Children Safety in Social Media Act

Senaic Office of the Sortetary TWENTIETH CONGRESS OF THE ) REPUBLIC OF THE PHILIPPINES ) ) First Regular Session MAR -9 P4:33 SENATE RECEIVED BY: 1955 S. No. — Introduced by Senator Loren Legarda AN ACT ESTABLISHING A MINIMUM AGE FOR SOCIAL MEDIA USE, PRESCRIBING OBLIGATIONS FOR SOCIAL MEDIA PLATFORMS, PROVIDING PENALTIES THEREFOR, AND FOR OTHER PURPOSES EXPLANATORY NOTE Social media has transformed how Filipinos learn, communicate, and participate in public life. It can inform and inspire, but it can also mislead, overwhelm, and harm-especially when children are exposed to digital ecosystems engineered to capture attention, amplify conflict, and reward virality over truth. At the hearing of the Senate Committee on Public Information and Mass Media, I spoke about accountability in the digital age. Having started my career in journalism long before the rise of social media, I know the discipline it took to protect truth. Our children deserve that same protection now, in spaces where algorithms shape what they see, what they believe, and how they behave. Across communities and families, the harms linked to digital platforms are no longer abstract concerns. Cyberbullying, misinformation, exposure to harmful content, and compulsive use patterns can affect a child's mental health, development, and safety. Digital harms also intersect with the gravest threats to children online, including grooming and sexual exploitation. While freedom of expression remains a cornerstone of our democratic life, it

must be exercised within the bounds of law and with due regard for the rights of others. The State has a clear and compelling duty to protect children from harm, and it may adopt safeguards that are reasonable, narrowly tailored, and anchored on the least restrictive means. Guided by the best interests of the child and mindful of the primary role of parents in a child's upbringing, this bill proceeds from a clear proposition. Protecting children online requires enforceable duties for platforms and a framework that remains consistent with constitutional freedoms. This bill therefore establishes a minimum-age obligation for covered social media services, with primary responsibility placed on platform providers, not on children, parents, or schools. It requires platform providers to take reasonable, proportionate, and privacy-preserving steps to prevent age-restricted users from registering, accessing, or continuing to use covered services. The bill likewise recognizes that the same "reasonable steps" standard must be guided by clear rules, workable timelines, and safeguards against overreach, so that child protection does not become a pretext for indiscriminate data collection or undue restraint on lawful speech. To ensure that protective regulation remains lawful, necessary, and proportionate, the bill adopts clear limitations and procedural safeguards. It focuses on minimum-age access to covered services, rather than regulating expression based on viewpoint or content. It embeds due process and transparency through enforceable standards, notice-based compliance mechanisms, and defined government powers that must be exercised within the bounds of law. It also requires that age assurance be privacy-preserving, consistent with the Data Privacy Act and the principles of data minimization, purpose limitation, security, and accountability The bill also recognizes that effective child protection cannot rest on a single institution. Online harms are multi-dimensional. They implicate technology design, data governance, child welfare, education, mental health, law enforcement, and communications policy. In this light, the measure creates an inter-agency council to ensure coherent standards, coordinated enforcement, and clear accountability across

government. It takes a village to raise a child, and it likewise takes a whole-of-society framework to protect children in digital spaces shaped by rapidly evolving technologies. Finally, the bill invests in prevention, not punishment alone. Alongside platform duties, it strengthens public awareness, digital citizenship, and age-appropriate guidance for families and schools. It supports parental empowerment through accessible tools and clear options, while recognizing that parents should be supported by institutions, not burdened by them. It encourages a culture of responsibility, where platforms take active measures to reduce risk, and where children are equipped with digital literacy to navigate online environments safely as they grow. By setting enforceable platform obligations, strengthening inter-agency coordination, and confining implementation to the least restrictive, narrowly tailored, and data-minimizing safeguards, this measure protects children in the digital environment without chilling lawful speech. In view of the foregoing, the immediate passage of this measure is earnestly sought. LOREN LEGARDA

P Office of the ruetary TWENTIETH CONGRESS OF THE ) REPUBLIC OF THE PHILIPPINES MAR -9 P4:34 First Regular Session ) RECEIVED BY: SENATE 1955 S. No. _ Introduced by Senator Loren Legarda AN ACT ESTABLISHING A MINIMUM AGE FOR SOCIAL MEDIA USE, PRESCRIBING OBLIGATIONS FOR SOCIAL MEDIA PLATFORMS, PROVIDING PENALTIES THEREFOR, AND FOR OTHER PURPOSES Be it enacted by the Senate and the House of Representatives of the Philippines in Congress assembled:

Section 1. Short Title. - This Act shall be known as the "Children's Safety in

2 Social Media Act.

Sec. 2. Declaration of Policy. - It is hereby declared the policy of the State to

4 uphold the best interests of the child and to promote and protect the physical, 5 mental, moral, spiritual, intellectual, and social well-being of children and the youth, 6 consistent with the Constitution and the State's obligations under the United Nations 7 Convention on the Rights of the Child and other relevant laws. Recognizing that digital platforms and social media have become integral to 10 learning, communication, civic participation, creativity, and community life, the State 11 shall protect children in the digital environment, while safeguarding their rights to 12 freedom of expression, access to age- and developmentally-appropriate information,

1 privacy, and the confidentiality of personal data. In view of the demonstrable risks of harm arising from certain social media 4 platform features and practices, including cyberbullying, sexual exploitation and 5 abuse, exposure to harmful or age-inappropriate content, harassment, manipulation 6 through design and algorithmic amplification, and patterns of compulsive or 7 addictive use, the State adopts a risk-based and proportionate regulatory framework & that focuses on preventing and reducing such harms without unduly restricting • lawful speech, legitimate educational use, and beneficial online engagement. To this end, the State shall place primary responsibility on covered social 12 media platform providers, consistent with their public impact and duty of care, to 13 implement reasonable, effective, and privacy-preserving measures to prevent 14 children below the minimum age set by law from creating or maintaining accounts 15 on covered platforms, subject to clear standards, regulatory guidance, and 16 enforcement mechanisms. The State shall ensure that any age-assurance or compliance measure is 19 implemented in a manner that: (a) upholds data minimization and purpose 20 limitation; (b) prevents the overcollection, commercial use, or retention of 21 information gathered for age-assurance; (c) avoids compelling the use of 22 government-issued identification or digital identification as the sole means of 23 compliance; and (d) provides accessible safeguards and remedies against misuse, 24 consistent with due process and the right to privacy. The State further recognizes the primary right and duty of parents and 27 guardians in the upbringing of children and shall support parental authority through 28 accessible tools, transparency, and education, including media and digital literacy 29 initiatives, while promoting whole-of-government coordination to ensure coherence 30 with existing laws, child protection systems, cybercrime enforcement, education 31 policies, and data privacy regulations.

Sec. 3. Definition of Terms. - For the purposes of this Act, the following terms

2 are defined as follows: (a) Account refers to a registered profile, username, or credentialed access that enables a user to log in to a platform and use features available to account holders, including posting content, reacting, messaging within the platform, participating in groups or channels, live streaming, receiving personalized recommendations, or receiving notifications tied to the user profile. (b) Age Assurance refers to measures or methods reasonably designed to determine whether a prospective or existing account holder is an age-restricted user, which may include age estimation, age verification, age inference, parental or guardian attestation, or other privacy-preserving techniques, subject to this Act and applicable data protection laws. (c) Age-Restricted User refers to a child who has not reached the minimum age specified in this Act for holding an account on an age-restricted social media platform. (d) Age-Restricted Social Media Platform refers to an internet-based service, network, application, website, or computer program that satisfies all of the following conditions: (i) The sole purpose, or a significant purpose, of the service is to enable online social interaction between two (2) or more end-users, including interaction that enables end-users to share material for social purposes; ii The service allows end-users to link to, communicate with, or otherwise interact with some or all other end-users; and (iii) The service allows end-users to post, upload, share, or otherwise make available user-generated content on the service;

Provided, That "online social interaction" does not include primarily online business interaction in marketplaces, e-commerce, or service booking platforms). (e) Child refers to any person below eighteen (18) years of age. (f) Data Minimization and Purpose Limitation refer to the principles that information collected for age assurance and compliance shall be limited to what is necessary, used only for the permitted purpose, and retained only for as long as necessary to achieve that purpose. (g) Disabling Order refers to a written order issued by the Department of Information and Communications Technology (DICT) directing a Social Media Platform Provider to disable, deactivate, or restrict access to an identified account or page pursuant to this Act. (h) Excluded Services to online services, applications, websites, or platform features that would otherwise fall within the definition of an Age-Restricted Social Media Platform but are excluded from the minimum-age account restriction under Section 4 because they are low-risk and necessary for a child's access to essential communications, education, health, safety, or public services, as determined under this Act and its Implementing Rules and Regulations (IRR). A service or feature shall be considered an Excluded Service only if it meets 21 all of the following criteria: (i) Its primary purpose is to provide direct, limited-scope utility (e.g., messaging, learning, health/safety support, or delivery of government services, and not to provide a general-purpose feed-based or follower-based environment for public social networking; and (ii) It does not primarily rely on engagement-optimizing design that materially increases child-risk, including but not limited to algorithmic amplification to broad audiences, public follower networks by default,

or open discoverability of minors. (iii) Access and use can be provided in a manner consistent with data minimization, purpose limitation, and limited retention for child users. Excluded Services include, but are not limited to: (0) Private interpersonal communications services, where communications are primarily one-to-one or closed-group and not publicly discoverable by default; (ii) Education and learning management services, including school-authorized platforms used for instruction, assessment, official class communications, or school safety announcements; (ili) Health, mental health, counseling, hotline, and safety-support services, including crisis lines and child-protection reporting channels; (iv) Government digital services and official citizen service portals; and (v) Other services or features that the DICT, in consultation with the National Privacy Commission (NPC) and the National Telecommunications Commission (NTC), may classify by IRR as excluded, based on a documented finding that the service is low-risk and necessary, consistent with the best interests of the child and the child's right to useful, meaningful, and safe access to digital technologies. (1) Government-Issued Identification refers to any identification document or credential issued by the Philippine government or any of its instrumentalities, including any digital identification system recognized by the State, as may be defined by law. (j) Internet Service Provider (ISP) refers to any public telecommunications entity (PTE) or value-added service provider duly authorized by or registered with the National Telecommunications Commission (NTC) that

provides users or other entities with data connection allowing access to the internet through physical transport infrastructure, and such access is necessary for end-users to access online content and services and for content providers or platform providers to publish, host, or distribute materials online. (k) Personal Data refers to any information, whether recorded in material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained, or when put together with other information would directly and certainly identify an individual, consistent with applicable law. (1) Reasonable Steps refers to objectively appropriate, effective, and proportionate measures that a Social Media Platform Provider is expected to adopt to comply with this Act, taking into account available technologies, efficacy, risks of circumvention, the scale and nature of the platform, implementation cost relative to platform capacity, impacts on privacy, and the best interests of the child. (m) Service Provider refers to any natural or juridical person, whether domestic or foreign, that, in connection with an Age-Restricted Social Media Platform or the implementation of this Act, provides, operates, controls, or enables any of the following: (a) the platform or any component thereof; (b) hosting, content delivery, caching, domain name services, or other network services; (c) app distribution or access facilitation; or (d) internet access or connectivity services; and includes a Social Media Platform Provider and an Internet Service Provider. (n) Social Media Platform Provider refers to any natural or juridical person, whether domestic or foreign, that owns, operates, controls, or makes available an age-restricted social media platform in the Philippines, including through an app or web-based interface, and determines the purposes and means of processing user data for such platform.

(o) Third-Party Age Assurance Provider refers to any natural or juridical person, whether domestic or foreign, that provides, operates, or supplies age verification or age assurance systems, services, software, tools, or application programming interfaces (APIs) to a Social Media Platform Provider for purposes of determining whether an individual is an Age-Restricted User, and that processes Personal Data for such purpose, whether as an independent entity or as a processor engaged by the Social Media Platform Provider.

Sec. 4. Minimum Age Restriction for Social Media Accounts. - A child who has

10 not reached sixteen (16) years of age shall be an age-restricted user and shall be 11 prohibited from holding, creating, or maintaining an account on an age-restricted 12 social media platform. For the avoidance of doubt, the minimum age restriction under this Act 14 applies solely to the creation, holding, or maintenance of an account on an 15 age-restricted social media platform and to account-based interactive participation 16 therein. Provided, That the restriction under this Section shall not apply to electronic 18 services, platforms, or platform features deemed as Excluded Services as defined in 19 this Act. 20 Nothing in this Act shall be construed to prohibit passive viewing of publicly 21 available content where no account registration or login is required, subject to 22 existing child protection laws that apply irrespective of login state.

Sec. 5. Obligation of Social Media Platform Providers. - The provider of an

24 age-restricted social media platform shall take reasonable steps to prevent 25 age-restricted users from registering, accessing, holding, or continuing to use 26 accounts on the platform. Reasonable steps shall include, at a minimum, measures reasonably designed 28 to address: (a) New account creation (e.g., registration and onboarding);

(b) Existing accounts (e.g., review, restriction, deactivation/removal, as appropriate) (c) Circumvention risks (repeated evasion attempts and abuse of verification processes) In determining whether steps are reasonable, regard shall be had to: 6 (a) The nature and size of the platform and the risks posed to children; 7 (b) The effectiveness and proportionality of the measures adopted; 8 (c) The privacy impacts of age assurance and the availability of less intrusive options; and (d) The need to avoid measures that unduly impair lawful communication, education, and participation. 12 A Social Media Platform Provider shall maintain documented policies, 13 procedures, and technical measures adopted to comply with this Act, and shall keep 14 compliance records sufficient for verification by the DICT, consistent with data 15 minimization and purpose limitation. Such records shall be limited to what is 16 necessary to demonstrate compliance and shall not require the retention of personal 17 data beyond what is permitted under Section 9 of this Act. Social Media Platform Providers shall submit to the DICT, at such intervals and 19 in such form as may be provided in the IRR, an aggregated compliance report 20 describing the reasonable steps undertaken, implementation status, and 21 effectiveness indicators, without disclosing personal data except to the extent strictly 22 necessary for regulatory verification and consistent with the Data Privacy Act.

Sec. 6. Age Assurance Measures. - For purposes of complying with the

24 minimum age obligation, a Social Media Platform Provider may adopt age assurance 25 measures that are reliable, proportionate, and privacy-preserving, and are designed 26 to prevent age-restricted users from registering for, accessing, or continuing to use 27 the platform. Such measures may include, as applicable, account-based signals, user

1 interaction-based methods, third-party age assurance services, or other measures 2 permitted under rules issued pursuant to this Act. To prevent overcollection of sensitive identity data, a Social Media Platform 4 Provider shall not require government-issued identification, or any government or 5 government-accredited digital identity system, as the only means for an individual to 6 demonstrate that the individual is not an age-restricted user. Where 7 government-issued identification is offered as an option, the Social Media Platform 8 Provider must make available at least one reasonable alternative.

Sec. 7. Digital Well-Being and Break Tools. - Social Media Platform Providers

10 shall make available to all users, and in a manner that is privacy-preserving and easy 11 to use, digital well-being controls that enable: (a) voluntary time limits and 12 scheduled "quiet hour"; (b) break reminders and notification management; and (c) 13 for accounts reasonably determined to be used by minors, parent- or 14 guardian-controlled scheduling tools, subject to safeguards in this Act. No user shall be penalized solely for declining to enable such tools. The DICT 16 shall issue guidance standards in consultation with the NPC to ensure data 17 minimization and to prevent the collection of additional personal data solely for 18 implementing these tools.

Sec. 8. Safety-by-Design for Permitted Child Use. - Where (a) a child is

20 permitted to use an Excluded Service under this Act or its implementing rules and 21 regulations, or (b) a child who is not age-restricted and is permitted to hold an 22 account on a social media platform, the Social Media Platform Provider of such 23 service or platform shall implement and maintain age-appropriate default settings 24 and safety measures for such child users. At a minimum, such measures shall include: (a) Applying privacy-protective defaults, including limiting profile visibility and restricting geolocation sharing, searchability, and direct messaging from unknown users, where applicable;

(b) Providing accessible parental guidance tools, including features that enable parents or legal guardians, where applicable and voluntarily enabled, to supervise settings, manage contacts, and set reasonable time or usage controls, without requiring the disclosure of additional personal data beyond what is necessary; (c) Maintaining clear and child-sensitive reporting and response mechanisms for harmful content, harmful contact, and misuse, including acknowledgement and timely action consistent with the implementing rules; (d) Implementing measures reasonably designed to reduce exposure to age-inappropriate content, including content labeling, filtering options, and age-appropriate recommendations where such systems are used; and (e) Ensuring transparency, through plain-language notices on applicable child safety settings and how to access or modify them. Nothing in this section shall be construed to authorize restrictions on lawful 16 participation, access to information, or expression except to the extent necessary, 17 reasonable, and proportionate to protect the best interests of the child and to 18 implement the purposes of this Act, consistent with the Constitution.

Sec. 9. Data Privacy. - Any personal data collected or processed for purposes

20 that include compliance with the minimum age obligation shall be subject to the 21 following: (f) Collecting only what is strictly necessary to determine whether an individual is an age-restricted user; (g) Using or disclosing the data solely for age assurance and enforcement of this Act, and for no other purpose; (h) Applying appropriate organizational, physical, and technical security measures, including encryption and access controls;

(i) Destroying or irreversibly de-identifying the data as soon as it has served the purpose for which it was collected, unless retention is required by law; and (i) Complying with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 and all other applicable data protection laws, rules and regulations. Violation of this provision shall be subject 22 to penalties under this Act, the 8 Data Privacy Act of 2012, and any other administrative, 23 civil, or criminal penalties 9 as may be prescribed by law.

Sec. 10. Account Audits, Deactivation, Anti-Circumvention, and Reporting. -

11 Social Media Platform Providers shall: (a) Conduct risk-based audits of accounts and signals reasonably indicative of age misrepresentation, and deactivate accounts of age-restricted users; (b) Mitigate circumvention by preventing reactivation or creation of duplicate accounts by previously deactivated age-restricted users, consistent with privacy safeguards; (c) Provide a readily accessible reporting mechanism for users and parents/guardians to report suspected age-restricted accounts; and (d) Adopt prompt, documented response procedures for reports and findings under this Act.

Sec. 11. Role of the Department of Information and Communications

22 Technology. - The DICT shall be the primary implementing and coordinating agency 23 for the enforcement of this Act in relation to platform compliance with the minimum 24 age obligation and related safety duties, without prejudice to the mandates of the 25 NPC under Republic Act No. 10173, the NTC, and other concerned agencies. In carrying out this Act, the DICT shall exercise the following powers and 27 functions:

(a) Monitoring compliance of Social Media Platform Providers and, where applicable, Third-Party Age Assurance Providers, with age restrictions and related duties under this Act; (b) Receiving and maintaining accessible reporting channels for suspected violations, including underage access, circumvention, and platform non-compliance; (c) Investigating alleged violations, motu proprio or upon complaint, and conducting compliance checks consistent with due process and data minimization; (d) Issuing compliance notices requiring Social Media Platform Providers to take specified actions within a stated period, including removing, suspending, or restricting accounts reasonably determined to be held by age-restricted users, and reporting back the steps taken; (e) Referring matters involving privacy or personal data processing to the NPC for appropriate action, and coordinating with the Office of Cybercrime of the Department of Justice (DOJ) and other law-enforcement agencies for criminal violations; (f) Coordinating with the NTC, DepEd, DSWD, CHR, and other relevant agencies to ensure child-sensitive, rights-respecting, and technically workable implementation, including on education-related access where expressly allowed by this Act; (g) Recommending and supporting the issuance of implementing rules and technical standards, including age assurance guidance, in coordination with the NPC and other agencies concerned; and (h) Requiring Social Media Platform Providers and, where applicable, Third-Party Age Assurance Providers to submit documented compliance policies, technical descriptions, and aggregated compliance reports, and to produce compliance records necessary to verify adherence to this Act,

subject to data minimization, purpose limitation, and applicable privacy safeguards.

Sec. 12. Inter-Agency Council on Children's Safety in Social Media. - There is

4 hereby created an Inter-Agency Council on Children's Safety in Social Media (the 5 Council) to ensure a coordinated, rights-respecting, and technically workable 6 implementation of this Act. The Council shall be composed of the following ex officio members: 8 (a) The Secretary of the Department of Information and Communications Technology (DICT), who shall serve as Chairperson. (b) The Commissioner of the National Privacy Commission (NPC), who shall serve as Vice-Chairperson. (c) The Chairperson of the NTC, who shall serve as Member. (d) The Secretary of the Department of Education (DepEd), who shall serve as Member. (e) The Secretary of the Department of Social Welfare and Development (DSWD), who shall serve as Member. (* The Secretary of the Department of Justice (DOJ, through the Office of Cybercrime, who shall serve as Member. (g) The Chairperson of the Council for the Welfare of Children (CWC), who shall serve as Member. (h) The Chairperson of the Commission on Human Rights (CHR), who shall serve as Member. (i) One (1) representative from the National Youth Commission (NYC), who shall serve as Member. (j) Such other heads of agencies as may be designated in the IRR, consistent

with their respective statutory mandates, who shall serve as Members for purposes of carrying out specific functions under this Act. Each member-agency may designate a permanent alternate representative, 4 who shall not be lower than an Assistant Secretary or its equivalent, and who shall 5 have full authority to act and vote on behalf of the principal. 6 The DICT shall serve as Secretariat of the Council. 7 The Council may invite, as non-voting resource persons, representatives from 8 relevant stakeholders, including Social Media Platform Providers, civil society, 9 academe, mental health professionals, and child-rights organizations, as may be 10 necessary in the performance of its functions.

Sec. 15. Public Awareness and Digital Well-Being Programs. - The DICT shall,

12 in coordination with the Philippine Information Agency (PIA) and in consultation with 13 the DepEd, Department of Health (DOH), NYC, the NPC, local government units, and 14 other relevant government agencies, the private sector, and civil society 15 organizations, develop, lead, undertake, and coordinate a nationwide program to 16 heighten public awareness, parental empowerment, and community involvement in 17 furtherance of the purposes of this Act. For this purpose, the DICT shall implement a sustained information and 19 education campaign, which shall include: (a) Promoting internet safety and child online protection best practices, including practical guidance on privacy settings, reporting tools, content controls, and safe-by-design use of platforms; (b) Conducting a national outreach and education campaign through broadcast, print, community-based activities, and online resources, to inform the public of online risks to children, including cyberbullying, exploitation, harmful content exposure, and excessive or compulsive use; (c) Facilitating access to updated information and resources on online safety, child development, and age-appropriate digital use, including materials for

parents, guardians, educators, and learners; 2 (d) Coordinating with DepEd and DOH on school- and community-based interventions to address digital overuse and its links to mental and physical health, including awareness of warning signs, healthy screen habits, and pathways for referral and support; and (e) Strengthening public confidence in child online protection measures by ensuring that public advisories and education materials emphasize proportionate safeguards, parental tools, and privacy-preserving practices consistent with applicable data protection laws and regulations.

Sec. 16. Digital Citizenship Literacy. - The DepEd shall ensure that the K to 12

11 curriculum is supported by age-appropriate programs on digital citizenship and 12 media and information literacy, including online safety, critical thinking, responsible 13 expression, and reporting mechanisms, consistent with Republic Act No. 10533 or 14 the Enhanced Basic Education Act of 2013. The Commission on Higher Education 15 (CHED) and the Technical Education and Skills Development Authority (TESDA) shall 16 likewise promote and integrate digital citizenship literacy programs, as applicable, 17 within their respective mandates.

Sec. 17. Online Safety Coordinators. - There shall be appointed an Online

19 Safety Coordinator (OSC) in all primary and secondary schools. They shall ensure the 20 protection of all students from potential harms that may occur through the internet 21 and electronic media and serve as the main contact persons on all online-related 22 issues. OSCs shall act as auditor of online safety measures, including the collection 23 and recording of online safety incidents.

Sec. 18. Disabling of Age-Restricted Accounts. - When the DICT, upon prima

25 facie determination based on verified information or complaint, finds that an account 26 or page is owned, controlled, or principally used by an Age-Restricted User, it shall 27 issue a Disabling Order directing the relevant Social Media Platform Provider to 28 disable, deactivate, or restrict access to the identified account or page within 29 forty-eight (48) hours from receipt of the Order.

The Disabling Order shall be implemented in a manner that is necessary and 2 proportionate, and limited to what is required to enforce the minimum age 3 restriction, consistent with constitutional protections on expression and due process. Within twenty-four (24) hours from issuance of the Disabling Order, the DICT 5 shall furnish the NTC a copy thereof and indicate the date and time of service upon 6 the Social Media Platform Provider, for purposes of monitoring compliance by Social 7 Media Platform Providers and, where applicable, coordinating action within its & jurisdiction pursuant to this Act and other applicable laws. The Social Media Platform Provider shall document implementation of the 10 Disabling Order and, within three (3) days from implementation, shall submit to the 11 DICT and furnish the NTC a compliance report stating: (a) the action taken and the 12 date and time of implementation; (b) the steps undertaken to prevent reactivation or 13 circumvention of the disabled account consistent with this Act; and (c) the 14 notification made under this Act and its implementing rules: Provided, That the 15 report shall not include Personal Data beyond what is strictly necessary for 16 regulatory verification, consistent with the Data Privacy Act and the principles of 17 data minimization and purpose limitation.

Sec. 19. Request to Lift Disabling Order. - The Social Media Platform Provider

19 shall provide an accessible mechanism for the account holder and, where applicable, 20 the parent or legal guardian, to request the lifting or modification of a Disabling 21 Order on the ground of erroneous age classification. The request shall include 22 supporting information sufficient to reasonably establish that the account holder is 23 not an Age-Restricted User, as consistent with this Act, the Data Privacy Act, and the 24 IRR. Upon receipt of the request, the Social Media Platform Provider shall transmit 26 the request and relevant information to the DICT within three (3) days, together 27 with a brief statement of the basis for the Disabling Order and the platform's 28 relevant age assurance indicators, limited to what is necessary for review.

The DICT shall resolve the request within ten (10) days from receipt based on 2 substantial evidence, and shall either: (a) affirm the Disabling Order; or (b) direct 3 the lifting or modification of the Disabling Order and the restoration of access, in 4 whole or in part, subject to appropriate safeguards consistent with this Act. Pending s resolution, the disabling or restriction shall remain in effect. Where the DICT directs restoration, the Social Media Platform Provider shall 7 restore access within forty-eight (48) hours from receipt of the DICT directive.

Sec. 20. Compliance of Service Providers. - Service Providers, including Social

• Media Platform Providers and, where applicable, Internet Service Providers, shall 10 comply with a Disabling Order issued under Section 18 within forty-eight (48) hours 11 from receipt. If the Social Media Platform Provider fails or refuses to comply within the 13 period, and after notice of such noncompliance, the DICT may recommend that the 14 NTC require the implementation of effective and proportionate technical measures, 15 as a measure of last resort, to prevent access to the specific account or page 16 identified in the Disabling Order, subject to rules that minimize collateral blocking 17 under the IRR. Such technical measures may include: (a) Domain name blocking (DNS blocking) for the specific prohibited account/page access point; (b) URL blocking for the specific prohibited account/page address; (c) IP address blocking, only where strictly necessary and technically appropriate; and (d) Other functionally equivalent measures that are targeted, time-bound, and least restrictive. Failure to comply with a Disabling Order, without lawful excuse, shall subject 27 the responsible entity to the administrative penalties provided under this Act and

1 other applicable laws, including: (a) the restriction, suspension, or prohibition of 2 access to, or operations of, the covered service within the Philippines to the extent 3 authorized under this Act; and (b) where the responsible entity holds a permit, 4 license, franchise, certificate, or registration issued by another government agency, 5 the DICT may recommend to the appropriate regulatory agency the suspension, 6 cancellation, or other appropriate action on such authority.

Sec. 21. Penalties. - Any Social Media Platform Provider, or Third-Party Age

8 Assurance Providers, that fails to comply with any provision of this Act, including but o not limited to the failure to implement adequate Age Assurance measures, refusal to 10 comply with a Disabling Order, or unauthorized retention or misuse of personal data 11 collected under this Act, shall be subject to the following administrative penalties, 12 without prejudice to any civil or criminal liability under existing laws: (a) For Social Media Platform Providers: (i) Fines of not less than One Million Pesos (Php 1,000,000) but not exceeding Twenty Million Pesos (Php 20,000,000) for each act of non-compliance, depending on the gravity and frequency of the violation; (ii) Daily fines of not more than One Hundred Thousand Pesos (Php 100,000) for each day of continuing violation after due notice; and (iii) Suspension or revocation of access, operations, or licenses within the Philippines upon a finding of gross negligence, repeated non-compliance, or willful violation, subject to due process. (b) For Third-Party Age Assurance Providers: (i) Fines of not less than Five Hundred Thousand Pesos (Php 500,000.00) but not more than Five Million Pesos (Php 5,000,000) for breach of data privacy provisions or failure to meet verification standards set under this Act; and ii) Permanent disqualification from providing related services to social

media platforms operating in the Philippines upon a finding of gross negligence, repeated non-compliance, or willful misconduct, subject to due process. The imposition of the above penalties shall be without prejudice to 5 prosecution under Republic Act No. 10173, otherwise known as the "Data Privacy Act 6 of 2012," Republic Act No. 10175, otherwise known as the "Cybercrime Prevention 7 Act of 2012," or any other applicable penal law.

Sec. 22. Appropriations. - The amount necessary to carry out the provisions

9 of this Act is hereby authorized to be appropriated in the General Appropriations Act 10 of the year following its enactment into law and thereafter.

Sec. 23. Implementing Rules and Regulations. - Within ninety (90) days from

12 the effectivity of this Act, the DICT, in consultation with the NTC, NPC, DOJ, DSWD, 13 CHR, DepEd, DOH, and other appropriate government agencies, and after 14 consultation with relevant stakeholders from the education, child protection, youth, 15 and technology sectors, shall promulgate the necessary rules and regulations for the 16 effective implementation of this Act.

Sec. 24. Separability Clause. - If any provision of this Act is declared

18 unconstitutional or invalid, the remaining provisions shall remain in full force and 19 effect.

Sec. 25. Repealing Clause. - All laws, decrees, executive orders, rules and

21 regulations, or parts thereof inconsistent with this Act are hereby repealed or 22 amended accordingly.

Sec. 26. Effectivity Clause. - This Act shall take effect fifteen (15) days after

24 its publication in the Official Gazette or in a newspaper of general circulation. Approved,