Safe Media Access and Responsible Technology for Kids in Digital Spaces (Smart Kids) Act

Schate Office of the Secretari TWENTIETH CONGRESS OF THE ) REPUBLIC OF THE PHILIPPINES ) 26 APR 28 A10:36 First Regular Session RECEIVED BY: SENATE Senate Bill No. _ 2071 Introduced by Senator JOEL VILLANUEVA AN ACT PROMOTING SAFE AND RESPONSIBLE DIGITAL PLATFORMS BY IMPOSING DUTIES AND PENALTIES ON SOCIAL MEDIA PLATFORMS AND ONLINE SERVICE PROVIDERS FOR THE PROTECTION OF AGE-RESTRICTED USERS EXPLANATORY NOTE The digital world has become an integral part of modern life. It is where young people learn, communicate, and express themselves. However, alongside these opportunities are serious and growing risks-from harmful and inappropriate content, to addictive platform design, to online exploitation and abuse. At present, many digital platforms are designed to maximize user engagement, often at the expense of safety and well-being. Features such as algorithm-driven feeds, infinite scrolling, and autoplay are deliberately structured to capture attention and prolong usage. In this environment, those most vulnerable are those least equipped to navigate these risks. This measure responds to this growing concern by establishing a clear and enforceable framework that prioritizes the safety and well-being of age-restricted users, defined as individuals below fifteen (15) years of age. The bill adopts a firm but balanced approach. It prohibits access by age-restricted users to covered platforms, while placing the primary responsibility on platform operators to enforce such prohibition. Rather than penalizing young users, the measure ensures that those who design, operate, and profit from digital platforms are held accountable for maintaining a safe environment.

To support this framework, the bill requires platform operators to implement robust systems, including age assurance mechanisms, content moderation, safety-by- design features, and continuous risk management processes. It also mandates transparency obligations and strengthens protections on personal data, ensuring that compliance does not come at the expense of privacy or fundamental rights. Recognizing the need for a whole-of-society approach, the bill also promotes digital literacy, strengthens institutional support within schools, and encourages responsible parental involvement through non-punitive and educational measures. At the same time, the measure incorporates necessary safeguards to ensure fairness, practicality, and adaptability. It provides for reasonable exceptions, recognizes good faith compliance, and ensures that enforcement remains proportionate and consistent with due process. Ultimately, this bill is anchored on a simple but vital principle: those who shape the digital environment must also be responsible for making it safe. In view of the foregoing, the passage of this bill is earnestly sought. брем- JOEL VILLANUEVA/

Senate Office of the Soccretarp TWENTIETH CONGRESS OF THE REPUBLIC OF THE PHILIPPINES ) APR 28 A10 :36 First Regular Session ) RECEIVED BY: SENATE 2071 Senate Bill No. Introduced by Senator JOEL VILLANUEVA AN ACT PROMOTING SAFE AND RESPONSIBLE DIGITAL PLATFORMS BY IMPOSING DUTIES AND PENALTIES ON SOCIAL MEDIA PLATFORMS AND ONLINE SERVICE PROVIDERS FOR THE PROTECTION OF AGE-RESTRICTED USERS Be it enacted by the Senate and House of Representatives of the Philippines in Congress assembled:

SECTION 1. Short Title. - This Act shall be known as the "Safe Media

2 Access and Responsible Technology for Kids in Digital Spaces (SMART KIDS) 3 Act"

SEC. 2. Declaration of Policy. - It is hereby declared the policy of the

5 State to uphold and safeguard the physical, mental, emotional, and moral well- 6 being of children in an increasingly digital world, recognizing that their growth 7 and development now extend beyond traditional spaces into online 8 environments. The State shall promote a safe, secure, and age-appropriate 9 digital experience for every child, ensuring that technology serves as a tool for learning, creativity, and meaningful connection, rather than a source of harm. In pursuit of this, digital platforms shall be required to exercise a clear duty of care and accountability in the design, operation, and governance of their services, particularly where children are concerned. The State also affirms its commitment to uphold fundamental constitutional rights, striking a careful and principled balance between

1 protecting children and preserving the rights to privacy, due process, and 2 access to information. It shall likewise empower parents, educators, and 3 communities by strengthening digital literacy, equipping them with the 4 knowledge and tools necessary to guide children safely in the online space. 5 Ultimately, the State shall establish a regulatory framework that is 6 proportionate, enforceable, and technology-neutral, consistent with the Data 7 Privacy Act and aligned with evolving international best practices, to ensure 8 that the digital ecosystem remains both safe for children and fair for all.

SEC. 3. Definition of Terms. - For purposes of this Act:

10 (a) Age-Restricted Users - refer to individuals below fifteen (15) years of age; (b) Covered Platform - regardless of the platform's designation, business model, or primary purpose, provided, that the foregoing shall be subject to the exceptions under Section 15 of this Act, any social media platform, website, mobile application, online service, or digital application that enables users to: 1. Create, share, or access user-generated content, including text, images, audio, or video; 2. Interact, communicate, or connect with other users, including through messaging, commenting, or similar features; 3. Discover or consume content curated or distributed through algorithms, feeds, or recommendation systems; or 4. Participate in online communities, networks, or forums, whether public or private; This shall include, but not be limited to: 1. Social networking platforms 2. Content-sharing platforms (video, photo, livestreaming) 3. Messaging or communication platforms with social features 4. Online forums, discussion boards, and community-based platforms Platforms with algorithmic content feeds or engagement-driven features

1 (c) Platform Operator- any natural or juridical person that owns, operates, or controls a covered platform accessible in the Philippines; 3 (d) Age Assurance Mechanisms - proportionate and privacy-preserving methods used to determine whether a user falls within the category of age-restricted users; 6 (e) Addictive Design Features - platform features such as infinite scrolling, autoplay, push notifications, or algorithmic amplification designed to maximize engagement. 9 (f) User-generated Content- any form of content, including text, images, audio, video, or other media, created by users that is created by users of an online system or platform, and made accessible via social media.

SEC. 4. Prohibition on Access by Age-Restricted Users to Covered

Platforms. - No age-restricted user shall be permitted to create, maintain, or access an account on any covered platform. Platform operators shall take reasonable, effective, and proportionate measures to enforce such prohibition, and shall perform the following: (a) Implement effective and enforceable measures to prevent the creation and continued use of accounts by age-restricted users; (b) Establish systems to detect, verify, suspend, deactivate, or remove accounts reasonably believed to be owned or operated by age-restricted users, subject to due process safeguards; (c) Establish accessible and timely mechanisms for users to challenge account suspension, restriction, or removal, consistent with due process. (d) Ensure that the prohibition applies regardless of the manner of access, including direct or indirect access, use of third-party tools, shared accounts, or other means intended to circumvent safeguards; (e) Maintain and periodically update mechanisms to address circumvention, considering evolving technologies and user behavior; and (f) Implement enforcement measures in a manner that is proportionate and consistent with applicable laws, including the protection of user rights.

SEC. 5. Duty to Create a Safe and Age-Appropriate Digital

Environment. - Platform operators shall establish, implement, and maintain

proportionate and effective systems to ensure the safety of age-restricted users, including: 3 (a) Adoption of continuous risk assessment and mitigation processes, including periodic audits, to identify, evaluate, and address systemic risks, design-related harms, and emerging threats; (b) Establishment of accessible, user-friendly, and timely grievance, reporting, and notice-and-takedown mechanisms, with clear procedures for action and feedback; 9 (c) Implementation of proactive and responsive content moderation systems, including human and automated review, to detect, prevent, and remove harmful, exploitative, or inappropriate content; (d) Provision of clear, concise, and age-appropriate terms of service, community standards, and user guidelines, written in plain language and accessible formats; (e) Deployment of safety-by-design technical measures, including parental or guardian controls, content filtering systems, interaction restrictions, and reasonable usage or time management tools; (f) Application of privacy-by-default protections, including strict limitations on data collection, profiling, behavioral tracking, and targeted or behaviorally driven advertising; (g) Implementation of safeguards to limit exposure to harmful content and high-risk interactions, including restrictions on unsolicited contact from unknown users and controls over advertising exposure; (h) Identification, limitation, or disabling of addictive or engagement-driven design features, including autoplay, infinite scrolling, and algorithmic amplification that promotes prolonged or compulsive use; (i) Adoption of age-appropriate design standards, ensuring that platform features, interfaces, and functionalities are suitable and proportionate to the safety and developmental needs of age-restricted users; and (i) Maintenance of internal accountability and compliance mechanisms, including documentation and reporting systems, to ensure adherence to obligations under this Act.

SEC. 6. Prevention and Mitigation of Information and

2 Communications Technology Risks. - Platform operators shall adopt 3 system-level, proactive, and continuous measures to identify, assess, and 4 mitigate risks arising from the use of their services by age-restricted users. In 5 furtherance thereof, platform operators shall: 6 (a) Implement effective, privacy-preserving age assurance mechanisms to reasonably determine whether a user is an age-restricted user, without requiring excessive collection or retention of personal data; 9 (b) Conduct regular risk assessments and audits of platform design, algorithms, and functionalities to identify features that may expose age- restricted users to harm; (c) Integrate risk-reduction design interventions, including user-facing warnings, safety prompts, and friction mechanisms that discourage harmful or high-risk behavior; (d) Ensure that platform systems are designed to reduce exposure to manipulative or exploitative practices, including behaviorally targeted or algorithmically amplified content; and (e) Provide embedded, age-appropriate guidance and safety information within platform interfaces to promote responsible and informed digital use.

SEC. 7. Data Privacy and Protection. - Platform operators shall

respect and protect the personal data of age-restricted users and shall ensure 23 that their systems are designed with privacy and security in mind. For this purpose: (a) All collection, processing, and use of personal data shall strictly comply with the Data Privacy Act of 2012 and other applicable laws; Platform operators shall adhere to the principle of data minimization, collecting only personal data that is necessary for the provision of services and the implementation of safety measures, and shall not gather excessive or unnecessary information;

1 (c) Any system used to determine a user's age shall be privacy-preserving, secure, and proportionate, and shall not require the disclosure of more personal information than is reasonably needed; (d) Users shall not be required to submit government-issued identification as a condition for accessing digital platforms or services; (e) Platform operators shall not establish or maintain centralized identity databases or large-scale databases of personal identities, or engage in any form of mass surveillance of users; 9 (f) Appropriate technical, organizational, and security measures shall be implemented to protect personal data against unauthorized access, disclosure, alteration, or misuse; (g) Platform operators shall promptly notify the National Privacy Commission (NPC) and affected users in case of data breaches involving age-restricted users; (h) Platform operators shall provide clear and easy-to-understand information on how personal data is collected, used, and protected, including the rights of users under applicable data privacy laws; and (i) Platform operators shall establish mechanisms for the exercise of data subject rights, consistent with applicable data privacy laws.

SEC. 8. Transparency and Accountability. - Platform operators shall

ensure transparency in their operations and accountability in the implementation of their obligations under this Act. For this purpose, they shall: (a) Submit annual transparency reports to the Department of Information and Communications Technology (DICT), which shall include: 1. measures implemented to comply with this Act; 2. summary of risks identified and mitigation actions taken; 3. number and nature of reports received relating to harmful content or interactions; 4. actions taken in response to such reports; 5. general description of age assurance and safety systems; and 6. challenges, limitations, and areas for improvement;

1 (b) Maintain internal records and documentation sufficient to demonstrate compliance with the provisions of this Act; 3 (c) Cooperate with lawful requests, audits, and investigations conducted by regulatory authorities; and 5 (d) Ensure that transparency measures are implemented in a manner that does not compromise user privacy or platform security.

SEC. 9. Digital Literacy and Public Awareness. - The State shall

8 promote a culture of safe and responsible digital use. For this purpose: 9 (a) The DICT, in coordination with the Philippine Information Agency (PIA) and other relevant stakeholders, shall develop and implement nationwide digital safety and awareness programs; (b) The Department of Education (DepEd), Commission on Higher Education (CHED), and Technical Education and Skills Development Authority (TESDA) shall integrate digital citizenship, online safety, and responsible technology use into their respective curricula and training programs; (c) Programs shall include education on online risks, privacy protection, responsible platform use, and reporting mechanisms; and (d) Government agencies shall encourage collaboration with the private sector and civil society to promote digital safety initiatives.

SEC. 10. Online Safety Coordinators. - The DepEd shall ensure that

each primary and secondary school designates an Online Safety Coordinator (OSC) from among existing school personnel, including but not limited to guidance counselors, ICT coordinators, or designated teachers. The OSC shall serve as the focal person for matters relating to digital safety and online well-being of students, and shall: (a) Promote and support the protection of students from risks and harms arising from the use of the internet and electronic media; (b) Serve as the primary point of contact for students, parents, and school personnel on issues relating to online safety; (c) Assist in the implementation of digital safety programs, policies, and awareness initiatives, consistent with the curriculum and programs of DepEd;

1 (d) Monitor and document online safety incidents affecting students, and coordinate with school authorities and appropriate government agencies, when necessary; and (e) Support initiatives that promote responsible, safe, and informed digital practices among students. The designation of an OSC shall be integrated within the existing 7 functions and responsibilities of school personnel and shall be subject to 8 guidelines to be issued by DepEd, considering school capacity, workload, and 9 available resources. No additional plantilla positions shall be created for this purpose. 11 Implementation shall be carried out within existing appropriations of DepEd and concerned schools.

SEC. 11. Regulatory Oversight. - To ensure the effective

implementation and enforcement of this Act, the following agencies shall exercise their respective mandates: (a) The DICT shall serve as the lead implementing and coordinating agency, and shall: 1. Monitor and evaluate compliance of platform operators with the provisions of this Act; Issue rules, guidelines, and technical standards, including risk management, safety-by-design, and reporting requirements; 3. Conduct audits, investigations, and compliance assessments, either motu proprio or upon complaint; 4. Receive, review, and analyze transparency reports submitted by platform operators; 5. Establish mechanisms for public complaints and reporting of violations; 6. Impose appropriate sanctions or enforcement actions, in accordance with this Act; and 7. Coordinate with other government agencies, stakeholders, and international counterparts on matters relating to digital platform safety.

1 (b) The NPC shall exercise primary jurisdiction over data privacy and protection matters, and shall: 1. Ensure compliance with the Data Privacy Act of 2012 and related issuances; 2. Review and assess age assurance mechanisms and other data processing activities to ensure that these are privacy-preserving and proportionate; 3. Investigate data breaches, unauthorized processing, and violations of data subject rights involving age-restricted users; 4. Issue guidelines and advisories on privacy standards applicable to platform operators; and Coordinate with the DICT in the enforcement of provisions involving both platform safety and data protection. (c) The Department of Trade and Industry (DTI) shall exercise jurisdiction over consumer protection matters, and shall: 1. Address complaints involving unfair, deceptive, or abusive platform practices affecting users; 2. Ensure that platform operators comply with consumer protection laws, including transparency, fairness, and accountability obligations; 3. Investigate and act against misleading representations, including those relating to safety features, content moderation, and user protections; and 4. Coordinate with the DICT in enforcing measures that affect both platform safety and consumer welfare.

SEC. 12. Liability and Penalties. - Platform operators who fail to

comply with the obligations under this Act shall be subject to proportionate, graduated, and enforceable penalties, considering the nature and impact of the violation. (a) Administrative Sanctions. - In the first instance, the appropriate regulatory authority may issue warnings, compliance orders, or directives,

requiring the platform operator to correct deficiencies within a specified period. (b) Monetary Penalties. - Where a violation is established, platform operators shall be liable to pay administrative fines ranging from One Million Pesos (P1,000,000.00) to Twenty Million Pesos (P20,000,000.00), depending on the gravity, scale, and duration of the violation. (c) Aggravated or Repeated Violations. - In cases of repeated, willful, or grossly negligent violations, or where the violation results in significant harm to age-restricted users, the platform operator may be subject to: 1. Increased fines of up to Fifty Million Pesos (P50,000,000.00); and/or 2. Suspension, restriction, or limitation of operations within the Philippines, as may be determined by the appropriate authority, consistent with due process. (d) Factors in Determining Penalties. - In determining the appropriate penalty, the following factors shall be considered: 1. The number of users affected; 2. The nature, gravity, and duration of the violation; 3. The extent of actual or potential harm caused; 4. The size, resources, and technical capacity of the platform operator; 5. The degree of responsibility or negligence involved; 6. The efforts undertaken to comply in good faith, including corrective actions; and 7. The history of prior violations or non-compliance. (e) Due Process and Enforcement. - No penalty shall be imposed without notice and opportunity to be heard, and all enforcement actions shall be carried out in accordance with applicable laws, rules, and regulations.

SEC. 13. Non-Liability of Age-Restricted Users. - No criminal, civil,

or administrative liability shall attach to age-restricted users. Enforcement shall 29 be directed exclusively against platform operators.

SEC. 14. Responsibility of Parents or Guardians. - Parents or legal

guardians shall exercise reasonable supervision and guidance over age- restricted users under their care in relation to the use of covered platforms.

In cases of gross negligence, defined as a clear and repeated failure to 2 exercise reasonable supervision resulting in the circumvention of safeguards 3 established under this Act, the appropriate authority may impose proportionate administrative measures, including: 5 (a) Issuance of formal warnings and directives to comply with supervisory responsibilities; 7 (b) Mandatory participation in digital safety, responsible technology use, or parenting support programs to be developed by the DICT, in coordination with relevant agencies; 10 (c) Compliance with such corrective or educational measures as may be necessary to promote the safe and responsible use of digital platforms; and (d) Cooperation with relevant authorities in addressing risks to the safety and well-being of age-restricted users. No criminal or civil liability shall attach to parents or guardians under this Act, and any measures imposed shall be proportionate, non-punitive, and 17 focused on education and prevention.

SEC. 15. Exempted Platforms. - The prohibitions under this Act shall

not apply to: (a) Educational platforms, including learning management systems, virtual classrooms, and other digital tools officially recognized or authorized by the DepEd, CHED, or TESDA; (b) Government platforms used for the delivery of essential public services, including but not limited to health, social protection, education, emergency response, and public information; (c) Platforms necessary for health, safety, or emergency purposes, including those used for communication during disasters or urgent situations; and (d) Other platforms or categories as may be determined by the DICT, in consultation with relevant agencies, based on necessity, public interest, and consistency with the objectives of this Act.

SEC. 16. Conditions for Exemption. - The exemptions provided under

Sec. 15 of this Act shall be subject to the following conditions:

1 (a) Platforms shall not incorporate social media features unrelated to their primary purpose in a manner that circumvents the prohibition under this Act; 4 (b) Platform operators shall implement appropriate safeguards, including privacy protections, access controls, and content limitations, consistent with this Act; 7 (c) Use of such platforms by age-restricted users shall be limited to legitimate, supervised, or necessary purposes; and 9 (d) The DICT may review, restrict, or revoke the application of any exception where it is found to be used to circumvent the intent of this Act.

SEC. 17. Good Faith Compliance. - Platform operators that

demonstrate good faith efforts and substantial compliance with the obligations under this Act shall not be held liable for isolated or inadvertent violations, if they take prompt corrective action upon discovery.

SEC. 18. Applicability to Foreign Platform Operators. - This Act

shall apply to all platform operators offering services to users in the Philippines, regardless of place of incorporation, and may be enforced through appropriate regulatory and legal mechanisms.

SEC. 19. Implementing Rules and Regulations. - The rules and

regulations necessary for the effective and efficient enforcement of the provisions of this Act shall be formulated by the DICT in consultation with relevant government agencies, LGUs, the private sector, and other 23 stakeholders, and shall be implemented within ninety (90) days from the effectivity of this Act. Unjustified or willful failure or refusal of the relevant government agencies to promulgate the IRR within the specified period shall subject the heads of these government agencies to administrative penalties under applicable civil service laws. Should the IRR contain provisions that are contrary to this Act, the heads 30 of the government agencies responsible for such provision, when done in bad faith or with gross negligence, shall be held administratively liable.

SEC. 20. Separability Clause. - If any portion or provision of this Act

2 is declared unconstitutional, the remainder hereof or any provisions not 3 affected thereby shall remain in force and effect.

SEC. 21. Repealing Clause. - Any law, presidential decree or issuance,

5 executive order, letter of instruction, rule, or regulation inconsistent with the 6 provisions of this Act is hereby repealed or modified accordingly.

SEC. 22. Effectivity. - This Act shall take effect fifteen (15) days after

its complete publication in the Official Gazette or in a newspaper of general 9 circulation. Approved,