to another user the covered online service provider knows to 2
be an adult unless 1 or more of the following applies: 3
(i) The covered minor has expressly and unambiguously chosen to 4
allow the adult user to view the covered minor's media. 5
(ii) The covered minor has expressly and unambiguously chosen 6
to make the covered minor's media publicly available. 7
(c) Not permitting a user the covered online service provider 8
knows to be an adult to like, comment on, or otherwise provide 9
feedback on the covered minor's media unless the covered minor has 10
expressly and unambiguously chosen to allow the adult user to do 11
so. 12
(d) Not permitting direct messaging between the covered minor 13
and another user the covered online service provider knows to be an 14
adult unless the covered minor has expressly and unambiguously 15
chosen to allow direct messaging with the adult user. 16
(e) Not displaying the covered minor's location to other users 17
unless the covered minor has expressly and unambiguously chosen to 18
share the covered minor's location with a specific user. 19
(f) Not displaying the users connected to the covered minor on 20
an online service unless the covered minor has expressly and 21
unambiguously chosen to share the information with a specific user. 22
(g) Disabling search engine indexing of the covered minor's 23
account profile, unless the covered minor has expressly and 24
unambiguously chosen to enable search engine indexing of the 25
covered minor's account profile. 26
(2) A covered online service provider shall not do either of 27
the following: 28
(a) Provide a covered minor with a single setting that makes 29
12
VMP S03831'25 (S-2)_SB758_APS_1 szkiex
all of the default privacy settings less protective at once. 1
(b) Request or prompt a covered minor to make the covered 2
minor's privacy settings less protective, unless the change is 3
strictly necessary for the covered minor to access a service or 4
feature they have expressly and unambiguously requested. 5
(3) A covered online service provider shall do both of the 6
following: 7
(a) Provide a prominent, accessible, and responsive tool to 8
allow a covered minor to request that the covered minor's account 9
be unpublished or deleted. 10
(b) Honor a request under subdivision (a) not later than 15 11
days after a covered online service provider receives the request. 12
Sec. 11. (1) A covered online service provider shall only 13
process or retain the minimum amount of a covered minor's personal 14
data that is necessary to provide the specific elements of an 15
online service with which the covered minor has knowingly engaged. 16
A covered online service provider shall not use personal data under 17
this subsection for any reason other than the reason for which the 18
personal data was collected. 19
(2) A covered online service provider is not required to 20
collect the personal data of a user to comply with this act. A 21
covered online service provider that collects personal data of a 22
user for age verification shall not use the user's personal data 23
for any other purpose and shall delete the user's personal data 24
immediately after using the personal data for age verification. 25
(3) A covered online service provider shall provide an obvious 26
sign to a covered minor when precise geolocation information is 27
being collected or used. 28
(4) A covered online service provider shall not do any of the 29
13
VMP S03831'25 (S-2)_SB758_APS_1 szkiex
following: 1
(a) Facilitate targeted advertising to a covered minor. 2
(b) Send a notification to a covered minor between 10 p.m. and 3
6 a.m. and, on a weekday from September 1 to May 31, between 8 a.m. 4
and 4 p.m. 5
(c) Profile a covered minor unless profiling is necessary to 6
provide an online service requested by the covered minor, and only 7
with respect to the aspects of the online service with which the 8
covered minor is actively and knowingly engaged. 9
(d) Facilitate advertisements for prohibited products to 10
covered minors, including, but not limited to, advertisements for 11
narcotic drugs, tobacco products, gambling, and alcohol. 12
(e) Use dark patterns. 13
(f) Use the personal data of a covered minor to select, 14
recommend, or prioritize media for the covered minor unless the 15
recommendation, prioritization, or selection of media is based on 16
any of the following: 17
(i) The covered minor's express and unambiguous request to 18
receive any of the following types of media: 19
(A) Media from a specific account, feed, or user, or to 20
receive more or less media from that account, feed, or user. 21
(B) A specific category of media, such as videos depicting 22
specific types of content, or to see more or less of that category 23
of media. 24
(C) More or less media with similar characteristics as the 25
media the covered minor is currently viewing. 26
(ii) User-selected privacy or accessibility settings. 27
(iii) A search query by the covered minor if the search query is 28
used only to select and prioritize media in response to the search. 29
14
VMP S03831'25 (S-2)_SB758_APS_1 szkiex
Sec. 13. (1) A covered online service provider shall provide a 1
parent the ability to do all of the following for a covered child 2
or a covered minor, as applicable: 3
(a) Manage the covered child's privacy and account settings in 4
a manner that allows the parent to view the covered child's account 5
settings and change and control privacy and account settings of the 6
covered child. 7
(b) Restrict purchases and financial transactions of the 8
covered minor. 9
(c) Enable the parent to view the total time the covered child 10
has spent on an online service and place reasonable limits on the 11
covered child's use of the online service. 12
(2) A covered online service provider shall offer a parent the 13
ability to restrict a covered child's use of the online service 14
during times of day specified by the parent, including during 15
school hours and at night. 16
(3) A covered online service provider shall notify a covered 17
minor when any of the tools described in this section are in effect 18
and describe what settings have been applied. 19
Sec. 15. A covered online service provider shall establish 20
mechanisms to enable a covered minor or a parent to report any 21
harms experienced by a covered minor on the online service. 22
Sec. 17. (1) By January 1 of each year, a covered online 23
service provider that processes the personal data of covered minors 24
as part of the covered online service provider's business shall 25
issue a public report, prominently posted to the covered online 26
service provider's website, that is prepared by an independent 27
third-party auditor. A report under this subsection must contain 28
all of the following information: 29
15
VMP S03831'25 (S-2)_SB758_APS_1 szkiex
(a) A detailed description of the covered online service 1
provider as pertaining to minors, including the online service's 2
covered design features, the use of personal data, and business 3
practices. 4
(b) Subject to subsection (2), all of the following 5
information: 6
(i) The purpose of the online service. 7
(ii) The extent to which the online service is likely to be 8
accessed by minors. 9
(iii) An accounting of the total number and types of reports 10
received under section 15 and an assessment of how those reports 11
were addressed. 12
(iv) Whether, how, and for what purpose the covered online 13
service provider processes minors' personal data and sensitive 14
personal data. 15
(v) The design safety features for minors, the privacy 16
protections for minors, and the tools for parents that the covered 17
online service provider has adopted. 18
(vi) Whether and how the online service uses covered design 19
features. 20
(vii) The covered online service provider's process for 21
handling data access, deletion, and correction requests for minors' 22
data. 23
(viii) Age assurance, age verification, or age estimation 24
methods used. 25
(ix) Whether and how the covered online service provider 26
utilized algorithms. 27
(x) If the covered online service provider uses a covered 28
design feature, the average daily time spent on the online service 29
16
VMP S03831'25 (S-2)_SB758_APS_1 szkiex
by covered minors for the 90th, 95th, 99th, and 99.9th percentile 1
of covered minors. 2
(2) The information required under subsection (1) must include 3
a comparison of each category of information for different age 4
groups, including all of the following age groups: 5
(a) Individuals who are 10 to 12 years of age. 6
(b) Individuals who are 13 to 15 years of age. 7
(c) Individuals who are 16 to 17 years of age. 8
(d) Individuals who are 18 years of age or older. 9
(3) An independent auditor that prepares a report under 10
subsection (1) shall follow inspection and consultation practices 11
designed to ensure that the report is comprehensive and accurate 12
and shall consult with experts on the use of online services by 13
minors in relation to the preparation of the report. 14
(4) A covered online service provider shall provide an 15
independent auditor that prepares a report under subsection (1) 16
full and complete cooperation and access to information and 17
operations required to ensure that the report is comprehensive and 18
accurate. 19
(5) All personal data contained in the report required under 20
subsection (1) must be deidentified and aggregated. 21
Sec. 18. (1) The attorney general shall promulgate rules to 22
implement this act under the administrative procedures act of 1969, 23
1969 PA 306, MCL 24.201 to 24.328, including rules that prohibit or 24
limit data processing practices or covered design features that 25
facilitate compulsive use by covered minors or impair autonomy, 26
decision making, or choice of covered minors. 27
(2) The attorney general shall review and update rules 28
promulgated under subsection (1) not less than once every 2 years 29
17
Final Page
VMP S03831'25 (S-2)_SB758_APS_1 szkiex
to keep pace with emerging technology. 1
Sec. 19. (1) A covered online service provider shall designate 2
1 or more of the covered online service provider's officers to be 3
responsible for the covered online service provider's compliance 4
with this act. 5
(2) Beginning on January 1, 2027, a covered online service 6
provider that violates this act is subject to a civil fine of not 7
more than $50,000.00 for each violation. 8
Enacting section 1. This act takes effect on July 1, 2026. 9
Enacting section 2. This act does not take effect unless 10
Senate Bill No. 759 of the 103rd Legislature is enacted into law. 11