[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 1418 Reported in Senate (RS)]

<DOC>





                                                       Calendar No. 288
118th CONGRESS
  1st Session
                                S. 1418

   To amend the Children's Online Privacy Protection Act of 1998 to 
  strengthen protections relating to the online collection, use, and 
disclosure of personal information of children and teens, and for other 
                               purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                              May 3, 2023

Mr. Markey (for himself and Mr. Cassidy) introduced the following bill; 
    which was read twice and referred to the Committee on Commerce, 
                      Science, and Transportation

                           December 13, 2023

              Reported by Ms. Cantwell, with an amendment
 [Strike out all after the enacting clause and insert the part printed 
                               in italic]

_______________________________________________________________________

                                 A BILL


 
   To amend the Children's Online Privacy Protection Act of 1998 to 
  strengthen protections relating to the online collection, use, and 
disclosure of personal information of children and teens, and for other 
                               purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

<DELETED>SECTION 1. SHORT TITLE; TABLE OF CONTENTS.</DELETED>

<DELETED>    (a) Short Title.--This Act may be cited as the ``Children 
and Teens' Online Privacy Protection Act''.</DELETED>
<DELETED>    (b) Table of Contents.--The table of contents for this Act 
is as follows:</DELETED>

<DELETED>Sec. 1. Short title; table of contents.
<DELETED>Sec. 2. Definitions.
<DELETED>Sec. 3. Online collection, use, and disclosure of personal 
                            information of children and teens.
<DELETED>Sec. 4. Fair Information Practices Principles.
<DELETED>Sec. 5. Digital Marketing Bill of Rights for Teens.
<DELETED>Sec. 6. Targeted marketing to children or teens.
<DELETED>Sec. 7. Removal of content.
<DELETED>Sec. 8. Rule for treatment of users of websites, services, and 
                            applications directed to children or teens.
<DELETED>Sec. 9. Study of mobile and online application oversight.
<DELETED>Sec. 10. Youth Privacy and Marketing Division.
<DELETED>Sec. 11. Enforcement and applicability.
<DELETED>Sec. 12. GAO study.

<DELETED>SEC. 2. DEFINITIONS.</DELETED>

<DELETED>    (a) In General.--In this Act:</DELETED>
        <DELETED>    (1) Commission.--The term ``Commission'' means the 
        Federal Trade Commission.</DELETED>
        <DELETED>    (2) Standards.--The term ``standards'' means 
        benchmarks, guidelines, best practices, methodologies, 
        procedures, and processes.</DELETED>
<DELETED>    (b) Other Definitions.--The definitions set forth in 
section 1302 of the Children's Online Privacy Protection Act of 1998 
(15 U.S.C. 6501), as amended by section 3(a) of this Act, shall apply 
in this Act, except to the extent the Commission provides otherwise by 
regulations issued under section 553 of title 5, United States 
Code.</DELETED>

<DELETED>SEC. 3. ONLINE COLLECTION, USE, AND DISCLOSURE OF PERSONAL 
              INFORMATION OF CHILDREN AND TEENS.</DELETED>

<DELETED>    (a) Definitions.--Section 1302 of the Children's Online 
Privacy Protection Act of 1998 (15 U.S.C. 6501) is amended--</DELETED>
        <DELETED>    (1) by amending paragraph (2) to read as 
        follows:</DELETED>
        <DELETED>    ``(2) Operator.--The term `operator'--</DELETED>
                <DELETED>    ``(A) means any person--</DELETED>
                        <DELETED>    ``(i) who, for commercial 
                        purposes, in interstate or foreign commerce 
                        operates or provides a website on the internet, 
                        an online service, an online application, a 
                        mobile application, or a connected device; 
                        and</DELETED>
                        <DELETED>    ``(ii) who--</DELETED>
                                <DELETED>    ``(I) collects or 
                                maintains, either directly or through a 
                                service provider, personal information 
                                from or about the users of that 
                                website, service, application, or 
                                connected device;</DELETED>
                                <DELETED>    ``(II) allows another 
                                person to collect personal information 
                                directly from users of that website, 
                                service, application, or connected 
                                device (in which case, the operator is 
                                deemed to have collected the 
                                information); or</DELETED>
                                <DELETED>    ``(III) allows users of 
                                that website, service, application, or 
                                connected device to publicly disclose 
                                personal information (in which case, 
                                the operator is deemed to have 
                                collected the information); 
                                and</DELETED>
                <DELETED>    ``(B) does not include any nonprofit 
                entity that would otherwise be exempt from coverage 
                under section 5 of the Federal Trade Commission Act (15 
                U.S.C. 45).'';</DELETED>
        <DELETED>    (2) in paragraph (4)--</DELETED>
                <DELETED>    (A) by amending subparagraph (A) to read 
                as follows:</DELETED>
                <DELETED>    ``(A) the release of personal information 
                collected from a child or teen for any purpose, except 
                where the personal information is provided to a person 
                other than an operator who--</DELETED>
                        <DELETED>    ``(i) provides support for the 
                        internal operations of the website, online 
                        service, online application, mobile 
                        application, or connected device of the 
                        operator, excluding any activity relating to 
                        targeted marketing directed to children, teens, 
                        or connected devices; and</DELETED>
                        <DELETED>    ``(ii) does not disclose or use 
                        that personal information for any other 
                        purpose; and''; and</DELETED>
                <DELETED>    (B) in subparagraph (B)--</DELETED>
                        <DELETED>    (i) by inserting ``or teen'' after 
                        ``child'' each place the term 
                        appears;</DELETED>
                        <DELETED>    (ii) by inserting ``or teens'' 
                        after ``children''; and</DELETED>
                        <DELETED>    (iii) by striking ``website or 
                        online service'' and inserting ``website, 
                        online service, online application, mobile 
                        application, or connected device'';</DELETED>
        <DELETED>    (3) in paragraph (8), by striking subparagraphs 
        (F) and (G) and inserting the following:</DELETED>
                <DELETED>    ``(F) geolocation information;</DELETED>
                <DELETED>    ``(G) information generated from the 
                measurement or technological processing of an 
                individual's biological, physical, or physiological 
                characteristics, including--</DELETED>
                        <DELETED>    ``(i) fingerprints;</DELETED>
                        <DELETED>    ``(ii) voice prints;</DELETED>
                        <DELETED>    ``(iii) iris or retina imagery 
                        scans;</DELETED>
                        <DELETED>    ``(iv) facial imagery or 
                        templates;</DELETED>
                        <DELETED>    ``(v) deoxyribonucleic acid (DNA) 
                        information; or</DELETED>
                        <DELETED>    ``(vi) gait;</DELETED>
                <DELETED>    ``(H) information reasonably associated 
                with or attributed to a child or teen;</DELETED>
                <DELETED>    ``(I) information (including an internet 
                protocol address) that permits the identification of--
                </DELETED>
                        <DELETED>    ``(i) an individual; or</DELETED>
                        <DELETED>    ``(ii) any device used by an 
                        individual to directly or indirectly access the 
                        internet or an online service, online 
                        application, mobile application, or connected 
                        device; or</DELETED>
                <DELETED>    ``(J) information concerning a child or 
                teen or the parents of that child or teen (including 
                any unique or substantially unique identifier, such as 
                a customer number) that an operator collects online 
                from the child or teen and combines with an identifier 
                described in this paragraph.'';</DELETED>
        <DELETED>    (4) by amending paragraph (9) to read as 
        follows:</DELETED>
        <DELETED>    ``(9) Verifiable consent.--The term `verifiable 
        consent' means any reasonable effort (taking into consideration 
        available technology), including a request for authorization 
        for future collection, use, and disclosure described in the 
        notice, to ensure that, in the case of a child, a parent of the 
        child, or, in the case of a teen, the teen--</DELETED>
                <DELETED>    ``(A) receives specific notice of the 
                personal information collection, use, and disclosure 
                practices of the operator; and</DELETED>
                <DELETED>    ``(B) before the personal information of 
                the child or teen is collected, freely and 
                unambiguously authorizes--</DELETED>
                        <DELETED>    ``(i) the collection, use, and 
                        disclosure, as applicable, of that personal 
                        information; and</DELETED>
                        <DELETED>    ``(ii) any subsequent use of that 
                        personal information.'';</DELETED>
        <DELETED>    (5) by striking paragraph (10) and redesignating 
        paragraphs (11) and (12) as paragraphs (10) and (11), 
        respectively; and</DELETED>
        <DELETED>    (6) by adding at the end the following:</DELETED>
        <DELETED>    ``(12) Connected device.--The term `connected 
        device' means a device that is capable of connecting to the 
        internet, directly or indirectly, or to another connected 
        device.</DELETED>
        <DELETED>    ``(13) Online application.--The term `online 
        application'--</DELETED>
                <DELETED>    ``(A) means an internet-connected software 
                program; and</DELETED>
                <DELETED>    ``(B) includes a service or application 
                offered via a connected device.</DELETED>
        <DELETED>    ``(14) Online service.--</DELETED>
                <DELETED>    ``(A) In general.--The term `online 
                service' means a mass-market retail service by wire or 
                radio that provides the capability to transmit data and 
                receive data from all or substantially all Internet 
                endpoints, including any capabilities that are 
                incidental to and enable the operation of a 
                communications service, but excluding dial-up Internet 
                service.</DELETED>
                <DELETED>    ``(B) Scope.--Such term includes--
                </DELETED>
                        <DELETED>    ``(i) any service that the Federal 
                        Communications Commission finds to be providing 
                        a functionally equivalent service to a service 
                        described in subparagraph (A); and</DELETED>
                        <DELETED>    ``(ii) a service or application 
                        offered via a connected device.</DELETED>
        <DELETED>    ``(15) Directed to children or teens.--</DELETED>
                <DELETED>    ``(A) In general.--The terms `directed to 
                children', `directed to teens', and `directed to 
                children or teens' mean, with respect to a website, 
                online service, online application, mobile application, 
                or connected device, that the website, online service, 
                online application, mobile application, or connected 
                device, or a portion thereof, is targeted to children 
                or teens, as the case may be, as demonstrated by--
                </DELETED>
                        <DELETED>    ``(i) the subject matter of the 
                        website, online service, online application, 
                        mobile application, or connected 
                        device;</DELETED>
                        <DELETED>    ``(ii) the visual content of the 
                        website, online service, online application, 
                        mobile application, or connected 
                        device;</DELETED>
                        <DELETED>    ``(iii) the use of animated 
                        characters or child-oriented activities for 
                        children, or the use of teen-oriented 
                        characters or teen-oriented activities for 
                        teens, and related incentives on the website, 
                        online service, online application, mobile 
                        application, or connected device;</DELETED>
                        <DELETED>    ``(iv) the music or other audio 
                        content on the website, online service, online 
                        application, mobile application, or connected 
                        device;</DELETED>
                        <DELETED>    ``(v) the age of models on the 
                        website, online service, online application, 
                        mobile application, or connected 
                        device;</DELETED>
                        <DELETED>    ``(vi) the presence, on the 
                        website, online service, online application, 
                        mobile application, or connected device, of--
                        </DELETED>
                                <DELETED>    ``(I) child 
                                celebrities;</DELETED>
                                <DELETED>    ``(II) celebrities who 
                                appeal to children;</DELETED>
                                <DELETED>    ``(III) teen celebrities; 
                                or</DELETED>
                                <DELETED>    ``(IV) celebrities who 
                                appeal to teens;</DELETED>
                        <DELETED>    ``(vii) the language used on the 
                        website, online service, online application, 
                        mobile application, or connected 
                        device;</DELETED>
                        <DELETED>    ``(viii) advertising content used 
                        on, or used to advertise, the website, online 
                        service, online application, mobile 
                        application, or connected device; or</DELETED>
                        <DELETED>    ``(ix) reliable empirical evidence 
                        relating to--</DELETED>
                                <DELETED>    ``(I) the composition of 
                                the audience of the website, online 
                                service, online application, mobile 
                                application, or connected device; 
                                and</DELETED>
                                <DELETED>    ``(II) the intended 
                                audience of the website, online 
                                service, online application, mobile 
                                application, or connected 
                                device.</DELETED>
                <DELETED>    ``(B) Rules of construction.--</DELETED>
                        <DELETED>    ``(i) Services deemed directed to 
                        children or teens.--For the purposes of this 
                        title, a website, online service, online 
                        application, mobile application, or connected 
                        device, or a portion thereof, shall be deemed 
                        to be directed to children or teens if it 
                        collects personal information directly from 
                        users of any other website, online service, 
                        online application, mobile application, or 
                        connected device that is--</DELETED>
                                <DELETED>    ``(I) directed to children 
                                or teens under the criteria described 
                                in subparagraph (A); or</DELETED>
                                <DELETED>    ``(II) used or reasonably 
                                likely to be used by children or 
                                teens.</DELETED>
                        <DELETED>    ``(ii) Services deemed directed to 
                        mixed audiences.--</DELETED>
                                <DELETED>    ``(I) In general.--A 
                                website, online service, online 
                                application, mobile application, or 
                                connected device that is directed to 
                                children or teens under the criteria 
                                described in subparagraph (A), but that 
                                does not target children or teens as 
                                the primary audience of the website, 
                                online service, online application, 
                                mobile application, or connected device 
                                shall not be deemed to be directed to 
                                children or teens for purposes of this 
                                title if the website, online service, 
                                online application, mobile application, 
                                or connected device--</DELETED>
                                        <DELETED>    ``(aa) does not 
                                        collect personal information 
                                        from any user of the website, 
                                        online service, online 
                                        application, mobile 
                                        application, or connected 
                                        device before verifying age 
                                        information of the user; 
                                        and</DELETED>
                                        <DELETED>    ``(bb) does not, 
                                        without first complying with 
                                        any relevant notice and consent 
                                        provision under this title, 
                                        collect, use, or disclose 
                                        personal information of any 
                                        user who identifies themselves 
                                        to the website, online service, 
                                        online application, mobile 
                                        application, or connected 
                                        device as an individual who is 
                                        age 16 or younger.</DELETED>
                                <DELETED>    ``(II) Use of certain 
                                tools.--For purposes of this title, a 
                                website, online service, online 
                                application, mobile application, or 
                                connected device, shall not be deemed 
                                directed to children or teens solely 
                                because the website, online service, 
                                online application, mobile application, 
                                or connected device refers or links to 
                                any other website, online service, 
                                online application, mobile application, 
                                or connected device directed to 
                                children or teens by using information 
                                location tools, including--</DELETED>
                                        <DELETED>    ``(aa) a 
                                        directory;</DELETED>
                                        <DELETED>    ``(bb) an 
                                        index;</DELETED>
                                        <DELETED>    ``(cc) a 
                                        reference;</DELETED>
                                        <DELETED>    ``(dd) a pointer; 
                                        or</DELETED>
                                        <DELETED>    ``(ee) a hypertext 
                                        link.</DELETED>
        <DELETED>    ``(16) Mobile application.--The term `mobile 
        application'--</DELETED>
                <DELETED>    ``(A) means a software program that runs 
                on the operating system of--</DELETED>
                        <DELETED>    ``(i) a cellular 
                        telephone;</DELETED>
                        <DELETED>    ``(ii) a tablet computer; 
                        or</DELETED>
                        <DELETED>    ``(iii) a similar portable 
                        computing device that transmits data over a 
                        wireless connection; and</DELETED>
                <DELETED>    ``(B) includes a service or application 
                offered via a connected device.</DELETED>
        <DELETED>    ``(17) Geolocation information.--The term 
        `geolocation information' means information sufficient to 
        identify a street name and name of a city or town.</DELETED>
        <DELETED>    ``(18) Teen.--The term `teen' means an individual 
        over the age of 12 and under the age of 17.</DELETED>
        <DELETED>    ``(19) Targeted marketing.--</DELETED>
                <DELETED>    ``(A) In general.--The term `targeted 
                marketing' means advertising or any other effort to 
                market a product or service that is directed to a 
                specific individual or device--</DELETED>
                        <DELETED>    ``(i) based on--</DELETED>
                                <DELETED>    ``(I) the personal 
                                information of--</DELETED>
                                        <DELETED>    ``(aa) the 
                                        individual; or</DELETED>
                                        <DELETED>    ``(bb) a group of 
                                        individuals who are similar in 
                                        gender, age, income level, 
                                        race, or ethnicity to the 
                                        specific individual to whom the 
                                        product or service is 
                                        marketed;</DELETED>
                                <DELETED>    ``(II) psychological 
                                profiling of an individual or group of 
                                individuals; or</DELETED>
                                <DELETED>    ``(III) a unique 
                                identifier of the device; or</DELETED>
                        <DELETED>    ``(ii) as a result of use by the 
                        individual, access by any device of the 
                        individual, or use by a group of individuals 
                        who are similar to the specific individual, of 
                        more than a single--</DELETED>
                                <DELETED>    ``(I) website;</DELETED>
                                <DELETED>    ``(II) online 
                                service;</DELETED>
                                <DELETED>    ``(III) online 
                                application;</DELETED>
                                <DELETED>    ``(IV) mobile 
                                application;</DELETED>
                                <DELETED>    ``(V) connected device; 
                                or</DELETED>
                                <DELETED>    ``(VI) operating 
                                system.</DELETED>
                <DELETED>    ``(B) Exclusions.--The term `targeted 
                marketing' shall not include--</DELETED>
                        <DELETED>    ``(i) advertising or marketing to 
                        an individual or the device of an individual in 
                        response to the individual's specific request 
                        for information or feedback;</DELETED>
                        <DELETED>    ``(ii) contextual advertising, 
                        such as when an advertisement is displayed 
                        based on the context in which the advertisement 
                        appears and does not vary based on who is 
                        viewing the advertisement; or</DELETED>
                        <DELETED>    ``(iii) processing personal 
                        information solely for measuring or reporting 
                        advertising or content performance, reach, or 
                        frequency, including independent 
                        measurement.</DELETED>
                <DELETED>    ``(C) Authority to further define.--The 
                Commission may promulgate rules under section 553 of 
                title 5, United State Code, to further define the term 
                `targeted marketing' but only as necessary to address 
                changes to or innovations of technology, changes in how 
                personal information is used or transferred, changes to 
                the means and manners by which children or teens 
                interact with a website, online service, online 
                application, mobile application, or connected device, 
                or evolving concerns regarding the privacy of children 
                or teens.</DELETED>
        <DELETED>    ``(20) Reasonably likely to be used.--The 
        Commission may promulgate rules under section 553 of title 5, 
        United States Code, or issue guidance to establish factors that 
        should be considered in applying the term `reasonably likely to 
        be used' for the purposes of this title.</DELETED>
        <DELETED>    ``(21) Reasonably likely to be a child or teen.--
        The Commission may promulgate rules under section 553 of title 
        5, United States Code, or issue guidance to establish factors 
        that should be considered in applying the term `reasonably 
        likely to be a child or teen' for the purposes of this 
        title.''.</DELETED>
<DELETED>    (b) Online Collection, Use, and Disclosure of Personal 
Information of Children and Teens.--Section 1303 of the Children's 
Online Privacy Protection Act of 1998 (15 U.S.C. 6502) is amended--
</DELETED>
        <DELETED>    (1) by striking the heading and inserting the 
        following: ``online collection, use, and disclosure of personal 
        information of children and teens.'';</DELETED>
        <DELETED>    (2) in subsection (a)--</DELETED>
                <DELETED>    (A) by amending paragraph (1) to read as 
                follows:</DELETED>
        <DELETED>    ``(1) In general.--It is unlawful for an operator 
        of a website, online service, online application, mobile 
        application, or connected device that is directed to children 
        or teens or is used or reasonably likely to be used by children 
        or teens in a manner that involves the collection of personal 
        information, to collect personal information from a child or 
        teen in a manner that violates the regulations prescribed under 
        subsection (b).''; and</DELETED>
                <DELETED>    (B) in paragraph (2)--</DELETED>
                        <DELETED>    (i) by striking ``of such a 
                        website or online service''; and</DELETED>
                        <DELETED>    (ii) by striking ``subsection 
                        (b)(1)(B)(iii) to the parent of a child'' and 
                        inserting ``subsection (b)(1)(A)(iii) to the 
                        parent of a child or under subsection 
                        (b)(1)(A)(iv) to a teen''; and</DELETED>
        <DELETED>    (3) in subsection (b)--</DELETED>
                <DELETED>    (A) in paragraph (1)--</DELETED>
                        <DELETED>    (i) by striking ``this Act'' and 
                        inserting ``the Children and Teens' Online 
                        Privacy Protection Act'';</DELETED>
                        <DELETED>    (ii) in subparagraph (A)--
                        </DELETED>
                                <DELETED>    (I) by striking ``operator 
                                of any website'' and all that follows 
                                through ``from a child'' and inserting 
                                ``operator of a website, online 
                                service, online application, mobile 
                                application, or connected device that 
                                is directed to children or teens or is 
                                used or is reasonably likely to be used 
                                by children or teens in a manner that 
                                involves the collection of their 
                                personal information'';</DELETED>
                                <DELETED>    (II) in clause (i)--
                                </DELETED>
                                        <DELETED>    (aa) by striking 
                                        ``notice on the website'' and 
                                        inserting ``clear and 
                                        conspicuous notice'';</DELETED>
                                        <DELETED>    (bb) by inserting 
                                        ``or teens'' after 
                                        ``children'';</DELETED>
                                        <DELETED>    (cc) by striking 
                                        ``, and the operator's'' and 
                                        inserting ``, the operator's''; 
                                        and</DELETED>
                                        <DELETED>    (dd) by striking 
                                        ``; and'' and inserting ``, and 
                                        the procedures or mechanisms 
                                        the operator uses to ensure 
                                        that personal information is 
                                        not collected from children or 
                                        teens except in accordance with 
                                        the regulations promulgated 
                                        under this paragraph;''; 
                                        and</DELETED>
                                <DELETED>    (III) in clause (ii)--
                                </DELETED>
                                        <DELETED>    (aa) by striking 
                                        ``parental''; and</DELETED>
                                        <DELETED>    (bb) by inserting 
                                        ``or teens'' after 
                                        ``children'';</DELETED>
                        <DELETED>    (iii) in subparagraph (B)--
                        </DELETED>
                                <DELETED>    (I) in the matter 
                                preceding clause (i), by striking 
                                ``website or online service'' and 
                                inserting ``operator'';</DELETED>
                                <DELETED>    (II) in clause (ii), by 
                                inserting ``to delete personal 
                                information collected from the child 
                                or'' after ``the opportunity at any 
                                time''; and</DELETED>
                                <DELETED>    (III) in clause (iii), by 
                                inserting ``, if such information is 
                                available to the operator at the time 
                                the parent makes the request'' before 
                                the semicolon;</DELETED>
                        <DELETED>    (iv) by redesignating 
                        subparagraphs (C) and (D) as subparagraphs (D) 
                        and (E), respectively;</DELETED>
                        <DELETED>    (v) by inserting after 
                        subparagraph (B) the following new 
                        subparagraph:</DELETED>
                <DELETED>    ``(C) require the operator to provide, 
                upon the request of a teen under this subparagraph who 
                has provided personal information to the operator, upon 
                proper identification of that teen--</DELETED>
                        <DELETED>    ``(i) a description of the 
                        specific types of personal information 
                        collected from the teen by the 
                        operator;</DELETED>
                        <DELETED>    ``(ii) the opportunity at any time 
                        to delete personal information collected from 
                        the teen and refuse further use or collection 
                        of personal information from the teen; 
                        and</DELETED>
                        <DELETED>    ``(iii) a means that is reasonable 
                        under the circumstances for the teen to obtain 
                        any personal information collected from the 
                        teen, if such information is available to the 
                        operator at the time the teen makes the 
                        request;'';</DELETED>
                        <DELETED>    (vi) in subparagraph (D), as so 
                        redesignated, by striking ``conditioning'' and 
                        all that follows through ``such activity'' and 
                        inserting the following: ``the collection from 
                        a child or teen of more personal information 
                        that is reasonably required to use the website, 
                        online service, online application, mobile 
                        application, or connected device'';</DELETED>
                        <DELETED>    (vii) in subparagraph (E), as so 
                        redesignated--</DELETED>
                                <DELETED>    (I) by striking ``of such 
                                a website or online service''; 
                                and</DELETED>
                                <DELETED>    (II) by inserting ``and 
                                teens'' after ``children''; 
                                and</DELETED>
                        <DELETED>    (viii) by adding at the end the 
                        following flush text:</DELETED>
        <DELETED>``The Commission shall review and update the 
        regulations promulgated under this paragraph as 
        necessary.'';</DELETED>
                <DELETED>    (B) in paragraph (2)--</DELETED>
                        <DELETED>    (i) in the matter preceding 
                        subparagraph (A), by striking ``verifiable 
                        parental consent'' and inserting ``verifiable 
                        consent'';</DELETED>
                        <DELETED>    (ii) in subparagraph (A)--
                        </DELETED>
                                <DELETED>    (I) by inserting ``or 
                                teen'' after ``collected from a 
                                child'';</DELETED>
                                <DELETED>    (II) by inserting ``or 
                                teen'' after ``request from the 
                                child''; and</DELETED>
                                <DELETED>    (III) by inserting ``or 
                                teen or to contact another child or 
                                teen'' after ``to recontact the 
                                child'';</DELETED>
                        <DELETED>    (iii) in subparagraph (B)--
                        </DELETED>
                                <DELETED>    (I) by striking ``parent 
                                or child'' and inserting ``parent or 
                                teen''; and</DELETED>
                                <DELETED>    (II) by striking 
                                ``parental consent'' each place the 
                                term appears and inserting ``verifiable 
                                consent'';</DELETED>
                        <DELETED>    (iv) in subparagraph (C)--
                        </DELETED>
                                <DELETED>    (I) in the matter 
                                preceding clause (i), by inserting ``or 
                                teen'' after ``child'' each place the 
                                term appears;</DELETED>
                                <DELETED>    (II) in clause (i)--
                                </DELETED>
                                        <DELETED>    (aa) by inserting 
                                        ``or teen'' after ``child'' 
                                        each place the term appears; 
                                        and</DELETED>
                                        <DELETED>    (bb) by inserting 
                                        ``or teen, as applicable,'' 
                                        after ``parent'' each place the 
                                        term appears; and</DELETED>
                                <DELETED>    (III) in clause (ii)--
                                </DELETED>
                                        <DELETED>    (aa) by inserting 
                                        ``or teen, as applicable,'' 
                                        after ``parent''; and</DELETED>
                                        <DELETED>    (bb) by inserting 
                                        ``or teen'' after ``child'' 
                                        each place the term appears; 
                                        and</DELETED>
                        <DELETED>    (v) in subparagraph (D)--
                        </DELETED>
                                <DELETED>    (I) in the matter 
                                preceding clause (i), by inserting ``or 
                                teen'' after ``child'' each place the 
                                term appears;</DELETED>
                                <DELETED>    (II) in clause (ii), by 
                                inserting ``or teen'' after ``child''; 
                                and</DELETED>
                                <DELETED>    (III) in the flush text 
                                following clause (iii)--</DELETED>
                                        <DELETED>    (aa) by inserting 
                                        ``or teen, as applicable,'' 
                                        after ``parent'' each place the 
                                        term appears; and</DELETED>
                                        <DELETED>    (bb) by inserting 
                                        ``or teen'' after ``child''; 
                                        and</DELETED>
                <DELETED>    (C) by amending paragraph (3) to read as 
                follows:</DELETED>
        <DELETED>    ``(3) Continuation of service.--The regulations 
        shall prohibit an operator from discontinuing service provided 
        to a child or teen on the basis of a request by the parent of 
        the child or by the teen, under the regulations prescribed 
        under subparagraph (B) or (C) of paragraph (1), respectively, 
        to delete personal information collected from the child or 
        teen, to the extent that the operator is capable of providing 
        such service without such information.''.</DELETED>
<DELETED>    (c) Safe Harbors.--Section 1304 of the Children's Online 
Privacy Protection Act of 1998 (15 U.S.C. 6503) is amended--</DELETED>
        <DELETED>    (1) in subsection (b)(1), by inserting ``and 
        teens'' after ``children''; and</DELETED>
        <DELETED>    (2) by adding at the end the following:</DELETED>
<DELETED>    ``(d) Publication.--</DELETED>
        <DELETED>    ``(1) In general.--The Commission shall publish on 
        the internet website of the Commission any report or 
        documentation required by regulation to be submitted to the 
        Commission to carry out this section.</DELETED>
        <DELETED>    ``(2) Restrictions on publication.--The 
        restrictions described in subsection (f) of section 6 of the 
        Federal Trade Commission Act (15 U.S.C. 46(f)) applicable to 
        the publication of information obtained by the Commission 
        through investigations conducted under such section shall apply 
        in same manner to the publication under this subsection of 
        information obtained by the Commission from a report or 
        documentation described in paragraph (1).''.</DELETED>
<DELETED>    (d) Administration and Applicability of Act.--Section 1306 
of the Children's Online Privacy Protection Act of 1998 (15 U.S.C. 
6505) is amended--</DELETED>
        <DELETED>    (1) in subsection (b)--</DELETED>
                <DELETED>    (A) in paragraph (1), by striking ``, in 
                the case of'' and all that follows through ``the Board 
                of Directors of the Federal Deposit Insurance 
                Corporation;'' and inserting the following: ``by the 
                appropriate Federal banking agency, with respect to any 
                insured depository institution (as those terms are 
                defined in section 3 of that Act (12 U.S.C. 1813));''; 
                and</DELETED>
                <DELETED>    (B) by striking paragraph (2) and 
                redesignating paragraphs (3) through (6) as paragraphs 
                (2) through (5), respectively; and</DELETED>
        <DELETED>    (2) by adding at the end the following new 
        subsection:</DELETED>
<DELETED>    ``(f) Telecommunications Carriers and Cable Operators.--
</DELETED>
        <DELETED>    ``(1) Enforcement by commission.--Notwithstanding 
        section 4, 5(a)(2), or 6 of the Federal Trade Commission Act 
        (15 U.S.C. 44, 45(a)(2), 46), or any jurisdictional limitation 
        of the Commission, the Commission shall also enforce this Act 
        and the regulations promulgated under this Act, in the same 
        manner provided in subsection (d), with respect to common 
        carriers subject to the Communications Act of 1934 (47 U.S.C. 
        151 et seq.) and Acts amendatory thereof and supplementary 
        thereto.</DELETED>
        <DELETED>    ``(2) Relationship to other law.--To the extent 
        that section 222, 338(i), or 631 of the Communications Act of 
        1934 (47 U.S.C. 222, 338(i), 551) is inconsistent with this 
        title, this title controls.''.</DELETED>

<DELETED>SEC. 4. FAIR INFORMATION PRACTICES PRINCIPLES.</DELETED>

<DELETED>    (a) In General.--The Fair Information Practices Principles 
described in this section are the following:</DELETED>
        <DELETED>    (1) Collection limitation principle.--Except as 
        provided in paragraph (3), personal information should be 
        collected from a child or teen only when collection of the 
        personal information is--</DELETED>
                <DELETED>    (A) consistent with the context of a 
                particular transaction or service or the relationship 
                of the child or teen with the operator, including 
                collection necessary to fulfill a transaction or 
                provide a service requested by the child or teen; 
                or</DELETED>
                <DELETED>    (B) required or specifically authorized by 
                law.</DELETED>
        <DELETED>    (2) Data quality principle.--The personal 
        information of a child or teen should be accurate, complete, 
        and kept up-to-date to the extent necessary to fulfill the 
        purposes described in subparagraphs (A) through (D) of 
        paragraph (3).</DELETED>
        <DELETED>    (3) Purpose specification principle.--The purposes 
        for which personal information is collected and used should be 
        specified to the parent of a child or to a teen not later than 
        at the time of the collection of the information. The 
        subsequent use or disclosure of the information should be 
        limited to--</DELETED>
                <DELETED>    (A) fulfillment of the transaction or 
                service requested by the teen or parent of the 
                child;</DELETED>
                <DELETED>    (B) support for the internal operations of 
                the website, service, or application, as described in 
                section 312.2 of title 16, Code of Federal Regulations 
                (as in effect on the date of enactment of this Act), 
                excluding any activity relating to targeted marketing 
                directed to children, teens, or a device of a child or 
                teen if the support for internal operations in 
                consistent with the interest of the child or 
                teen;</DELETED>
                <DELETED>    (C) compliance with legal process or other 
                purposes expressly authorized under specific legal 
                authority; or</DELETED>
                <DELETED>    (D) other purposes--</DELETED>
                        <DELETED>    (i) that are specified in a notice 
                        to the teen or parent of the child; 
                        and</DELETED>
                        <DELETED>    (ii) to which the teen or parent 
                        of the child has consented under paragraph (7) 
                        before the information is used or disclosed for 
                        such other purposes.</DELETED>
        <DELETED>    (4) Retention limitation principle.--</DELETED>
                <DELETED>    (A) In general.--The personal information 
                of a child or teen should not be retained for longer 
                than is necessary to fulfill a transaction or provide a 
                service requested by the child or teen or such other 
                purposes specified in subparagraphs (A) through (D) of 
                paragraph (3).</DELETED>
                <DELETED>    (B) Data disposal.--The operator should 
                implement a reasonable and appropriate data disposal 
                policy based on the nature and sensitivity of personal 
                information described in subparagraph (A).</DELETED>
        <DELETED>    (5) Security safeguards principle.--The personal 
        information of a child or teen should be protected by 
        reasonable and appropriate security safeguards against risks 
        such as loss or unauthorized access, destruction, use, 
        modification, or disclosure.</DELETED>
        <DELETED>    (6) Transparency principle.--</DELETED>
                <DELETED>    (A) General principle.--The operator 
                should be transparent about developments, practices, 
                and policies with respect to the personal information 
                of a child or teen.</DELETED>
                <DELETED>    (B) Provision of information.--The 
                operator should provide to each parent of a child, or 
                to each teen, using the website, online service, online 
                application, mobile application, or connected device of 
                the operator with a clear and prominent means--
                </DELETED>
                        <DELETED>    (i) to identify and contact the 
                        operator, by, at a minimum, disclosing, clearly 
                        and prominently, the identity of the operator 
                        and--</DELETED>
                                <DELETED>    (I) in the case of an 
                                operator who is an individual, the 
                                address of the principal residence (but 
                                not a personal residence) of the 
                                operator and an email address or online 
                                contact form and telephone number for 
                                the operator; or</DELETED>
                                <DELETED>    (II) in the case of any 
                                other operator, the address of the 
                                principal place of business of the 
                                operator and an email address or online 
                                contact form and telephone number for 
                                the operator;</DELETED>
                        <DELETED>    (ii) to determine whether the 
                        operator possesses any personal information of 
                        the child or teen, the nature of any such 
                        information, and the purposes for which the 
                        information was collected and is being 
                        retained;</DELETED>
                        <DELETED>    (iii) to obtain any personal 
                        information of the child or teen that is in the 
                        possession of the operator from the operator, 
                        or from a person specified by the operator, 
                        within a reasonable time after making a 
                        request, at a charge (if any) that is not 
                        excessive, in a reasonable manner, and in a 
                        form that is readily intelligible to the child 
                        or teen;</DELETED>
                        <DELETED>    (iv) to challenge the accuracy of 
                        personal information of the child or teen that 
                        is in the possession of the operator;</DELETED>
                        <DELETED>    (v) to determine if the child or 
                        teen has established the inaccuracy of personal 
                        information in a challenge under clause (iv) in 
                        order to have such information erased, 
                        corrected, completed, or otherwise amended; 
                        and</DELETED>
                        <DELETED>    (vi) to determine the method by 
                        which the operator obtains data relevant to the 
                        child or teen.</DELETED>
                <DELETED>    (C) Limitation.--Nothing in this paragraph 
                shall be construed to permit an operator to erase or 
                otherwise modify personal information requested by a 
                law enforcement agency pursuant to legal 
                authority.</DELETED>
        <DELETED>    (7) Individual participation principle.--The 
        operator should--</DELETED>
                <DELETED>    (A) obtain consent from a parent of a 
                child or from a teen before using or disclosing the 
                personal information of the child or teen for any 
                purpose other than the purposes described in 
                subparagraph (A) of paragraph (3); and</DELETED>
                <DELETED>    (B) obtain affirmative express consent 
                from a parent of a child or from a teen before using or 
                disclosing previously collected personal information of 
                the child or teen for purposes that constitute a 
                material change in practice from the original purposes 
                specified to the child or teen under paragraph 
                (3).</DELETED>
        <DELETED>    (8) Racial and socioeconomic profiling.--The 
        personal information of a child or teen shall not be used to 
        direct content to the child or teen, or a group of individuals 
        similar to the child or teen, on the basis of race, 
        socioeconomic factors, or any proxy thereof.</DELETED>
<DELETED>    (b) Rule of Construction.--Nothing in this section, 
including compliance with the Fair Information Principles, shall be 
construed to permit an operator to avoid compliance with other 
requirements set forth in this Act or the Children's Online Privacy 
Protection Act (15 U.S.C. 6501 et seq.).</DELETED>

<DELETED>SEC. 5. DIGITAL MARKETING BILL OF RIGHTS FOR TEENS.</DELETED>

<DELETED>    (a) Acts Prohibited.--</DELETED>
        <DELETED>    (1) Prohibition.--</DELETED>
                <DELETED>    (A) In general.--Except as provided in 
                subparagraph (B), it shall be unlawful for an operator 
                of a website, online service, online application, 
                mobile application, or connected device to collect 
                personal information from a user if--</DELETED>
                        <DELETED>    (i) the user is reasonably likely 
                        to be a teen; or</DELETED>
                        <DELETED>    (ii) the website, online service, 
                        online application, mobile application, or 
                        connected device is directed to 
                        teens.</DELETED>
                <DELETED>    (B) Exception.--Subparagraph (A) shall not 
                apply to an operator that has adopted and complies with 
                a Digital Marketing Bill of Rights for Teens that meets 
                the Fair Information Practices Principles described in 
                section 4.</DELETED>
        <DELETED>    (2) Effective date.--This subsection shall take 
        effect on the date that is 180 days after the promulgation of 
        regulations under subsection (b).</DELETED>
<DELETED>    (b) Regulations.--</DELETED>
        <DELETED>    (1) In general.--Not later than 1 year after the 
        date of enactment of this Act, the Commission shall promulgate, 
        under section 553 of title 5, United States Code, regulations 
        to implement this section, including regulations further 
        defining the Fair Information Practices Principles described in 
        section 4.</DELETED>
        <DELETED>    (2) Updates.--Not less frequently than once every 
        4 years after the date on which regulations are promulgated 
        under paragraph (1), the Commission shall review and update 
        those regulations as necessary.</DELETED>

<DELETED>SEC. 6. TARGETED MARKETING TO CHILDREN AND TEENS.</DELETED>

<DELETED>    (a) Prohibited Acts With Respect to Children and Teens.--
It shall be unlawful for an operator of a website, online service, 
online application, mobile application, or connected device to collect, 
use, disclose to third parties, or compile personal information of a 
user for purposes of targeted marketing (or to allow another person to 
collect, use, disclose, or compile such information for such purpose) 
if--</DELETED>
        <DELETED>    (1) such use, disclosure, or compiling of personal 
        information involves or is reasonably likely to involve 
        collection of personal information from a child or teen; 
        or</DELETED>
        <DELETED>    (2) the website, online service, online 
        application, mobile application, or connected device is 
        directed to children or teens.</DELETED>
<DELETED>    (b) Effective Date.--This section shall take effect on the 
date that is 180 days after the date of enactment of this 
Act.</DELETED>

<DELETED>SEC. 7. REMOVAL OF CONTENT.</DELETED>

<DELETED>    (a) Acts Prohibited.--It is unlawful for an operator to 
make, or enable a child or teen to make, publicly available through a 
website, online service, online application, mobile application, or 
connected device content or information that contains or displays 
personal information of children or teens in a manner that violates 
subsection (b).</DELETED>
<DELETED>    (b) Requirement.--</DELETED>
        <DELETED>    (1) In general.--An operator, to the extent 
        technologically feasible, shall--</DELETED>
                <DELETED>    (A) implement mechanisms that permit a 
                user of the website, online service, online 
                application, mobile application, or connected device of 
                the operator (and, in the case of a user that is a 
                child, a parent of that user) to erase or otherwise 
                eliminate content or information that is--</DELETED>
                        <DELETED>    (i) submitted to the website, 
                        online service, online application, mobile 
                        application, or connected device by that 
                        user;</DELETED>
                        <DELETED>    (ii) publicly available through 
                        the website, online service, online 
                        application, mobile application, or connected 
                        device; and</DELETED>
                        <DELETED>    (iii) contains or displays 
                        personal information of children or teens; 
                        and</DELETED>
                <DELETED>    (B) take appropriate steps to--</DELETED>
                        <DELETED>    (i) make users and parents of 
                        users who are children aware of the mechanisms 
                        described in subparagraph (A); and</DELETED>
                        <DELETED>    (ii) provide notice to users and 
                        parents of users who are children that the 
                        mechanisms described in subparagraph (A) do not 
                        necessarily provide comprehensive removal of 
                        the content or information submitted by 
                        users.</DELETED>
        <DELETED>    (2) Exceptions.--Paragraph (1) shall not be 
        construed to require an operator or third party to erase or 
        otherwise eliminate content or information that--</DELETED>
                <DELETED>    (A) any other provision of Federal or 
                State law requires the operator or third party to 
                maintain; or</DELETED>
                <DELETED>    (B) was submitted to the website, online 
                service, online application, mobile application, or 
                connected device of the operator by any person other 
                than the user who is attempting to erase or otherwise 
                eliminate the content or information, including content 
                or information submitted by the user that was 
                republished or resubmitted by another person.</DELETED>
<DELETED>    (c) Limitation.--Nothing in this section shall be 
construed to limit the authority of a law enforcement agency to obtain 
any content or information from an operator as authorized by law or 
pursuant to an order of a court of competent jurisdiction.</DELETED>
<DELETED>    (d) Effective Date.--This section shall take effect on the 
date that is 180 days after the date of enactment of this 
Act.</DELETED>

<DELETED>SEC. 8. RULE FOR TREATMENT OF USERS OF WEBSITES, SERVICES, AND 
              APPLICATIONS DIRECTED TO CHILDREN OR TEENS.</DELETED>

<DELETED>    For the purposes of this Act, an operator of a website, 
online service, online application, mobile application, or connected 
device that is directed to children or teens shall treat each user of 
that website, online service, online application, mobile application, 
or connected device as a child or teen, except as permitted by the 
Commission pursuant to a regulation promulgated under this Act, and 
except to the extent the website, online service, online application, 
mobile application, or connected device is deemed directed to mixed 
audiences.</DELETED>

<DELETED>SEC. 9. STUDY OF MOBILE AND ONLINE APPLICATION 
              OVERSIGHT.</DELETED>

<DELETED>    Not later than 3 years after the date of enactment of this 
Act, the Commission shall submit to each committee of the Senate and 
each committee of the House of Representatives that has jurisdiction 
over the Commission a report on the processes of platforms that offer 
mobile and online applications for ensuring that, of those applications 
that are directed to children or teens, the applications operate in 
accordance with--</DELETED>
        <DELETED>    (1) this Act, the amendments made by this Act, and 
        rules promulgated under this Act; and</DELETED>
        <DELETED>    (2) rules promulgated by the Commission under 
        section 5 of the Federal Trade Commission Act (15 U.S.C. 45) 
        relating to unfair or deceptive acts or practices in 
        marketing.</DELETED>

<DELETED>SEC. 10. YOUTH PRIVACY AND MARKETING DIVISION.</DELETED>

<DELETED>    (a) Establishment.--There is established within the 
Commission a division to be known as the Youth Privacy and Marketing 
Division.</DELETED>
<DELETED>    (b) Director.--The Youth Privacy and Marketing Division 
shall be headed by a Director.</DELETED>
<DELETED>    (c) Duties.--The Youth Privacy and Marketing Division 
established under subsection (a) shall be responsible for assisting the 
Commission to address, as it relates to this Act and the amendments 
made by this Act--</DELETED>
        <DELETED>    (1) the privacy of children and teens; 
        and</DELETED>
        <DELETED>    (2) marketing directed at children and 
        teens.</DELETED>
<DELETED>    (d) Staff.--The Director of the Youth Privacy and 
Marketing Division shall hire adequate staff to carry out the duties 
under subsection (c), including individuals who are experts in data 
protection, digital advertising, data analytics, and youth 
development.</DELETED>
<DELETED>    (e) Reports.--Not later than 1 year after the date of 
enactment of this Act, and each year thereafter, the Director of the 
Youth and Privacy Marketing Division shall submit to the Committee on 
Commerce, Science, and Transportation of the Senate and the Committee 
on Energy and Commerce of the House of Representatives a report that 
includes--</DELETED>
        <DELETED>    (1) a description of the work of the Youth Privacy 
        and Marketing Division on emerging concerns relating to youth 
        privacy and marketing practices; and</DELETED>
        <DELETED>    (2) an assessment of how effectively the 
        Commission has, during the period for which the report is 
        submitted, addressed youth privacy and marketing 
        practices.</DELETED>

<DELETED>SEC. 11. ENFORCEMENT AND APPLICABILITY.</DELETED>

<DELETED>    (a) Enforcement by the Commission.--</DELETED>
        <DELETED>    (1) In general.--Except as otherwise provided, 
        this Act and the regulations prescribed under this Act shall be 
        enforced by the Commission under the Federal Trade Commission 
        Act (15 U.S.C. 41 et seq.).</DELETED>
        <DELETED>    (2) Unfair or deceptive acts or practices.--
        Subject to subsection (b), a violation of this Act or a 
        regulation prescribed under this Act shall be treated as a 
        violation of a rule defining an unfair or deceptive act or 
        practice prescribed under section 18(a)(1)(B) of the Federal 
        Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).</DELETED>
        <DELETED>    (3) Actions by the commission.--</DELETED>
                <DELETED>    (A) In general.--Subject to subsection 
                (b), and except as provided in subsection (d)(1), the 
                Commission shall prevent any person from violating this 
                Act or a regulation prescribed under this Act in the 
                same manner, by the same means, and with the same 
                jurisdiction, powers, and duties as though all 
                applicable terms and provisions of the Federal Trade 
                Commission Act (15 U.S.C. 41 et seq.) were incorporated 
                into and made a part of this Act, and any person who 
                violates this Act or such regulation shall be subject 
                to the penalties and entitled to the privileges and 
                immunities provided in the Federal Trade Commission 
                Act.</DELETED>
                <DELETED>    (B) Violations.--Notwithstanding section 
                5(m) of the Federal Trade Commission Act (15 U.S.C. 
                45(m)), a civil penalty recovered for a violation of 
                this Act or a regulation prescribed under this Act may 
                be in excess of the amounts provided for in that 
                section as the court finds appropriate to deter 
                violations of this Act and regulations prescribed under 
                this Act.</DELETED>
<DELETED>    (b) Enforcement by Certain Other Agencies.--
Notwithstanding subsection (a), compliance with the requirements 
imposed under this Act shall be enforced as follows:</DELETED>
        <DELETED>    (1) Under section 8 of the Federal Deposit 
        Insurance Act (12 U.S.C. 1818) by the appropriate Federal 
        banking agency, with respect to an insured depository 
        institution (as such terms are defined in section 3 of such Act 
        (12 U.S.C. 1813)).</DELETED>
        <DELETED>    (2) Under the Federal Credit Union Act (12 U.S.C. 
        1751 et seq.) by the National Credit Union Administration 
        Board, with respect to any Federal credit union.</DELETED>
        <DELETED>    (3) Under part A of subtitle VII of title 49, 
        United States Code, by the Secretary of Transportation, with 
        respect to any air carrier or foreign air carrier subject to 
        such part.</DELETED>
        <DELETED>    (4) Under the Packers and Stockyards Act, 1921 (7 
        U.S.C. 181 et seq.) (except as provided in section 406 of that 
        Act (7 U.S.C. 226, 227)) by the Secretary of Agriculture, with 
        respect to any activities subject to that Act.</DELETED>
        <DELETED>    (5) Under the Farm Credit Act of 1971 (12 U.S.C. 
        2001 et seq.) by the Farm Credit Administration, with respect 
        to any Federal land bank, Federal land bank association, 
        Federal intermediate credit bank, or production credit 
        association.</DELETED>
<DELETED>    (c) Enforcement by State Attorneys General.--</DELETED>
        <DELETED>    (1) In general.--</DELETED>
                <DELETED>    (A) Civil actions.--In any case in which 
                the attorney general of a State has reason to believe 
                that an interest of the residents of that State has 
                been or is threatened or adversely affected by the 
                engagement of any person in a practice that violates 
                this Act or a regulation prescribed under this Act, the 
                State, as parens patriae, may bring a civil action on 
                behalf of the residents of the State in a district 
                court of the United States of appropriate jurisdiction 
                to--</DELETED>
                        <DELETED>    (i) enjoin that 
                        practice;</DELETED>
                        <DELETED>    (ii) enforce compliance with this 
                        Act or such regulation;</DELETED>
                        <DELETED>    (iii) obtain damages, restitution, 
                        or other compensation on behalf of residents of 
                        the State; or</DELETED>
                        <DELETED>    (iv) obtain such other relief as 
                        the court may consider to be 
                        appropriate.</DELETED>
                <DELETED>    (B) Notice.--</DELETED>
                        <DELETED>    (i) In general.--Before filing an 
                        action under subparagraph (A), the attorney 
                        general of the State involved shall provide to 
                        the Commission--</DELETED>
                                <DELETED>    (I) written notice of that 
                                action; and</DELETED>
                                <DELETED>    (II) a copy of the 
                                complaint for that action.</DELETED>
                        <DELETED>    (ii) Exemption.--</DELETED>
                                <DELETED>    (I) In general.--Clause 
                                (i) shall not apply with respect to the 
                                filing of an action by an attorney 
                                general of a State under this paragraph 
                                if the attorney general of the State 
                                determines that it is not feasible to 
                                provide the notice described in that 
                                clause before the filing of the 
                                action.</DELETED>
                                <DELETED>    (II) Notification.--In an 
                                action described in subclause (I), the 
                                attorney general of a State shall 
                                provide notice and a copy of the 
                                complaint to the Commission at the same 
                                time as the attorney general files the 
                                action.</DELETED>
        <DELETED>    (2) Intervention.--</DELETED>
                <DELETED>    (A) In general.--On receiving notice under 
                paragraph (1)(B), the Commission shall have the right 
                to intervene in the action that is the subject of the 
                notice.</DELETED>
                <DELETED>    (B) Effect of intervention.--If the 
                Commission intervenes in an action under paragraph (1), 
                it shall have the right--</DELETED>
                        <DELETED>    (i) to be heard with respect to 
                        any matter that arises in that action; 
                        and</DELETED>
                        <DELETED>    (ii) to file a petition for 
                        appeal.</DELETED>
        <DELETED>    (3) Construction.--For purposes of bringing any 
        civil action under paragraph (1), nothing in this Act shall be 
        construed to prevent an attorney general of a State from 
        exercising the powers conferred on the attorney general by the 
        laws of that State to--</DELETED>
                <DELETED>    (A) conduct investigations;</DELETED>
                <DELETED>    (B) administer oaths or affirmations; 
                or</DELETED>
                <DELETED>    (C) compel the attendance of witnesses or 
                the production of documentary and other 
                evidence.</DELETED>
        <DELETED>    (4) Actions by the commission.--In any case in 
        which an action is instituted by or on behalf of the Commission 
        for violation of this Act or a regulation prescribed under this 
        Act, no State may, during the pendency of that action, 
        institute a separate action under paragraph (1) against any 
        defendant named in the complaint in the action instituted by or 
        on behalf of the Commission for that violation.</DELETED>
        <DELETED>    (5) Venue; service of process.--</DELETED>
                <DELETED>    (A) Venue.--Any action brought under 
                paragraph (1) may be brought in the district court of 
                the United States that meets applicable requirements 
                relating to venue under section 1391 of title 28, 
                United States Code.</DELETED>
                <DELETED>    (B) Service of process.--In an action 
                brought under paragraph (1), process may be served in 
                any district in which the defendant--</DELETED>
                        <DELETED>    (i) is an inhabitant; or</DELETED>
                        <DELETED>    (ii) may be found.</DELETED>
<DELETED>    (d) Telecommunications Carriers and Cable Operators.--
</DELETED>
        <DELETED>    (1) Enforcement by commission.--Notwithstanding 
        section 4, 5(a)(2), or 6 of the Federal Trade Commission Act 
        (15 U.S.C. 44, 45(a)(2), 46) or any jurisdictional limitation 
        of the Commission, the Commission shall also enforce this Act 
        and regulations promulgated under this Act, in the same manner 
        provided in paragraph (a), with respect to common carriers 
        subject to the Communications Act of 1934 (47 U.S.C. 151 et 
        seq.) and Acts amendatory thereof and supplementary 
        thereto.</DELETED>
        <DELETED>    (2) Relationship to other laws.--To the extent 
        that section 222, 338(i), or 631 of the Communications Act of 
        1934 (47 U.S.C. 222, 338(i), 551) is inconsistent with this 
        Act, this Act controls.</DELETED>
<DELETED>    (e) Safe Harbors.--</DELETED>
        <DELETED>    (1) Definition.--In this subsection--</DELETED>
                <DELETED>    (A) the term ``applicable section'' means 
                section 5, 6, 7, or 8 of this Act;</DELETED>
                <DELETED>    (B) the term ``covered operator'' means an 
                operator subject to guidelines approved under paragraph 
                (2);</DELETED>
                <DELETED>    (C) the term ``requesting entity'' means 
                an entity that submits a safe harbor request to the 
                Commission; and</DELETED>
                <DELETED>    (D) the term ``safe harbor request'' means 
                a request to have self-regulatory guidelines described 
                in paragraph (2)(A) approved under that 
                paragraph.</DELETED>
        <DELETED>    (2) Guidelines.--</DELETED>
                <DELETED>    (A) In general.--An operator may satisfy 
                the requirements of regulations issued under an 
                applicable section by following a set of self-
                regulatory guidelines, issued by representatives of the 
                marketing or online industries, or by other persons, 
                that, after notice and an opportunity for comment, are 
                approved by the Commission upon making a determination 
                that the guidelines meet the requirements of the 
                regulations issued under that applicable 
                section.</DELETED>
                <DELETED>    (B) Expedited response to requests.--Not 
                later than 180 days after the date on which a safe 
                harbor request is filed under subparagraph (A), the 
                Commission shall act upon the request set forth in 
                writing the conclusions of the Commission with regard 
                to the request.</DELETED>
                <DELETED>    (C) Appeals.--A requesting entity may 
                appeal the final action of the Commission under 
                subparagraph (B), or a failure by the Commission to act 
                in the period described in that paragraph, to a 
                district court of the United States of appropriate 
                jurisdiction, as provided for in section 706 of title 
                5, United States Code.</DELETED>
        <DELETED>    (3) Incentives.--</DELETED>
                <DELETED>    (A) Self-regulatory incentives.--In 
                prescribing regulations under an applicable section, 
                the Commission shall provide incentives for self-
                regulation by covered operators to implement the 
                protections afforded children and teens, as applicable, 
                under the regulatory requirements described in those 
                sections.</DELETED>
                <DELETED>    (B) Deemed compliance.--The incentives 
                under subparagraph (A) shall include provisions for 
                ensuring that a covered operator will be deemed to be 
                in compliance with the requirements of the regulations 
                under an applicable section if that person complies 
                with guidelines approved under paragraph (2).</DELETED>
        <DELETED>    (4) Regulations.--</DELETED>
                <DELETED>    (A) In general.--In prescribing 
                regulations relating to safe harbor guidelines under an 
                applicable section, the Commission shall--</DELETED>
                        <DELETED>    (i) establish criteria for the 
                        approval of guidelines that will ensure that a 
                        covered operator provides substantially the 
                        same or greater protections for children and 
                        teens, as applicable, as those contained in the 
                        regulations issued under the applicable 
                        section; and</DELETED>
                        <DELETED>    (ii) subject to subsection (B), 
                        require that any report or documentation 
                        required to be submitted to the Commission by a 
                        covered operator or requesting entity will be 
                        published on the internet website of the 
                        Commission.</DELETED>
                <DELETED>    (B) Restrictions on publication.--The 
                restrictions described in subsection (f) of section 6 
                of the Federal Trade Commission Act (15 U.S.C. 46(f)) 
                applicable to the publication of information obtained 
                by the Commission through investigations conducted 
                under such section shall apply in same manner to the 
                publication under this paragraph of information 
                included in a report or documentation described in 
                subparagraph (A).</DELETED>
        <DELETED>    (5) Report by the inspector general.--</DELETED>
                <DELETED>    (A) In general.--Not later than 2 years 
                after the date of enactment of this Act, and once each 
                2 years thereafter, the Inspector General of the 
                Commission shall submit to the Commission and each 
                committee of the Senate and each committee of the House 
                of Representatives that has jurisdiction over the 
                Commission a report regarding the safe harbor 
                provisions under this subparagraph, which shall 
                include--</DELETED>
                        <DELETED>    (i) an analysis of whether the 
                        safe harbor provisions are--</DELETED>
                                <DELETED>    (I) operating fairly and 
                                effectively; and</DELETED>
                                <DELETED>    (II) effectively 
                                protecting the interests of children 
                                and teens; and</DELETED>
                        <DELETED>    (ii) proposals for policy changes 
                        that would improve the effectiveness of the 
                        safe harbor provisions.</DELETED>
                <DELETED>    (B) Publication.--Not later than 10 days 
                after the date on which a report under subparagraph (A) 
                is submitted, the Commission shall publish the report 
                on the internet website of the Commission.</DELETED>
<DELETED>    (f) Effective Date.--This section shall take effect on the 
date that is 90 days after the date of enactment of this Act.</DELETED>
<DELETED>    (g) Rule of Construction.--Nothing in this Act may be 
construed to authorize any action by the Commission that would violate 
section 18(h) of the Federal Trade Commission Act (15 U.S.C. 
57a(h)).</DELETED>

<DELETED>SEC. 12. GAO STUDY.</DELETED>

<DELETED>    (a) Study.--The Comptroller General of the United States 
(in this section referred to as the ``Comptroller General'') shall 
conduct a study on the privacy of teens who use financial technology 
products. Such study shall--</DELETED>
        <DELETED>    (1) identify the type of financial technology 
        products that teens are using;</DELETED>
        <DELETED>    (2) identify the potential risks to teens' privacy 
        from using such financial technology products; and</DELETED>
        <DELETED>    (3) determine whether existing laws are sufficient 
        to address such risks to teens' privacy.</DELETED>
<DELETED>    (b) Report.--Not later than 1 year after the date of 
enactment of this section, the Comptroller General shall submit to 
Congress a report containing the results of the study conducted under 
subsection (a), together with recommendations for such legislation and 
administrative action as the Comptroller General determines 
appropriate.</DELETED>

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

    (a) Short Title.--This Act may be cited as the ``Children and 
Teens' Online Privacy Protection Act''.
    (b) Table of Contents.--The table of contents for this Act is as 
follows:

Sec. 1. Short title; table of contents.
Sec. 2. Online collection, use, disclosure, and deletion of personal 
                            information of children and teens.
Sec. 3. Study and reports of mobile and online application oversight 
                            and enforcement.
Sec. 4. GAO study.

SEC. 2. ONLINE COLLECTION, USE, DISCLOSURE, AND DELETION OF PERSONAL 
              INFORMATION OF CHILDREN AND TEENS.

    (a) Definitions.--Section 1302 of the Children's Online Privacy 
Protection Act of 1998 (15 U.S.C. 6501) is amended--
            (1) by amending paragraph (2) to read as follows:
            ``(2) Operator.--The term `operator'--
                    ``(A) means any person--
                            ``(i) who, for commercial purposes, in 
                        interstate or foreign commerce operates or 
                        provides a website on the internet, an online 
                        service, an online application, or a mobile 
                        application; and
                            ``(ii) who--
                                    ``(I) collects or maintains, either 
                                directly or through a service provider, 
                                personal information from or about the 
                                users of that website, service, or 
                                application;
                                    ``(II) allows another person to 
                                collect personal information directly 
                                from users of that website, service, or 
                                application (in which case, the 
                                operator is deemed to have collected 
                                the information); or
                                    ``(III) allows users of that 
                                website, service, or application to 
                                publicly disclose personal information 
                                (in which case, the operator is deemed 
                                to have collected the information); and
                    ``(B) does not include any nonprofit entity that 
                would otherwise be exempt from coverage under section 5 
                of the Federal Trade Commission Act (15 U.S.C. 45).'';
            (2) in paragraph (4)--
                    (A) by amending subparagraph (A) to read as 
                follows:
                    ``(A) the release of personal information collected 
                from a child or teen by an operator for any purpose, 
                except where the personal information is provided to a 
                person other than an operator who--
                            ``(i) provides support for the internal 
                        operations of the website, online service, 
                        online application, or mobile application of 
                        the operator, excluding any activity relating 
                        to individual-specific advertising to children 
                        or teens; and
                            ``(ii) does not disclose or use that 
                        personal information for any other purpose; 
                        and''; and
                    (B) in subparagraph (B)--
                            (i) by inserting ``or teen'' after 
                        ``child'' each place the term appears; and
                            (ii) by striking ``website or online 
                        service'' and inserting ``website, online 
                        service, online application, or mobile 
                        application'';
            (3) by striking paragraph (8) and inserting the following:
            ``(8) Personal information.--
                    ``(A) In general.--The term `personal information' 
                means individually identifiable information about an 
                individual collected online, including--
                            ``(i) a first and last name;
                            ``(ii) a home or other physical address 
                        including street name and name of a city or 
                        town;
                            ``(iii) an e-mail address;
                            ``(iv) a telephone number;
                            ``(v) a Social Security number;
                            ``(vi) any other identifier that the 
                        Commission determines permits the physical or 
                        online contacting of a specific individual;
                            ``(vii) geolocation information;
                            ``(viii) information generated from the 
                        measurement or technological processing of an 
                        individual's biological, physical, or 
                        physiological characteristics that is used to 
                        identify an individual, including--
                                    ``(I) fingerprints;
                                    ``(II) voice prints;
                                    ``(III) iris or retina imagery 
                                scans;
                                    ``(IV) facial templates;
                                    ``(V) deoxyribonucleic acid (DNA) 
                                information; or
                                    ``(VI) gait;
                            ``(ix) information linked or reasonably 
                        linkable to a child or teen; or
                            ``(x) information linked or reasonably 
                        linkable to a child or teen or the parents of 
                        that child or teen (including any unique 
                        identifier) that an operator collects online 
                        from the child or teen and combines with an 
                        identifier described in this subparagraph.
                    ``(B) Exclusion.--The term `personal information' 
                shall not include an audio file that contains a child's 
                or teen's voice so long as the operator--
                            ``(i) does not request information via 
                        voice that would otherwise be considered 
                        personal information under this paragraph;
                            ``(ii) provides clear notice of its 
                        collection and use of the audio file and its 
                        deletion policy in its privacy policy;
                            ``(iii) only uses the voice within the 
                        audio file solely as a replacement for written 
                        words, to perform a task, or engage with a 
                        website, online service, online application, or 
                        mobile application, such as to perform a search 
                        or fulfill a verbal instruction or request; and
                            ``(iv) only maintains the audio file long 
                        enough to complete the stated purpose and then 
                        immediately deletes the audio file and does not 
                        make any other use of the audio file prior to 
                        deletion.'';
            (4) by amending paragraph (9) to read as follows:
            ``(9) Verifiable consent.--The term `verifiable consent' 
        means any reasonable effort (taking into consideration 
        available technology), including a request for authorization 
        for future collection, use, and disclosure described in the 
        notice, to ensure that, in the case of a child, a parent of the 
        child, or, in the case of a teen, the teen--
                    ``(A) receives specific notice of the personal 
                information collection, use, and disclosure practices 
                of the operator; and
                    ``(B) before the personal information of the child 
                or teen is collected, freely and unambiguously 
                authorizes--
                            ``(i) the collection, use, and disclosure, 
                        as applicable, of that personal information; 
                        and
                            ``(ii) any subsequent use of that personal 
                        information.'';
            (5) in paragraph (10)--
                    (A) in the paragraph header, by striking ``Website 
                or online service directed to children'' and inserting 
                ``Website, online service, online application, or 
                mobile application directed to children'';
                    (B) by striking ``website or online service'' each 
                place it appears and inserting ``website, online 
                service, online application, or mobile application''; 
                and
                    (C) by adding at the end the following new 
                subparagraph:
                    ``(C) Rule of construction.--In considering whether 
                a website, online service, online application, or 
                mobile application is directed to children, the 
                Commission shall, using competent and reliable 
                empirical evidence, apply a totality of circumstances 
                test to consider the intended audience of the website, 
                online service, online application, or mobile 
                application, as a whole.''; and
            (6) by adding at the end the following:
            ``(13) Connected device.--The term `connected device' means 
        a device that is capable of connecting to the internet, 
        directly or indirectly, or to another connected device.
            ``(14) Online application.--The term `online application'--
                    ``(A) means an internet-connected software program; 
                and
                    ``(B) includes a service or application offered via 
                a connected device.
            ``(15) Mobile application.--The term `mobile application'--
                    ``(A) means a software program that runs on the 
                operating system of--
                            ``(i) a cellular telephone;
                            ``(ii) a tablet computer; or
                            ``(iii) a similar portable computing device 
                        that transmits data over a wireless connection; 
                        and
                    ``(B) includes a service or application offered via 
                a connected device.
            ``(16) Geolocation information.--The term `geolocation 
        information' means information sufficient to identify a street 
        name and name of a city or town.
            ``(17) Teen.--The term `teen' means an individual over the 
        age of 12 and under the age of 17.
            ``(18) Individual-specific advertising to children or 
        teens.--
                    ``(A) In general.--The term `individual-specific 
                advertising to children or teens' means advertising or 
                any other effort to market a product or service that is 
                directed to a specific child or teen or a device that 
                is linked or reasonably linkable to a child or teen--
                            ``(i) based on--
                                    ``(I) the personal information of--
                                            ``(aa) the child or teen; 
                                        or
                                            ``(bb) a group of children 
                                        or teens who are similar in 
                                        sex, age, income level, race, 
                                        or ethnicity to the specific 
                                        child or teen to whom the 
                                        product or service is marketed;
                                    ``(II) psychological profiling of a 
                                child or teen or group of children or 
                                teens; or
                                    ``(III) a unique identifier of the 
                                device; or
                            ``(ii) as a result of use by the child or 
                        teen, access by any device of the child or 
                        teen, or use by a group of children or teens 
                        who are similar to the specific child or teen, 
                        of more than a single--
                                    ``(I) website;
                                    ``(II) online service;
                                    ``(III) online application;
                                    ``(IV) mobile application; or
                                    ``(V) connected device.
                    ``(B) Exclusions.--The term `individual-specific 
                advertising to children or teens' shall not include--
                            ``(i) advertising or marketing to an 
                        individual or the device of an individual in 
                        response to the individual's specific request 
                        for information or feedback, such as a child's 
                        or teen's current search query;
                            ``(ii) contextual advertising, such as when 
                        an advertisement is displayed based on the 
                        content of the website, online service, online 
                        application, mobile application, or connected 
                        device in which the advertisement appears and 
                        does not vary based on personal information 
                        related to the viewer; or
                            ``(iii) processing personal information 
                        solely for measuring or reporting advertising 
                        or content performance, reach, or frequency, 
                        including independent measurement.
                    ``(C) Rule of construction.--Nothing in 
                subparagraph (A) shall be construed to prohibit an 
                operator with actual knowledge or knowledge fairly 
                implied on the basis of objective circumstances that an 
                individual is under the age of 17 from delivering 
                advertising or marketing that is age-appropriate and 
                intended for a child or teen audience, so long as the 
                operator does not use any personal information other 
                than whether the user is under the age of 17.''.
    (b) Online Collection, Use, Disclosure, and Deletion of Personal 
Information of Children and Teens.--Section 1303 of the Children's 
Online Privacy Protection Act of 1998 (15 U.S.C. 6502) is amended--
            (1) by striking the heading and inserting the following: 
        ``online collection, use, disclosure, and deletion of personal 
        information of children and teens.'';
            (2) in subsection (a)--
                    (A) by amending paragraph (1) to read as follows:
            ``(1) In general.--It is unlawful for an operator of a 
        website, online service, online application, or mobile 
        application directed to children or for any operator of a 
        website, online service, online application, or mobile 
        application with actual knowledge or knowledge fairly implied 
        on the basis of objective circumstances--
                    ``(A) to collect personal information from a child 
                or teen in a manner that violates the regulations 
                prescribed under subsection (b);
                    ``(B) to collect, use, disclose to third parties, 
                or compile personal information of a child or teen for 
                purposes of individual-specific advertising to children 
                or teens (or to allow another person to collect, use, 
                disclose, or compile such information for such 
                purpose);
                    ``(C) to collect the personal information of a 
                child or teen except when the collection of the 
                personal information is--
                            ``(i) consistent with the context of a 
                        particular or service or the relationship of 
                        the child or teen with the operator, including 
                        collection necessary to fulfill a transaction 
                        or provide a product or service requested by 
                        the child or teen; or
                            ``(ii) required or specifically authorized 
                        by Federal or State law; or
                    ``(D) to store or transfer the personal information 
                of a child or teen outside of the United States unless 
                the operator discloses to the child or teen involved 
                that their personal information is being stored or 
                transferred outside of the United States; or
                    ``(E) to retain the personal information of a child 
                or teen for longer than is reasonably necessary to 
                fulfill a transaction or provide a service requested by 
                the child or teen except as required or specifically 
                authorized by Federal or State law.''; and
                    (B) in paragraph (2)--
                            (i) by striking ``Notwithstanding paragraph 
                        (1)'' and inserting ``Notwithstanding paragraph 
                        (1)(A)'';
                            (ii) by striking ``of such a website or 
                        online service''; and
                            (iii) by striking ``subsection 
                        (b)(1)(B)(iii) to the parent of a child'' and 
                        inserting ``subsection (b)(1)(B)(iii) to the 
                        parent of a child or under subsection 
                        (b)(1)(C)(iii) to a teen'';
            (3) in subsection (b)--
                    (A) in paragraph (1)--
                            (i) in subparagraph (A)--
                                    (I) by striking ``operator of any 
                                website'' and all that follows through 
                                ``from a child'' and inserting 
                                ``operator of a website, online 
                                service, online application, or mobile 
                                application directed to children or 
                                that has actual knowledge or knowledge 
                                fairly implied on the basis of 
                                objective circumstances that it is 
                                collecting personal information from 
                                children or teens'';
                                    (II) in clause (i)--
                                            (aa) by striking ``notice 
                                        on the website'' and inserting 
                                        ``clear and conspicuous 
                                        notice'';
                                            (bb) by inserting ``or 
                                        teens'' after ``children'';
                                            (cc) by striking ``, and 
                                        the operator's'' and inserting 
                                        ``, the operator's''; and
                                            (dd) by striking ``; and'' 
                                        and inserting ``, the rights 
                                        and opportunities available to 
                                        the parent of the child or teen 
                                        under subparagraphs (B) and 
                                        (C), and the procedures or 
                                        mechanisms the operator uses to 
                                        ensure that personal 
                                        information is not collected 
                                        from children or teens except 
                                        in accordance with the 
                                        regulations promulgated under 
                                        this paragraph;'';
                                    (III) in clause (ii)--
                                            (aa) by striking 
                                        ``parental'';
                                            (bb) by inserting ``or 
                                        teens'' after ``children'';
                                            (cc) by striking the 
                                        semicolon at the end and 
                                        inserting ``; and''; and
                                    (IV) by inserting after clause (ii) 
                                the following new clause:
                            ``(iii) to obtain verifiable consent from a 
                        parent of a child or a teen before using or 
                        disclosing personal information of the child or 
                        teen for any purpose that is a material change 
                        from the original purposes and disclosure 
                        practices specified to the parent of the child 
                        or the teen under clause (i);'';
                            (ii) in subparagraph (B)--
                                    (I) in the matter preceding clause 
                                (i), by striking ``website or online 
                                service'' and inserting ``operator'';
                                    (II) in clause (i), by inserting 
                                ``and the method by which the operator 
                                obtained the personal information, and 
                                the purposes for which the operator 
                                collects, uses, discloses, and retains 
                                the personal information'' before the 
                                semicolon;
                                    (III) in clause (ii)--
                                            (aa) by inserting ``to 
                                        delete personal information 
                                        collected from the child or 
                                        content or information 
                                        submitted by the child to a 
                                        website, online service, online 
                                        application, or mobile 
                                        application and'' after ``the 
                                        opportunity at any time''; and
                                            (bb) by striking ``; and'' 
                                        and inserting a semicolon;
                                    (IV) by redesignating clause (iii) 
                                as clause (iv) and inserting after 
                                clause (ii) the following new clause:
                            ``(iii) the opportunity to challenge the 
                        accuracy of the personal information and, if 
                        the parent of the child establishes the 
                        inaccuracy of the personal information, to have 
                        the inaccurate personal information 
                        corrected;''; and
                                    (V) in clause (iv), as so 
                                redesignated, by inserting ``, if such 
                                information is available to the 
                                operator at the time the parent makes 
                                the request'' before the semicolon;
                            (iii) by redesignating subparagraphs (C) 
                        and (D) as subparagraphs (D) and (E), 
                        respectively;
                            (iv) by inserting after subparagraph (B) 
                        the following new subparagraph:
                    ``(C) require the operator to provide, upon the 
                request of a teen under this subparagraph who has 
                provided personal information to the operator, upon 
                proper identification of that teen--
                            ``(i) a description of the specific types 
                        of personal information collected from the teen 
                        by the operator, the method by which the 
                        operator obtained the personal information, and 
                        the purposes for which the operator collects, 
                        uses, discloses, and retains the personal 
                        information;
                            ``(ii) the opportunity at any time to 
                        delete personal information collected from the 
                        teen or content or information submitted by the 
                        teen to a website, online service, online 
                        application, or mobile application and to 
                        refuse further use or collection of personal 
                        information from the teen;
                            ``(iii) the opportunity to challenge the 
                        accuracy of the personal information and, if 
                        the parent of the child establishes the 
                        inaccuracy of the personal information, to have 
                        the inaccurate personal information corrected; 
                        and
                            ``(iv) a means that is reasonable under the 
                        circumstances for the teen to obtain any 
                        personal information collected from the teen, 
                        if such information is available to the 
                        operator at the time the teen makes the 
                        request;''; and
                            (v) by amending subparagraph (E), as so 
                        redesignated, to read as follows:
                    ``(E) require the operator to establish, implement, 
                and maintain reasonable security practices to protect 
                the confidentiality, integrity, and accessibility of 
                personal information of children or teens collected by 
                the operator, and to protect such personal information 
                against unauthorized access.'';
                    (B) in paragraph (2)--
                            (i) in the matter preceding subparagraph 
                        (A), by striking ``verifiable parental 
                        consent'' and inserting ``verifiable consent'';
                            (ii) in subparagraph (A)--
                                    (I) by inserting ``or teen'' after 
                                ``collected from a child'';
                                    (II) by inserting ``or teen'' after 
                                ``request from the child''; and
                                    (III) by inserting ``or teen or to 
                                contact another child or teen'' after 
                                ``to recontact the child'';
                            (iii) in subparagraph (B)--
                                    (I) by striking ``parent or child'' 
                                and inserting ``parent or teen''; and
                                    (II) by striking ``parental 
                                consent'' each place the term appears 
                                and inserting ``verifiable consent'';
                            (iv) in subparagraph (C)--
                                    (I) in the matter preceding clause 
                                (i), by inserting ``or teen'' after 
                                ``child'' each place the term appears;
                                    (II) in clause (i)--
                                            (aa) by inserting ``or 
                                        teen'' after ``child'' each 
                                        place the term appears; and
                                            (bb) by inserting ``or 
                                        teen, as applicable,'' after 
                                        ``parent'' each place the term 
                                        appears; and
                                    (III) in clause (ii), by inserting 
                                ``or teen'' after ``child'' each place 
                                the term appears; and
                            (v) in subparagraph (D)--
                                    (I) in the matter preceding clause 
                                (i), by inserting ``or teen'' after 
                                ``child'' each place the term appears;
                                    (II) in clause (ii), by inserting 
                                ``or teen'' after ``child''; and
                                    (III) in the flush text following 
                                clause (iii)--
                                            (aa) by inserting ``or 
                                        teen, as applicable,'' after 
                                        ``parent'' each place the term 
                                        appears; and
                                            (bb) by inserting ``or 
                                        teen'' after ``child''; and
                    (C) by adding after paragraph (3) the following:
            ``(4) Continuation of service.--The regulations shall 
        prohibit an operator from discontinuing service provided to a 
        child or teen on the basis of a request by the parent of the 
        child or by the teen, under the regulations prescribed under 
        subparagraph (B) or (C) of paragraph (1), respectively, to 
        delete personal information collected from the child or teen, 
        to the extent that the operator is capable of providing such 
        service without such information.
            ``(5) Rule of construction.--A request made pursuant to 
        subparagraph (B) or (C) of paragraph (1) to delete personal 
        information of a child or teen shall not be construed--
                    ``(A) to limit the authority of a law enforcement 
                agency to obtain any content or information from an 
                operator pursuant to a lawfully executed warrant or an 
                order of a court of competent jurisdiction;
                    ``(B) to require an operator or third party delete 
                information that--
                            ``(i) any other provision of Federal or 
                        State law requires the operator or third party 
                        to maintain; or
                            ``(ii) was submitted to the website, online 
                        service, online application, or mobile 
                        application of the operator by any person other 
                        than the user who is attempting to erase or 
                        otherwise eliminate the content or information, 
                        including content or information submitted by 
                        the user that was republished or resubmitted by 
                        another person; or
                    ``(C) prohibit an operator from--
                            ``(i) retaining a record of the deletion 
                        request and the minimum information necessary 
                        for the purposes of ensuring compliance with a 
                        request made pursuant to subparagraph (B) or 
                        (C); or
                            ``(ii) ensuring that the child or teen's 
                        information remains deleted.''; and
            (4) in subsection (c), by striking ``a regulation 
        prescribed under subsection (a)'' and inserting ``subparagraph 
        (B), (C), (D), or (E) of subsection (a)(1), or a of a 
        regulation prescribed under subparagraph (A) of such 
        subsection,''.
    (c) Safe Harbors.--Section 1304 of the Children's Online Privacy 
Protection Act of 1998 (15 U.S.C. 6503) is amended--
            (1) in subsection (b)(1), by inserting ``and teens'' after 
        ``children''; and
            (2) by adding at the end the following:
    ``(d) Publication.--
            ``(1) In general.--The Commission shall publish on the 
        internet website of the Commission any report or documentation 
        required by regulation to be submitted to the Commission to 
        carry out this section.
            ``(2) Restrictions on publication.--The restrictions 
        described in subsection (f) of section 6 of the Federal Trade 
        Commission Act (15 U.S.C. 46(f)) applicable to the publication 
        of information obtained by the Commission through 
        investigations conducted under such section shall apply in same 
        manner to the publication under this subsection of information 
        obtained by the Commission from a report or documentation 
        described in paragraph (1).''.
    (d) Administration and Applicability of Act.--Section 1306 of the 
Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6505) is 
amended--
            (1) in subsection (b)--
                    (A) in paragraph (1), by striking ``, in the case 
                of'' and all that follows through ``the Board of 
                Directors of the Federal Deposit Insurance 
                Corporation;'' and inserting the following: ``by the 
                appropriate Federal banking agency, with respect to any 
                insured depository institution (as those terms are 
                defined in section 3 of that Act (12 U.S.C. 1813));''; 
                and
                    (B) by striking paragraph (2) and redesignating 
                paragraphs (3) through (6) as paragraphs (2) through 
                (5), respectively; and
            (2) by adding at the end the following new subsections:
    ``(f) Determination of Whether an Operator Has Knowledge Fairly 
Implied on the Basis of Objective Circumstances.--
            ``(1) Rule of construction.--For purposes of enforcing this 
        Act or a regulation promulgated under this Act, in making a 
        determination as to whether an operator has knowledge fairly 
        implied on the basis of objective circumstances that a user is 
        a child or teen, the Commission shall rely on competent and 
        reliable empirical evidence, taking into account the totality 
        of the circumstances, including consideration of whether the 
        operator, using available technology, exercised reasonable 
        care.
            ``(2) Protections for privacy.--Nothing in the Commission's 
        determination under paragraph (1) shall be construed to require 
        an operator to--
                    ``(A) affirmatively collect any personal 
                information with respect to the age of a child or teen 
                that an operator is not already collecting in the 
                normal course of business; or
                    ``(B) implement an age gating or age verification 
                functionality.
            ``(3) Commission guidance.--
                    ``(A) In general.--Within 180 days of enactment, 
                the Commission shall issue guidance to provide 
                information, including best practices and examples for 
                operators to understand the Commission's determination 
                of whether an operator has knowledge fairly implied on 
                the basis of objective circumstances.
                    ``(B) Limitation.--No guidance issued by the 
                Commission with respect to this Act shall confer any 
                rights on any person, State, or locality, nor shall 
                operate to bind the Commission or any person to the 
                approach recommended in such guidance. In any 
                enforcement action brought pursuant to this Act, the 
                Commission shall allege a specific violation of a 
                provision of this Act. The Commission may not base an 
                enforcement action on, or execute a consent order based 
                on, practices that are alleged to be inconsistent with 
                any such guidance, unless the practices allegedly 
                violate this Act.
    ``(g) Additional Requirement.--Any regulations issued under this 
Act shall include a description and analysis of the impact of proposed 
and final Rules on small entities per the Regulatory Flexibility Act of 
1980 (5 U.S.C. 601 et seq.).''.

SEC. 3. STUDY AND REPORTS OF MOBILE AND ONLINE APPLICATION OVERSIGHT 
              AND ENFORCEMENT.

    (a) Oversight Report.--Not later than 3 years after the date of 
enactment of this Act, the Federal Trade Commission shall submit to the 
Committee on Commerce, Science, and Transportation of the Senate and 
the Committee on Energy and Commerce of the House of Representatives a 
report on the processes of platforms that offer mobile and online 
applications for ensuring that, of those applications that are 
websites, online services, online applications, or mobile applications 
directed to children, the applications operate in accordance with--
            (1) this Act, the amendments made by this Act, and rules 
        promulgated under this Act; and
            (2) rules promulgated by the Commission under section 5 of 
        the Federal Trade Commission Act (15 U.S.C. 45) relating to 
        unfair or deceptive acts or practices in marketing.
    (b) Enforcement Report.--Not later than 1 year after the date of 
enactment of this Act, and each year thereafter, the Federal Trade 
Commission shall submit to the Committee on Commerce, Science, and 
Transportation of the Senate and the Committee on Energy and Commerce 
of the House of Representatives a report that addresses, at a minimum--
            (1) the number of actions brought by the Commission during 
        the reporting year to enforce the Children's Online Privacy 
        Protection Act of 1998 (15 U.S.C. 6501) (referred to in this 
        subsection as the ``Act'') and the outcome of each such action;
            (2) the total number of investigations or inquiries into 
        potential violations of the Act; during the reporting year;
            (3) the total number of open investigations or inquiries 
        into potential violations of the Act as of the time the report 
        is submitted;
            (4) the number and nature of complaints received by the 
        Commission relating to an allegation of a violation of the Act 
        during the reporting year; and
            (5) policy or legislative recommendations to strengthen 
        online protections for children and teens.

SEC. 4. GAO STUDY.

    (a) Study.--The Comptroller General of the United States (in this 
section referred to as the ``Comptroller General'') shall conduct a 
study on the privacy of teens who use financial technology products. 
Such study shall--
            (1) identify the type of financial technology products that 
        teens are using;
            (2) identify the potential risks to teens' privacy from 
        using such financial technology products; and
            (3) determine whether existing laws are sufficient to 
        address such risks to teens' privacy.
    (b) Report.--Not later than 1 year after the date of enactment of 
this section, the Comptroller General shall submit to Congress a report 
containing the results of the study conducted under subsection (a), 
together with recommendations for such legislation and administrative 
action as the Comptroller General determines appropriate.
                                                       Calendar No. 288

118th CONGRESS

  1st Session

                                S. 1418

_______________________________________________________________________

                                 A BILL

   To amend the Children's Online Privacy Protection Act of 1998 to 
  strengthen protections relating to the online collection, use, and 
disclosure of personal information of children and teens, and for other 
                               purposes.

_______________________________________________________________________

                           December 13, 2023

                       Reported with an amendment