SECTION 1. The General Laws are hereby amended by inserting after chapter 93L the following chapter:-

CHAPTER 93M. ONLINE TECHNOLIGCAL EXPLOITATION

Section 1. As used in this chapter and in section 61 of chapter 265, the following terms shall, unless the context clearly requires otherwise, have the following meanings:

“Coerced consent”, the purported consent obtained from a person: (1) through fraud, duress, misrepresentation, undue influence, or nondisclosure; (2) who lacks capacity; or (3) through exploiting or leveraging the person’s immigration status, pregnancy, disability, addiction, juvenile status or economic circumstances.

“Computer”, an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device.

“Consent”, an agreement that is informed and thorough and does not include coerced consent.

“Covered platform”, an interactive computer service that hosts or makes available to the general public pornographic images. For purposes of this definition, the availability of pornographic images to a group of subscribers shall be considered available to the general public if any member of the general public, subject to reasonable limitations, can obtain a subscription.

“Covered platform operator”, a provider of a covered platform.

“Information content provider”, any person or entity that is responsible, in whole or in part, for the creation or development of information provided through the Internet or any other interactive computer service.

“Interactive computer service”, any information service, system, or access software provider that provides or enables computer access by multiple users to a computer server, including specifically a service or system that provides access to the Internet and such systems operated or services offered by libraries or educational institutions.

“Intimate visual depiction”, any visual depiction: (1) of an individual who is reasonably identifiable from the visual depiction itself or information displayed in connection with the visual depiction, including through (i) facial recognition, (ii) an identifying marking on the individual, including a birthmark or piercing, (iii) an identifying feature of the background of the visual depiction, (iv) voice matching, or (v) written confirmation from an individual who is responsible, in whole or in part, for the creation or development of the visual depiction; and (2) in which (i) the individual depicted is engaging in sexually explicit conduct, or (ii) the naked genitals, anus, pubic area, or post-pubescent female nipple of the individual depicted are visible.

“Pornographic image”, any visual depiction of actual or feigned sexually explicit conduct or any intimate visual depiction.

“Sexually explicit conduct”, actual or simulated: (i) sexual intercourse, including genital-genital, oral-genital, anal-genital, or oral-anal, whether between persons of the same or opposite sex; (ii) bestiality; (iii) masturbation; (iv) sadistic or masochistic abuse; or (v) lascivious exhibition of the anus, genitals, or pubic area of any person;

“User”, an individual who is an information content provider or, with respect to a covered platform, an individual who is an information content provider who is responsible, in whole or in part, for the creation or development of pornographic images hosted or made available by the covered platform.

“Visual depiction”, a photograph, film, video, or modified photograph, film, or video, whether made or produced by electronic, mechanical, or other means.

Section 2. (a) (1) A covered platform operator may not upload or allow a user to upload a pornographic image to the covered platform unless the operator has verified, in accordance with paragraph (2):

(i) the identity of the user; and

(ii) that the user is not less than 18 years old.

(2) In carrying out paragraph (1), a covered platform operator shall verify the identity and age of a user by:

(i) requiring use of an adult access code or adult personal identification number;

(ii) accepting a digital certificate that verifies age; or

(iii) using any other reasonable measure of age verification that the attorney general has determined to be feasible with available technology.

(3) Merely requiring a user to confirm that the user is not less than 18 years of age, without independent means of verification, shall not satisfy the age requirement under paragraph (1).

(b) (1) A covered platform operator may not upload or allow a user to upload a pornographic image to the covered platform unless the operator has verified, in accordance with paragraph (2), that each individual appearing in the pornographic image:

(i) was not less than 18 years of age when the pornographic image was created;

(ii) has provided explicit written evidence of consent for each sex act in which the individual engaged during the creation of the pornographic image; and

(iii) has provided explicit written consent for the distribution of the specific pornographic image.

(2) (A) Consent described in clause (ii) of paragraph (1) does not imply or constitute evidence of consent described in clause (iii) of paragraph (1).

(B) Consent described in clause (iii) of paragraph (1) does not imply or constitute evidence of consent described in subparagraph (ii) of paragraph (1).

(3) In carrying out paragraph (1), a covered platform operator shall obtain, either from the user seeking to upload the pornographic image or through other means:

(A) a consent form created or approved by the attorney general under paragraph (4) from each individual appearing in the pornographic image that includes:

(i) the name, date of birth, and signature of the individual;

(ii) a statement that the individual is not less than 18 years of age, unless no reasonable person could conclude that the individual is less than 30 years of age;

(iii) a statement that the consent is for distribution of the specific pornographic image;

(iv) the geographic area and medium, meaning online, print, or other distribution method, for which the individual provides consent to distribution of the pornographic image;

(v) the duration of time for which the individual provides consent to distribution of the pornographic image;

(vi) a list of the specific sex acts that the person agrees to engage in for the pornographic image; and

(vii) a statement that explains coerced consent and that the individual has the right to withdraw the individual’s consent at any time; and

(B) not less than 1 form of valid identification for each individual appearing in the pornographic image:

(i) that was issued by an agency of the United States or of a state, local, or foreign government and contains the name, date of birth, signature, and photograph of the individual; and

(ii) on which the name, date of birth, and signature of the individual match the name, date of birth, and signature of the individual on the consent form required under clause (A).

(4) (A) (i) The attorney general shall create and make available to the public a consent form for purposes of clause (A) of paragraph (3).

(ii) A covered platform operator shall make the consent form created under clause (i) available to users in both written and electronic format.

(B) For purposes of clause (A) of paragraph (3), a user may submit to a covered platform an alternative consent form created by a user or covered platform operator if the alternative consent form has been approved by the attorney general.

(c) Nothing in this section shall be construed to affect any obligation of a covered platform under any other general or special law or impact or otherwise limit the criminal liability of a user or other individual under any other law.

Section 3. (a) As used in this section, the following terms shall, unless the context clearly requires otherwise, have the following meanings:

“Authorized representative”, a person authorized, pursuant to applicable law, in writing by the individual to act on behalf of the individual with regard to the matter in question; or, in the case of an individual under the age of 18, a parent or legal guardian of the individual.

“Eligible person”, with respect to a pornographic image uploaded to a covered platform, an eligible person is: (i) an individual who appears in the pornographic image and has not provided consent to, or has withdrawn consent in compliance with this chapter, the distribution of the pornographic image; (ii) an authorized representative of an individual described in clause (i); or (iii) a law enforcement officer acting pursuant to a valid court order.

(b) A covered platform operator shall establish a procedure for removing a pornographic image from the covered platform at the request of a person and designate 1 or more employees of the operator to be responsible for handling requests for removal of pornographic images.

(c) A covered platform operator shall display a prominently visible notice on the website or mobile application of the covered platform that provides instructions on how a person can request the removal of a pornographic image.

(d) (1) If a covered platform operator receives a request from an eligible person, through any request mechanism offered by the operator under subsection (b), to remove a pornographic image that is being hosted by the covered platform without the consent of an individual who

appears in the pornographic image, the operator shall remove the pornographic image as quickly as possible, but not later than 72 hours after receiving the request.

(2) If a covered platform operator receives a request from a person other than an eligible person, through any request mechanism offered by the operator under subsection (b), to remove a pornographic image that is being hosted by the covered platform without the consent of an individual who appears in the pornographic image, not later than 72 hours after receiving the request the operator shall review the records of the operator with respect to the pornographic image to determine whether the pornographic image was uploaded to the platform in accordance with the verification requirements under subsections (a) and (b) of section 2. If the operator determines that the pornographic image was not uploaded to the platform in accordance with the verification requirements under said subsections (a) and (b) of said section 2, the operator shall remove the pornographic image.

(e) In the case of a pornographic image that has been removed from a covered platform in accordance with this section, the covered platform operator shall block the pornographic image, and any altered or edited version of the pornographic image, from being uploaded to the covered platform again.

Section 4. (a) A user of a covered platform may not upload a pornographic image of an individual to the covered platform without the consent of the individual.

(b) For purposes of subsection (a), whether an individual has provided consent to the uploading of an image shall be determined in accordance with this chapter and any other applicable law.

Section 5. (a) (1) The attorney general may impose a civil penalty on any covered platform operator that violates subsection (a) of section 2 in an amount of not more than $10,000 for each day during which a pornographic image remains on the covered platform in violation of said subsection (a) of section 2, beginning 24 hours after the attorney general provides notice of the violation to the operator. A civil penalty under this paragraph shall accrue on a per-day and per-image basis.

(2) If a covered platform operator violates subsection (b) of section 2 with respect to a pornographic image, any person aggrieved by the violation may bring a civil action against the covered platform operator in the superior court for damages in an amount equal to the greater of: (i) $10,000 for each day during which a pornographic image remains on the covered platform in violation of said subsection (b) of said section 2, calculated on a per-day and per-image basis; or (ii) actual damages.

(b) (1) The attorney general may impose a civil penalty on any covered platform operator that violates subsection (b) of section 3 in an amount of not more than $10,000 for each day during which the covered platform remains in violation of said subsection (b) of said section 3, beginning 24 hours after the attorney general provides notice of the violation to the operator.

(2) The attorney general may impose a civil penalty on any covered platform operator that violates subsection (c) of section 3 in an amount of not more than $5,000 for each day during which the covered platform remains in violation of said subsection (c) of said section 3, beginning 24 hours after the attorney general provides notice of the violation to the operator.

(3) (A) If a covered platform operator violates subsection (d) of section 3 with respect to a pornographic image, any person aggrieved by the violation may bring a civil action against the covered platform operator in the superior court for damages in an amount equal to the greater of: (i) $10,000 for each day during which the pornographic image remains on the covered platform in violation of said subsection (d) of said section 3, calculated on a per-day and per-image basis; or (ii) actual damages.

(B) A covered platform operator shall not be liable under subparagraph (A) for a violation of section said subsection (d) of said section 3 if, in allowing the upload of a pornographic image to the covered platform, the operator reasonably relied on verification materials, in accordance with paragraph (3) of subsection (b) of section 2, that were later found to be fraudulent, provided that the operator removes the pornographic image not later than 24 hours after discovering that the verification materials are fraudulent. If a covered platform operator fails to remove a pornographic image within 24 hours of discovering that the verification materials are fraudulent, damages under clause (i) of subparagraph (A) shall be calculated with respect to each day on or after the date on which that 24-hour period expires.

(4) If a covered platform operator violates subsection (e) of section 3 with respect to a pornographic image, any person aggrieved by the violation may bring a civil action against the covered platform operator in the superior court for damages in an amount equal to the greater of: (i) $10,000 for each day during which the pornographic image remains on the covered platform in violation of said subsection (e) of said section 3; or (ii) actual damages.

(c) If a user of a covered platform violates section 4 with respect to a pornographic image, any person aggrieved by the violation may bring a civil action against the user in the superior court for damages in an amount equal to the greater of: (i) $10,000 for each day during which the pornographic image remains on the covered platform in violation of said section 4, calculated on a per-day and per-image basis; or (ii) actual damages.

SECTION 2. Chapter 265 of the General Laws is hereby amended by adding the following section:-

Section 61. (a) The definitions set forth in section 1 of chapter 93M shall, unless the context clearly requires otherwise, apply to this section.

(b) Except as provided in subsection (d), it shall be unlawful for any information content provider to knowingly use any interactive computer service to publish an intimate visual depiction of an individual with knowledge of or reckless disregard for: (1) the lack of consent of the individual to the publication; and (2) the reasonable expectation of the individual that the depiction would not be published through an interactive computer service without the individual’s consent.

(c) Any person who violates subsection (b) shall be punished by a fine of not more than $10,000 or by imprisonment in a state prison for not more than 5 years, or both.

(d) Subsection (b) shall not: (i) prohibit any lawful law enforcement, correctional, or intelligence activity; (ii) apply to an individual acting in good faith to report unlawful activity or in pursuance of a legal or other lawful obligation; or (iii) apply to a document production or filing associated with a legal proceeding.

SECTION 3. (a) There shall be a special legislative commission established, pursuant to section 2A of chapter 4 of the General Laws, to examine sentencing for criminal online technological exploitation, pursuant to section 2 of chapter 265 of the General Laws. The commission shall recommend: (i) sentencing guidelines for such crimes, including potential legislative amendments to subsection (c) of said section 2 of said chapter 265; (ii) guidance to help consumers prevent and report criminal online technological exploitation; and (iii) further action, including legislative action, to protect survivors from criminal online technological exploitation.

(b) The commission shall consist of: (i) the chairs of the joint committee on the judiciary, who shall serve as co-chairs of the commission; (ii) 1 member to be appointed by the speaker of the house of representatives; (iii) 1 member to be appointed by the president of the senate; (iv) 1 member to be appointed by the minority leader of the house of representatives; (v) 1 member to be appointed by the minority leader of the senate; (vi) 2 members to be appointed by the governor; (vii) 2 members to be appointed by the attorney general; (viii) 2 members to be appointed by the Supreme Judicial Court; (ix) 1 member to be appointed by the American Bar Association - Massachusetts office; (x) 1 member to be appointed the Citizens for Juvenile Justice, Inc.; (xi) 1 member to be appointed by the Committee for Public Counsel Services; (xii) 1 member to be appointed by the Massachusetts District Attorneys Association; (xiii) 1 member to be appointed by Jane Doe Inc.: The Massachusetts Coalition Against Sexual Assault and Domestic Violence; and (xiv) 1 member to be appointed by YW Boston, Inc.

(c) The commission shall commence no later than 90 days after the effective date of this act.

(d) No later than December 31, 2025, the commission shall file a report of its findings and recommendations, including any draft legislation, with the clerks of the house of representatives and the senate and the chairs of the joint committee on the judiciary.

SECTION 4. The attorney general shall create the consent form required pursuant to clause (i) of subparagraph (A) of paragraph (4) of subsection (b) of section 2 of chapter 93M of the General Laws within 60 days after passage of this act.

SECTION 5. Subsection (e) of section 3 of chapter 93M of the General Laws shall take effect 180 days after passage of this act.

SECTION 6. Except as set forth in sections 4 and 5, this act shall take effect 90 days after its passage.