Chapter 7D of the Massachusetts General Laws is hereby amended to add the following new section:

Section 12:

(a). Definitions:

(1) “Social Media Company” - A social media company means any entity that operates, directly or indirectly, including through a parent company, subsidiaries, or affiliates, a website, desktop application, or mobile application that:

(i) permits an individual or entity to create an account or profile for the purpose of generating, sharing, and viewing user-generated content through such account or profile;

(ii) sells digital advertising space;

(iii) has more than 1,000,000 monthly active users for a majority of months during the preceding 12 months;

(iv) enables one or more users to generate content that can be viewed by other users of the website, desktop application, or mobile application; and

(v) enables users to view content generated by other users of the website, desktop application, or mobile application.

This definition does not include an entity if the entity does not operate a website, desktop application, or mobile application except for a website, desktop application, or mobile application the primary purpose of which is to allow users to post product reviews, business reviews, or travel information and reviews, or to provide emergency alert services.

A social media company described in this subsection is a social media company that meets one or more of the following:

(i) The company is domiciled in, headquartered in, has its principal place business in, or is organized under the laws of a country of concern.

(ii) A country of concern, entity of concern, or some combination thereof, directly or indirectly owns, controls with the ability to decide important matters, or holds with power to vote, ten percent or more of the outstanding voting stock or shares of the company.

(iii) The company employs software or algorithms controlled or whose export is restricted by a country of concern or entity of concern.

(iv) The company is subject to substantial influence, directly or indirectly, from a country of concern or entity of concern owing to which—

the company shares or could be compelled to share data on United States citizens with a country of concern or entity of concern; or

the content moderation practices of the company are subject to substantial influence from a country of concern or entity of concern.

DEEMED COMPANIES.—The following companies shall be deemed to be social media companies described in this subsection as of the date of the enactment of this Act:

Bytedance, Ltd,

TikTok,

WeChat,

A subsidiary of or a successor company to a company listed in subparagraph (a),(b), or (c).

A company owned or controlled directly or indirectly by a company listed in subparagraph (a), (b) or (c).

(2) “Country of Concern” – A country of concern include the People’s Republic of China (including Hong Kong and Macau), Russia, Iran, North Korea, Cuba, and Venezuela.

(3) “Entity of Concern” - means— (i) a governmental body at any level in a country of concern; (ii) the armed forces of a country of concern; (iii) the leading political party of a country of concern;(iv) an individual who is a national of a country of concern and is domiciled and living in a country of concern, and who is subject to substantial influence, directly or indirectly, from a country of concern; or (v) a private business or a state-owned enterprise domiciled in a country of concern or owned or controlled by a private business or state-owned enterprise domiciled in a country of concern.

(4) “Employee” – means any elected or appointed, officers or employees of any agency, department, division, bureau, or any political subdivision of the commonwealth, county, or municipality, whether serving full or part-time, temporary or permanent, compensated or uncompensated, and officers or soldiers of the military forces of the commonwealth.

(5) “Electronic devices” – means any government issued devices, including but not limited to commonwealth, county, and municipally issued cell phones, laptops, or other devices capable of connecting to the internet except for public safety purposes.

(b.) No employee of the commonwealth, county, or municpality shall use or download any applications or software from any social media company as described in subsection a. of this section on to Commonwealth owned electronic devices.

(c.) The Secretary of the Executive Office of Technology Services and Security will:

develop and implement a plan to remove any referenced hardware products from the commonwealth, county, and municipal networks;

remove any referenced software products from the commonwealth, county, and municipal network;

Implement measures to prevent the installation of referenced hardware and software products on commonwealth owned or managed technology assets;

Implement network-based restrictions to prevent the use of, or access to prohibited services;

Include risks associated with these technologies into the Commonwealth’s Cybersecurity Awareness Training Program through the Office of the Comptroller.

The secretary will continually monitor and update the list in subsection a. of this act.

(d.) (1) The secretary will additionally file a report with the Legislature relative to the risks of the social media companies described in subsection (a.) no later than 180 days following the passage of this act.

(2) Annually, no later than December 31, the secretary shall reassess and report on the risks of social media companies described in subsection (a) and any policy recommendations to the governor, and the clerks of the house of representatives and the senate.

(e.) This act will take effect immediately following its passage.