[Congressional Bills 117th Congress]
[From the U.S. Government Publishing Office]
[S. 3663 Reported in Senate (RS)]

<DOC>





                                                       Calendar No. 660
117th CONGRESS
  2d Session
                                S. 3663

           To protect the safety of children on the internet.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                           February 16, 2022

 Mr. Blumenthal (for himself, Mrs. Blackburn, Mr. Markey, Mrs. Capito, 
  Mr. Lujan, Mr. Cassidy, Ms. Baldwin, Ms. Ernst, Ms. Klobuchar, Mr. 
  Daines, Mr. Peters, Mr. Rubio, Mr. Hickenlooper, and Mr. Sullivan) 
introduced the following bill; which was read twice and referred to the 
           Committee on Commerce, Science, and Transportation

                           December 15, 2022

              Reported by Ms. Cantwell, with an amendment
 [Strike out all after the enacting clause and insert the part printed 
                               in italic]

_______________________________________________________________________

                                 A BILL


 
           To protect the safety of children on the internet.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

<DELETED>SECTION 1. SHORT TITLE; TABLE OF CONTENTS.</DELETED>

<DELETED>    (a) Short Title.--This Act may be cited as the ``Kids 
Online Safety Act''.</DELETED>
<DELETED>    (b) Table of Contents.--The table of contents for this Act 
is as follows:</DELETED>

<DELETED>Sec. 1. Short title; table of contents.
<DELETED>Sec. 2. Definitions.
<DELETED>Sec. 3. Duty of care.
<DELETED>Sec. 4. Safeguards for minors.
<DELETED>Sec. 5. Disclosure.
<DELETED>Sec. 6. Transparency.
<DELETED>Sec. 7. Independent research.
<DELETED>Sec. 8. Market research.
<DELETED>Sec. 9. Age verification study and report.
<DELETED>Sec. 10. Enforcement.
<DELETED>Sec. 11. Kids Online Safety Council.
<DELETED>Sec. 12. Authorization of appropriations.
<DELETED>Sec. 13. Effective date.
<DELETED>Sec. 14. Severability.

<DELETED>SEC. 2. DEFINITIONS.</DELETED>

<DELETED>    In this Act:</DELETED>
        <DELETED>    (1) Algorithmic recommendation system.--The term 
        ``algorithmic recommendation system'' means a fully or 
        partially automated system used to suggest, promote, or rank 
        information.</DELETED>
        <DELETED>    (2) Covered platform.--The term ``covered 
        platform'' means a commercial software application or 
        electronic service that connects to the internet and that is 
        used, or is reasonably likely to be used, by a minor.</DELETED>
        <DELETED>    (3) Minor.--The term ``minor'' means an individual 
        who is age 16 or younger.</DELETED>
        <DELETED>    (4) Parent.--The term ``parent'' includes a legal 
        guardian or an individual with legal custody over a 
        child.</DELETED>
        <DELETED>    (5) Personal data.--The term ``personal data'' 
        means information that identifies or is linked or reasonably 
        linkable to an individual, household, or consumer 
        device.</DELETED>

<DELETED>SEC. 3. DUTY OF CARE.</DELETED>

<DELETED>    (a) Best Interests.--A covered platform has a duty to act 
in the best interests of a minor that uses the platform's products or 
services.</DELETED>
<DELETED>    (b) Prevention of Harm to Minors.--In acting in the best 
interests of minors, a covered platform has a duty to prevent and 
mitigate the heightened risks of physical, emotional, developmental, or 
material harms to minors posed by materials on, or engagement with, the 
platform, including--</DELETED>
        <DELETED>    (1) promotion of self-harm, suicide, eating 
        disorders, substance abuse, and other matters that pose a risk 
        to physical and mental health of a minor;</DELETED>
        <DELETED>    (2) patterns of use that indicate or encourage 
        addiction-like behaviors;</DELETED>
        <DELETED>    (3) physical harm, online bullying, and harassment 
        of a minor;</DELETED>
        <DELETED>    (4) sexual exploitation, including enticement, 
        grooming, sex trafficking, and sexual abuse of minors and 
        trafficking of online child sexual abuse material;</DELETED>
        <DELETED>    (5) promotion and marketing of products or 
        services that are unlawful for minors, such as illegal drugs, 
        tobacco, gambling, or alcohol; and</DELETED>
        <DELETED>    (6) predatory, unfair, or deceptive marketing 
        practices.</DELETED>

<DELETED>SEC. 4. SAFEGUARDS FOR MINORS.</DELETED>

<DELETED>    (a) Safeguards for Minors.--</DELETED>
        <DELETED>    (1) In general.--A covered platform shall provide 
        a minor, or a parent acting on a minor's behalf, with readily 
        accessible and easy-to-use safeguards to control their 
        experience and personal data on the covered platform, including 
        settings to--</DELETED>
                <DELETED>    (A) limit the ability of other individuals 
                to contact or find a minor, in particular adults with 
                no relationship to the minor;</DELETED>
                <DELETED>    (B) prevent other individuals from viewing 
                the minor's personal data collected by or shared on the 
                covered platform, in particular restricting public 
                access to personal data;</DELETED>
                <DELETED>    (C) limit features that increase, sustain, 
                or extend use of the covered platform by a minor, such 
                as automatic playing of media, rewards for time spent 
                on the platform, and notifications;</DELETED>
                <DELETED>    (D) opt out of algorithmic recommendation 
                systems that use a minor's personal data;</DELETED>
                <DELETED>    (E) delete the minor's account and request 
                removal of personal data;</DELETED>
                <DELETED>    (F) restrict the sharing of the 
                geolocation of a minor and to provide notice regarding 
                the tracking of a minor's geolocation; and</DELETED>
                <DELETED>    (G) limit time spent by a minor on the 
                covered platform.</DELETED>
        <DELETED>    (2) Default safeguard settings for minors.--A 
        covered platform shall provide that, in the case of a user that 
        the platform knows or reasonably believes to be a minor, the 
        default setting for any safeguard described under paragraph (1) 
        shall be the strongest option available.</DELETED>
        <DELETED>    (3) Accessibility for minors.--With respect to 
        safeguards described under paragraph (1), a covered platform 
        shall provide information and control options in a manner that 
        is age appropriate and does not encourage minors to weaken or 
        turn off safeguards.</DELETED>
<DELETED>    (b) Parental Tools.--</DELETED>
        <DELETED>    (1) Parental tools.--A covered platform shall 
        provide readily accessible and easy-to-use parental tools for 
        parents to appropriately supervise the use of the covered 
        platform by a minor.</DELETED>
        <DELETED>    (2) Requirements.--The parental tools provided by 
        a covered platform shall include--</DELETED>
                <DELETED>    (A) the ability to control privacy and 
                account settings, including the safeguards established 
                under subsection (a)(1);</DELETED>
                <DELETED>    (B) the ability to restrict purchases and 
                financial transactions by a minor;</DELETED>
                <DELETED>    (C) the ability to track total time spent 
                on the platform;</DELETED>
                <DELETED>    (D) a clear and conspicuous mechanism for 
                parents to opt out of or turn off any default parental 
                tools put in place by the covered platform; 
                and</DELETED>
                <DELETED>    (E) access to other information regarding 
                a minor's use of a covered platform and control options 
                necessary to a parent's ability to address the harms 
                described in section 3(b).</DELETED>
        <DELETED>    (3) Notice to minors.--A covered platform shall 
        provide clear and conspicuous notice to a minor when parental 
        tools are in effect.</DELETED>
        <DELETED>    (4) Default parental tools.--A covered platform 
        shall provide that, in the case of a user that the platform 
        knows or reasonably believes to be a minor, parental tools 
        shall be enabled by default.</DELETED>
<DELETED>    (c) Reporting Mechanism.--</DELETED>
        <DELETED>    (1) Parental reports.--A covered platform shall 
        provide minors and parents with--</DELETED>
                <DELETED>    (A) a readily accessible and easy-to-use 
                means to submit reports of harms to a minor, including 
                harms described in section 3(b);</DELETED>
                <DELETED>    (B) an electronic point of contact 
                specific to matters involving harms to a minor; 
                and</DELETED>
                <DELETED>    (C) confirmation of the receipt of such a 
                report and a means to track a submitted 
                report.</DELETED>
        <DELETED>    (2) Timing.--A covered platform shall establish an 
        internal process to receive and respond to reports in a 
        reasonable and timely manner.</DELETED>
<DELETED>    (d) Illegal Content.--A covered platform shall not 
facilitate the advertising of products or services to minors that are 
illegal to sell to minors based on applicable State or Federal 
law.</DELETED>

<DELETED>SEC. 5. DISCLOSURE.</DELETED>

<DELETED>    (a) Notice.--</DELETED>
        <DELETED>    (1) Registration.--Prior to registration, use, or 
        purchase of a covered platform by a minor, the platform shall 
        provide clear, accessible, and easy-to-understand--</DELETED>
                <DELETED>    (A) notice of the policies and practices 
                of the covered platform with respect to personal data 
                and safeguards for minors;</DELETED>
                <DELETED>    (B) information about how to access the 
                safeguards and parental tools required under section 4; 
                and</DELETED>
                <DELETED>    (C) notice about whether the covered 
                platform, including any algorithmic recommendation 
                systems used by the platform, pose any heightened risks 
                of harm to a minor, including harms described in 
                section 3(b).</DELETED>
        <DELETED>    (2) Parental notification.--For a minor, or an 
        individual that a covered platform reasonably believes is a 
        minor, a covered platform shall additionally provide the 
        notice, information, and statement described in paragraph (1) 
        to a parent of the minor.</DELETED>
        <DELETED>    (3) Acknowledgment.--After providing the notice, 
        information, and statement described in paragraph (1), but 
        prior to initial use of the covered platform, the covered 
        platform shall obtain acknowledgment from a minor, or a parent 
        of the minor, of the receipt of information related to the 
        heightened risks of harm to minors referenced in the statement 
        in paragraph (1)(C).</DELETED>
<DELETED>    (b) Algorithmic Recommendation System.--A covered platform 
that uses an algorithmic recommendation system shall set out in its 
terms and conditions, in a clear, accessible, and easy-to-understand 
manner--</DELETED>
        <DELETED>    (1) an overview of how algorithmic recommendation 
        systems are used by the covered platform to provide information 
        to users of the platform who are minors, including how such 
        systems use personal data belonging to minors; and</DELETED>
        <DELETED>    (2) options for minors or their parents to modify 
        the results of the algorithmic recommendation system, including 
        the right to opt out or down-rank types or categories of 
        recommendations.</DELETED>
<DELETED>    (c) Advertising and Marketing.--A covered platform that 
facilitates advertising aimed at minors shall provide clear, 
accessible, and easy-to-understand information and labels regarding--
</DELETED>
        <DELETED>    (1) the name of the product, service, or brand and 
        the subject matter of an advertisement or marketing 
        material;</DELETED>
        <DELETED>    (2) why the minor is being targeted for a 
        particular advertisement or marketing material if the covered 
        platform engages in targeted advertising, including meaningful 
        information about how the personal data of the minor was used 
        to target the advertisement or marketing material; 
        and</DELETED>
        <DELETED>    (3) whether particular media displayed to a user 
        is an advertisement or marketing material, including disclosure 
        of endorsements of products, services, or brands made for 
        commercial consideration by other users of the 
        platform.</DELETED>
<DELETED>    (d) Resources for Parents and Minors.--A covered platform 
shall provide to minors and parents clear, accessible, easy-to-
understand, and comprehensive information in a prominent location 
regarding--</DELETED>
        <DELETED>    (1) its policies and practices with respect to 
        personal data and safeguards for minors; and</DELETED>
        <DELETED>    (2) how to access the safeguards and parental 
        tools required under section 4.</DELETED>

<DELETED>SEC. 6. TRANSPARENCY.</DELETED>

<DELETED>    (a) Audit of Systemic Risks to Minors.--</DELETED>
        <DELETED>    (1) In general.--Not less frequently than once a 
        year, a covered platform shall issue a public report 
        identifying the foreseeable risks of harm to minors based on an 
        independent, third-party audit conducted through reasonable 
        inspection of the covered platform and describe the prevention 
        and mitigation measures taken to address such risks.</DELETED>
        <DELETED>    (2) Content.--</DELETED>
                <DELETED>    (A) Transparency.--The public reports 
                required of a covered platform under this section shall 
                include--</DELETED>
                        <DELETED>    (i) an assessment of whether the 
                        covered platform is reasonably likely to be 
                        accessed by minors;</DELETED>
                        <DELETED>    (ii) a description of the 
                        commercial interests of the covered platform in 
                        use by minors;</DELETED>
                        <DELETED>    (iii) an accounting of the number 
                        of individuals using the covered platform 
                        reasonably believed to be minors in the United 
                        States, disaggregated by the age ranges of 0-5, 
                        6-9, 10-12, and 13-16;</DELETED>
                        <DELETED>    (iv) an accounting of the time 
                        spent by the median and average minor in the 
                        United States on a daily, weekly, and monthly 
                        basis, disaggregated by the age ranges of 0-5, 
                        6-9, 10-12, and 13-16;</DELETED>
                        <DELETED>    (v) an accounting, disaggregated 
                        by category of harm, of--</DELETED>
                                <DELETED>    (I) the total number of 
                                reports of the dissemination of illegal 
                                or harmful content involving minors; 
                                and</DELETED>
                                <DELETED>    (II) the prevalence of 
                                content that is illegal or harmful to 
                                minors; and</DELETED>
                        <DELETED>    (vi) a description of any material 
                        breaches of parental tools or assurances 
                        regarding minors, unexpected use of the 
                        personal data of minors, and other matters 
                        regarding non-compliance.</DELETED>
                <DELETED>    (B) Systemic risks assessment.--The public 
                reports required of a covered platform under this 
                section shall include--</DELETED>
                        <DELETED>    (i) an audit of the known and 
                        emerging risks to minors posed by the covered 
                        platform, including the harms described in 
                        section 3(b);</DELETED>
                        <DELETED>    (ii) an assessment of how 
                        algorithmic recommendation systems and targeted 
                        advertising systems can contribute to harms to 
                        minors;</DELETED>
                        <DELETED>    (iii) a description of whether and 
                        how the covered platform uses system design 
                        features to increase, sustain, or extend use of 
                        a product or service by a minor, such as 
                        automatic playing of media, rewards for time 
                        spent, and notifications;</DELETED>
                        <DELETED>    (iv) a description of whether, 
                        how, and for what purpose the platform collects 
                        or processes geolocation, contact information, 
                        health data, or other categories of personal 
                        data of heightened concern regarding minors, as 
                        determined by the Commission;</DELETED>
                        <DELETED>    (v) an evaluation of the efficacy 
                        and any issues in delivering safeguards to 
                        minors under section 4; and</DELETED>
                        <DELETED>    (vi) an evaluation of any other 
                        relevant matters of public concern over risks 
                        to minors.</DELETED>
                <DELETED>    (C) Mitigation.--The public reports 
                required of a covered platform under this section shall 
                include--</DELETED>
                        <DELETED>    (i) a description of the 
                        safeguards and parental tools available to 
                        minors and parents on the covered 
                        platform;</DELETED>
                        <DELETED>    (ii) a description of 
                        interventions by the covered platform when it 
                        had or has reason to believe that harm could 
                        occur to minors;</DELETED>
                        <DELETED>    (iii) a description of the 
                        prevention and mitigation measures intended to 
                        be taken in response to the known and emerging 
                        risks identified in its audit of system risks, 
                        including steps taken to--</DELETED>
                                <DELETED>    (I) adapt or remove system 
                                design features that expose minors to 
                                risks;</DELETED>
                                <DELETED>    (II) set safeguards to 
                                their most safe settings by 
                                default;</DELETED>
                                <DELETED>    (III) prevent the presence 
                                of illegal and illicit content on the 
                                covered platform; and</DELETED>
                                <DELETED>    (IV) adapt algorithmic 
                                recommendation system to prioritize the 
                                best interests of users who are 
                                minors;</DELETED>
                        <DELETED>    (iv) a description of internal 
                        processes for handling reports and automated 
                        detection mechanisms for harms to minors, 
                        including the rate, timeliness, and 
                        effectiveness of responses under the 
                        requirement of section 4(c);</DELETED>
                        <DELETED>    (v) the status of implementing 
                        prevention and mitigation measures identified 
                        in prior assessments; and</DELETED>
                        <DELETED>    (vi) a description of the 
                        additional measures to be taken by the covered 
                        platform to address the circumvention of 
                        safeguards and parental tools.</DELETED>
        <DELETED>    (3) Reasonable inspection.--In conducting an 
        inspection of the systemic risks of harm to minors, a covered 
        platform shall--</DELETED>
                <DELETED>    (A) take into consideration the function 
                of algorithmic recommendation systems;</DELETED>
                <DELETED>    (B) consult parents, experts, and civil 
                society with respect to the prevention of harms to 
                minors;</DELETED>
                <DELETED>    (C) conduct research based on experiences 
                of minors that use the covered platform, including 
                harms reported under section 4(c);</DELETED>
                <DELETED>    (D) take account of research, including 
                research regarding system design features, marketing, 
                or product integrity, industry best practices, or 
                outside research; and</DELETED>
                <DELETED>    (E) consider indicia or inferences of age 
                of users, in addition to any self-declared information 
                about the age of individuals.</DELETED>
        <DELETED>    (4) Privacy safeguards.--In issuing the public 
        reports required under this section, a covered platform shall 
        take steps to safeguard the privacy of its users, including 
        ensuring that data is presented in a de-anonymized, aggregated 
        format.</DELETED>

<DELETED>SEC. 7. INDEPENDENT RESEARCH.</DELETED>

<DELETED>    (a) Definitions.--In this section:</DELETED>
        <DELETED>    (1) Assistant secretary.--The term ``Assistant 
        Secretary'' means the Assistant Secretary of Commerce for 
        Communications and Information.</DELETED>
        <DELETED>    (2) Eligible researcher.--The term ``eligible 
        researcher'' means an individual or group of individuals 
        affiliated with or employed by--</DELETED>
                <DELETED>    (A) an institution of higher education (as 
                defined in section 101 of the Higher Education Act of 
                1965 (20 U.S.C. 1001)); or</DELETED>
                <DELETED>    (B) a nonprofit organization, including 
                any organization described in section 501(c) of the 
                Internal Revenue Code of 1986.</DELETED>
        <DELETED>    (3) Program.--The term ``Program'' means the 
        program established under subsection (b)(1).</DELETED>
        <DELETED>    (4) Public interest research.--The term ``public 
        interest research'' means the scientific or historical analysis 
        of information that is performed for the primary purpose of 
        advancing a broadly recognized public interest.</DELETED>
        <DELETED>    (5) Qualified researcher.--The term ``qualified 
        researcher'' means an eligible researcher who is approved by 
        the Assistant Secretary to conduct public interest research 
        regarding harms to minors under the Program.</DELETED>
<DELETED>    (b) Access to Data on Harms to Minors.--</DELETED>
        <DELETED>    (1) Establishment.--The Assistant Secretary shall 
        establish a program under which an eligible researcher may 
        apply for, and a covered platform shall provide, access to data 
        assets from the covered platform for the sole purpose of 
        conducting public interest research regarding harms to the 
        safety and well-being of minors, including matters described in 
        section 3(b).</DELETED>
        <DELETED>    (2) Application requirements.--In order to be 
        approved to access data assets from a covered platform, an 
        eligible researcher shall, in the application submitted under 
        paragraph (1)--</DELETED>
                <DELETED>    (A) conduct the research for noncommercial 
                purposes;</DELETED>
                <DELETED>    (B) demonstrate a proven record of 
                expertise on the proposed research topic and related 
                research methodologies; and</DELETED>
                <DELETED>    (C) commit to fulfill, and demonstrate a 
                capacity to fulfill, the specific data security and 
                confidentiality requirements corresponding to the 
                application.</DELETED>
        <DELETED>    (3) Duties and rights of covered platforms.--
        </DELETED>
                <DELETED>    (A) Access to data assets.--</DELETED>
                        <DELETED>    (i) In general.--If the Assistant 
                        Secretary approves an application under 
                        paragraph (1) with respect to a covered 
                        platform, the covered platform shall, in a 
                        timely manner, provide the qualified researcher 
                        with access to data assets necessary to conduct 
                        public interest research described in that 
                        paragraph.</DELETED>
                        <DELETED>    (ii) Form of access.--A covered 
                        platform shall provide to a qualified 
                        researcher access to data assets under clause 
                        (i) through online databases, application 
                        programming interfaces, and data files as 
                        appropriate for the qualified researcher to 
                        undertake public interest research.</DELETED>
                <DELETED>    (B) Nondisclosure agreement.--A covered 
                platform may require, as a condition of access to the 
                data assets of the covered platform, that a qualified 
                researcher enter into a nondisclosure agreement 
                regarding the release of data assets, provided that--
                </DELETED>
                        <DELETED>    (i) the agreement does not 
                        restrict the publication of the qualified 
                        researcher's findings; and</DELETED>
                        <DELETED>    (ii) the terms of the agreement 
                        allow the qualified researcher to provide the 
                        original agreement or a copy of the agreement 
                        to the Assistant Secretary.</DELETED>
                <DELETED>    (C) Appeal.--A covered platform may appeal 
                the granting of an application under paragraph (1) on 
                the grounds that, and the Assistant Secretary shall 
                grant such appeal if--</DELETED>
                        <DELETED>    (i) the covered platform does not 
                        have access to the requested data assets; 
                        or</DELETED>
                        <DELETED>    (ii) providing access to the data 
                        assets will lead to significant vulnerabilities 
                        in the security of the covered platform's 
                        service.</DELETED>
        <DELETED>    (4) Processes, procedures, and standards.--Not 
        later than 1 year after the date of enactment of this Act, the 
        Assistant Secretary shall establish--</DELETED>
                <DELETED>    (A)(i) a process by which an eligible 
                researcher may submit an application described in 
                paragraph (1); and</DELETED>
                <DELETED>    (ii) an appeals process for eligible 
                researchers to appeal adverse decisions on applications 
                described in paragraph (1) (including a decision to 
                grant an appeal under paragraph (3)(C));</DELETED>
                <DELETED>    (B) procedures for implementation of the 
                Program, including methods for--</DELETED>
                        <DELETED>    (i) participation by covered 
                        platforms; and</DELETED>
                        <DELETED>    (ii) verification by the Assistant 
                        Secretary of the credentials of eligible 
                        researchers;</DELETED>
                <DELETED>    (C) standards for privacy, security, and 
                confidentiality required to participate in the Program; 
                and</DELETED>
                <DELETED>    (D) standards for transparency regarding 
                the operation and administration of the 
                Program.</DELETED>
        <DELETED>    (5) Duty of confidentiality.--To protect user 
        privacy, a qualified researcher shall have a duty of 
        confidentiality with respect to data assets provided by a 
        covered platform, which may be defined by the Assistant 
        Secretary.</DELETED>
        <DELETED>    (6) Federal agencies.--Nothing in this subsection 
        shall be construed to authorize a Federal agency to seek access 
        to the data of a covered platform through the 
        Program.</DELETED>
<DELETED>    (c) Safe Harbor for Independent Collection.--With respect 
to public interest research conducted regarding harms to minors, 
including matters described in section 3(b), no cause of action related 
to terms of service violations undertaken while collecting data assets 
in the course of such research shall lie or be maintained in any court 
against the researcher conducting the research.</DELETED>
<DELETED>    (d) Rulemaking.--The Assistant Secretary, in consultation 
with the Secretary of Commerce and the Director of the National 
Institute of Standards and Technology, shall promulgate rules in 
accordance with section 553 of title 5, United States Code, as 
necessary to implement this section.</DELETED>

<DELETED>SEC. 8. MARKET RESEARCH.</DELETED>

<DELETED>    (a) Market Research by Covered Platforms.--The Federal 
Trade Commission, in coordination with the Secretary of Commerce, shall 
establish guidelines for covered platforms seeking to conduct market- 
and product-focused research on minors or individuals it reasonably 
believes to be minors. Such guidelines shall include--</DELETED>
        <DELETED>    (1) a standard consent form that provides minors 
        and their parents a clear and easy-to-understand explanation of 
        the scope and purpose of the research to be conducted, and 
        provides an opportunity for informed consent; and</DELETED>
        <DELETED>    (2) recommendations for research practices for 
        studies that may include minors, disaggregated by the age 
        ranges of 0-5, 6-9, 10-12, 13-15, and 16-17.</DELETED>
<DELETED>    (b) Guidelines.--The Federal Trade Commission shall 
promulgate such guidelines not later than 18 months after the date of 
enactment of this Act. In doing so, they shall seek input from members 
of the public and the representatives of the Kids Online Safety Council 
established under section 11.</DELETED>

<DELETED>SEC. 9. AGE VERIFICATION STUDY AND REPORT.</DELETED>

<DELETED>    (a) Study.--The Director of the National Institute of 
Standards and Technology, in coordination with the Federal 
Communications Commission, Federal Trade Commission, and the Secretary 
of Commerce, shall conduct a study evaluating the most technologically 
feasible options for developing systems to verify age at the device or 
operating system level.</DELETED>
<DELETED>    (b) Contents.--Such study shall consider--</DELETED>
        <DELETED>    (1) the benefits of creating a device or operating 
        system level age verification system;</DELETED>
        <DELETED>    (2) what information may need to be collected to 
        create this type of age verification system;</DELETED>
        <DELETED>    (3) the accuracy of such systems and their impact 
        or steps to improve accessibility, including for individuals 
        with disabilities;</DELETED>
        <DELETED>    (4) how such a system or systems could verify age 
        while mitigating risks to user privacy and data security and 
        safeguarding minors' personal data; and</DELETED>
        <DELETED>    (5) the technical feasibility, including the need 
        for potential hardware and software changes, including for 
        devices currently in commerce and owned by consumers.</DELETED>
<DELETED>    (c) Report.--Not later than 1 year after the date of 
enactment of this Act, the agencies described in subsection (a) shall 
submit a report containing the results of the study conducted under 
such subsection to the Committee on Commerce, Science, and 
Transportation of the Senate and the Committee on Energy and Commerce 
of the House of Representatives.</DELETED>

<DELETED>SEC. 10. ENFORCEMENT.</DELETED>

<DELETED>    (a) Enforcement by Federal Trade Commission.--</DELETED>
        <DELETED>    (1) Unfair and deceptive acts or practices.--A 
        violation of this Act or a regulation promulgated under this 
        Act by any person shall be treated as a violation of a rule 
        defining an unfair or deceptive act or practice prescribed 
        under section 18(a)(1)(B) of the Federal Trade Commission Act 
        (15 U.S.C. 57a(a)(1)(B)).</DELETED>
        <DELETED>    (2) Powers of the commission.--</DELETED>
                <DELETED>    (A) In general.--Except as provided in 
                subparagraph (B) and subsection (b), the Federal Trade 
                Commission (referred to in this section as the 
                ``Commission'') shall enforce this Act and any 
                regulation promulgated under this Act in the same 
                manner, by the same means, and with the same 
                jurisdiction, powers, and duties as though all 
                applicable terms and provisions of the Federal Trade 
                Commission Act (15 U.S.C. 41 et seq.) were incorporated 
                into and made a part of this Act.</DELETED>
                <DELETED>    (B) Application to common carriers and 
                nonprofit organizations.--Notwithstanding section 4, 
                5(a)(2), or 6 of the Federal Trade Commission Act (15 
                U.S.C. 44, 45(a)(2), 46) or any jurisdictional 
                limitation of the Commission, the Commission shall also 
                enforce this Act and the regulations promulgated under 
                this Act, in the manner provided under this subsection, 
                with respect to--</DELETED>
                        <DELETED>    (i) common carriers subject to the 
                        Communications Act of 1934 (47 U.S.C. 151 et 
                        seq.) and all Acts amendatory thereof and 
                        supplementary thereto; and</DELETED>
                        <DELETED>    (ii) organizations not organized 
                        to carry on business for their own profit or 
                        that of their members.</DELETED>
                <DELETED>    (C) Privileges and immunities.--Any person 
                that violates this Act or a regulation promulgated 
                under this Act shall be subject to the penalties, and 
                entitled to the privileges and immunities, provided in 
                the Federal Trade Commission Act (15 U.S.C. 41 et 
                seq.).</DELETED>
        <DELETED>    (3) Regulations.--The Commission may promulgate 
        regulations under section 553 of title 5, United States Code, 
        to carry out sections 4, 5, and 6 of this Act.</DELETED>
        <DELETED>    (4) Authority preserved.--Nothing in this section 
        shall be construed to limit the authority of the Commission 
        under any other provision of law.</DELETED>
<DELETED>    (b) Enforcement by State Attorneys General.--</DELETED>
        <DELETED>    (1) In general.--</DELETED>
                <DELETED>    (A) Civil actions.--In any case in which 
                the attorney general of a State has reason to believe 
                that an interest of the residents of that State has 
                been or is threatened or adversely affected by the 
                engagement of any person in a practice that violates 
                this Act or a regulation promulgated under this Act, 
                the State, as parens patriae, may bring a civil action 
                on behalf of the residents of the State in a district 
                court of the United States or a State court of 
                appropriate jurisdiction to--</DELETED>
                        <DELETED>    (i) enjoin that 
                        practice;</DELETED>
                        <DELETED>    (ii) enforce compliance with this 
                        Act or such regulation;</DELETED>
                        <DELETED>    (iii) on behalf of residents of 
                        the State, obtain damages, statutory damages, 
                        restitution, or other compensation, each of 
                        which shall be distributed in accordance with 
                        State law; or</DELETED>
                        <DELETED>    (iv) obtain such other relief as 
                        the court may consider to be 
                        appropriate.</DELETED>
                <DELETED>    (B) Notice.--</DELETED>
                        <DELETED>    (i) In general.--Before filing an 
                        action under subparagraph (A), the attorney 
                        general of the State involved shall provide to 
                        the Commission--</DELETED>
                                <DELETED>    (I) written notice of that 
                                action; and</DELETED>
                                <DELETED>    (II) a copy of the 
                                complaint for that action.</DELETED>
                        <DELETED>    (ii) Exemption.--</DELETED>
                                <DELETED>    (I) In general.--Clause 
                                (i) shall not apply with respect to the 
                                filing of an action by an attorney 
                                general of a State under this paragraph 
                                if the attorney general of the State 
                                determines that it is not feasible to 
                                provide the notice described in that 
                                clause before the filing of the 
                                action.</DELETED>
                                <DELETED>    (II) Notification.--In an 
                                action described in subclause (I), the 
                                attorney general of a State shall 
                                provide notice and a copy of the 
                                complaint to the Commission at the same 
                                time as the attorney general files the 
                                action.</DELETED>
        <DELETED>    (2) Intervention.--</DELETED>
                <DELETED>    (A) In general.--On receiving notice under 
                paragraph (1)(B), the Commission shall have the right 
                to intervene in the action that is the subject of the 
                notice.</DELETED>
                <DELETED>    (B) Effect of intervention.--If the 
                Commission intervenes in an action under paragraph (1), 
                it shall have the right--</DELETED>
                        <DELETED>    (i) to be heard with respect to 
                        any matter that arises in that action; 
                        and</DELETED>
                        <DELETED>    (ii) to file a petition for 
                        appeal.</DELETED>
        <DELETED>    (3) Construction.--For purposes of bringing any 
        civil action under paragraph (1), nothing in this Act shall be 
        construed to prevent an attorney general of a State from 
        exercising the powers conferred on the attorney general by the 
        laws of that State to--</DELETED>
                <DELETED>    (A) conduct investigations;</DELETED>
                <DELETED>    (B) administer oaths or affirmations; 
                or</DELETED>
                <DELETED>    (C) compel the attendance of witnesses or 
                the production of documentary and other 
                evidence.</DELETED>
        <DELETED>    (4) Actions by the commission.--In any case in 
        which an action is instituted by or on behalf of the Commission 
        for violation of this Act or a regulation promulgated under 
        this Act, no State may, during the pendency of that action, 
        institute an action under paragraph (1) against any defendant 
        named in the complaint in the action instituted by or on behalf 
        of the Commission for that violation.</DELETED>
        <DELETED>    (5) Venue; service of process.--</DELETED>
                <DELETED>    (A) Venue.--Any action brought under 
                paragraph (1) may be brought in--</DELETED>
                        <DELETED>    (i) the district court of the 
                        United States that meets applicable 
                        requirements relating to venue under section 
                        1391 of title 28, United States Code; 
                        or</DELETED>
                        <DELETED>    (ii) a State court of competent 
                        jurisdiction.</DELETED>
                <DELETED>    (B) Service of process.--In an action 
                brought under paragraph (1) in a district court of the 
                United States, process may be served wherever 
                defendant--</DELETED>
                        <DELETED>    (i) is an inhabitant; or</DELETED>
                        <DELETED>    (ii) may be found.</DELETED>

<DELETED>SEC. 11. KIDS ONLINE SAFETY COUNCIL.</DELETED>

<DELETED>    (a) Establishment.--Not later than 1 year after the date 
of enactment of this Act, the Secretary of Commerce shall establish and 
convene the Kids Online Safety Council for the purpose of providing 
advice on the implementation of this Act.</DELETED>
<DELETED>    (b) Participation.--The Kids Online Safety Council shall 
include participation from--</DELETED>
        <DELETED>    (1) parents, academic experts, health 
        professionals, and members of civil society with respect to the 
        prevention of harms to minors;</DELETED>
        <DELETED>    (2) youth representation;</DELETED>
        <DELETED>    (3) representatives of covered 
        platforms;</DELETED>
        <DELETED>    (4) representatives of the National 
        Telecommunications and Information Administration, the National 
        Institute of Standards and Technology, the Federal Trade 
        Commission, and the Department of Justice; and</DELETED>
        <DELETED>    (5) State attorneys general or their 
        representatives.</DELETED>

<DELETED>SEC. 12. AUTHORIZATION OF APPROPRIATIONS.</DELETED>

<DELETED>    There are authorized to be appropriated to the Federal 
Trade Commission such sums as may be necessary to carry out this 
Act.</DELETED>

<DELETED>SEC. 13. EFFECTIVE DATE.</DELETED>

<DELETED>    Except as otherwise provided in this Act, this Act shall 
take effect on the date that is 18 months after the date of enactment 
of this Act.</DELETED>

<DELETED>SEC. 14. SEVERABILITY.</DELETED>

<DELETED>    If any provision of this Act, or an amendment made by this 
Act, is determined to be unenforceable or invalid, the remaining 
provisions of this Act and the amendments made by this Act shall not be 
affected.</DELETED>

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

    (a) Short Title.--This Act may be cited as the ``Kids Online Safety 
Act''.
    (b) Table of Contents.--The table of contents for this Act is as 
follows:

Sec. 1. Short title; table of contents.
Sec. 2. Definitions.
Sec. 3. Duty of care.
Sec. 4. Safeguards for minors.
Sec. 5. Disclosure.
Sec. 6. Transparency.
Sec. 7. Independent research.
Sec. 8. Market research.
Sec. 9. Age verification study and report.
Sec. 10. Guidance.
Sec. 11. Enforcement.
Sec. 12. Kids online safety council.
Sec. 13. Effective date.
Sec. 14. Relationship to other laws.
Sec. 15. Severability.

SEC. 2. DEFINITIONS.

    In this Act:
            (1) Algorithmic recommendation system.--The term 
        ``algorithmic recommendation system'' means a fully or 
        partially automated system used to suggest, promote, or rank 
        information.
            (2) Child.--The term ``child'' means an individual who is 
        age 12 or younger.
            (3) Covered platform.--The term ``covered platform'' means 
        a social media service, social network, video game, messaging 
        application, video streaming service, educational service, or 
        an online platform that connects to the internet and that is 
        used, or is reasonably likely to be used, by a minor.
            (4) Mental health disorder.--The term ``mental health 
        disorder'' has the meaning given such term in the Diagnostic 
        and Statistical Manual of Mental Health Disorders, 5th Edition 
        (or a successor edition).
            (5) Minor.--The term ``minor'' means an individual who is 
        age 16 or younger.
            (6) Online platform.--The term ``online platform'' means 
        any public-facing website, online service, online application, 
        or mobile application that primarily provides a community forum 
        for user generated content, including sharing videos, images, 
        games, audio files, or other content.
            (7) Parent.--The term ``parent'' includes a legal guardian 
        or an individual with legal custody over a minor.
            (8) Personal data.--The term ``personal data'' means 
        information that identifies or is linked or reasonably linkable 
        to an individual, household, or consumer device.
            (9) Compulsive usage.--The term ``compulsive usage'' means 
        any response stimulated by external factors that causes an 
        individual to engage in repetitive behavior reasonably likely 
        to cause psychological distress, loss of control, anxiety, 
        depression, or harmful stress responses.

SEC. 3. DUTY OF CARE.

    (a) Best Interests.--A covered platform shall act in the best 
interests of a minor that uses the platform's products or services, as 
described in subsection (b).
    (b) Prevention of Harm to Minors.--In acting in the best interests 
of minors, a covered platform shall take reasonable measures in its 
design and operation of products and services to prevent and mitigate--
            (1) mental health disorders or associated behaviors, 
        including the promotion or exacerbation of self-harm, suicide, 
        eating disorders, and substance use disorders;
            (2) patterns of use that indicate or encourage addiction-
        like behaviors;
            (3) physical violence, online bullying, and harassment of a 
        minor;
            (4) sexual exploitation, including enticement, grooming, 
        sex trafficking, and sexual abuse of minors and trafficking of 
        online child sexual abuse material;
            (5) promotion and marketing of narcotic drugs (as defined 
        in section 102 of the Controlled Substances Act (21 U.S.C. 
        802)), tobacco products, gambling, or alcohol; and
            (6) predatory, unfair, or deceptive marketing practices, or 
        other financial harms.

SEC. 4. SAFEGUARDS FOR MINORS.

    (a) Safeguards for Minors.--
            (1) In general.--A covered platform shall provide a minor 
        with readily-accessible and easy-to-use safeguards to, as 
        applicable--
                    (A) limit the ability of other individuals to 
                contact or find a minor, in particular individuals aged 
                17 or over with no relationship to the minor;
                    (B) prevent other users, whether registered or not, 
                from viewing the minor's personal data collected by or 
                shared on the covered platform, in particular 
                restricting public access to personal data;
                    (C) limit features that increase, sustain, or 
                extend use of the covered platform by a minor, such as 
                automatic playing of media, rewards for time spent on 
                the platform, notifications, and other features that 
                result in compulsive usage of the covered platform by a 
                minor;
                    (D) control algorithmic recommendation systems that 
                use a minor's personal data, including the right to--
                            (i) opt out of such algorithmic 
                        recommendation systems; or
                            (ii) limit types or categories of 
                        recommendations from such systems;
                    (E) delete the minor's account and delete their 
                personal data;
                    (F) restrict the sharing of the geolocation of a 
                minor and provide notice regarding the tracking of a 
                minor's geolocation; and
                    (G) limit the amount of time spent by a minor on 
                the covered platform.
            (2) Default safeguard settings for minors.--A covered 
        platform shall provide that, in the case of a user that the 
        platform knows or reasonably believes to be a minor, the 
        default setting for any safeguard described under paragraph (1) 
        shall be the option available on the platform that provides the 
        most protective level of control that is offered by the 
        platform over privacy and safety for that user.
    (b) Parental Tools.--
            (1) Tools.--A covered platform shall provide readily-
        accessible and easy-to-use tools for parents to supervise the 
        use of the covered platform by a minor.
            (2) Requirements.--The tools provided by a covered platform 
        shall include--
                    (A) the ability to control privacy and account 
                settings, including the safeguards established under 
                subsection (a)(1);
                    (B) the ability to restrict purchases and financial 
                transactions by a minor, where applicable;
                    (C) the ability to track metrics of total time 
                spent on the platform; and
                    (D) control options that allow parents to address 
                the harms described in section 3(b).
            (3) Notice to minors.--A covered platform shall provide 
        clear and conspicuous notice to a minor when tools described in 
        this subsection are in effect.
            (4) Default tools.--A covered platform shall provide that, 
        in the case of a user that the platform knows or reasonably 
        believes to be a child, the tools described in this subsection 
        shall be enabled by default.
    (c) Reporting Mechanism.--
            (1) Reports submitted by parents, minors, and schools.--A 
        covered platform shall provide--
                    (A) a readily-accessible and easy-to-use means to 
                submit reports to the covered platform of harms to 
                minors;
                    (B) an electronic point of contact specific to 
                matters involving harms to a minor; and
                    (C) confirmation of the receipt of such a report 
                and a means to track a submitted report.
            (2) Timing.--A covered platform shall establish an internal 
        process to receive and substantively respond to reports in a 
        reasonable and timely manner, but in no case later than 14 days 
        after the receipt of a report.
    (d) Advertising of Illegal Products.--A covered platform shall not 
facilitate the advertising of narcotic drugs (as defined in section 102 
of the Controlled Substances Act (21 U.S.C. 802)), tobacco products, 
gambling, or alcohol to minors.
    (e) Application.--
            (1) Accessibility.--With respect to safeguards and parental 
        controls described under subsections (a) and (b), a covered 
        platform shall provide--
                    (A) information and control options in a clear and 
                conspicuous manner that takes into consideration the 
                differing ages, capacities, and developmental needs of 
                the minors most likely to access the covered platform 
                and does not encourage minors or parents to weaken or 
                disable safeguards or parental controls;
                    (B) readily-accessible and easy-to-use controls to 
                enable or disable safeguards or parental controls, as 
                appropriate; and
                    (C) information and control options in the same 
                language, form, and manner as the covered platform 
                provides any product or service used by minors.
            (2) Dark patterns prohibition.--For purposes of this 
        section, it shall be unlawful for any covered platform to 
        design, modify, or manipulate a user interface of a covered 
        platform with the purpose or substantial effect of subverting 
        or impairing user autonomy, decision-making, or choice in order 
        to weaken or disable safeguards or parental controls.
            (3) Rules of construction.--Nothing in this section shall 
        be construed to--
                    (A) prevent a covered platform from--
                            (i) taking reasonable measures to limit 
                        algorithmic recommendation systems from 
                        distributing unlawful, obscene, or harmful 
                        material to minors as described in section 
                        3(b); or
                            (ii) implementing measures to block or 
                        filter spam, prevent criminal activity, or 
                        protect the security of a platform or service;
                    (B) require the disclosure of a minor's browsing 
                behavior, search history, messages, or other content of 
                their communications; or
                    (C) restrict a covered platform's ability to--
                            (i) cooperate with law enforcement agencies 
                        regarding activity that the operator reasonably 
                        and in good faith believes may violate Federal, 
                        State, or local laws, rules, or regulations;
                            (ii) comply with a civil, criminal, or 
                        regulatory inquiry or any investigation, 
                        subpoena, or summons by Federal, State, local, 
                        or other government authorities; or
                            (iii) exercise, respond to, or defend 
                        against legal claims.

SEC. 5. DISCLOSURE.

    (a) Notice.--
            (1) Registration.--Prior to registration, use, or purchase 
        of a covered platform by a minor, the platform shall provide 
        clear, conspicuous, and easy-to-understand--
                    (A) notice of the policies and practices of the 
                covered platform with respect to personal data and 
                safeguards for minors;
                    (B) information about how to access the safeguards 
                and parental tools required under section 4; and
                    (C) notice about whether the covered platform, 
                including any algorithmic recommendation systems used 
                by the platform, pose any heightened risks of harms to 
                minors.
            (2) Parental notification.--For a minor, or an individual 
        that a covered platform reasonably believes is a minor, a 
        covered platform shall additionally provide the notice, 
        information, and statement described in paragraph (1) to a 
        parent of the minor.
            (3) Acknowledgment.--After providing the notice, 
        information, and statement described in paragraph (1), but 
        prior to initial use of the covered platform, the covered 
        platform shall take reasonable steps to obtain express 
        affirmative acknowledgment from a parent of the minor of the 
        receipt of information related to the heightened risks of harm 
        to minors referenced in the statement in paragraph (1)(C).
            (4) Rulemaking.--The Commission may issue rules pursuant to 
        section 553 of title 5, United States Code, to establish 
        standards for covered platforms to comply with this subsection, 
        including--
                    (A) a minimum level of information covered 
                platforms must provide pursuant to paragraph (1), where 
                applicable; and
                    (B) processes for parental notification, which may 
                include templates or models of short-form notices.
    (b) Algorithmic Recommendation System.--A covered platform that 
operates algorithmic recommendation systems that use minors' personal 
data shall set out in its terms and conditions, in a clear, 
conspicuous, and easy-to-understand manner--
            (1) an overview of how those algorithmic recommendation 
        systems are used by the covered platform to provide information 
        to users of the platform who are minors, including how such 
        systems use the personal data of minors; and
            (2) information about options for minors or their parents 
        to control algorithmic recommendation systems that use a 
        minor's personal data (including by opting out of such 
        systems).
    (c) Advertising and Marketing Information and Labels.--
            (1) Information and labels.--A covered platform that 
        facilitates advertising aimed at minors shall provide clear, 
        conspicuous, and easy-to-understand information and labels on 
        advertisements and marketing material regarding--
                    (A) the name of the product, service, or brand and 
                the subject matter of an advertisement or marketing 
                material;
                    (B) why the minor is being targeted for a 
                particular advertisement or marketing material if the 
                covered platform engages in targeted advertising, 
                including material information about how the minor's 
                personal data was used to target the advertisement or 
                marketing material; and
                    (C) whether particular media displayed to a user is 
                an advertisement or marketing material, including 
                disclosure of endorsements of products, services, or 
                brands made for commercial consideration by other users 
                of the platform.
            (2) Rulemaking.--The Commission may issue rules pursuant to 
        section 553 of title 5, United States Code, to implement this 
        subsection, specifically establishing the minimum level of 
        information and labels necessary for the disclosures required 
        under paragraph (1), which may include templates or models of 
        short-form notices.
    (d) Resources for Parents and Minors.--A covered platform shall 
provide to minors and parents clear, conspicuous, easy-to-understand, 
and comprehensive information in a prominent location regarding--
            (1) its policies and practices with respect to personal 
        data and safeguards for minors; and
            (2) how to access the safeguards and tools required under 
        section 4.
    (e) Resources in Additional Languages.--A covered platform shall 
ensure, to the extent practicable, that the disclosures required by 
this section are made available in the same language, form, and manner 
as the covered platform provides any product or service used by minors.

SEC. 6. TRANSPARENCY.

    (a) In General.--Subject to subsection (b), not less frequently 
than once a year, a covered platform shall issue a public report 
identifying the reasonably foreseeable risk of harms to minors and 
describing the prevention and mitigation measures taken to address such 
risk based on an independent, third-party audit conducted through 
reasonable inspection of the covered platform.
    (b) Scope of Application.--The requirements of this section shall 
not apply to a covered platform if, for the most recent calendar year, 
the platform averaged less than 10,000,000 active users on a monthly 
basis in the United States.
    (c) Content.--
            (1) Transparency.--The public reports required of a covered 
        platform under this section shall include--
                    (A) an assessment of the extent to which the 
                platform is likely to be accessed by minors;
                    (B) a description of the commercial interests of 
                the covered platform in use by minors;
                    (C) an accounting of the number of individuals 
                using the covered platform reasonably believed to be 
                minors in the United States, disaggregated by the age 
                ranges of 0-5, 6-9, 10-12, and 13-16;
                    (D) an accounting of the median and mean amounts of 
                time spent on the platform by minors in the United 
                States who have accessed the platform during the 
                reporting year on a daily, weekly, and monthly basis, 
                disaggregated by the age ranges of 0-5, 6-9, 10-12, and 
                13-16;
                    (E) an accounting of total reports received 
                regarding, and the prevalence of content related to, 
                the harms described in section 3(b), disaggregated by 
                category of harm; and
                    (F) a description of any material breaches of 
                parental tools or assurances regarding minors, 
                representations regarding the use of the personal data 
                of minors, and other matters regarding non-compliance.
            (2) Systemic risks assessment.--The public reports required 
        of a covered platform under this section shall include--
                    (A) an audit of the reasonably foreseeable risk of 
                harms to minors posed by the covered platform, 
                including identifying any other physical, mental, 
                developmental, or financial harms in addition to those 
                described in section 3(b);
                    (B) an assessment of how algorithmic recommendation 
                systems and targeted advertising systems can contribute 
                to harms to minors;
                    (C) a description of whether and how the covered 
                platform uses system design features to increase, 
                sustain, or extend use of a product or service by a 
                minor, such as automatic playing of media, rewards for 
                time spent, and notifications;
                    (D) a description of whether, how, and for what 
                purpose the platform collects or processes categories 
                of personal data that may cause reasonably foreseeable 
                risk of harms to minors;
                    (E) an evaluation of the efficacy of safeguards for 
                minors under section 4, and any issues in delivering 
                such safeguards and the associated parental tools; and
                    (F) an evaluation of any other relevant matters of 
                public concern over risk of harms to minors.
            (3) Mitigation.--The public reports required of a covered 
        platform under this section shall include--
                    (A) a description of the safeguards and parental 
                tools available to minors and parents on the covered 
                platform;
                    (B) a description of interventions by the covered 
                platform when it had or has reason to believe that 
                harms to minors could occur;
                    (C) a description of the prevention and mitigation 
                measures intended to be taken in response to the known 
                and emerging risks identified in its audit of system 
                risks, including steps taken to--
                            (i) prevent harms to minors, including 
                        adapting or removing system design features;
                            (ii) provide the most protective level of 
                        control over privacy and safety by default; and
                            (iii) adapt algorithmic recommendation 
                        systems to prioritize the best interests of 
                        users who are minors, as described in section 
                        3(b);
                    (D) a description of internal processes for 
                handling reports and automated detection mechanisms for 
                harms to minors, including the rate, timeliness, and 
                effectiveness of responses under the requirement of 
                section 4(c);
                    (E) the status of implementing prevention and 
                mitigation measures identified in prior assessments; 
                and
                    (F) a description of the additional measures to be 
                taken by the covered platform to address the 
                circumvention of safeguards for minors and parental 
                tools.
    (d) Reasonable Inspection.--In conducting an inspection of the 
systemic risks of harm to minors under this section, an independent, 
third-party auditor shall--
            (1) take into consideration the function of algorithmic 
        recommendation systems;
            (2) consult parents and youth experts, including public 
        health and mental health nonprofit organizations, child and 
        adolescent health and development organizations, and civil 
        society with respect to the prevention of harms to minors;
            (3) conduct research based on experiences of minors that 
        use the covered platform, including reports under section 4(c) 
        and information provided by law enforcement;
            (4) take account of research, including research regarding 
        system design features, marketing, or product integrity, 
        industry best practices, or outside research; and
            (5) consider indicia or inferences of age of users, in 
        addition to any self-declared information about the age of 
        individuals.
    (e) Cooperation With Independent, Third-party Audit.--To facilitate 
the report required by subsection (c), a covered platform shall--
            (1) provide or otherwise make available to the independent 
        third-party conducting the audit all information and material 
        in its possession, custody, or control that is relevant to the 
        audit;
            (2) provide or otherwise make available to the independent 
        third-party conducting the audit access to all network, 
        systems, and assets relevant to the audit; and
            (3) disclose all relevant facts to the independent third-
        party conducting the audit, and not misrepresent in any manner, 
        expressly or by implication, any relevant fact.
    (f) Privacy Safeguards.--
            (1) In general.--In issuing the public reports required 
        under this section, a covered platform shall take steps to 
        safeguard the privacy of its users, including ensuring that 
        data is presented in a de-identified, aggregated format.
            (2) Clarification.--The section shall not be construed to 
        require--
                    (A) the affirmative collection of any personal data 
                with respect to the age of users that a covered 
                platform is not already collecting in the normal course 
                of business; or
                    (B) the covered platform to implement an age gating 
                functionality.
    (g) Location.--The public reports required under this section 
should be posted by a covered platform on an easy to find location on a 
publicly-available website.
    (h) Rulemaking.--The Commission may issue rules pursuant to section 
553 of title 5, United States Code to implement this section, 
specifically establishing processes and minimum standards for third-
party auditors to identify and assess--
            (1) known and emerging risks to minors; and
            (2) how algorithmic recommendation systems and targeted 
        advertising systems can contribute to harms to minors as 
        described in section 3(b).

SEC. 7. INDEPENDENT RESEARCH.

    (a) Definitions.--In this section:
            (1) Assistant secretary.--The term ``Assistant Secretary'' 
        means the Assistant Secretary of Commerce for Communications 
        and Information.
            (2) De-identified data.--The term ``de-identified data'' 
        means information--
                    (A) that does not identify and is not linked or 
                reasonably linkable to an individual or an individual's 
                device; and
                    (B) with respect to which a covered platform or 
                researcher takes reasonable technical and contractual 
                measures to ensure that the information is not used to 
                re-identify any individual or individual's device.
            (3) Eligible researcher.--The term ``eligible researcher'' 
        means an individual or group of individuals affiliated with or 
        employed by--
                    (A) an institution of higher education (as defined 
                in section 101 of the Higher Education Act of 1965 (20 
                U.S.C. 1001)); or
                    (B) a nonprofit organization described in section 
                501(c)(3) of the Internal Revenue Code of 1986.
            (4) Program.--The term ``Program'' means the program 
        established under subsection (b)(1).
            (5) Public interest research.--The term ``public interest 
        research'' means the scientific or historical analysis of 
        information that is performed for the primary purpose of 
        advancing a broadly recognized public interest.
            (6) Qualified researcher.--The term ``qualified 
        researcher'' means an eligible researcher who is approved by 
        the Assistant Secretary to conduct public interest research 
        regarding harms to minors under the Program.
    (b) Public Interest Research Program Relating to Identified Harms 
to Minors.--
            (1) Establishment.--Subject to paragraph (2), the Assistant 
        Secretary shall establish a program, with public notice and an 
        opportunity to comment, under which an eligible researcher may 
        apply for, and a covered platform shall provide, access to data 
        assets from the covered platform for the sole purpose of 
        conducting public interest research regarding the harms 
        described in section 3(b).
            (2) Scope of application.--The requirements of this 
        subsection shall not apply to a covered platform if, for the 
        most recent calendar year, the platform averaged less than 
        10,000,000 active users on a monthly basis in the United 
        States.
            (3) Processes, procedures, and standards.--Not later than 1 
        year after the date of enactment of this Act, the Assistant 
        Secretary shall establish for the program established under 
        this subsection--
                    (A) definitions for data assets (related to harms 
                described in section 3(b)) that qualify for disclosure 
                to researchers under the program and standards of 
                access for data assets to be provided under the 
                program;
                    (B) a process by which an eligible researcher may 
                submit an application described in paragraph (1);
                    (C) an appeals process for eligible researchers to 
                appeal adverse decisions on applications described in 
                paragraph (1) (including a decision to grant an appeal 
                under paragraph (4)(C));
                    (D) procedures for implementation of the program, 
                including methods for--
                            (i) participation by covered platforms; and
                            (ii) verification by the Assistant 
                        Secretary of the credentials of eligible 
                        researchers and processes for the application 
                        or disqualification to participate in the 
                        program;
                    (E) standards for privacy, security, and 
                confidentiality required to participate in the program;
                    (F) a mechanism to allow individuals to control the 
                use of their personal data under the program, including 
                the ability to opt out of the program;
                    (G) standards for transparency regarding the 
                operation and administration of the program; and
                    (H) rules to prevent requests for data assets that 
                present financial conflicts of interest, including 
                efforts by covered platforms to gain a competitive 
                advantage by directly funding data access requests, the 
                use of qualified researcher status for commercial gain, 
                or efforts by covered platforms to obtain access to 
                intellectual property that is otherwise protected by 
                law.
            (4) Duties and rights of covered platforms.--
                    (A) Access to data assets.--
                            (i) In general.--If the Assistant Secretary 
                        approves an application under paragraph (1) 
                        with respect to a covered platform, the covered 
                        platform shall, in a timely manner, provide the 
                        qualified researcher with access to data assets 
                        necessary to conduct public interest research 
                        described in that paragraph.
                            (ii) Limitations.--Nothing in this section 
                        shall be construed to require a covered 
                        platform to provide access to data assets that 
                        are intellectual property protected by Federal 
                        law, trade secrets, or commercial or financial 
                        information.
                            (iii) Form of access.--A covered platform 
                        shall provide to a qualified researcher access 
                        to data assets under clause (i) through online 
                        databases, application programming interfaces, 
                        and data files as appropriate.
                    (B) Nondisclosure agreement.--A covered platform 
                may require, as a condition of access to the data 
                assets of the covered platform, that a qualified 
                researcher enter into a nondisclosure agreement 
                restricting the release of data assets, provided that--
                            (i) the agreement does not restrict the 
                        publication or discussion regarding the 
                        qualified researcher's findings; and
                            (ii) the terms of the agreement allow the 
                        qualified researcher to provide the original 
                        agreement or a copy of the agreement to the 
                        Assistant Secretary.
                    (C) Appeal.--
                            (i) Agency appeal.--A covered platform may 
                        appeal the granting of an application under 
                        paragraph (1) on the grounds that, and the 
                        Assistant Secretary shall grant such appeal 
                        if--
                                    (I) the covered platform does not 
                                have access to the requested data 
                                assets or the requested data assets are 
                                not reasonably tailored to application; 
                                or
                                    (II) providing access to the data 
                                assets will lead to material 
                                vulnerabilities for the privacy of 
                                users or the security of the covered 
                                platform's service or create a 
                                significant risk of the violation of 
                                Federal or state law.
                            (ii) Judicial review.--A decision of the 
                        Assistant Secretary with respect to an appeal 
                        under clause (i) shall be considered to be a 
                        final agency action for purposes of judicial 
                        review under chapter 7 of title 5, United 
                        States Code.
                    (D) Timing.--A covered platform for which this 
                provision applies shall participate no later than two 
                years after enactment of this Act.
            (5) Application requirements.--In order to be approved to 
        access data assets from a covered platform, an eligible 
        researcher shall, in the application submitted under paragraph 
        (1)--
                    (A) commit to conduct the research for 
                noncommercial purposes;
                    (B) demonstrate a proven record of expertise on the 
                proposed research topic and related research 
                methodologies;
                    (C) if the eligible researcher is seeking access to 
                data assets that include personal data, show a 
                reasonable need for access to data assets that would be 
                considered personal data, such as by demonstrating that 
                the research cannot reasonably be accomplished using 
                de-identified data or aggregated information; and
                    (D) commit to fulfill, and demonstrate a capacity 
                to fulfill, the specific data security and 
                confidentiality requirements corresponding to the 
                application.
            (6) Privacy and duty of confidentiality.--
                    (A) Researcher confidentiality.--To protect user 
                privacy, a qualified researcher shall keep data assets 
                provided by a covered platform under the program 
                confidential and secure.
                    (B) Platform confidentiality.--A covered platform 
                shall use reasonable measures to enable researcher 
                access to data assets under the program in a secure and 
                privacy-protective manner, including through the de-
                identification of personal data or use of other 
                privacy-enhancing technologies.
                    (C) Federal agencies.--Nothing in this subsection 
                shall be construed to authorize a Federal agency to 
                seek access to the data of a covered platform through 
                the program.
    (c) Safe Harbor for Collection of Data for Public Interest Research 
Regarding Identified Harms to Minors.--If, in the course of conducting 
public interest research regarding harms described in section 3(b) 
(without regard to whether such research is conducted under the 
program), an eligible researcher collects or uses data from a covered 
platform in a manner that violates the terms of service of the 
platform, no cause of action based on such violation shall lie or be 
maintained in any court against such researcher unless the violation 
relates to the failure of the researcher to take reasonable measures to 
protect user privacy and security.
    (d) Rulemaking.--The Assistant Secretary, in consultation with the 
Secretary of Commerce, the Director of the National Institute of 
Standards and Technology, the Director of the National Science 
Foundation, and the Director of the National Institutes of Health shall 
promulgate rules in accordance with section 553 of title 5, United 
States Code, as necessary to implement this section.

SEC. 8. MARKET RESEARCH.

    (a) Market Research by Covered Platforms.--The Federal Trade 
Commission, in consultation with the Secretary of Commerce, shall 
establish guidance for covered platforms seeking to conduct market- and 
product-focused research on minors or individuals it reasonably 
believes to be minors. Such guidance shall include--
            (1) a standard consent form that provides minors and their 
        parents a clear, conspicuous, and easy-to-understand 
        explanation of the scope and purpose of the research to be 
        conducted, and provides an opportunity for informed consent; 
        and
            (2) recommendations for research practices for studies that 
        may include minors, disaggregated by the age ranges of 0-5, 6-
        9, 10-12, and 13-16.
    (b) Guidelines.--The Federal Trade Commission shall promulgate such 
guidelines not later than 18 months after the date of enactment of this 
Act. In doing so, they shall seek input from members of the public and 
the representatives of the Kids Online Safety Council established under 
section 12.

SEC. 9. AGE VERIFICATION STUDY AND REPORT.

    (a) Study.--The Director of the National Institute of Standards and 
Technology, in coordination with the Federal Communications Commission, 
Federal Trade Commission, and the Secretary of Commerce, shall conduct 
a study evaluating the most technologically feasible methods and 
options for developing systems to verify age at the device or operating 
system level.
    (b) Contents.--Such study shall consider --
            (1) the benefits of creating a device or operating system 
        level age verification system;
            (2) what information may need to be collected to create 
        this type of age verification system;
            (3) the accuracy of such systems and their impact or steps 
        to improve accessibility, including for individuals with 
        disabilities;
            (4) how such a system or systems could verify age while 
        mitigating risks to user privacy and data security and 
        safeguarding minors' personal data, emphasizing minimizing the 
        amount of data collected and processed by covered platforms for 
        such a system; and
            (5) the technical feasibility, including the need for 
        potential hardware and software changes, including for devices 
        currently in commerce and owned by consumers.
    (c) Report.--Not later than 1 year after the date of enactment of 
this Act, the agencies described in subsection (a) shall submit a 
report containing the results of the study conducted under such 
subsection to the Committee on Commerce, Science, and Transportation of 
the Senate and the Committee on Energy and Commerce of the House of 
Representatives.

SEC. 10. GUIDANCE.

    Not later than 1 year after the date of enactment of this Act, the 
Federal Trade Commission, in consultation with the Kids Online Safety 
Council established under section 12, shall issue guidance to--
            (1) assist elementary or secondary schools in using the 
        notice, safeguards and tools provided under this Act and 
        facilitate compliance with student privacy laws; and
            (2) provide information and examples for covered platforms 
        and auditors regarding--
                    (A) identifying features that are used to increase, 
                sustain, or extend use of the covered platform by a 
                minor;
                    (B) safeguarding minors against the possible misuse 
                of parental tools;
                    (C) best practices in providing minors and parents 
                the most protective level of control over privacy and 
                safety;
                    (D) using indicia or inferences of age of users for 
                assessing use of the covered platform by minors;
                    (E) methods for evaluating the efficacy of 
                safeguards; and
                    (F) providing additional control options that allow 
                parents to address the harms described in section 3(b); 
                and
            (3) outline conduct that does not have the purpose or 
        substantial effect of subverting or impairing user autonomy, 
        decision-making, or choice, or of causing, increasing, or 
        encouraging compulsive usage for a minor, such as--
                    (A) de minimis user interface changes derived from 
                testing consumer preferences, including different 
                styles, layouts, or text, where such changes are not 
                done with the purpose of weakening or disabling 
                safeguards or parental controls;
                    (B) algorithms or data outputs outside the control 
                of a covered platform; and
                    (C) establishing default settings that provide 
                enhanced privacy protection to users or otherwise 
                enhance their autonomy and decision-making ability.

SEC. 11. ENFORCEMENT.

    (a) Enforcement by Federal Trade Commission.--
            (1) Unfair and deceptive acts or practices.--A violation of 
        this Act or a regulation promulgated under this Act shall be 
        treated as a violation of a rule defining an unfair or 
        deceptive act or practice prescribed under section 18(a)(1)(B) 
        of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
            (2) Powers of the commission.--
                    (A) In general.--Except as provided in subsection 
                (b), the Federal Trade Commission (referred to in this 
                section as the ``Commission'') shall enforce this Act 
                and any regulation promulgated under this Act in the 
                same manner, by the same means, and with the same 
                jurisdiction, powers, and duties as though all 
                applicable terms and provisions of the Federal Trade 
                Commission Act (15 U.S.C. 41 et seq.) were incorporated 
                into and made a part of this Act.
                    (B) Privileges and immunities.--Any person that 
                violates this Act or a regulation promulgated under 
                this Act shall be subject to the penalties, and 
                entitled to the privileges and immunities, provided in 
                the Federal Trade Commission Act (15 U.S.C. 41 et 
                seq.).
            (3) Authority preserved.--Nothing in this Act shall be 
        construed to limit the authority of the Commission under any 
        other provision of law.
    (b) Enforcement by State Attorneys General.--
            (1) In general.--
                    (A) Civil actions.--In any case in which the 
                attorney general of a State has reason to believe that 
                an interest of the residents of that State has been or 
                is threatened or adversely affected by the engagement 
                of any person in a practice that violates this Act or a 
                regulation promulgated under this Act, the State, as 
                parens patriae, may bring a civil action on behalf of 
                the residents of the State in a district court of the 
                United States or a State court of appropriate 
                jurisdiction to--
                            (i) enjoin that practice;
                            (ii) enforce compliance with this Act or 
                        such regulation;
                            (iii) on behalf of residents of the State, 
                        obtain damages, restitution, or other 
                        compensation, each of which shall be 
                        distributed in accordance with State law; or
                            (iv) obtain such other relief as the court 
                        may consider to be appropriate.
                    (B) Notice.--
                            (i) In general.--Before filing an action 
                        under subparagraph (A), the attorney general of 
                        the State involved shall provide to the 
                        Commission--
                                    (I) written notice of that action; 
                                and
                                    (II) a copy of the complaint for 
                                that action.
                            (ii) Exemption.--
                                    (I) In general.--Clause (i) shall 
                                not apply with respect to the filing of 
                                an action by an attorney general of a 
                                State under this paragraph if the 
                                attorney general of the State 
                                determines that it is not feasible to 
                                provide the notice described in that 
                                clause before the filing of the action.
                                    (II) Notification.--In an action 
                                described in subclause (I), the 
                                attorney general of a State shall 
                                provide notice and a copy of the 
                                complaint to the Commission at the same 
                                time as the attorney general files the 
                                action.
            (2) Intervention.--
                    (A) In general.--On receiving notice under 
                paragraph (1)(B), the Commission shall have the right 
                to intervene in the action that is the subject of the 
                notice.
                    (B) Effect of intervention.--If the Commission 
                intervenes in an action under paragraph (1), it shall 
                have the right--
                            (i) to be heard with respect to any matter 
                        that arises in that action; and
                            (ii) to file a petition for appeal.
            (3) Construction.--For purposes of bringing any civil 
        action under paragraph (1), nothing in this Act shall be 
        construed to prevent an attorney general of a State from 
        exercising the powers conferred on the attorney general by the 
        laws of that State to--
                    (A) conduct investigations;
                    (B) administer oaths or affirmations; or
                    (C) compel the attendance of witnesses or the 
                production of documentary and other evidence.
            (4) Actions by the commission.--In any case in which an 
        action is instituted by or on behalf of the Commission for 
        violation of this Act or a regulation promulgated under this 
        Act, no State may, during the pendency of that action, 
        institute a separate action under paragraph (1) against any 
        defendant named in the complaint in the action instituted by or 
        on behalf of the Commission for that violation.
            (5) Venue; service of process.--
                    (A) Venue.--Any action brought under paragraph (1) 
                may be brought in--
                            (i) the district court of the United States 
                        that meets applicable requirements relating to 
                        venue under section 1391 of title 28, United 
                        States Code; or
                            (ii) a State court of competent 
                        jurisdiction.
                    (B) Service of process.--In an action brought under 
                paragraph (1) in a district court of the United States, 
                process may be served wherever defendant--
                            (i) is an inhabitant; or
                            (ii) may be found.

SEC. 12. KIDS ONLINE SAFETY COUNCIL.

    (a) Establishment.--Not later than 180 days after the date of 
enactment of this Act, the Secretary of Commerce shall establish and 
convene the Kids Online Safety Council for the purpose of providing 
advice on matters related to this Act.
    (b) Participation.--The Kids Online Safety Council shall include 
diverse participation from--
            (1) academic experts, health professionals, and members of 
        civil society with expertise in mental health and the 
        prevention of harms to minors;
            (2) representatives in academia and civil society with 
        specific expertise in privacy and civil liberties;
            (3) parents and youth representation;
            (4) representatives of covered platforms;
            (5) representatives of the National Telecommunications and 
        Information Administration, the National Institute of Standards 
        and Technology, the Federal Trade Commission, the Department of 
        Justice, and the Department of Health and Human Services;
            (6) State attorneys general or their designees acting in 
        State or local government; and
            (7) representatives of communities of socially 
        disadvantaged individuals (as defined in section 8 of the Small 
        Business Act (15 U.S.C. 637)).
    (c) Activities.--The matters to be addressed by the Kids Online 
Safety Council shall include--
            (1) identifying emerging or current risks of harms to 
        minors associated with online platforms;
            (2) recommending measures and methods for assessing, 
        preventing, and mitigating harms to minors online;
            (3) recommending methods and themes for conducting research 
        regarding online harms to minors; and
            (4) recommending best practices and clear, consensus-based 
        technical standards for transparency reports and audits, as 
        required under this Act.
The recommended standards for reports and audits under paragraph (4) 
shall include methods, criteria, and scope to promote overall 
accountability.

SEC. 13. EFFECTIVE DATE.

    Except as otherwise provided in this Act, this Act shall take 
effect on the date that is 18 months after the date of enactment of 
this Act.

SEC. 14. RELATIONSHIP TO OTHER LAWS.

    Nothing in this Act shall be construed to--
            (1) preempt section 444 of the General Education Provisions 
        Act (20 U.S.C. 1232g, commonly known as the ``Family 
        Educational Rights and Privacy Act of 1974'') or other Federal 
        or State laws governing student privacy; or
            (2) authorize any action that would conflict with section 
        18(h) of the Federal Trade Commission Act (15 U.S.C. 57a(h)).

SEC. 15. SEVERABILITY.

    If any provision of this Act, or an amendment made by this Act, is 
determined to be unenforceable or invalid, the remaining provisions of 
this Act and the amendments made by this Act shall not be affected.
                                                       Calendar No. 660

117th CONGRESS

  2d Session

                                S. 3663

_______________________________________________________________________

                                 A BILL

           To protect the safety of children on the internet.

_______________________________________________________________________

                           December 15, 2022

                       Reported with an amendment