Online collection, use, disclosure, and deletion of personal information of children and teens

(a)

Definitions

Section 1302 of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501) is amended—(1)by amending paragraph (2) to read as follows:

(2)

Operator

The term operator—(A)means any person—(i)who, for commercial purposes, in interstate or foreign commerce operates or provides a website on the internet, an online service, an online application, or a mobile application; and(ii)who—(I)collects or maintains, either directly or through a service provider, personal information from or about the users of that website, service, or application;(II)allows another person to collect personal information directly from users of that website, service, or application (in which case, the operator is deemed to have collected the information); or(III)allows users of that website, service, or application to publicly disclose personal information (in which case, the operator is deemed to have collected the information); and(B)does not include any nonprofit entity that would otherwise be exempt from coverage under section 5 of the Federal Trade Commission Act (15 U.S.C. 45).

;

(2)in paragraph (4)—(A)by amending subparagraph (A) to read as follows:

(A)the release of personal information collected from a child or teen by an operator for any purpose, except where the personal information is provided to a person other than an operator who—(i)provides support for the internal operations of the website, online service, online application, or mobile application of the operator, excluding any activity relating to individual-specific advertising to children or teens; and(ii)does not disclose or use that personal information for any other purpose; and

; and

(B)in subparagraph (B)—(i)by inserting or teen after child each place the term appears;(ii)by striking website or online service and inserting website, online service, online application, or mobile application; and(iii)by striking actual knowledge and inserting actual knowledge or knowledge fairly implied on the basis of objective circumstances;(3)by striking paragraph (8) and inserting the following:

(8)

Personal information

(A)

In general

The term personal information means individually identifiable information about an individual collected online, including—(i)a first and last name;(ii)a home or other physical address including street name and name of a city or town;(iii)an e-mail address;(iv)a telephone number;(v)a Social Security number;(vi)any other identifier that the Commission determines permits the physical or online contacting of a specific individual;(vii)a persistent identifier that can be used to recognize a specific child or teen over time and across different websites, online services, online applications, or mobile applications, including but not limited to a customer number held in a cookie, an Internet Protocol (IP) address, a processor or device serial number, or unique device identifier, but excluding an identifier that is used by an operator solely for providing support for the internal operations of the website, online service, online application, or mobile application; (viii)a photograph, video, or audio file where such file contains a specific child's or teen's image or voice; (ix) geolocation information;(x)information generated from the measurement or technological processing of an individual's biological, physical, or physiological characteristics that is used to identify an individual, including—(I)fingerprints;(II)voice prints;(III)iris or retina imagery scans;(IV)facial templates;(V)deoxyribonucleic acid (DNA) information; or(VI)gait; or(xi)information linked or reasonably linkable to a child or teen or the parents of that child or teen (including any unique identifier) that an operator collects online from the child or teen and combines with an identifier described in this subparagraph.(B)

Exclusion

The term personal information shall not include an audio file that contains a child's or teen’s voice so long as the operator—(i)does not request information via voice that would otherwise be considered personal information under this paragraph;(ii)provides clear notice of its collection and use of the audio file and its deletion policy in its privacy policy;(iii)only uses the voice within the audio file solely as a replacement for written words, to perform a task, or engage with a website, online service, online application, or mobile application, such as to perform a search or fulfill a verbal instruction or request; and(iv)only maintains the audio file long enough to complete the stated purpose and then immediately deletes the audio file and does not make any other use of the audio file prior to deletion.(C)

Support for the internal operations of a website, online service, online application, or mobile application

(i)

In general

For purposes of subparagraph (A)(vii), the term support for the internal operations of a website, online service, online application, or mobile application means those activities necessary to—(I)maintain or analyze the functioning of the website, online service, online application, or mobile application;(II)perform network communications;(III)authenticate users of, or personalize the content on, the website, online service, online application, or mobile application;(IV)serve contextual advertising, provided that any persistent identifier is only used as necessary for technical purposes to serve the contextual advertisement, or cap the frequency of advertising;(V)protect the security or integrity of the user, website, online service, online application, or mobile application;(VI)ensure legal or regulatory compliance, or(VII)fulfill a request of a child or teen as permitted by subparagraphs (A) through (C) of section 1303(b)(2).(ii)

Condition

Except as specifically permitted under clause (i), information collected for the activities listed in clause (i) cannot be used or disclosed to contact a specific individual, including through individual-specific advertising to children or teens, to amass a profile on a specific individual, in connection with processes that encourage or prompt use of a website or online service, or for any other purpose.

;

(4)by amending paragraph (9) to read as follows:

(9)

Verifiable consent

The term verifiable consent means any reasonable effort (taking into consideration available technology), including a request for authorization for future collection, use, and disclosure described in the notice, to ensure that, in the case of a child, a parent of the child, or, in the case of a teen, the teen—(A)receives direct notice of the personal information collection, use, and disclosure practices of the operator; and(B)before the personal information of the child or teen is collected, freely and unambiguously authorizes—(i)the collection, use, and disclosure, as applicable, of that personal information; and(ii)any subsequent use of that personal information.

;

(5)in paragraph (10)—(A)in the paragraph header, by striking

Website or online service directed to children

and inserting

Website, online service, online application, or mobile application directed to children

;(B)by striking website or online service each place it appears and inserting website, online service, online application, or mobile application; and(C)by adding at the end the following new subparagraph:

(C)

Rule of construction

In considering whether a website, online service, online application, or mobile application, or portion thereof, is directed to children, the Commission shall apply a totality of circumstances test and will also consider competent and reliable empirical evidence regarding audience composition and evidence regarding the intended audience of the website, online service, online application, or mobile application.

; and

(6)by adding at the end the following:

(13)

Connected device

The term connected device means a device that is capable of connecting to the internet, directly or indirectly, or to another connected device.(14)

Online application

The term online application—(A)means an internet-connected software program; and(B)includes a service or application offered via a connected device.(15)

Mobile application

The term mobile application—(A)means a software program that runs on the operating system of—(i)a cellular telephone;(ii)a tablet computer; or(iii)a similar portable computing device that transmits data over a wireless connection; and(B)includes a service or application offered via a connected device.(16)

Geolocation information

The term geolocation information means information sufficient to identify a street name and name of a city or town.(17)

Teen

The term teen means an individual who has attained age 13 and is under the age of 17.(18)

Individual-specific advertising to children or teens

(A)

In general

The term individual-specific advertising to children or teens means advertising or any other effort to market a product or service that is directed to a specific child or teen or a connected device that is linked or reasonably linkable to a child or teen based on—(i)the personal information from—(I)the child or teen; or(II)a group of children or teens who are similar in sex, age, household income level, race, or ethnicity to the specific child or teen to whom the product or service is marketed;(ii)profiling of a child or teen or group of children or teens; or(iii)a unique identifier of the connected device.(B)

Exclusions

The term individual-specific advertising to children or teens shall not include—(i)advertising or marketing to an individual or the device of an individual in response to the individual’s specific request for information or feedback, such as a child's or teen's current search query;(ii)contextual advertising, such as when an advertisement is displayed based on the content of the website, online service, online application, mobile application, or connected device in which the advertisement appears and does not vary based on personal information related to the viewer; (iii)processing personal information solely for measuring or reporting advertising or content performance, reach, or frequency, including independent measurement; or(iv)advertising or marketing directed to a connected device used by both adult and child or teen members of a household where such advertising or marketing is directed to the profile of the adult user.(C)

Rule of construction

Nothing in subparagraph (A) shall be construed to prohibit an operator with actual knowledge or knowledge fairly implied on the basis of objective circumstances that a user is under the age of 17 from delivering advertising or marketing that is age-appropriate and intended for a child or teen audience, so long as the operator does not use any personal information other than whether the user is under the age of 17.(19)

Educational agency or institution

The term educational agency or institution means—(A)a State educational agency or local educational agency, as such terms are defined in section 8101 of the Elementary and Secondary Education Act of 1965 (20 U.S.C. 7801); or(B)an institutional day or residential school, including a public school (including a charter school) or private school, that provides elementary or secondary education, as determined under State law.

(b)

Online collection, use, disclosure, and deletion of personal information of children and teens

Section 1303 of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6502) is amended—(1)by striking the heading and inserting the following:

Online collection, use, disclosure, and deletion of personal information of children and teens.

;(2)in subsection (a)—(A)by amending paragraph (1) to read as follows:

(1)

In general

It is unlawful for an operator of a website, online service, online application, or mobile application directed to children or for any operator of a website, online service, online application, or mobile application with actual knowledge or knowledge fairly implied on the basis of objective circumstances that a user is a child or teen—(A)to collect personal information from a child or teen in a manner that violates the regulations prescribed under subsection (b);(B)except as provided in subparagraphs (B) and (C) of section 1302(18), to collect, use, disclose to third parties, or maintain personal information of a child or teen for purposes of individual-specific advertising to children or teens (or to allow another person to collect, use, disclose, or maintain such information for such purpose);(C)to collect the personal information of a child or teen except when the collection of the personal information is—(i)consistent with the context of a particular transaction or service or the relationship of the child or teen with the operator, including collection necessary to fulfill a transaction or provide a product or service requested by the child or teen; or(ii)required or specifically authorized by Federal or State law; or(D)to store or transfer the personal information of a child or teen outside of the United States unless the operator provides direct notice to the parent of the child, in the case of a child, or to the teen, in the case of a teen, that the child's or teen's personal information is being stored or transferred outside of the United States; or(E)to retain the personal information of a child or teen for longer than is reasonably necessary to fulfill a transaction or provide a service requested by the child or teen except as required or specifically authorized by Federal or State law.

; and

(B)in paragraph (2)—(i)in the header, by striking

parent

and inserting

parent or teen

;(ii)by striking Notwithstanding paragraph (1) and inserting Notwithstanding paragraph (1)(A);(iii)by striking of such a website or online service; and(iv)by striking subsection (b)(1)(B)(iii) to the parent of a child and inserting subsection (b)(1)(B)(iv) to the parent of a child or under subsection (b)(1)(C)(iv) to a teen;(3)in subsection (b)—(A)in paragraph (1)—(i)in subparagraph (A)—(I)by striking operator of any website and all that follows through from a child and inserting operator of a website, online service, online application, or mobile application directed to children or that has actual knowledge or knowledge fairly implied on the basis of objective circumstances that a user is a child or teen;(II)in clause (i)— (aa)by striking notice on the website and inserting clear and conspicuous notice on the website;(bb)by inserting or teens after children;(cc)by striking , and the operator's and inserting , the operator's; and(dd)by striking ; and and inserting , the rights and opportunities available to the parent of the child or teen under subparagraphs (B) and (C), and the procedures or mechanisms the operator uses to ensure that personal information is not collected from children or teens except in accordance with the regulations promulgated under this paragraph;;(III)in clause (ii)— (aa)by striking parental;(bb)by inserting or teens after children;(cc)by striking the semicolon at the end and inserting ; and; and(IV)by inserting after clause (ii) the following new clause:

(iii)to obtain verifiable consent from a parent of a child or from a teen before using or disclosing personal information of the child or teen for any purpose that is a material change from the original purposes and disclosure practices specified to the parent of the child or the teen under clause (i);

;

(ii)in subparagraph (B)—(I)in the matter preceding clause (i), by striking website or online service and inserting operator;(II)in clause (i), by inserting and the method by which the operator obtained the personal information, and the purposes for which the operator collects, uses, discloses, and retains the personal information before the semicolon; (III)in clause (ii)—(aa)by inserting to delete personal information collected from the child or content or information submitted by the child to a website, online service, online application, or mobile application and after the opportunity at any time; and(bb)by striking ; and and inserting a semicolon;(IV)by redesignating clause (iii) as clause (iv) and inserting after clause (ii) the following new clause:

(iii)the opportunity to challenge the accuracy of the personal information and, if the parent of the child establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected;

; and

(V)in clause (iv), as so redesignated, by inserting , if such information is available to the operator at the time the parent makes the request before the semicolon;(iii)by redesignating subparagraphs (C) and (D) as subparagraphs (D) and (E), respectively;(iv)by inserting after subparagraph (B) the following new subparagraph:

(C)require the operator to provide, upon the request of a teen under this subparagraph who has provided personal information to the operator, upon proper identification of that teen—(i)a description of the specific types of personal information collected from the teen by the operator, the method by which the operator obtained the personal information, and the purposes for which the operator collects, uses, discloses, and retains the personal information;(ii)the opportunity at any time to delete personal information collected from the teen or content or information submitted by the teen to a website, online service, online application, or mobile application and to refuse to permit the operator's further use or maintenance in retrievable form, or online collection, of personal information from the teen;(iii)the opportunity to challenge the accuracy of the personal information and, if the teen establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected; and(iv)a means that is reasonable under the circumstances for the teen to obtain any personal information collected from the teen, if such information is available to the operator at the time the teen makes the request;

;

(v)in subparagraph (D), as so redesignated— (I)by striking a child's and inserting a child's or teen's; and(II)by inserting or teen after the child; and(vi)by amending subparagraph (E), as so redesignated, to read as follows:

(E)require the operator to establish, implement, and maintain reasonable security practices to protect the confidentiality, integrity, and accessibility of personal information of children or teens collected by the operator, and to protect such personal information against unauthorized access.

;

(B)in paragraph (2)—(i)in the matter preceding subparagraph (A), by striking verifiable parental consent and inserting verifiable consent;(ii)in subparagraph (A)—(I)by inserting or teen after collected from a child;(II)by inserting or teen after request from the child; and(III)by inserting or teen or to contact another child or teen after to recontact the child;(iii)in subparagraph (B)—(I)by striking parent or child and inserting parent or teen; and(II)by striking parental consent each place the term appears and inserting verifiable consent;(iv)in subparagraph (C)—(I)in the matter preceding clause (i), by inserting or teen after child each place the term appears;(II)in clause (i)—(aa)by inserting or teen after child each place the term appears; and(bb)by inserting or teen, as applicable, after parent each place the term appears; and(III)in clause (ii)— (aa)by striking without notice to the parent and inserting without notice to the parent or teen, as applicable,; and(bb)by inserting or teen after child each place the term appears; and(v)in subparagraph (D)—(I)in the matter preceding clause (i), by inserting or teen after child each place the term appears;(II)in clause (ii), by inserting or teen after child; and(III)in the flush text following clause (iii)—(aa)by inserting or teen, as applicable, after parent each place the term appears; and(bb)by inserting or teen after child;(C)by redesignating paragraph (3) as paragraph (4) and inserting after paragraph (2) the following new paragraph:

(3)

Application to operators acting under agreements with educational agencies or institutions

The regulations may provide that verifiable consent under paragraph (1)(A)(ii) is not required for an operator that is acting under a written agreement with an educational agency or institution that, at a minimum, requires the—(A)operator to—(i)limit its collection, use, and disclosure of the personal information from a child or teen to solely educational purposes and for no other commercial purposes;(ii)provide the educational agency or institution with a notice of the specific types of personal information the operator will collect from the child or teen, the method by which the operator will obtain the personal information, and the purposes for which the operator will collect, use, disclose, and retain the personal information;(iii)provide the educational agency or institution with a link to the operator’s online notice of information practices as required under subsection (b)(1)(A)(i); and(iv)provide the educational agency or institution, upon request, with a means to review the personal information collected from a child or teen, to prevent further use or maintenance or future collection of personal information from a child or teen, and to delete personal information collected from a child or teen or content or information submitted by a child or teen to the operator’s website, online service, online application, or mobile application;(B)representative of the educational agency or institution to acknowledge and agree that they have authority to authorize the collection, use, and disclosure of personal information from children or teens on behalf of the educational agency or institution, along with such authorization, their name, and title at the educational agency or institution; and(C)educational agency or institution to—(i)provide on its website a notice that identifies the operator with which it has entered into a written agreement under this subsection and provides a link to the operator’s online notice of information practices as required under paragraph (1)(A)(i);(ii)provide the operator’s notice regarding its information practices, as required under subparagraph (A)(ii), upon request, to a parent, in the case of a child, or a parent or teen, in the case of a teen; and(iii)upon the request of a parent, in the case of a child, or a parent or teen, in the case of a teen, request the operator provide a means to review the personal information from the child or teen and provide the parent, in the case of a child, or parent or teen, in the case of the teen, a means to review the personal information.

;

(D)by amending paragraph (4), as so redesignated, to read as follows:

(4)

Termination of service

The regulations shall permit the operator of a website, online service, online application, or mobile application to terminate service provided to a child whose parent has refused, or a teen who has refused, under the regulations prescribed under paragraphs (1)(B)(ii) and (1)(C)(ii), to permit the operator’s further use or maintenance in retrievable form, or future online collection of, personal information from that child or teen.

; and

(E)by adding at the end the following new paragraphs:

(5)

Continuation of service

The regulations shall prohibit an operator from discontinuing service provided to a child or teen on the basis of a request by the parent of the child or by the teen, under the regulations prescribed under subparagraph (B) or (C) of paragraph (1), respectively, to delete personal information collected from the child or teen, to the extent that the operator is capable of providing such service without such information.(6)

Rule of construction

A request made pursuant to subparagraph (B) or (C) of paragraph (1) to delete or correct personal information of a child or teen shall not be construed—(A)to limit the authority of a law enforcement agency to obtain any content or information from an operator pursuant to a lawfully executed warrant or an order of a court of competent jurisdiction;(B)to require an operator or third party delete or correct information that—(i)any other provision of Federal or State law requires the operator or third party to maintain; or(ii)was submitted to the website, online service, online application, or mobile application of the operator by any person other than the user who is attempting to erase or otherwise eliminate the content or information, including content or information submitted by the user that was republished or resubmitted by another person; or(C)to prohibit an operator from—(i)retaining a record of the deletion request and the minimum information necessary for the purposes of ensuring compliance with a request made pursuant to subparagraph (B) or (C);(ii)preventing, detecting, protecting against, or responding to security incidents, identity theft, or fraud, or reporting those responsible for such actions;(iii)protecting the integrity or security of a website, online service, online application or mobile application; or(iv)ensuring that the child's or teen's information remains deleted.(7)

Common verifiable consent mechanism

(A)

In general

(i)

Feasibility of mechanism

The Commission shall assess the feasibility, with notice and public comment, of allowing operators the option to use a common verifiable consent mechanism that fully meets the requirements of this title. (ii)

Requirements

The feasibility assessment described in clause (i) shall consider whether a single operator could use a common verifiable consent mechanism to obtain verifiable consent, as required under this title, from a parent of a child or from a teen on behalf of multiple, listed operators that provide a joint or related service.(B)

Report

Not later than 1 year after the date of enactment of this paragraph, the Commission shall submit a report to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Energy and Commerce of the House of Representatives with the findings of the assessment required by subparagraph (A).(C)

Regulations

If the Commission finds that the use of a common verifiable consent mechanism is feasible and would meet the requirements of this title, the Commission shall issue regulations to permit the use of a common verifiable consent mechanism in accordance with the findings outlined in such report.

;

(4)in subsection (c), by striking a regulation prescribed under subsection (a) and inserting subparagraph (B), (C), (D), or (E) of subsection (a)(1), or of a regulation prescribed under subsection (b),; and(5)by striking subsection (d) and inserting the following:

(d)

Relationship to State law

The provisions of this title shall preempt any State law, rule, or regulation only to the extent that such State law, rule, or regulation conflicts with a provision of this title. Nothing in this title shall be construed to prohibit any State from enacting a law, rule, or regulation that provides greater protection to children or teens than the provisions of this title.

(c)

Safe harbors

Section 1304 of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6503) is amended—(1)in subsection (b)(1), by inserting and teens after children; and(2)by adding at the end the following:

(d)

Publication

(1)

In general

Subject to the restrictions described in paragraph (2), the Commission shall publish on the internet website of the Commission any report or documentation required by regulation to be submitted to the Commission to carry out this section.(2)

Restrictions on publication

The restrictions described in section 6(f) and section 21 of the Federal Trade Commission Act (15 U.S.C. 46(f), 57b–2) applicable to the disclosure of information obtained by the Commission shall apply in same manner to the disclosure under this subsection of information obtained by the Commission from a report or documentation described in paragraph (1).

(d)

Actions by States

Section 1305 of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6504) is amended—(1)in subsection (a)(1)—(A)in the matter preceding subparagraph (A), by inserting section 1303(a)(1) or before any regulation; and(B)in subparagraph (B), by inserting section 1303(a)(1) or before the regulation; and(2)in subsection (d)—(A)by inserting section 1303(a)(1) or before any regulation; and(B)by inserting section 1303(a)(1) or before that regulation.(e)

Administration and applicability of Act

Section 1306 of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6505) is amended—(1)in subsection (b)—(A)in paragraph (1), by striking , in the case of and all that follows through the Board of Directors of the Federal Deposit Insurance Corporation; and inserting the following: by the appropriate Federal banking agency, with respect to any insured depository institution (as those terms are defined in section 3 of that Act (12 U.S.C. 1813));; and(B)by striking paragraph (2) and redesignating paragraphs (3) through (6) as paragraphs (2) through (5), respectively;(2)in subsection (d)—(A)by inserting section 1303(a)(1) or before a rule; and(B)by striking such rule and inserting section 1303(a)(1) or a rule of the Commission under section 1303; and(3)by adding at the end the following new subsections:

(f)

Determination of whether an operator has knowledge fairly implied on the basis of objective circumstances

(1)

Rule of construction

For purposes of enforcing this title or a regulation promulgated under this title, in making a determination as to whether an operator has knowledge fairly implied on the basis of objective circumstances that a specific user is a child or teen, the Commission or State attorneys general shall rely on competent and reliable evidence, taking into account the totality of the circumstances, including whether a reasonable and prudent person under the circumstances would have known that the user is a child or teen. Nothing in this title, including a determination described in the preceding sentence, shall be construed to require an operator to—(A)affirmatively collect any personal information with respect to the age of a child or teen that an operator is not already collecting in the normal course of business; or(B)implement an age gating or age verification functionality.(2)

Commission guidance

(A)

In general

Within 180 days of enactment, the Commission shall issue guidance to provide information, including best practices and examples for operators to understand the Commission’s determination of whether an operator has knowledge fairly implied on the basis of objective circumstances that a user is a child or teen.(B)

Limitation

No guidance issued by the Commission with respect to this title shall confer any rights on any person, State, or locality, nor shall operate to bind the Commission or any person to the approach recommended in such guidance. In any enforcement action brought pursuant to this title, the Commission or State attorney general, as applicable, shall allege a specific violation of a provision of this title. The Commission or State attorney general, as applicable, may not base an enforcement action on, or execute a consent order based on, practices that are alleged to be inconsistent with any such guidance, unless the practices allegedly violate this title. For purposes of enforcing this title or a regulation promulgated under this title, State attorneys general shall take into account any guidance issued by the Commission under subparagraph (A).(g)

Additional requirement

Any regulations issued under this title shall include a description and analysis of the impact of proposed and final Rules on small entities per the Regulatory Flexibility Act of 1980 (5 U.S.C. 601 et seq.).