Illinois passes Children’s Social Media Safety Act

Illinois just drew a line in the sand that every parent in America should care about. The state passed the Children’s Social Media Safety Act in 2026, forcing platforms to default to the most private settings possible for users under 18 — no opt-in required, no dark patterns, no buried toggles. This is the most significant child privacy legislation passed at the state level this year, and it puts the burden where it belongs: on the platforms, not the kids.

What the Illinois Law Actually Does

The Children’s Social Media Safety Act requires social media companies to automatically apply maximum privacy settings for minors. That means location data off by default. That means profiles private by default. That means no algorithmic amplification of a child’s content to strangers without explicit parental or guardian consent.

Illinois mandates that platforms cannot use a minor’s data for targeted advertising without verified parental consent. The law also restricts how platforms can notify minors — no midnight push notifications designed to drag a 13-year-old back onto an app when they should be asleep.

This is not a suggestion. Platforms that operate in Illinois and fail to comply face real legal exposure. That’s the point.

Why Social Media Privacy Settings Have Always Been a Rigged Game

Here’s what the platforms never wanted you to say out loud: privacy settings have always been designed to fail you. The defaults are wide open. The controls are buried three menus deep. The language is deliberately confusing. If you want to protect yourself — or your child — you have to actively fight the interface every step of the way.

That’s not an accident. Open data means better ad targeting. Better ad targeting means more revenue. The whole system is engineered against the user’s interest, and children are the most vulnerable users on any platform.

We’ve watched this play out in real time. Teens targeted with body image content. Kids having their locations tracked. Minors’ faces scraped from public profiles and fed into databases they’ll never hear about. The platforms have had years to fix this voluntarily. They chose not to.

What Good Default Privacy Settings for Kids Should Look Like

Private Account — Always On

No minor’s profile should ever be public by default. Full stop. A child’s posts, followers, and activity should be invisible to anyone they haven’t explicitly approved. This is the single most effective setting for reducing stranger contact and content scraping.

Location Services — Always Off

Platforms should never have access to a minor’s precise location by default. Not for geotagged posts. Not for “nearby friends” features. Not for anything. Location data is the most dangerous data a child can expose.

Targeted Advertising — Disabled by Default

Children should not be ad-targeted based on behavioral data, period. Illinois makes this explicit. Every other state should follow.

Message Requests from Strangers — Blocked

No minor should receive direct messages from accounts they don’t follow by default. This is a basic safety measure that platforms have dragged their feet on for years because “reach” is a metric they sell to creators and advertisers.

Is This a Privacy Win or Just a Legal Band-Aid?

The honest answer is both. The Illinois law is a genuine step forward, but enforcement is where these bills historically collapse. Platforms are global. Illinois is one state. Without federal backing or aggressive attorney general enforcement, companies have every incentive to implement technical compliance while preserving the spirit of their data-hungry defaults.

We’ve seen this pattern before. COPPA passed in 1998. Kids were still being tracked illegally in 2024. The law existing and the law being enforced are two completely different things.

What makes this moment feel different — slightly — is the broader momentum. There’s growing pressure on platforms from multiple directions simultaneously. Privacy advocates are louder. AI-powered surveillance is becoming more visible to regular people. And the public conversation about what tech companies owe children is shifting fast. If you want to understand how data systems are expanding their reach into everyday life, look at how law enforcement tools like TGCSB’s IntraGPT are already giving police instant access to years of records — the infrastructure for mass data access is being built at every level, and children’s social data sits right in the middle of it.

What Parents Can Do Right Now

Don’t wait for your state to catch up to Illinois. Every major platform has privacy controls that are better than the defaults — you just have to hunt for them. On Instagram, go to Settings, then Privacy, and flip every toggle that limits who can see your child’s account, tag them, or message them. On TikTok, Family Pairing gives parents direct control. On Snapchat, enable Ghost Mode for location immediately.

The bigger fight is systemic. Individual settings only go so far when the platform’s core architecture is built to erode them. That’s a policy problem. Illinois just made it a legal one.

The tech investment world is also paying attention. Capital flows tell us where the industry is heading, and right now the AI startup funding boom is not equally distributed — which means the companies building the next generation of social platforms are concentrated in specific markets with specific regulatory pressures. Regulation shapes investment, and investment shapes the products your kids will use in five years.

The Hot Take

Every state waiting for federal action on child social media privacy is complicit in the harm happening right now. Congress has had multiple sessions, multiple hearings, multiple opportunities to pass comprehensive child privacy legislation — and they’ve produced nothing enforceable. States shouldn’t be asking for permission to protect children. They should be racing each other to see who can pass the strictest law. Illinois didn’t wait. Neither should anyone else.

The platforms will sue. They’ll claim First Amendment issues. They’ll fund think tanks to produce white papers about innovation being stifled. That’s the playbook, and it’s predictable. The correct response is to not care, because on the other side of those legal arguments are kids whose data is being packaged and sold before they’re old enough to understand what data even means. Illinois chose the kids. That’s the only choice that matters.

Watch the Breakdown