[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 1418 Reported in Senate (RS)]
<DOC>
Calendar No. 288
118th CONGRESS
1st Session
S. 1418
To amend the Children's Online Privacy Protection Act of 1998 to
strengthen protections relating to the online collection, use, and
disclosure of personal information of children and teens, and for other
purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
May 3, 2023
Mr. Markey (for himself and Mr. Cassidy) introduced the following bill;
which was read twice and referred to the Committee on Commerce,
Science, and Transportation
December 13, 2023
Reported by Ms. Cantwell, with an amendment
[Strike out all after the enacting clause and insert the part printed
in italic]
_______________________________________________________________________
A BILL
To amend the Children's Online Privacy Protection Act of 1998 to
strengthen protections relating to the online collection, use, and
disclosure of personal information of children and teens, and for other
purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
<DELETED>SECTION 1. SHORT TITLE; TABLE OF CONTENTS.</DELETED>
<DELETED> (a) Short Title.--This Act may be cited as the ``Children
and Teens' Online Privacy Protection Act''.</DELETED>
<DELETED> (b) Table of Contents.--The table of contents for this Act
is as follows:</DELETED>
<DELETED>Sec. 1. Short title; table of contents.
<DELETED>Sec. 2. Definitions.
<DELETED>Sec. 3. Online collection, use, and disclosure of personal
information of children and teens.
<DELETED>Sec. 4. Fair Information Practices Principles.
<DELETED>Sec. 5. Digital Marketing Bill of Rights for Teens.
<DELETED>Sec. 6. Targeted marketing to children or teens.
<DELETED>Sec. 7. Removal of content.
<DELETED>Sec. 8. Rule for treatment of users of websites, services, and
applications directed to children or teens.
<DELETED>Sec. 9. Study of mobile and online application oversight.
<DELETED>Sec. 10. Youth Privacy and Marketing Division.
<DELETED>Sec. 11. Enforcement and applicability.
<DELETED>Sec. 12. GAO study.
<DELETED>SEC. 2. DEFINITIONS.</DELETED>
<DELETED> (a) In General.--In this Act:</DELETED>
<DELETED> (1) Commission.--The term ``Commission'' means the
Federal Trade Commission.</DELETED>
<DELETED> (2) Standards.--The term ``standards'' means
benchmarks, guidelines, best practices, methodologies,
procedures, and processes.</DELETED>
<DELETED> (b) Other Definitions.--The definitions set forth in
section 1302 of the Children's Online Privacy Protection Act of 1998
(15 U.S.C. 6501), as amended by section 3(a) of this Act, shall apply
in this Act, except to the extent the Commission provides otherwise by
regulations issued under section 553 of title 5, United States
Code.</DELETED>
<DELETED>SEC. 3. ONLINE COLLECTION, USE, AND DISCLOSURE OF PERSONAL
INFORMATION OF CHILDREN AND TEENS.</DELETED>
<DELETED> (a) Definitions.--Section 1302 of the Children's Online
Privacy Protection Act of 1998 (15 U.S.C. 6501) is amended--</DELETED>
<DELETED> (1) by amending paragraph (2) to read as
follows:</DELETED>
<DELETED> ``(2) Operator.--The term `operator'--</DELETED>
<DELETED> ``(A) means any person--</DELETED>
<DELETED> ``(i) who, for commercial
purposes, in interstate or foreign commerce
operates or provides a website on the internet,
an online service, an online application, a
mobile application, or a connected device;
and</DELETED>
<DELETED> ``(ii) who--</DELETED>
<DELETED> ``(I) collects or
maintains, either directly or through a
service provider, personal information
from or about the users of that
website, service, application, or
connected device;</DELETED>
<DELETED> ``(II) allows another
person to collect personal information
directly from users of that website,
service, application, or connected
device (in which case, the operator is
deemed to have collected the
information); or</DELETED>
<DELETED> ``(III) allows users of
that website, service, application, or
connected device to publicly disclose
personal information (in which case,
the operator is deemed to have
collected the information);
and</DELETED>
<DELETED> ``(B) does not include any nonprofit
entity that would otherwise be exempt from coverage
under section 5 of the Federal Trade Commission Act (15
U.S.C. 45).'';</DELETED>
<DELETED> (2) in paragraph (4)--</DELETED>
<DELETED> (A) by amending subparagraph (A) to read
as follows:</DELETED>
<DELETED> ``(A) the release of personal information
collected from a child or teen for any purpose, except
where the personal information is provided to a person
other than an operator who--</DELETED>
<DELETED> ``(i) provides support for the
internal operations of the website, online
service, online application, mobile
application, or connected device of the
operator, excluding any activity relating to
targeted marketing directed to children, teens,
or connected devices; and</DELETED>
<DELETED> ``(ii) does not disclose or use
that personal information for any other
purpose; and''; and</DELETED>
<DELETED> (B) in subparagraph (B)--</DELETED>
<DELETED> (i) by inserting ``or teen'' after
``child'' each place the term
appears;</DELETED>
<DELETED> (ii) by inserting ``or teens''
after ``children''; and</DELETED>
<DELETED> (iii) by striking ``website or
online service'' and inserting ``website,
online service, online application, mobile
application, or connected device'';</DELETED>
<DELETED> (3) in paragraph (8), by striking subparagraphs
(F) and (G) and inserting the following:</DELETED>
<DELETED> ``(F) geolocation information;</DELETED>
<DELETED> ``(G) information generated from the
measurement or technological processing of an
individual's biological, physical, or physiological
characteristics, including--</DELETED>
<DELETED> ``(i) fingerprints;</DELETED>
<DELETED> ``(ii) voice prints;</DELETED>
<DELETED> ``(iii) iris or retina imagery
scans;</DELETED>
<DELETED> ``(iv) facial imagery or
templates;</DELETED>
<DELETED> ``(v) deoxyribonucleic acid (DNA)
information; or</DELETED>
<DELETED> ``(vi) gait;</DELETED>
<DELETED> ``(H) information reasonably associated
with or attributed to a child or teen;</DELETED>
<DELETED> ``(I) information (including an internet
protocol address) that permits the identification of--
</DELETED>
<DELETED> ``(i) an individual; or</DELETED>
<DELETED> ``(ii) any device used by an
individual to directly or indirectly access the
internet or an online service, online
application, mobile application, or connected
device; or</DELETED>
<DELETED> ``(J) information concerning a child or
teen or the parents of that child or teen (including
any unique or substantially unique identifier, such as
a customer number) that an operator collects online
from the child or teen and combines with an identifier
described in this paragraph.'';</DELETED>
<DELETED> (4) by amending paragraph (9) to read as
follows:</DELETED>
<DELETED> ``(9) Verifiable consent.--The term `verifiable
consent' means any reasonable effort (taking into consideration
available technology), including a request for authorization
for future collection, use, and disclosure described in the
notice, to ensure that, in the case of a child, a parent of the
child, or, in the case of a teen, the teen--</DELETED>
<DELETED> ``(A) receives specific notice of the
personal information collection, use, and disclosure
practices of the operator; and</DELETED>
<DELETED> ``(B) before the personal information of
the child or teen is collected, freely and
unambiguously authorizes--</DELETED>
<DELETED> ``(i) the collection, use, and
disclosure, as applicable, of that personal
information; and</DELETED>
<DELETED> ``(ii) any subsequent use of that
personal information.'';</DELETED>
<DELETED> (5) by striking paragraph (10) and redesignating
paragraphs (11) and (12) as paragraphs (10) and (11),
respectively; and</DELETED>
<DELETED> (6) by adding at the end the following:</DELETED>
<DELETED> ``(12) Connected device.--The term `connected
device' means a device that is capable of connecting to the
internet, directly or indirectly, or to another connected
device.</DELETED>
<DELETED> ``(13) Online application.--The term `online
application'--</DELETED>
<DELETED> ``(A) means an internet-connected software
program; and</DELETED>
<DELETED> ``(B) includes a service or application
offered via a connected device.</DELETED>
<DELETED> ``(14) Online service.--</DELETED>
<DELETED> ``(A) In general.--The term `online
service' means a mass-market retail service by wire or
radio that provides the capability to transmit data and
receive data from all or substantially all Internet
endpoints, including any capabilities that are
incidental to and enable the operation of a
communications service, but excluding dial-up Internet
service.</DELETED>
<DELETED> ``(B) Scope.--Such term includes--
</DELETED>
<DELETED> ``(i) any service that the Federal
Communications Commission finds to be providing
a functionally equivalent service to a service
described in subparagraph (A); and</DELETED>
<DELETED> ``(ii) a service or application
offered via a connected device.</DELETED>
<DELETED> ``(15) Directed to children or teens.--</DELETED>
<DELETED> ``(A) In general.--The terms `directed to
children', `directed to teens', and `directed to
children or teens' mean, with respect to a website,
online service, online application, mobile application,
or connected device, that the website, online service,
online application, mobile application, or connected
device, or a portion thereof, is targeted to children
or teens, as the case may be, as demonstrated by--
</DELETED>
<DELETED> ``(i) the subject matter of the
website, online service, online application,
mobile application, or connected
device;</DELETED>
<DELETED> ``(ii) the visual content of the
website, online service, online application,
mobile application, or connected
device;</DELETED>
<DELETED> ``(iii) the use of animated
characters or child-oriented activities for
children, or the use of teen-oriented
characters or teen-oriented activities for
teens, and related incentives on the website,
online service, online application, mobile
application, or connected device;</DELETED>
<DELETED> ``(iv) the music or other audio
content on the website, online service, online
application, mobile application, or connected
device;</DELETED>
<DELETED> ``(v) the age of models on the
website, online service, online application,
mobile application, or connected
device;</DELETED>
<DELETED> ``(vi) the presence, on the
website, online service, online application,
mobile application, or connected device, of--
</DELETED>
<DELETED> ``(I) child
celebrities;</DELETED>
<DELETED> ``(II) celebrities who
appeal to children;</DELETED>
<DELETED> ``(III) teen celebrities;
or</DELETED>
<DELETED> ``(IV) celebrities who
appeal to teens;</DELETED>
<DELETED> ``(vii) the language used on the
website, online service, online application,
mobile application, or connected
device;</DELETED>
<DELETED> ``(viii) advertising content used
on, or used to advertise, the website, online
service, online application, mobile
application, or connected device; or</DELETED>
<DELETED> ``(ix) reliable empirical evidence
relating to--</DELETED>
<DELETED> ``(I) the composition of
the audience of the website, online
service, online application, mobile
application, or connected device;
and</DELETED>
<DELETED> ``(II) the intended
audience of the website, online
service, online application, mobile
application, or connected
device.</DELETED>
<DELETED> ``(B) Rules of construction.--</DELETED>
<DELETED> ``(i) Services deemed directed to
children or teens.--For the purposes of this
title, a website, online service, online
application, mobile application, or connected
device, or a portion thereof, shall be deemed
to be directed to children or teens if it
collects personal information directly from
users of any other website, online service,
online application, mobile application, or
connected device that is--</DELETED>
<DELETED> ``(I) directed to children
or teens under the criteria described
in subparagraph (A); or</DELETED>
<DELETED> ``(II) used or reasonably
likely to be used by children or
teens.</DELETED>
<DELETED> ``(ii) Services deemed directed to
mixed audiences.--</DELETED>
<DELETED> ``(I) In general.--A
website, online service, online
application, mobile application, or
connected device that is directed to
children or teens under the criteria
described in subparagraph (A), but that
does not target children or teens as
the primary audience of the website,
online service, online application,
mobile application, or connected device
shall not be deemed to be directed to
children or teens for purposes of this
title if the website, online service,
online application, mobile application,
or connected device--</DELETED>
<DELETED> ``(aa) does not
collect personal information
from any user of the website,
online service, online
application, mobile
application, or connected
device before verifying age
information of the user;
and</DELETED>
<DELETED> ``(bb) does not,
without first complying with
any relevant notice and consent
provision under this title,
collect, use, or disclose
personal information of any
user who identifies themselves
to the website, online service,
online application, mobile
application, or connected
device as an individual who is
age 16 or younger.</DELETED>
<DELETED> ``(II) Use of certain
tools.--For purposes of this title, a
website, online service, online
application, mobile application, or
connected device, shall not be deemed
directed to children or teens solely
because the website, online service,
online application, mobile application,
or connected device refers or links to
any other website, online service,
online application, mobile application,
or connected device directed to
children or teens by using information
location tools, including--</DELETED>
<DELETED> ``(aa) a
directory;</DELETED>
<DELETED> ``(bb) an
index;</DELETED>
<DELETED> ``(cc) a
reference;</DELETED>
<DELETED> ``(dd) a pointer;
or</DELETED>
<DELETED> ``(ee) a hypertext
link.</DELETED>
<DELETED> ``(16) Mobile application.--The term `mobile
application'--</DELETED>
<DELETED> ``(A) means a software program that runs
on the operating system of--</DELETED>
<DELETED> ``(i) a cellular
telephone;</DELETED>
<DELETED> ``(ii) a tablet computer;
or</DELETED>
<DELETED> ``(iii) a similar portable
computing device that transmits data over a
wireless connection; and</DELETED>
<DELETED> ``(B) includes a service or application
offered via a connected device.</DELETED>
<DELETED> ``(17) Geolocation information.--The term
`geolocation information' means information sufficient to
identify a street name and name of a city or town.</DELETED>
<DELETED> ``(18) Teen.--The term `teen' means an individual
over the age of 12 and under the age of 17.</DELETED>
<DELETED> ``(19) Targeted marketing.--</DELETED>
<DELETED> ``(A) In general.--The term `targeted
marketing' means advertising or any other effort to
market a product or service that is directed to a
specific individual or device--</DELETED>
<DELETED> ``(i) based on--</DELETED>
<DELETED> ``(I) the personal
information of--</DELETED>
<DELETED> ``(aa) the
individual; or</DELETED>
<DELETED> ``(bb) a group of
individuals who are similar in
gender, age, income level,
race, or ethnicity to the
specific individual to whom the
product or service is
marketed;</DELETED>
<DELETED> ``(II) psychological
profiling of an individual or group of
individuals; or</DELETED>
<DELETED> ``(III) a unique
identifier of the device; or</DELETED>
<DELETED> ``(ii) as a result of use by the
individual, access by any device of the
individual, or use by a group of individuals
who are similar to the specific individual, of
more than a single--</DELETED>
<DELETED> ``(I) website;</DELETED>
<DELETED> ``(II) online
service;</DELETED>
<DELETED> ``(III) online
application;</DELETED>
<DELETED> ``(IV) mobile
application;</DELETED>
<DELETED> ``(V) connected device;
or</DELETED>
<DELETED> ``(VI) operating
system.</DELETED>
<DELETED> ``(B) Exclusions.--The term `targeted
marketing' shall not include--</DELETED>
<DELETED> ``(i) advertising or marketing to
an individual or the device of an individual in
response to the individual's specific request
for information or feedback;</DELETED>
<DELETED> ``(ii) contextual advertising,
such as when an advertisement is displayed
based on the context in which the advertisement
appears and does not vary based on who is
viewing the advertisement; or</DELETED>
<DELETED> ``(iii) processing personal
information solely for measuring or reporting
advertising or content performance, reach, or
frequency, including independent
measurement.</DELETED>
<DELETED> ``(C) Authority to further define.--The
Commission may promulgate rules under section 553 of
title 5, United State Code, to further define the term
`targeted marketing' but only as necessary to address
changes to or innovations of technology, changes in how
personal information is used or transferred, changes to
the means and manners by which children or teens
interact with a website, online service, online
application, mobile application, or connected device,
or evolving concerns regarding the privacy of children
or teens.</DELETED>
<DELETED> ``(20) Reasonably likely to be used.--The
Commission may promulgate rules under section 553 of title 5,
United States Code, or issue guidance to establish factors that
should be considered in applying the term `reasonably likely to
be used' for the purposes of this title.</DELETED>
<DELETED> ``(21) Reasonably likely to be a child or teen.--
The Commission may promulgate rules under section 553 of title
5, United States Code, or issue guidance to establish factors
that should be considered in applying the term `reasonably
likely to be a child or teen' for the purposes of this
title.''.</DELETED>
<DELETED> (b) Online Collection, Use, and Disclosure of Personal
Information of Children and Teens.--Section 1303 of the Children's
Online Privacy Protection Act of 1998 (15 U.S.C. 6502) is amended--
</DELETED>
<DELETED> (1) by striking the heading and inserting the
following: ``online collection, use, and disclosure of personal
information of children and teens.'';</DELETED>
<DELETED> (2) in subsection (a)--</DELETED>
<DELETED> (A) by amending paragraph (1) to read as
follows:</DELETED>
<DELETED> ``(1) In general.--It is unlawful for an operator
of a website, online service, online application, mobile
application, or connected device that is directed to children
or teens or is used or reasonably likely to be used by children
or teens in a manner that involves the collection of personal
information, to collect personal information from a child or
teen in a manner that violates the regulations prescribed under
subsection (b).''; and</DELETED>
<DELETED> (B) in paragraph (2)--</DELETED>
<DELETED> (i) by striking ``of such a
website or online service''; and</DELETED>
<DELETED> (ii) by striking ``subsection
(b)(1)(B)(iii) to the parent of a child'' and
inserting ``subsection (b)(1)(A)(iii) to the
parent of a child or under subsection
(b)(1)(A)(iv) to a teen''; and</DELETED>
<DELETED> (3) in subsection (b)--</DELETED>
<DELETED> (A) in paragraph (1)--</DELETED>
<DELETED> (i) by striking ``this Act'' and
inserting ``the Children and Teens' Online
Privacy Protection Act'';</DELETED>
<DELETED> (ii) in subparagraph (A)--
</DELETED>
<DELETED> (I) by striking ``operator
of any website'' and all that follows
through ``from a child'' and inserting
``operator of a website, online
service, online application, mobile
application, or connected device that
is directed to children or teens or is
used or is reasonably likely to be used
by children or teens in a manner that
involves the collection of their
personal information'';</DELETED>
<DELETED> (II) in clause (i)--
</DELETED>
<DELETED> (aa) by striking
``notice on the website'' and
inserting ``clear and
conspicuous notice'';</DELETED>
<DELETED> (bb) by inserting
``or teens'' after
``children'';</DELETED>
<DELETED> (cc) by striking
``, and the operator's'' and
inserting ``, the operator's'';
and</DELETED>
<DELETED> (dd) by striking
``; and'' and inserting ``, and
the procedures or mechanisms
the operator uses to ensure
that personal information is
not collected from children or
teens except in accordance with
the regulations promulgated
under this paragraph;'';
and</DELETED>
<DELETED> (III) in clause (ii)--
</DELETED>
<DELETED> (aa) by striking
``parental''; and</DELETED>
<DELETED> (bb) by inserting
``or teens'' after
``children'';</DELETED>
<DELETED> (iii) in subparagraph (B)--
</DELETED>
<DELETED> (I) in the matter
preceding clause (i), by striking
``website or online service'' and
inserting ``operator'';</DELETED>
<DELETED> (II) in clause (ii), by
inserting ``to delete personal
information collected from the child
or'' after ``the opportunity at any
time''; and</DELETED>
<DELETED> (III) in clause (iii), by
inserting ``, if such information is
available to the operator at the time
the parent makes the request'' before
the semicolon;</DELETED>
<DELETED> (iv) by redesignating
subparagraphs (C) and (D) as subparagraphs (D)
and (E), respectively;</DELETED>
<DELETED> (v) by inserting after
subparagraph (B) the following new
subparagraph:</DELETED>
<DELETED> ``(C) require the operator to provide,
upon the request of a teen under this subparagraph who
has provided personal information to the operator, upon
proper identification of that teen--</DELETED>
<DELETED> ``(i) a description of the
specific types of personal information
collected from the teen by the
operator;</DELETED>
<DELETED> ``(ii) the opportunity at any time
to delete personal information collected from
the teen and refuse further use or collection
of personal information from the teen;
and</DELETED>
<DELETED> ``(iii) a means that is reasonable
under the circumstances for the teen to obtain
any personal information collected from the
teen, if such information is available to the
operator at the time the teen makes the
request;'';</DELETED>
<DELETED> (vi) in subparagraph (D), as so
redesignated, by striking ``conditioning'' and
all that follows through ``such activity'' and
inserting the following: ``the collection from
a child or teen of more personal information
that is reasonably required to use the website,
online service, online application, mobile
application, or connected device'';</DELETED>
<DELETED> (vii) in subparagraph (E), as so
redesignated--</DELETED>
<DELETED> (I) by striking ``of such
a website or online service'';
and</DELETED>
<DELETED> (II) by inserting ``and
teens'' after ``children'';
and</DELETED>
<DELETED> (viii) by adding at the end the
following flush text:</DELETED>
<DELETED>``The Commission shall review and update the
regulations promulgated under this paragraph as
necessary.'';</DELETED>
<DELETED> (B) in paragraph (2)--</DELETED>
<DELETED> (i) in the matter preceding
subparagraph (A), by striking ``verifiable
parental consent'' and inserting ``verifiable
consent'';</DELETED>
<DELETED> (ii) in subparagraph (A)--
</DELETED>
<DELETED> (I) by inserting ``or
teen'' after ``collected from a
child'';</DELETED>
<DELETED> (II) by inserting ``or
teen'' after ``request from the
child''; and</DELETED>
<DELETED> (III) by inserting ``or
teen or to contact another child or
teen'' after ``to recontact the
child'';</DELETED>
<DELETED> (iii) in subparagraph (B)--
</DELETED>
<DELETED> (I) by striking ``parent
or child'' and inserting ``parent or
teen''; and</DELETED>
<DELETED> (II) by striking
``parental consent'' each place the
term appears and inserting ``verifiable
consent'';</DELETED>
<DELETED> (iv) in subparagraph (C)--
</DELETED>
<DELETED> (I) in the matter
preceding clause (i), by inserting ``or
teen'' after ``child'' each place the
term appears;</DELETED>
<DELETED> (II) in clause (i)--
</DELETED>
<DELETED> (aa) by inserting
``or teen'' after ``child''
each place the term appears;
and</DELETED>
<DELETED> (bb) by inserting
``or teen, as applicable,''
after ``parent'' each place the
term appears; and</DELETED>
<DELETED> (III) in clause (ii)--
</DELETED>
<DELETED> (aa) by inserting
``or teen, as applicable,''
after ``parent''; and</DELETED>
<DELETED> (bb) by inserting
``or teen'' after ``child''
each place the term appears;
and</DELETED>
<DELETED> (v) in subparagraph (D)--
</DELETED>
<DELETED> (I) in the matter
preceding clause (i), by inserting ``or
teen'' after ``child'' each place the
term appears;</DELETED>
<DELETED> (II) in clause (ii), by
inserting ``or teen'' after ``child'';
and</DELETED>
<DELETED> (III) in the flush text
following clause (iii)--</DELETED>
<DELETED> (aa) by inserting
``or teen, as applicable,''
after ``parent'' each place the
term appears; and</DELETED>
<DELETED> (bb) by inserting
``or teen'' after ``child'';
and</DELETED>
<DELETED> (C) by amending paragraph (3) to read as
follows:</DELETED>
<DELETED> ``(3) Continuation of service.--The regulations
shall prohibit an operator from discontinuing service provided
to a child or teen on the basis of a request by the parent of
the child or by the teen, under the regulations prescribed
under subparagraph (B) or (C) of paragraph (1), respectively,
to delete personal information collected from the child or
teen, to the extent that the operator is capable of providing
such service without such information.''.</DELETED>
<DELETED> (c) Safe Harbors.--Section 1304 of the Children's Online
Privacy Protection Act of 1998 (15 U.S.C. 6503) is amended--</DELETED>
<DELETED> (1) in subsection (b)(1), by inserting ``and
teens'' after ``children''; and</DELETED>
<DELETED> (2) by adding at the end the following:</DELETED>
<DELETED> ``(d) Publication.--</DELETED>
<DELETED> ``(1) In general.--The Commission shall publish on
the internet website of the Commission any report or
documentation required by regulation to be submitted to the
Commission to carry out this section.</DELETED>
<DELETED> ``(2) Restrictions on publication.--The
restrictions described in subsection (f) of section 6 of the
Federal Trade Commission Act (15 U.S.C. 46(f)) applicable to
the publication of information obtained by the Commission
through investigations conducted under such section shall apply
in same manner to the publication under this subsection of
information obtained by the Commission from a report or
documentation described in paragraph (1).''.</DELETED>
<DELETED> (d) Administration and Applicability of Act.--Section 1306
of the Children's Online Privacy Protection Act of 1998 (15 U.S.C.
6505) is amended--</DELETED>
<DELETED> (1) in subsection (b)--</DELETED>
<DELETED> (A) in paragraph (1), by striking ``, in
the case of'' and all that follows through ``the Board
of Directors of the Federal Deposit Insurance
Corporation;'' and inserting the following: ``by the
appropriate Federal banking agency, with respect to any
insured depository institution (as those terms are
defined in section 3 of that Act (12 U.S.C. 1813));'';
and</DELETED>
<DELETED> (B) by striking paragraph (2) and
redesignating paragraphs (3) through (6) as paragraphs
(2) through (5), respectively; and</DELETED>
<DELETED> (2) by adding at the end the following new
subsection:</DELETED>
<DELETED> ``(f) Telecommunications Carriers and Cable Operators.--
</DELETED>
<DELETED> ``(1) Enforcement by commission.--Notwithstanding
section 4, 5(a)(2), or 6 of the Federal Trade Commission Act
(15 U.S.C. 44, 45(a)(2), 46), or any jurisdictional limitation
of the Commission, the Commission shall also enforce this Act
and the regulations promulgated under this Act, in the same
manner provided in subsection (d), with respect to common
carriers subject to the Communications Act of 1934 (47 U.S.C.
151 et seq.) and Acts amendatory thereof and supplementary
thereto.</DELETED>
<DELETED> ``(2) Relationship to other law.--To the extent
that section 222, 338(i), or 631 of the Communications Act of
1934 (47 U.S.C. 222, 338(i), 551) is inconsistent with this
title, this title controls.''.</DELETED>
<DELETED>SEC. 4. FAIR INFORMATION PRACTICES PRINCIPLES.</DELETED>
<DELETED> (a) In General.--The Fair Information Practices Principles
described in this section are the following:</DELETED>
<DELETED> (1) Collection limitation principle.--Except as
provided in paragraph (3), personal information should be
collected from a child or teen only when collection of the
personal information is--</DELETED>
<DELETED> (A) consistent with the context of a
particular transaction or service or the relationship
of the child or teen with the operator, including
collection necessary to fulfill a transaction or
provide a service requested by the child or teen;
or</DELETED>
<DELETED> (B) required or specifically authorized by
law.</DELETED>
<DELETED> (2) Data quality principle.--The personal
information of a child or teen should be accurate, complete,
and kept up-to-date to the extent necessary to fulfill the
purposes described in subparagraphs (A) through (D) of
paragraph (3).</DELETED>
<DELETED> (3) Purpose specification principle.--The purposes
for which personal information is collected and used should be
specified to the parent of a child or to a teen not later than
at the time of the collection of the information. The
subsequent use or disclosure of the information should be
limited to--</DELETED>
<DELETED> (A) fulfillment of the transaction or
service requested by the teen or parent of the
child;</DELETED>
<DELETED> (B) support for the internal operations of
the website, service, or application, as described in
section 312.2 of title 16, Code of Federal Regulations
(as in effect on the date of enactment of this Act),
excluding any activity relating to targeted marketing
directed to children, teens, or a device of a child or
teen if the support for internal operations in
consistent with the interest of the child or
teen;</DELETED>
<DELETED> (C) compliance with legal process or other
purposes expressly authorized under specific legal
authority; or</DELETED>
<DELETED> (D) other purposes--</DELETED>
<DELETED> (i) that are specified in a notice
to the teen or parent of the child;
and</DELETED>
<DELETED> (ii) to which the teen or parent
of the child has consented under paragraph (7)
before the information is used or disclosed for
such other purposes.</DELETED>
<DELETED> (4) Retention limitation principle.--</DELETED>
<DELETED> (A) In general.--The personal information
of a child or teen should not be retained for longer
than is necessary to fulfill a transaction or provide a
service requested by the child or teen or such other
purposes specified in subparagraphs (A) through (D) of
paragraph (3).</DELETED>
<DELETED> (B) Data disposal.--The operator should
implement a reasonable and appropriate data disposal
policy based on the nature and sensitivity of personal
information described in subparagraph (A).</DELETED>
<DELETED> (5) Security safeguards principle.--The personal
information of a child or teen should be protected by
reasonable and appropriate security safeguards against risks
such as loss or unauthorized access, destruction, use,
modification, or disclosure.</DELETED>
<DELETED> (6) Transparency principle.--</DELETED>
<DELETED> (A) General principle.--The operator
should be transparent about developments, practices,
and policies with respect to the personal information
of a child or teen.</DELETED>
<DELETED> (B) Provision of information.--The
operator should provide to each parent of a child, or
to each teen, using the website, online service, online
application, mobile application, or connected device of
the operator with a clear and prominent means--
</DELETED>
<DELETED> (i) to identify and contact the
operator, by, at a minimum, disclosing, clearly
and prominently, the identity of the operator
and--</DELETED>
<DELETED> (I) in the case of an
operator who is an individual, the
address of the principal residence (but
not a personal residence) of the
operator and an email address or online
contact form and telephone number for
the operator; or</DELETED>
<DELETED> (II) in the case of any
other operator, the address of the
principal place of business of the
operator and an email address or online
contact form and telephone number for
the operator;</DELETED>
<DELETED> (ii) to determine whether the
operator possesses any personal information of
the child or teen, the nature of any such
information, and the purposes for which the
information was collected and is being
retained;</DELETED>
<DELETED> (iii) to obtain any personal
information of the child or teen that is in the
possession of the operator from the operator,
or from a person specified by the operator,
within a reasonable time after making a
request, at a charge (if any) that is not
excessive, in a reasonable manner, and in a
form that is readily intelligible to the child
or teen;</DELETED>
<DELETED> (iv) to challenge the accuracy of
personal information of the child or teen that
is in the possession of the operator;</DELETED>
<DELETED> (v) to determine if the child or
teen has established the inaccuracy of personal
information in a challenge under clause (iv) in
order to have such information erased,
corrected, completed, or otherwise amended;
and</DELETED>
<DELETED> (vi) to determine the method by
which the operator obtains data relevant to the
child or teen.</DELETED>
<DELETED> (C) Limitation.--Nothing in this paragraph
shall be construed to permit an operator to erase or
otherwise modify personal information requested by a
law enforcement agency pursuant to legal
authority.</DELETED>
<DELETED> (7) Individual participation principle.--The
operator should--</DELETED>
<DELETED> (A) obtain consent from a parent of a
child or from a teen before using or disclosing the
personal information of the child or teen for any
purpose other than the purposes described in
subparagraph (A) of paragraph (3); and</DELETED>
<DELETED> (B) obtain affirmative express consent
from a parent of a child or from a teen before using or
disclosing previously collected personal information of
the child or teen for purposes that constitute a
material change in practice from the original purposes
specified to the child or teen under paragraph
(3).</DELETED>
<DELETED> (8) Racial and socioeconomic profiling.--The
personal information of a child or teen shall not be used to
direct content to the child or teen, or a group of individuals
similar to the child or teen, on the basis of race,
socioeconomic factors, or any proxy thereof.</DELETED>
<DELETED> (b) Rule of Construction.--Nothing in this section,
including compliance with the Fair Information Principles, shall be
construed to permit an operator to avoid compliance with other
requirements set forth in this Act or the Children's Online Privacy
Protection Act (15 U.S.C. 6501 et seq.).</DELETED>
<DELETED>SEC. 5. DIGITAL MARKETING BILL OF RIGHTS FOR TEENS.</DELETED>
<DELETED> (a) Acts Prohibited.--</DELETED>
<DELETED> (1) Prohibition.--</DELETED>
<DELETED> (A) In general.--Except as provided in
subparagraph (B), it shall be unlawful for an operator
of a website, online service, online application,
mobile application, or connected device to collect
personal information from a user if--</DELETED>
<DELETED> (i) the user is reasonably likely
to be a teen; or</DELETED>
<DELETED> (ii) the website, online service,
online application, mobile application, or
connected device is directed to
teens.</DELETED>
<DELETED> (B) Exception.--Subparagraph (A) shall not
apply to an operator that has adopted and complies with
a Digital Marketing Bill of Rights for Teens that meets
the Fair Information Practices Principles described in
section 4.</DELETED>
<DELETED> (2) Effective date.--This subsection shall take
effect on the date that is 180 days after the promulgation of
regulations under subsection (b).</DELETED>
<DELETED> (b) Regulations.--</DELETED>
<DELETED> (1) In general.--Not later than 1 year after the
date of enactment of this Act, the Commission shall promulgate,
under section 553 of title 5, United States Code, regulations
to implement this section, including regulations further
defining the Fair Information Practices Principles described in
section 4.</DELETED>
<DELETED> (2) Updates.--Not less frequently than once every
4 years after the date on which regulations are promulgated
under paragraph (1), the Commission shall review and update
those regulations as necessary.</DELETED>
<DELETED>SEC. 6. TARGETED MARKETING TO CHILDREN AND TEENS.</DELETED>
<DELETED> (a) Prohibited Acts With Respect to Children and Teens.--
It shall be unlawful for an operator of a website, online service,
online application, mobile application, or connected device to collect,
use, disclose to third parties, or compile personal information of a
user for purposes of targeted marketing (or to allow another person to
collect, use, disclose, or compile such information for such purpose)
if--</DELETED>
<DELETED> (1) such use, disclosure, or compiling of personal
information involves or is reasonably likely to involve
collection of personal information from a child or teen;
or</DELETED>
<DELETED> (2) the website, online service, online
application, mobile application, or connected device is
directed to children or teens.</DELETED>
<DELETED> (b) Effective Date.--This section shall take effect on the
date that is 180 days after the date of enactment of this
Act.</DELETED>
<DELETED>SEC. 7. REMOVAL OF CONTENT.</DELETED>
<DELETED> (a) Acts Prohibited.--It is unlawful for an operator to
make, or enable a child or teen to make, publicly available through a
website, online service, online application, mobile application, or
connected device content or information that contains or displays
personal information of children or teens in a manner that violates
subsection (b).</DELETED>
<DELETED> (b) Requirement.--</DELETED>
<DELETED> (1) In general.--An operator, to the extent
technologically feasible, shall--</DELETED>
<DELETED> (A) implement mechanisms that permit a
user of the website, online service, online
application, mobile application, or connected device of
the operator (and, in the case of a user that is a
child, a parent of that user) to erase or otherwise
eliminate content or information that is--</DELETED>
<DELETED> (i) submitted to the website,
online service, online application, mobile
application, or connected device by that
user;</DELETED>
<DELETED> (ii) publicly available through
the website, online service, online
application, mobile application, or connected
device; and</DELETED>
<DELETED> (iii) contains or displays
personal information of children or teens;
and</DELETED>
<DELETED> (B) take appropriate steps to--</DELETED>
<DELETED> (i) make users and parents of
users who are children aware of the mechanisms
described in subparagraph (A); and</DELETED>
<DELETED> (ii) provide notice to users and
parents of users who are children that the
mechanisms described in subparagraph (A) do not
necessarily provide comprehensive removal of
the content or information submitted by
users.</DELETED>
<DELETED> (2) Exceptions.--Paragraph (1) shall not be
construed to require an operator or third party to erase or
otherwise eliminate content or information that--</DELETED>
<DELETED> (A) any other provision of Federal or
State law requires the operator or third party to
maintain; or</DELETED>
<DELETED> (B) was submitted to the website, online
service, online application, mobile application, or
connected device of the operator by any person other
than the user who is attempting to erase or otherwise
eliminate the content or information, including content
or information submitted by the user that was
republished or resubmitted by another person.</DELETED>
<DELETED> (c) Limitation.--Nothing in this section shall be
construed to limit the authority of a law enforcement agency to obtain
any content or information from an operator as authorized by law or
pursuant to an order of a court of competent jurisdiction.</DELETED>
<DELETED> (d) Effective Date.--This section shall take effect on the
date that is 180 days after the date of enactment of this
Act.</DELETED>
<DELETED>SEC. 8. RULE FOR TREATMENT OF USERS OF WEBSITES, SERVICES, AND
APPLICATIONS DIRECTED TO CHILDREN OR TEENS.</DELETED>
<DELETED> For the purposes of this Act, an operator of a website,
online service, online application, mobile application, or connected
device that is directed to children or teens shall treat each user of
that website, online service, online application, mobile application,
or connected device as a child or teen, except as permitted by the
Commission pursuant to a regulation promulgated under this Act, and
except to the extent the website, online service, online application,
mobile application, or connected device is deemed directed to mixed
audiences.</DELETED>
<DELETED>SEC. 9. STUDY OF MOBILE AND ONLINE APPLICATION
OVERSIGHT.</DELETED>
<DELETED> Not later than 3 years after the date of enactment of this
Act, the Commission shall submit to each committee of the Senate and
each committee of the House of Representatives that has jurisdiction
over the Commission a report on the processes of platforms that offer
mobile and online applications for ensuring that, of those applications
that are directed to children or teens, the applications operate in
accordance with--</DELETED>
<DELETED> (1) this Act, the amendments made by this Act, and
rules promulgated under this Act; and</DELETED>
<DELETED> (2) rules promulgated by the Commission under
section 5 of the Federal Trade Commission Act (15 U.S.C. 45)
relating to unfair or deceptive acts or practices in
marketing.</DELETED>
<DELETED>SEC. 10. YOUTH PRIVACY AND MARKETING DIVISION.</DELETED>
<DELETED> (a) Establishment.--There is established within the
Commission a division to be known as the Youth Privacy and Marketing
Division.</DELETED>
<DELETED> (b) Director.--The Youth Privacy and Marketing Division
shall be headed by a Director.</DELETED>
<DELETED> (c) Duties.--The Youth Privacy and Marketing Division
established under subsection (a) shall be responsible for assisting the
Commission to address, as it relates to this Act and the amendments
made by this Act--</DELETED>
<DELETED> (1) the privacy of children and teens;
and</DELETED>
<DELETED> (2) marketing directed at children and
teens.</DELETED>
<DELETED> (d) Staff.--The Director of the Youth Privacy and
Marketing Division shall hire adequate staff to carry out the duties
under subsection (c), including individuals who are experts in data
protection, digital advertising, data analytics, and youth
development.</DELETED>
<DELETED> (e) Reports.--Not later than 1 year after the date of
enactment of this Act, and each year thereafter, the Director of the
Youth and Privacy Marketing Division shall submit to the Committee on
Commerce, Science, and Transportation of the Senate and the Committee
on Energy and Commerce of the House of Representatives a report that
includes--</DELETED>
<DELETED> (1) a description of the work of the Youth Privacy
and Marketing Division on emerging concerns relating to youth
privacy and marketing practices; and</DELETED>
<DELETED> (2) an assessment of how effectively the
Commission has, during the period for which the report is
submitted, addressed youth privacy and marketing
practices.</DELETED>
<DELETED>SEC. 11. ENFORCEMENT AND APPLICABILITY.</DELETED>
<DELETED> (a) Enforcement by the Commission.--</DELETED>
<DELETED> (1) In general.--Except as otherwise provided,
this Act and the regulations prescribed under this Act shall be
enforced by the Commission under the Federal Trade Commission
Act (15 U.S.C. 41 et seq.).</DELETED>
<DELETED> (2) Unfair or deceptive acts or practices.--
Subject to subsection (b), a violation of this Act or a
regulation prescribed under this Act shall be treated as a
violation of a rule defining an unfair or deceptive act or
practice prescribed under section 18(a)(1)(B) of the Federal
Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).</DELETED>
<DELETED> (3) Actions by the commission.--</DELETED>
<DELETED> (A) In general.--Subject to subsection
(b), and except as provided in subsection (d)(1), the
Commission shall prevent any person from violating this
Act or a regulation prescribed under this Act in the
same manner, by the same means, and with the same
jurisdiction, powers, and duties as though all
applicable terms and provisions of the Federal Trade
Commission Act (15 U.S.C. 41 et seq.) were incorporated
into and made a part of this Act, and any person who
violates this Act or such regulation shall be subject
to the penalties and entitled to the privileges and
immunities provided in the Federal Trade Commission
Act.</DELETED>
<DELETED> (B) Violations.--Notwithstanding section
5(m) of the Federal Trade Commission Act (15 U.S.C.
45(m)), a civil penalty recovered for a violation of
this Act or a regulation prescribed under this Act may
be in excess of the amounts provided for in that
section as the court finds appropriate to deter
violations of this Act and regulations prescribed under
this Act.</DELETED>
<DELETED> (b) Enforcement by Certain Other Agencies.--
Notwithstanding subsection (a), compliance with the requirements
imposed under this Act shall be enforced as follows:</DELETED>
<DELETED> (1) Under section 8 of the Federal Deposit
Insurance Act (12 U.S.C. 1818) by the appropriate Federal
banking agency, with respect to an insured depository
institution (as such terms are defined in section 3 of such Act
(12 U.S.C. 1813)).</DELETED>
<DELETED> (2) Under the Federal Credit Union Act (12 U.S.C.
1751 et seq.) by the National Credit Union Administration
Board, with respect to any Federal credit union.</DELETED>
<DELETED> (3) Under part A of subtitle VII of title 49,
United States Code, by the Secretary of Transportation, with
respect to any air carrier or foreign air carrier subject to
such part.</DELETED>
<DELETED> (4) Under the Packers and Stockyards Act, 1921 (7
U.S.C. 181 et seq.) (except as provided in section 406 of that
Act (7 U.S.C. 226, 227)) by the Secretary of Agriculture, with
respect to any activities subject to that Act.</DELETED>
<DELETED> (5) Under the Farm Credit Act of 1971 (12 U.S.C.
2001 et seq.) by the Farm Credit Administration, with respect
to any Federal land bank, Federal land bank association,
Federal intermediate credit bank, or production credit
association.</DELETED>
<DELETED> (c) Enforcement by State Attorneys General.--</DELETED>
<DELETED> (1) In general.--</DELETED>
<DELETED> (A) Civil actions.--In any case in which
the attorney general of a State has reason to believe
that an interest of the residents of that State has
been or is threatened or adversely affected by the
engagement of any person in a practice that violates
this Act or a regulation prescribed under this Act, the
State, as parens patriae, may bring a civil action on
behalf of the residents of the State in a district
court of the United States of appropriate jurisdiction
to--</DELETED>
<DELETED> (i) enjoin that
practice;</DELETED>
<DELETED> (ii) enforce compliance with this
Act or such regulation;</DELETED>
<DELETED> (iii) obtain damages, restitution,
or other compensation on behalf of residents of
the State; or</DELETED>
<DELETED> (iv) obtain such other relief as
the court may consider to be
appropriate.</DELETED>
<DELETED> (B) Notice.--</DELETED>
<DELETED> (i) In general.--Before filing an
action under subparagraph (A), the attorney
general of the State involved shall provide to
the Commission--</DELETED>
<DELETED> (I) written notice of that
action; and</DELETED>
<DELETED> (II) a copy of the
complaint for that action.</DELETED>
<DELETED> (ii) Exemption.--</DELETED>
<DELETED> (I) In general.--Clause
(i) shall not apply with respect to the
filing of an action by an attorney
general of a State under this paragraph
if the attorney general of the State
determines that it is not feasible to
provide the notice described in that
clause before the filing of the
action.</DELETED>
<DELETED> (II) Notification.--In an
action described in subclause (I), the
attorney general of a State shall
provide notice and a copy of the
complaint to the Commission at the same
time as the attorney general files the
action.</DELETED>
<DELETED> (2) Intervention.--</DELETED>
<DELETED> (A) In general.--On receiving notice under
paragraph (1)(B), the Commission shall have the right
to intervene in the action that is the subject of the
notice.</DELETED>
<DELETED> (B) Effect of intervention.--If the
Commission intervenes in an action under paragraph (1),
it shall have the right--</DELETED>
<DELETED> (i) to be heard with respect to
any matter that arises in that action;
and</DELETED>
<DELETED> (ii) to file a petition for
appeal.</DELETED>
<DELETED> (3) Construction.--For purposes of bringing any
civil action under paragraph (1), nothing in this Act shall be
construed to prevent an attorney general of a State from
exercising the powers conferred on the attorney general by the
laws of that State to--</DELETED>
<DELETED> (A) conduct investigations;</DELETED>
<DELETED> (B) administer oaths or affirmations;
or</DELETED>
<DELETED> (C) compel the attendance of witnesses or
the production of documentary and other
evidence.</DELETED>
<DELETED> (4) Actions by the commission.--In any case in
which an action is instituted by or on behalf of the Commission
for violation of this Act or a regulation prescribed under this
Act, no State may, during the pendency of that action,
institute a separate action under paragraph (1) against any
defendant named in the complaint in the action instituted by or
on behalf of the Commission for that violation.</DELETED>
<DELETED> (5) Venue; service of process.--</DELETED>
<DELETED> (A) Venue.--Any action brought under
paragraph (1) may be brought in the district court of
the United States that meets applicable requirements
relating to venue under section 1391 of title 28,
United States Code.</DELETED>
<DELETED> (B) Service of process.--In an action
brought under paragraph (1), process may be served in
any district in which the defendant--</DELETED>
<DELETED> (i) is an inhabitant; or</DELETED>
<DELETED> (ii) may be found.</DELETED>
<DELETED> (d) Telecommunications Carriers and Cable Operators.--
</DELETED>
<DELETED> (1) Enforcement by commission.--Notwithstanding
section 4, 5(a)(2), or 6 of the Federal Trade Commission Act
(15 U.S.C. 44, 45(a)(2), 46) or any jurisdictional limitation
of the Commission, the Commission shall also enforce this Act
and regulations promulgated under this Act, in the same manner
provided in paragraph (a), with respect to common carriers
subject to the Communications Act of 1934 (47 U.S.C. 151 et
seq.) and Acts amendatory thereof and supplementary
thereto.</DELETED>
<DELETED> (2) Relationship to other laws.--To the extent
that section 222, 338(i), or 631 of the Communications Act of
1934 (47 U.S.C. 222, 338(i), 551) is inconsistent with this
Act, this Act controls.</DELETED>
<DELETED> (e) Safe Harbors.--</DELETED>
<DELETED> (1) Definition.--In this subsection--</DELETED>
<DELETED> (A) the term ``applicable section'' means
section 5, 6, 7, or 8 of this Act;</DELETED>
<DELETED> (B) the term ``covered operator'' means an
operator subject to guidelines approved under paragraph
(2);</DELETED>
<DELETED> (C) the term ``requesting entity'' means
an entity that submits a safe harbor request to the
Commission; and</DELETED>
<DELETED> (D) the term ``safe harbor request'' means
a request to have self-regulatory guidelines described
in paragraph (2)(A) approved under that
paragraph.</DELETED>
<DELETED> (2) Guidelines.--</DELETED>
<DELETED> (A) In general.--An operator may satisfy
the requirements of regulations issued under an
applicable section by following a set of self-
regulatory guidelines, issued by representatives of the
marketing or online industries, or by other persons,
that, after notice and an opportunity for comment, are
approved by the Commission upon making a determination
that the guidelines meet the requirements of the
regulations issued under that applicable
section.</DELETED>
<DELETED> (B) Expedited response to requests.--Not
later than 180 days after the date on which a safe
harbor request is filed under subparagraph (A), the
Commission shall act upon the request set forth in
writing the conclusions of the Commission with regard
to the request.</DELETED>
<DELETED> (C) Appeals.--A requesting entity may
appeal the final action of the Commission under
subparagraph (B), or a failure by the Commission to act
in the period described in that paragraph, to a
district court of the United States of appropriate
jurisdiction, as provided for in section 706 of title
5, United States Code.</DELETED>
<DELETED> (3) Incentives.--</DELETED>
<DELETED> (A) Self-regulatory incentives.--In
prescribing regulations under an applicable section,
the Commission shall provide incentives for self-
regulation by covered operators to implement the
protections afforded children and teens, as applicable,
under the regulatory requirements described in those
sections.</DELETED>
<DELETED> (B) Deemed compliance.--The incentives
under subparagraph (A) shall include provisions for
ensuring that a covered operator will be deemed to be
in compliance with the requirements of the regulations
under an applicable section if that person complies
with guidelines approved under paragraph (2).</DELETED>
<DELETED> (4) Regulations.--</DELETED>
<DELETED> (A) In general.--In prescribing
regulations relating to safe harbor guidelines under an
applicable section, the Commission shall--</DELETED>
<DELETED> (i) establish criteria for the
approval of guidelines that will ensure that a
covered operator provides substantially the
same or greater protections for children and
teens, as applicable, as those contained in the
regulations issued under the applicable
section; and</DELETED>
<DELETED> (ii) subject to subsection (B),
require that any report or documentation
required to be submitted to the Commission by a
covered operator or requesting entity will be
published on the internet website of the
Commission.</DELETED>
<DELETED> (B) Restrictions on publication.--The
restrictions described in subsection (f) of section 6
of the Federal Trade Commission Act (15 U.S.C. 46(f))
applicable to the publication of information obtained
by the Commission through investigations conducted
under such section shall apply in same manner to the
publication under this paragraph of information
included in a report or documentation described in
subparagraph (A).</DELETED>
<DELETED> (5) Report by the inspector general.--</DELETED>
<DELETED> (A) In general.--Not later than 2 years
after the date of enactment of this Act, and once each
2 years thereafter, the Inspector General of the
Commission shall submit to the Commission and each
committee of the Senate and each committee of the House
of Representatives that has jurisdiction over the
Commission a report regarding the safe harbor
provisions under this subparagraph, which shall
include--</DELETED>
<DELETED> (i) an analysis of whether the
safe harbor provisions are--</DELETED>
<DELETED> (I) operating fairly and
effectively; and</DELETED>
<DELETED> (II) effectively
protecting the interests of children
and teens; and</DELETED>
<DELETED> (ii) proposals for policy changes
that would improve the effectiveness of the
safe harbor provisions.</DELETED>
<DELETED> (B) Publication.--Not later than 10 days
after the date on which a report under subparagraph (A)
is submitted, the Commission shall publish the report
on the internet website of the Commission.</DELETED>
<DELETED> (f) Effective Date.--This section shall take effect on the
date that is 90 days after the date of enactment of this Act.</DELETED>
<DELETED> (g) Rule of Construction.--Nothing in this Act may be
construed to authorize any action by the Commission that would violate
section 18(h) of the Federal Trade Commission Act (15 U.S.C.
57a(h)).</DELETED>
<DELETED>SEC. 12. GAO STUDY.</DELETED>
<DELETED> (a) Study.--The Comptroller General of the United States
(in this section referred to as the ``Comptroller General'') shall
conduct a study on the privacy of teens who use financial technology
products. Such study shall--</DELETED>
<DELETED> (1) identify the type of financial technology
products that teens are using;</DELETED>
<DELETED> (2) identify the potential risks to teens' privacy
from using such financial technology products; and</DELETED>
<DELETED> (3) determine whether existing laws are sufficient
to address such risks to teens' privacy.</DELETED>
<DELETED> (b) Report.--Not later than 1 year after the date of
enactment of this section, the Comptroller General shall submit to
Congress a report containing the results of the study conducted under
subsection (a), together with recommendations for such legislation and
administrative action as the Comptroller General determines
appropriate.</DELETED>
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) Short Title.--This Act may be cited as the ``Children and
Teens' Online Privacy Protection Act''.
(b) Table of Contents.--The table of contents for this Act is as
follows:
Sec. 1. Short title; table of contents.
Sec. 2. Online collection, use, disclosure, and deletion of personal
information of children and teens.
Sec. 3. Study and reports of mobile and online application oversight
and enforcement.
Sec. 4. GAO study.
SEC. 2. ONLINE COLLECTION, USE, DISCLOSURE, AND DELETION OF PERSONAL
INFORMATION OF CHILDREN AND TEENS.
(a) Definitions.--Section 1302 of the Children's Online Privacy
Protection Act of 1998 (15 U.S.C. 6501) is amended--
(1) by amending paragraph (2) to read as follows:
``(2) Operator.--The term `operator'--
``(A) means any person--
``(i) who, for commercial purposes, in
interstate or foreign commerce operates or
provides a website on the internet, an online
service, an online application, or a mobile
application; and
``(ii) who--
``(I) collects or maintains, either
directly or through a service provider,
personal information from or about the
users of that website, service, or
application;
``(II) allows another person to
collect personal information directly
from users of that website, service, or
application (in which case, the
operator is deemed to have collected
the information); or
``(III) allows users of that
website, service, or application to
publicly disclose personal information
(in which case, the operator is deemed
to have collected the information); and
``(B) does not include any nonprofit entity that
would otherwise be exempt from coverage under section 5
of the Federal Trade Commission Act (15 U.S.C. 45).'';
(2) in paragraph (4)--
(A) by amending subparagraph (A) to read as
follows:
``(A) the release of personal information collected
from a child or teen by an operator for any purpose,
except where the personal information is provided to a
person other than an operator who--
``(i) provides support for the internal
operations of the website, online service,
online application, or mobile application of
the operator, excluding any activity relating
to individual-specific advertising to children
or teens; and
``(ii) does not disclose or use that
personal information for any other purpose;
and''; and
(B) in subparagraph (B)--
(i) by inserting ``or teen'' after
``child'' each place the term appears; and
(ii) by striking ``website or online
service'' and inserting ``website, online
service, online application, or mobile
application'';
(3) by striking paragraph (8) and inserting the following:
``(8) Personal information.--
``(A) In general.--The term `personal information'
means individually identifiable information about an
individual collected online, including--
``(i) a first and last name;
``(ii) a home or other physical address
including street name and name of a city or
town;
``(iii) an e-mail address;
``(iv) a telephone number;
``(v) a Social Security number;
``(vi) any other identifier that the
Commission determines permits the physical or
online contacting of a specific individual;
``(vii) geolocation information;
``(viii) information generated from the
measurement or technological processing of an
individual's biological, physical, or
physiological characteristics that is used to
identify an individual, including--
``(I) fingerprints;
``(II) voice prints;
``(III) iris or retina imagery
scans;
``(IV) facial templates;
``(V) deoxyribonucleic acid (DNA)
information; or
``(VI) gait;
``(ix) information linked or reasonably
linkable to a child or teen; or
``(x) information linked or reasonably
linkable to a child or teen or the parents of
that child or teen (including any unique
identifier) that an operator collects online
from the child or teen and combines with an
identifier described in this subparagraph.
``(B) Exclusion.--The term `personal information'
shall not include an audio file that contains a child's
or teen's voice so long as the operator--
``(i) does not request information via
voice that would otherwise be considered
personal information under this paragraph;
``(ii) provides clear notice of its
collection and use of the audio file and its
deletion policy in its privacy policy;
``(iii) only uses the voice within the
audio file solely as a replacement for written
words, to perform a task, or engage with a
website, online service, online application, or
mobile application, such as to perform a search
or fulfill a verbal instruction or request; and
``(iv) only maintains the audio file long
enough to complete the stated purpose and then
immediately deletes the audio file and does not
make any other use of the audio file prior to
deletion.'';
(4) by amending paragraph (9) to read as follows:
``(9) Verifiable consent.--The term `verifiable consent'
means any reasonable effort (taking into consideration
available technology), including a request for authorization
for future collection, use, and disclosure described in the
notice, to ensure that, in the case of a child, a parent of the
child, or, in the case of a teen, the teen--
``(A) receives specific notice of the personal
information collection, use, and disclosure practices
of the operator; and
``(B) before the personal information of the child
or teen is collected, freely and unambiguously
authorizes--
``(i) the collection, use, and disclosure,
as applicable, of that personal information;
and
``(ii) any subsequent use of that personal
information.'';
(5) in paragraph (10)--
(A) in the paragraph header, by striking ``Website
or online service directed to children'' and inserting
``Website, online service, online application, or
mobile application directed to children'';
(B) by striking ``website or online service'' each
place it appears and inserting ``website, online
service, online application, or mobile application'';
and
(C) by adding at the end the following new
subparagraph:
``(C) Rule of construction.--In considering whether
a website, online service, online application, or
mobile application is directed to children, the
Commission shall, using competent and reliable
empirical evidence, apply a totality of circumstances
test to consider the intended audience of the website,
online service, online application, or mobile
application, as a whole.''; and
(6) by adding at the end the following:
``(13) Connected device.--The term `connected device' means
a device that is capable of connecting to the internet,
directly or indirectly, or to another connected device.
``(14) Online application.--The term `online application'--
``(A) means an internet-connected software program;
and
``(B) includes a service or application offered via
a connected device.
``(15) Mobile application.--The term `mobile application'--
``(A) means a software program that runs on the
operating system of--
``(i) a cellular telephone;
``(ii) a tablet computer; or
``(iii) a similar portable computing device
that transmits data over a wireless connection;
and
``(B) includes a service or application offered via
a connected device.
``(16) Geolocation information.--The term `geolocation
information' means information sufficient to identify a street
name and name of a city or town.
``(17) Teen.--The term `teen' means an individual over the
age of 12 and under the age of 17.
``(18) Individual-specific advertising to children or
teens.--
``(A) In general.--The term `individual-specific
advertising to children or teens' means advertising or
any other effort to market a product or service that is
directed to a specific child or teen or a device that
is linked or reasonably linkable to a child or teen--
``(i) based on--
``(I) the personal information of--
``(aa) the child or teen;
or
``(bb) a group of children
or teens who are similar in
sex, age, income level, race,
or ethnicity to the specific
child or teen to whom the
product or service is marketed;
``(II) psychological profiling of a
child or teen or group of children or
teens; or
``(III) a unique identifier of the
device; or
``(ii) as a result of use by the child or
teen, access by any device of the child or
teen, or use by a group of children or teens
who are similar to the specific child or teen,
of more than a single--
``(I) website;
``(II) online service;
``(III) online application;
``(IV) mobile application; or
``(V) connected device.
``(B) Exclusions.--The term `individual-specific
advertising to children or teens' shall not include--
``(i) advertising or marketing to an
individual or the device of an individual in
response to the individual's specific request
for information or feedback, such as a child's
or teen's current search query;
``(ii) contextual advertising, such as when
an advertisement is displayed based on the
content of the website, online service, online
application, mobile application, or connected
device in which the advertisement appears and
does not vary based on personal information
related to the viewer; or
``(iii) processing personal information
solely for measuring or reporting advertising
or content performance, reach, or frequency,
including independent measurement.
``(C) Rule of construction.--Nothing in
subparagraph (A) shall be construed to prohibit an
operator with actual knowledge or knowledge fairly
implied on the basis of objective circumstances that an
individual is under the age of 17 from delivering
advertising or marketing that is age-appropriate and
intended for a child or teen audience, so long as the
operator does not use any personal information other
than whether the user is under the age of 17.''.
(b) Online Collection, Use, Disclosure, and Deletion of Personal
Information of Children and Teens.--Section 1303 of the Children's
Online Privacy Protection Act of 1998 (15 U.S.C. 6502) is amended--
(1) by striking the heading and inserting the following:
``online collection, use, disclosure, and deletion of personal
information of children and teens.'';
(2) in subsection (a)--
(A) by amending paragraph (1) to read as follows:
``(1) In general.--It is unlawful for an operator of a
website, online service, online application, or mobile
application directed to children or for any operator of a
website, online service, online application, or mobile
application with actual knowledge or knowledge fairly implied
on the basis of objective circumstances--
``(A) to collect personal information from a child
or teen in a manner that violates the regulations
prescribed under subsection (b);
``(B) to collect, use, disclose to third parties,
or compile personal information of a child or teen for
purposes of individual-specific advertising to children
or teens (or to allow another person to collect, use,
disclose, or compile such information for such
purpose);
``(C) to collect the personal information of a
child or teen except when the collection of the
personal information is--
``(i) consistent with the context of a
particular or service or the relationship of
the child or teen with the operator, including
collection necessary to fulfill a transaction
or provide a product or service requested by
the child or teen; or
``(ii) required or specifically authorized
by Federal or State law; or
``(D) to store or transfer the personal information
of a child or teen outside of the United States unless
the operator discloses to the child or teen involved
that their personal information is being stored or
transferred outside of the United States; or
``(E) to retain the personal information of a child
or teen for longer than is reasonably necessary to
fulfill a transaction or provide a service requested by
the child or teen except as required or specifically
authorized by Federal or State law.''; and
(B) in paragraph (2)--
(i) by striking ``Notwithstanding paragraph
(1)'' and inserting ``Notwithstanding paragraph
(1)(A)'';
(ii) by striking ``of such a website or
online service''; and
(iii) by striking ``subsection
(b)(1)(B)(iii) to the parent of a child'' and
inserting ``subsection (b)(1)(B)(iii) to the
parent of a child or under subsection
(b)(1)(C)(iii) to a teen'';
(3) in subsection (b)--
(A) in paragraph (1)--
(i) in subparagraph (A)--
(I) by striking ``operator of any
website'' and all that follows through
``from a child'' and inserting
``operator of a website, online
service, online application, or mobile
application directed to children or
that has actual knowledge or knowledge
fairly implied on the basis of
objective circumstances that it is
collecting personal information from
children or teens'';
(II) in clause (i)--
(aa) by striking ``notice
on the website'' and inserting
``clear and conspicuous
notice'';
(bb) by inserting ``or
teens'' after ``children'';
(cc) by striking ``, and
the operator's'' and inserting
``, the operator's''; and
(dd) by striking ``; and''
and inserting ``, the rights
and opportunities available to
the parent of the child or teen
under subparagraphs (B) and
(C), and the procedures or
mechanisms the operator uses to
ensure that personal
information is not collected
from children or teens except
in accordance with the
regulations promulgated under
this paragraph;'';
(III) in clause (ii)--
(aa) by striking
``parental'';
(bb) by inserting ``or
teens'' after ``children'';
(cc) by striking the
semicolon at the end and
inserting ``; and''; and
(IV) by inserting after clause (ii)
the following new clause:
``(iii) to obtain verifiable consent from a
parent of a child or a teen before using or
disclosing personal information of the child or
teen for any purpose that is a material change
from the original purposes and disclosure
practices specified to the parent of the child
or the teen under clause (i);'';
(ii) in subparagraph (B)--
(I) in the matter preceding clause
(i), by striking ``website or online
service'' and inserting ``operator'';
(II) in clause (i), by inserting
``and the method by which the operator
obtained the personal information, and
the purposes for which the operator
collects, uses, discloses, and retains
the personal information'' before the
semicolon;
(III) in clause (ii)--
(aa) by inserting ``to
delete personal information
collected from the child or
content or information
submitted by the child to a
website, online service, online
application, or mobile
application and'' after ``the
opportunity at any time''; and
(bb) by striking ``; and''
and inserting a semicolon;
(IV) by redesignating clause (iii)
as clause (iv) and inserting after
clause (ii) the following new clause:
``(iii) the opportunity to challenge the
accuracy of the personal information and, if
the parent of the child establishes the
inaccuracy of the personal information, to have
the inaccurate personal information
corrected;''; and
(V) in clause (iv), as so
redesignated, by inserting ``, if such
information is available to the
operator at the time the parent makes
the request'' before the semicolon;
(iii) by redesignating subparagraphs (C)
and (D) as subparagraphs (D) and (E),
respectively;
(iv) by inserting after subparagraph (B)
the following new subparagraph:
``(C) require the operator to provide, upon the
request of a teen under this subparagraph who has
provided personal information to the operator, upon
proper identification of that teen--
``(i) a description of the specific types
of personal information collected from the teen
by the operator, the method by which the
operator obtained the personal information, and
the purposes for which the operator collects,
uses, discloses, and retains the personal
information;
``(ii) the opportunity at any time to
delete personal information collected from the
teen or content or information submitted by the
teen to a website, online service, online
application, or mobile application and to
refuse further use or collection of personal
information from the teen;
``(iii) the opportunity to challenge the
accuracy of the personal information and, if
the parent of the child establishes the
inaccuracy of the personal information, to have
the inaccurate personal information corrected;
and
``(iv) a means that is reasonable under the
circumstances for the teen to obtain any
personal information collected from the teen,
if such information is available to the
operator at the time the teen makes the
request;''; and
(v) by amending subparagraph (E), as so
redesignated, to read as follows:
``(E) require the operator to establish, implement,
and maintain reasonable security practices to protect
the confidentiality, integrity, and accessibility of
personal information of children or teens collected by
the operator, and to protect such personal information
against unauthorized access.'';
(B) in paragraph (2)--
(i) in the matter preceding subparagraph
(A), by striking ``verifiable parental
consent'' and inserting ``verifiable consent'';
(ii) in subparagraph (A)--
(I) by inserting ``or teen'' after
``collected from a child'';
(II) by inserting ``or teen'' after
``request from the child''; and
(III) by inserting ``or teen or to
contact another child or teen'' after
``to recontact the child'';
(iii) in subparagraph (B)--
(I) by striking ``parent or child''
and inserting ``parent or teen''; and
(II) by striking ``parental
consent'' each place the term appears
and inserting ``verifiable consent'';
(iv) in subparagraph (C)--
(I) in the matter preceding clause
(i), by inserting ``or teen'' after
``child'' each place the term appears;
(II) in clause (i)--
(aa) by inserting ``or
teen'' after ``child'' each
place the term appears; and
(bb) by inserting ``or
teen, as applicable,'' after
``parent'' each place the term
appears; and
(III) in clause (ii), by inserting
``or teen'' after ``child'' each place
the term appears; and
(v) in subparagraph (D)--
(I) in the matter preceding clause
(i), by inserting ``or teen'' after
``child'' each place the term appears;
(II) in clause (ii), by inserting
``or teen'' after ``child''; and
(III) in the flush text following
clause (iii)--
(aa) by inserting ``or
teen, as applicable,'' after
``parent'' each place the term
appears; and
(bb) by inserting ``or
teen'' after ``child''; and
(C) by adding after paragraph (3) the following:
``(4) Continuation of service.--The regulations shall
prohibit an operator from discontinuing service provided to a
child or teen on the basis of a request by the parent of the
child or by the teen, under the regulations prescribed under
subparagraph (B) or (C) of paragraph (1), respectively, to
delete personal information collected from the child or teen,
to the extent that the operator is capable of providing such
service without such information.
``(5) Rule of construction.--A request made pursuant to
subparagraph (B) or (C) of paragraph (1) to delete personal
information of a child or teen shall not be construed--
``(A) to limit the authority of a law enforcement
agency to obtain any content or information from an
operator pursuant to a lawfully executed warrant or an
order of a court of competent jurisdiction;
``(B) to require an operator or third party delete
information that--
``(i) any other provision of Federal or
State law requires the operator or third party
to maintain; or
``(ii) was submitted to the website, online
service, online application, or mobile
application of the operator by any person other
than the user who is attempting to erase or
otherwise eliminate the content or information,
including content or information submitted by
the user that was republished or resubmitted by
another person; or
``(C) prohibit an operator from--
``(i) retaining a record of the deletion
request and the minimum information necessary
for the purposes of ensuring compliance with a
request made pursuant to subparagraph (B) or
(C); or
``(ii) ensuring that the child or teen's
information remains deleted.''; and
(4) in subsection (c), by striking ``a regulation
prescribed under subsection (a)'' and inserting ``subparagraph
(B), (C), (D), or (E) of subsection (a)(1), or a of a
regulation prescribed under subparagraph (A) of such
subsection,''.
(c) Safe Harbors.--Section 1304 of the Children's Online Privacy
Protection Act of 1998 (15 U.S.C. 6503) is amended--
(1) in subsection (b)(1), by inserting ``and teens'' after
``children''; and
(2) by adding at the end the following:
``(d) Publication.--
``(1) In general.--The Commission shall publish on the
internet website of the Commission any report or documentation
required by regulation to be submitted to the Commission to
carry out this section.
``(2) Restrictions on publication.--The restrictions
described in subsection (f) of section 6 of the Federal Trade
Commission Act (15 U.S.C. 46(f)) applicable to the publication
of information obtained by the Commission through
investigations conducted under such section shall apply in same
manner to the publication under this subsection of information
obtained by the Commission from a report or documentation
described in paragraph (1).''.
(d) Administration and Applicability of Act.--Section 1306 of the
Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6505) is
amended--
(1) in subsection (b)--
(A) in paragraph (1), by striking ``, in the case
of'' and all that follows through ``the Board of
Directors of the Federal Deposit Insurance
Corporation;'' and inserting the following: ``by the
appropriate Federal banking agency, with respect to any
insured depository institution (as those terms are
defined in section 3 of that Act (12 U.S.C. 1813));'';
and
(B) by striking paragraph (2) and redesignating
paragraphs (3) through (6) as paragraphs (2) through
(5), respectively; and
(2) by adding at the end the following new subsections:
``(f) Determination of Whether an Operator Has Knowledge Fairly
Implied on the Basis of Objective Circumstances.--
``(1) Rule of construction.--For purposes of enforcing this
Act or a regulation promulgated under this Act, in making a
determination as to whether an operator has knowledge fairly
implied on the basis of objective circumstances that a user is
a child or teen, the Commission shall rely on competent and
reliable empirical evidence, taking into account the totality
of the circumstances, including consideration of whether the
operator, using available technology, exercised reasonable
care.
``(2) Protections for privacy.--Nothing in the Commission's
determination under paragraph (1) shall be construed to require
an operator to--
``(A) affirmatively collect any personal
information with respect to the age of a child or teen
that an operator is not already collecting in the
normal course of business; or
``(B) implement an age gating or age verification
functionality.
``(3) Commission guidance.--
``(A) In general.--Within 180 days of enactment,
the Commission shall issue guidance to provide
information, including best practices and examples for
operators to understand the Commission's determination
of whether an operator has knowledge fairly implied on
the basis of objective circumstances.
``(B) Limitation.--No guidance issued by the
Commission with respect to this Act shall confer any
rights on any person, State, or locality, nor shall
operate to bind the Commission or any person to the
approach recommended in such guidance. In any
enforcement action brought pursuant to this Act, the
Commission shall allege a specific violation of a
provision of this Act. The Commission may not base an
enforcement action on, or execute a consent order based
on, practices that are alleged to be inconsistent with
any such guidance, unless the practices allegedly
violate this Act.
``(g) Additional Requirement.--Any regulations issued under this
Act shall include a description and analysis of the impact of proposed
and final Rules on small entities per the Regulatory Flexibility Act of
1980 (5 U.S.C. 601 et seq.).''.
SEC. 3. STUDY AND REPORTS OF MOBILE AND ONLINE APPLICATION OVERSIGHT
AND ENFORCEMENT.
(a) Oversight Report.--Not later than 3 years after the date of
enactment of this Act, the Federal Trade Commission shall submit to the
Committee on Commerce, Science, and Transportation of the Senate and
the Committee on Energy and Commerce of the House of Representatives a
report on the processes of platforms that offer mobile and online
applications for ensuring that, of those applications that are
websites, online services, online applications, or mobile applications
directed to children, the applications operate in accordance with--
(1) this Act, the amendments made by this Act, and rules
promulgated under this Act; and
(2) rules promulgated by the Commission under section 5 of
the Federal Trade Commission Act (15 U.S.C. 45) relating to
unfair or deceptive acts or practices in marketing.
(b) Enforcement Report.--Not later than 1 year after the date of
enactment of this Act, and each year thereafter, the Federal Trade
Commission shall submit to the Committee on Commerce, Science, and
Transportation of the Senate and the Committee on Energy and Commerce
of the House of Representatives a report that addresses, at a minimum--
(1) the number of actions brought by the Commission during
the reporting year to enforce the Children's Online Privacy
Protection Act of 1998 (15 U.S.C. 6501) (referred to in this
subsection as the ``Act'') and the outcome of each such action;
(2) the total number of investigations or inquiries into
potential violations of the Act; during the reporting year;
(3) the total number of open investigations or inquiries
into potential violations of the Act as of the time the report
is submitted;
(4) the number and nature of complaints received by the
Commission relating to an allegation of a violation of the Act
during the reporting year; and
(5) policy or legislative recommendations to strengthen
online protections for children and teens.
SEC. 4. GAO STUDY.
(a) Study.--The Comptroller General of the United States (in this
section referred to as the ``Comptroller General'') shall conduct a
study on the privacy of teens who use financial technology products.
Such study shall--
(1) identify the type of financial technology products that
teens are using;
(2) identify the potential risks to teens' privacy from
using such financial technology products; and
(3) determine whether existing laws are sufficient to
address such risks to teens' privacy.
(b) Report.--Not later than 1 year after the date of enactment of
this section, the Comptroller General shall submit to Congress a report
containing the results of the study conducted under subsection (a),
together with recommendations for such legislation and administrative
action as the Comptroller General determines appropriate.
Calendar No. 288
118th CONGRESS
1st Session
S. 1418
_______________________________________________________________________
A BILL
To amend the Children's Online Privacy Protection Act of 1998 to
strengthen protections relating to the online collection, use, and
disclosure of personal information of children and teens, and for other
purposes.
_______________________________________________________________________
December 13, 2023
Reported with an amendment