Enhancing the Children’s Online Privacy Protection Act of 1998

(a)

Definitions

Section 1302 of the Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6501) is amended by adding at the end the following:

(13)

Delete

The term delete means to remove personal information such that the information is not maintained in retrievable form and cannot be retrieved in the normal course of business.

(b)

Regulation of unfair and deceptive acts and practices in connection with the collection and use of personal information from and about children on the internet

Section 1303 of the Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6502) is amended—(1)in subsection (a), by adding at the end the following:

(3)

Failure to delete

It is unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to fail to delete personal information collected from or about a child if a request for deletion is made pursuant to regulations prescribed under subsection (e).

; and

(2)by adding at the end the following:

(e)

Right of an individual To delete personal information collected when the person was a child

(1)

In general

Not later than 1 year after the date of enactment of this subsection, the Commission shall promulgate under section 553 of title 5, United States Code, regulations that require the operator of any website or online service directed to children, or any operator that has actual knowledge that it has collected personal information from a child or maintains such personal information—(A)to provide notice in a prominent place on the website of how an individual over the age of 13, or a legal guardian of an individual over the age of 13 acting with the knowledge and consent of the individual, can request that the operator delete all personal information in the possession of the operator that was collected from or about the individual when the individual was a child notwithstanding any parental consent that may have been provided when the individual was a child;(B)to promptly delete all personal information in the possession of the operator that was collected from or about an individual when the individual was a child when such deletion is requested by an individual over the age of 13 or by the legal guardian of such individual acting with the knowledge and consent of the individual, notwithstanding any parental consent that may have been provided when the individual was a child;(C)to provide written confirmation of deletion, after the deletion has occurred, to an individual or legal guardian of such individual who has requested such deletion pursuant to this subsection; and(D)to except from deletion personal information collected from or about a child—(i)only to the extent that the personal information is necessary—(I)to respond to judicial process; or(II)to the extent permitted under any other provision of law, to provide information to law enforcement agencies or for an investigation on a matter related to public safety; and(ii)if the operator retain such excepted personal information for only as long as reasonably necessary to fulfill the purpose for which the information has been excepted and that the excepted information not be used, disseminated or maintained in a form retrievable to anyone except for the purposes specified in this subparagraph.

(c)

Safe harbors

Section 1304 of the Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6503) is amended—(1)in subsection (a), by striking section 1303(b) and inserting subsections (b) and (e) of section 1303; and(2)in subsection (b)(1), by striking subsection (b) and inserting subsections (b) and (e).(d)

Actions by States

Section 1305(a)(1) of the Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6504(a)(1)) is amended by striking 1303(b) and inserting subsection (b) or (e) of section 1303.