Large social media services must let users move data starting in 2027

A covered social media service must provide a user with a copy of the user's personal data when requested. This applies to services with more than 100 million active monthly users whose primary focus is not charity or religion. An entity owned, controlled, operated, or maintained by a religious organization that is exempt from state property tax is excluded. The copy must be portable when technically feasible, readily usable when practicable, and transferable to another social media service without impediment. The law takes effect July 1, 2027. These requirements take effect July 1, 2027.

A covered social media company must provide an interface for sharing data and content with other services and third parties. This applies to services with more than 100 million active monthly users whose primary focus is not charity or religion. Users choose whether to share a common set of personal data and whether to let third parties access their content and receive notices about new or updated content. Exports must use a public standard free of licensing fees and patent restrictions, and follow privacy and security best practices. Users may export all or selected connection data, once or continuously at least every 24 hours. A service may set reasonable privacy and security terms, but may not favor itself over other services. These rules do not limit action against security risks, safety threats, harassment, malicious or fraudulent activity, illegal activity, or compliance with legal duties. An entity owned, controlled, operated, or maintained by a religious organization that is exempt from state property tax is excluded. The law takes effect July 1, 2027. These requirements take effect July 1, 2027.

A covered social media company must safeguard personal data obtained through an interoperability interface. This applies to services with more than 100 million active monthly users whose primary focus is not charity or religion. The company must protect the data in line with its privacy notice and its administrative, technical, and physical security practices. An entity owned, controlled, operated, or maintained by a religious organization that is exempt from state property tax is excluded. The law does not require a service to import data or treat imported data differently from other user-generated content. These rules take effect July 1, 2027. These requirements take effect July 1, 2027.