[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 2073 Engrossed Amendment Senate (EAS)]

<DOC>
  
  
  
  
  
  
  
  
  
  

                  In the Senate of the United States,

                                                         July 30, 2024.
    Resolved, That the Senate agree to the amendment of the House of 
Representatives to the bill (S. 2073) ``An Act to amend title 31, 
United States Code, to require agencies to include a list of outdated 
or duplicative reporting requirements in annual budget justifications, 
and for other purposes.'', with the following

                 SENATE AMENDMENTS TO HOUSE AMENDMENT:

            In lieu of the matter proposed to be inserted, insert the 
      following:

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

    (a) Short Title.--This Act may be cited as the ``Kids Online Safety 
and Privacy Act''.
    (b) Table of Contents.--The table of contents for this Act is as 
follows:

Sec. 1. Short title; table of contents.

                   TITLE I--KEEPING KIDS SAFE ONLINE

                     Subtitle A--Kids Online Safety

Sec. 101. Definitions.
Sec. 102. Duty of care.
Sec. 103. Safeguards for minors.
Sec. 104. Disclosure.
Sec. 105. Transparency.
Sec. 106. Research on social media and minors.
Sec. 107. Market research.
Sec. 108. Age verification study and report.
Sec. 109. Guidance.
Sec. 110. Enforcement.
Sec. 111. Kids online safety council.
Sec. 112. Effective date.
Sec. 113. Rules of construction and other matters.

                 Subtitle B--Filter Bubble Transparency

Sec. 120. Definitions.
Sec. 121. Requirement to allow users to see unmanipulated content on 
                            internet platforms.

          Subtitle C--Relationship to State Laws; Severability

Sec. 130. Relationship to State laws.
Sec. 131. Severability.

              TITLE II--CHILDREN AND TEENS' ONLINE PRIVACY

Sec. 201. Online collection, use, disclosure, and deletion of personal 
                            information of children and teens.
Sec. 202. Study and reports of mobile and online application oversight 
                            and enforcement.
Sec. 203. GAO study.
Sec. 204. Severability.

                 TITLE III--ELIMINATING USELESS REPORTS

Sec. 301. Sunsets for agency reports.

                   TITLE I--KEEPING KIDS SAFE ONLINE

                     Subtitle A--Kids Online Safety

SEC. 101. DEFINITIONS.

    In this subtitle:
            (1) Child.--The term ``child'' means an individual who is 
        under the age of 13.
            (2) Compulsive usage.--The term ``compulsive usage'' means 
        any response stimulated by external factors that causes an 
        individual to engage in repetitive behavior reasonably likely 
        to cause psychological distress.
            (3) Covered platform.--
                    (A) In general.--The term ``covered platform'' 
                means an online platform, online video game, messaging 
                application, or video streaming service that connects 
                to the internet and that is used, or is reasonably 
                likely to be used, by a minor.
                    (B) Exceptions.--The term ``covered platform'' does 
                not include--
                            (i) an entity acting in its capacity as a 
                        provider of--
                                    (I) a common carrier service 
                                subject to the Communications Act of 
                                1934 (47 U.S.C. 151 et seq.) and all 
                                Acts amendatory thereof and 
                                supplementary thereto;
                                    (II) a broadband internet access 
                                service (as such term is defined for 
                                purposes of section 8.1(b) of title 47, 
                                Code of Federal Regulations, or any 
                                successor regulation);
                                    (III) an email service;
                                    (IV) a teleconferencing or video 
                                conferencing service that allows 
                                reception and transmission of audio or 
                                video signals for real-time 
                                communication, provided that--
                                            (aa) the service is not an 
                                        online platform, including a 
                                        social media service or social 
                                        network; and
                                            (bb) the real-time 
                                        communication is initiated by 
                                        using a unique link or 
                                        identifier to facilitate 
                                        access; or
                                    (V) a wireless messaging service, 
                                including such a service provided 
                                through short messaging service or 
                                multimedia messaging service protocols, 
                                that is not a component of, or linked 
                                to, an online platform and where the 
                                predominant or exclusive function is 
                                direct messaging consisting of the 
                                transmission of text, photos or videos 
                                that are sent by electronic means, 
                                where messages are transmitted from the 
                                sender to a recipient, and are not 
                                posted within an online platform or 
                                publicly;
                            (ii) an organization not organized to carry 
                        on business for its own profit or that of its 
                        members;
                            (iii) any public or private preschool, 
                        elementary, or secondary school, or any 
                        institution of vocational, professional, or 
                        higher education;
                            (iv) a library (as defined in section 
                        213(1) of the Library Services and Technology 
                        Act (20 U.S.C. 9122(1)));
                            (v) a news or sports coverage website or 
                        app where--
                                    (I) the inclusion of video content 
                                on the website or app is related to the 
                                website or app's own gathering, 
                                reporting, or publishing of news 
                                content or sports coverage; and
                                    (II) the website or app is not 
                                otherwise an online platform;
                            (vi) a product or service that primarily 
                        functions as business-to-business software, a 
                        cloud storage, file sharing, or file 
                        collaboration service, provided that the 
                        product or service is not an online platform; 
                        or
                            (vii) a virtual private network or similar 
                        service that exists solely to route internet 
                        traffic between locations.
            (4) Design feature.--The term ``design feature'' means any 
        feature or component of a covered platform that will encourage 
        or increase the frequency, time spent, or activity of minors on 
        the covered platform. Design features include but are not 
        limited to--
                    (A) infinite scrolling or auto play;
                    (B) rewards for time spent on the platform;
                    (C) notifications;
                    (D) personalized recommendation systems;
                    (E) in-game purchases; or
                    (F) appearance altering filters.
            (5) Geolocation.--The term ``geolocation'' has the meaning 
        given the term ``geolocation information'' in section 1302 of 
        the Children's Online Privacy Protection Act of 1998 (15 U.S.C. 
        6501), as added by section 201(a).
            (6) Know or knows.--The term ``know'' or ``knows'' means to 
        have actual knowledge or knowledge fairly implied on the basis 
        of objective circumstances.
            (7) Mental health disorder.--The term ``mental health 
        disorder'' has the meaning given the term ``mental disorder'' 
        in the Diagnostic and Statistical Manual of Mental Health 
        Disorders, 5th Edition (or the most current successor edition).
            (8) Microtransaction.--
                    (A) In general.--The term ``microtransaction'' 
                means a purchase made in an online video game 
                (including a purchase made using a virtual currency 
                that is purchasable or redeemable using cash or credit 
                or that is included as part of a paid subscription 
                service).
                    (B) Inclusions.--Such term includes a purchase 
                involving surprise mechanics, new characters, or in-
                game items.
                    (C) Exclusions.--Such term does not include--
                            (i) a purchase made in an online video game 
                        using a virtual currency that is earned through 
                        gameplay and is not otherwise purchasable or 
                        redeemable using cash or credit or included as 
                        part of a paid subscription service; or
                            (ii) a purchase of additional levels within 
                        the game or an overall expansion of the game.
            (9) Minor.--The term ``minor'' means an individual who is 
        under the age of 17.
            (10) Online platform.--The term ``online platform'' means 
        any public-facing website, online service, online application, 
        or mobile application that predominantly provides a community 
        forum for user generated content, such as sharing videos, 
        images, games, audio files, or other content, including a 
        social media service, social network, or virtual reality 
        environment.
            (11) Online video game.--The term ``online video game'' 
        means a video game, including an educational video game, that 
        connects to the internet and that allows a user to--
                    (A) create and upload content other than content 
                that is incidental to gameplay, such as character or 
                level designs created by the user, preselected phrases, 
                or short interactions with other users;
                    (B) engage in microtransactions within the game; or
                    (C) communicate with other users.
            (12) Parent.--The term ``parent'' has the meaning given 
        that term in section 1302 of the Children's Online Privacy 
        Protection Act (15 U.S.C. 6501).
            (13) Personal data.--The term ``personal data'' has the 
        same meaning as the term ``personal information'' as defined in 
        section 1302 of the Children's Online Privacy Protection Act 
        (15 U.S.C. 6501).
            (14) Personalized recommendation system.--The term 
        ``personalized recommendation system'' means a fully or 
        partially automated system used to suggest, promote, or rank 
        content, including other users, hashtags, or posts, based on 
        the personal data of users. A recommendation system that 
        suggests, promotes, or ranks content based solely on the user's 
        language, city or town, or age shall not be considered a 
        personalized recommendation system.
            (15) Sexual exploitation and abuse.--The term ``sexual 
        exploitation and abuse'' means any of the following:
                    (A) Coercion and enticement, as described in 
                section 2422 of title 18, United States Code.
                    (B) Child sexual abuse material, as described in 
                sections 2251, 2252, 2252A, and 2260 of title 18, 
                United States Code.
                    (C) Trafficking for the production of images, as 
                described in section 2251A of title 18, United States 
                Code.
                    (D) Sex trafficking of children, as described in 
                section 1591 of title 18, United States Code.
            (16) User.--The term ``user'' means, with respect to a 
        covered platform, an individual who registers an account or 
        creates a profile on the covered platform.

SEC. 102. DUTY OF CARE.

    (a) Prevention of Harm to Minors.--A covered platform shall 
exercise reasonable care in the creation and implementation of any 
design feature to prevent and mitigate the following harms to minors:
            (1) Consistent with evidence-informed medical information, 
        the following mental health disorders: anxiety, depression, 
        eating disorders, substance use disorders, and suicidal 
        behaviors.
            (2) Patterns of use that indicate or encourage addiction-
        like behaviors by minors.
            (3) Physical violence, online bullying, and harassment of 
        the minor.
            (4) Sexual exploitation and abuse of minors.
            (5) Promotion and marketing of narcotic drugs (as defined 
        in section 102 of the Controlled Substances Act (21 U.S.C. 
        802)), tobacco products, gambling, or alcohol.
            (6) Predatory, unfair, or deceptive marketing practices, or 
        other financial harms.
    (b) Limitation.--Nothing in subsection (a) shall be construed to 
require a covered platform to prevent or preclude any minor from--
            (1) deliberately and independently searching for, or 
        specifically requesting, content; or
            (2) accessing resources and information regarding the 
        prevention or mitigation of the harms described in subsection 
        (a).

SEC. 103. SAFEGUARDS FOR MINORS.

    (a) Safeguards for Minors.--
            (1) Safeguards.--A covered platform shall provide a user or 
        visitor that the covered platform knows is a minor with 
        readily-accessible and easy-to-use safeguards to, as 
        applicable--
                    (A) limit the ability of other users or visitors to 
                communicate with the minor;
                    (B) prevent other users or visitors, whether 
                registered or not, from viewing the minor's personal 
                data collected by or shared on the covered platform, in 
                particular restricting public access to personal data;
                    (C) limit design features that encourage or 
                increase the frequency, time spent, or activity of 
                minors on the covered platform, such as infinite 
                scrolling, auto playing, rewards for time spent on the 
                platform, notifications, and other design features that 
                result in compulsive usage of the covered platform by 
                the minor;
                    (D) control personalized recommendation systems, 
                including the ability for a minor to have at least 1 of 
                the following options--
                            (i) opt out of such personalized 
                        recommendation systems, while still allowing 
                        the display of content based on a chronological 
                        format; or
                            (ii) limit types or categories of 
                        recommendations from such systems; and
                    (E) restrict the sharing of the geolocation of the 
                minor and provide notice regarding the tracking of the 
                minor's geolocation.
            (2) Option.--A covered platform shall provide a user that 
        the covered platform knows is a minor with a readily-accessible 
        and easy-to-use option to limit the amount of time spent by the 
        minor on the covered platform.
            (3) Default safeguard settings for minors.--A covered 
        platform shall provide that, in the case of a user or visitor 
        that the platform knows is a minor, the default setting for any 
        safeguard described under paragraph (1) shall be the option 
        available on the platform that provides the most protective 
        level of control that is offered by the platform over privacy 
        and safety for that user or visitor.
    (b) Parental Tools.--
            (1) Tools.--A covered platform shall provide readily-
        accessible and easy-to-use settings for parents to support a 
        user that the platform knows is a minor with respect to the 
        user's use of the platform.
            (2) Requirements.--The parental tools provided by a covered 
        platform shall include--
                    (A) the ability to manage a minor's privacy and 
                account settings, including the safeguards and options 
                established under subsection (a), in a manner that 
                allows parents to--
                            (i) view the privacy and account settings; 
                        and
                            (ii) in the case of a user that the 
                        platform knows is a child, change and control 
                        the privacy and account settings;
                    (B) the ability to restrict purchases and financial 
                transactions by the minor, where applicable; and
                    (C) the ability to view metrics of total time spent 
                on the covered platform and restrict time spent on the 
                covered platform by the minor.
            (3) Notice to minors.--A covered platform shall provide 
        clear and conspicuous notice to a user when the tools described 
        in this subsection are in effect and what settings or controls 
        have been applied.
            (4) Default tools.--A covered platform shall provide that, 
        in the case of a user that the platform knows is a child, the 
        tools required under paragraph (1) shall be enabled by default.
            (5) Application to existing accounts.--If, prior to the 
        effective date of this subsection, a covered platform provided 
        a parent of a user that the platform knows is a child with 
        notice and the ability to enable the parental tools described 
        under this subsection in a manner that would otherwise comply 
        with this subsection, and the parent opted out of enabling such 
        tools, the covered platform is not required to enable such 
        tools with respect to such user by default when this subsection 
        takes effect.
    (c) Reporting Mechanism.--
            (1) Reports submitted by parents, minors, and schools.--A 
        covered platform shall provide--
                    (A) a readily-accessible and easy-to-use means to 
                submit reports to the covered platform of harms to a 
                minor;
                    (B) an electronic point of contact specific to 
                matters involving harms to a minor; and
                    (C) confirmation of the receipt of such a report 
                and, within the applicable time period described in 
                paragraph (2), a substantive response to the individual 
                that submitted the report.
            (2) Timing.--A covered platform shall establish an internal 
        process to receive and substantively respond to such reports in 
        a reasonable and timely manner, but in no case later than--
                    (A) 10 days after the receipt of a report, if, for 
                the most recent calendar year, the platform averaged 
                more than 10,000,000 active users on a monthly basis in 
                the United States;
                    (B) 21 days after the receipt of a report, if, for 
                the most recent calendar year, the platform averaged 
                less than 10,000,000 active users on a monthly basis in 
                the United States; and
                    (C) notwithstanding subparagraphs (A) and (B), if 
                the report involves an imminent threat to the safety of 
                a minor, as promptly as needed to address the reported 
                threat to safety.
    (d) Advertising of Illegal Products.--A covered platform shall not 
facilitate the advertising of narcotic drugs (as defined in section 102 
of the Controlled Substances Act (21 U.S.C. 802)), tobacco products, 
gambling, or alcohol to an individual that the covered platform knows 
is a minor.
    (e) Rules of Application.--
            (1) Accessibility.--With respect to safeguards and parental 
        tools described under subsections (a) and (b), a covered 
        platform shall provide--
                    (A) information and control options in a clear and 
                conspicuous manner that takes into consideration the 
                differing ages, capacities, and developmental needs of 
                the minors most likely to access the covered platform 
                and does not encourage minors or parents to weaken or 
                disable safeguards or parental tools;
                    (B) readily-accessible and easy-to-use controls to 
                enable or disable safeguards or parental tools, as 
                appropriate; and
                    (C) information and control options in the same 
                language, form, and manner as the covered platform 
                provides the product or service used by minors and 
                their parents.
            (2) Dark patterns prohibition.--It shall be unlawful for 
        any covered platform to design, modify, or manipulate a user 
        interface of a covered platform with the purpose or substantial 
        effect of subverting or impairing user autonomy, decision-
        making, or choice with respect to safeguards or parental tools 
        required under this section.
            (3) Timing considerations.--
                    (A) No interruption to gameplay.--Subsections 
                (a)(1)(C) and (b)(3) shall not require an online video 
                game to interrupt the natural sequence of game play, 
                such as progressing through game levels or finishing a 
                competition.
                    (B) Application of changes to offline devices or 
                accounts.--If a user's device or user account does not 
                have access to the internet at the time of a change to 
                parental tools, a covered platform shall apply changes 
                the next time the device or user is connected to the 
                internet.
            (4) Rules of construction.--Nothing in this section shall 
        be construed to--
                    (A) prevent a covered platform from taking 
                reasonable measures to--
                            (i) block, detect, or prevent the 
                        distribution of unlawful, obscene, or other 
                        harmful material to minors as described in 
                        section 102(a); or
                            (ii) block or filter spam, prevent criminal 
                        activity, or protect the security of a platform 
                        or service;
                    (B) require the disclosure of a minor's browsing 
                behavior, search history, messages, contact list, or 
                other content or metadata of their communications;
                    (C) prevent a covered platform from using a 
                personalized recommendation system to display content 
                to a minor if the system only uses information on--
                            (i) the language spoken by the minor;
                            (ii) the city the minor is located in; or
                            (iii) the minor's age; or
                    (D) prevent an online video game from disclosing a 
                username or other user identification for the purpose 
                of competitive gameplay or to allow for the reporting 
                of users.
    (f) Device or Console Controls.--
            (1) In general.--Nothing in this section shall be construed 
        to prohibit a covered platform from integrating its products or 
        service with, or duplicate controls or tools provided by, 
        third-party systems, including operating systems or gaming 
        consoles, to meet the requirements imposed under subsections 
        (a) and (b) relating to safeguards for minors and parental 
        tools, provided that--
                    (A) the controls or tools meet such requirements; 
                and
                    (B) the minor or parent is provided sufficient 
                notice of the integration and use of the parental 
                tools.
            (2) Preservation of protections.--In the event of a 
        conflict between the controls or tools of a third-party system, 
        including operating systems or gaming consoles, and a covered 
        platform, the covered platform is not required to override the 
        controls or tools of a third-party system if it would undermine 
        the protections for minors from the safeguards or parental 
        tools imposed under subsections (a) and (b).

SEC. 104. DISCLOSURE.

    (a) Notice.--
            (1) Registration or purchase.--Prior to registration or 
        purchase of a covered platform by an individual that the 
        platform knows is a minor, the platform shall provide clear, 
        conspicuous, and easy-to-understand--
                    (A) notice of the policies and practices of the 
                covered platform with respect to safeguards for minors 
                required under section 103;
                    (B) information about how to access the safeguards 
                and parental tools required under section 103; and
                    (C) notice about whether the covered platform uses 
                or makes available to minors a product, service, or 
                design feature, including any personalized 
                recommendation system, that poses any heightened risk 
                of harm to minors.
            (2) Notification.--
                    (A) Notice and acknowledgment.--In the case of an 
                individual that a covered platform knows is a child, 
                the platform shall additionally provide information 
                about the parental tools and safeguards required under 
                section 103 to a parent of the child and obtain 
                verifiable consent (as defined in section 1302(9) of 
                the Children's Online Privacy Protection Act (15 U.S.C. 
                6501(9))) from the parent prior to the initial use of 
                the covered platform by the child.
                    (B) Reasonable effort.--A covered platform shall be 
                deemed to have satisfied the requirement described in 
                subparagraph (A) if the covered platform is in 
                compliance with the requirements of the Children's 
                Online Privacy Protection Act (15 U.S.C. 6501 et seq.) 
                to use reasonable efforts (taking into consideration 
                available technology) to provide a parent with the 
                information described in subparagraph (A) and to obtain 
                verifiable consent as required.
            (3) Consolidated notices.--For purposes of this subtitle, a 
        covered platform may consolidate the process for providing 
        information under this subsection and obtaining verifiable 
        consent or the consent of the minor involved (as applicable) as 
        required under this subsection with its obligations to provide 
        relevant notice and obtain verifiable consent under the 
        Children's Online Privacy Protection Act (15 U.S.C. 6501 et 
        seq.).
            (4) Guidance.--The Federal Trade Commission may issue 
        guidance to assist covered platforms in complying with the 
        specific notice requirements of this subsection.
    (b) Personalized Recommendation System.--A covered platform that 
operates a personalized recommendation system shall set out in its 
terms and conditions, in a clear, conspicuous, and easy-to-understand 
manner--
            (1) an overview of how such personalized recommendation 
        system is used by the covered platform to provide information 
        to minors, including how such systems use the personal data of 
        minors; and
            (2) information about options for minors or their parents 
        to opt out of or control the personalized recommendation system 
        (as applicable).
    (c) Advertising and Marketing Information and Labels.--
            (1) Information and labels.--A covered platform shall 
        provide clear, conspicuous, and easy-to-understand labels and 
        information, which can be provided through a link to another 
        web page or disclosure, to minors on advertisements regarding--
                    (A) the name of the product, service, or brand and 
                the subject matter of an advertisement; and
                    (B) whether particular media displayed to the minor 
                is an advertisement or marketing material, including 
                disclosure of endorsements of products, services, or 
                brands made for commercial consideration by other users 
                of the platform.
            (2) Guidance.--The Federal Trade Commission may issue 
        guidance to assist covered platforms in complying with the 
        requirements of this subsection, including guidance about the 
        minimum level of information and labels for the disclosures 
        required under paragraph (1).
    (d) Resources for Parents and Minors.--A covered platform shall 
provide to minors and parents clear, conspicuous, easy-to-understand, 
and comprehensive information in a prominent location, which may 
include a link to a web page, regarding--
            (1) its policies and practices with respect to safeguards 
        for minors required under section 103; and
            (2) how to access the safeguards and tools required under 
        section 103.
    (e) Resources in Additional Languages.--A covered platform shall 
ensure, to the extent practicable, that the disclosures required by 
this section are made available in the same language, form, and manner 
as the covered platform provides any product or service used by minors 
and their parents.

SEC. 105. TRANSPARENCY.

    (a) In General.--Subject to subsection (b), not less frequently 
than once a year, a covered platform shall issue a public report 
describing the reasonably foreseeable risks of harms to minors and 
assessing the prevention and mitigation measures taken to address such 
risk based on an independent, third-party audit conducted through 
reasonable inspection of the covered platform.
    (b) Scope of Application.--The requirements of this section shall 
apply to a covered platform if--
            (1) for the most recent calendar year, the platform 
        averaged more than 10,000,000 active users on a monthly basis 
        in the United States; and
            (2) the platform predominantly provides a community forum 
        for user-generated content and discussion, including sharing 
        videos, images, games, audio files, discussion in a virtual 
        setting, or other content, such as acting as a social media 
        platform, virtual reality environment, or a social network 
        service.
    (c) Content.--
            (1) Transparency.--The public reports required of a covered 
        platform under this section shall include--
                    (A) an assessment of the extent to which the 
                platform is likely to be accessed by minors;
                    (B) a description of the commercial interests of 
                the covered platform in use by minors;
                    (C) an accounting, based on the data held by the 
                covered platform, of--
                            (i) the number of users using the covered 
                        platform that the platform knows to be minors 
                        in the United States;
                            (ii) the median and mean amounts of time 
                        spent on the platform by users known to be 
                        minors in the United States who have accessed 
                        the platform during the reporting year on a 
                        daily, weekly, and monthly basis; and
                            (iii) the amount of content being accessed 
                        by users that the platform knows to be minors 
                        in the United States that is in English, and 
                        the top 5 non-English languages used by users 
                        accessing the platform in the United States;
                    (D) an accounting of total reports received 
                regarding, and the prevalence (which can be based on 
                scientifically valid sampling methods using the content 
                available to the covered platform in the normal course 
                of business) of content related to, the harms described 
                in section 102(a), disaggregated by category of harm 
                and language, including English and the top 5 non-
                English languages used by users accessing the platform 
                from the United States (as identified under 
                subparagraph (C)(iii)); and
                    (E) a description of any material breaches of 
                parental tools or assurances regarding minors, 
                representations regarding the use of the personal data 
                of minors, and other matters regarding non-compliance 
                with this subtitle.
            (2) Reasonably foreseeable risk of harm to minors.--The 
        public reports required of a covered platform under this 
        section shall include--
                    (A) an assessment of the reasonably foreseeable 
                risk of harms to minors posed by the covered platform, 
                specifically identifying those physical, mental, 
                developmental, or financial harms described in section 
                102(a);
                    (B) a description of whether and how the covered 
                platform uses design features that encourage or 
                increase the frequency, time spent, or activity of 
                minors on the covered platform, such as infinite 
                scrolling, auto playing, rewards for time spent on the 
                platform, notifications, and other design features that 
                result in compulsive usage of the covered platform by 
                the minor;
                    (C) a description of whether, how, and for what 
                purpose the platform collects or processes categories 
                of personal data that may cause reasonably foreseeable 
                risk of harms to minors;
                    (D) an evaluation of the efficacy of safeguards for 
                minors and parental tools under section 103, and any 
                issues in delivering such safeguards and the associated 
                parental tools;
                    (E) an evaluation of any other relevant matters of 
                public concern over risk of harms to minors associated 
                with the use of the covered platform; and
                    (F) an assessment of differences in risk of harm to 
                minors across different English and non-English 
                languages and efficacy of safeguards in those 
                languages.
            (3) Mitigation.--The public reports required of a covered 
        platform under this section shall include, for English and the 
        top 5 non-English languages used by users accessing the 
        platform from the United States (as identified under paragraph 
        (2)(C)(iii)))--
                    (A) a description of the safeguards and parental 
                tools available to minors and parents on the covered 
                platform;
                    (B) a description of interventions by the covered 
                platform when it had or has reason to believe that 
                harms to minors could occur;
                    (C) a description of the prevention and mitigation 
                measures intended to be taken in response to the known 
                and emerging risks identified in its assessment of 
                reasonably foreseeable risks of harms to minors, 
                including steps taken to--
                            (i) prevent harms to minors, including 
                        adapting or removing design features or 
                        addressing through parental tools;
                            (ii) provide the most protective level of 
                        control over privacy and safety by default; and
                            (iii) adapt recommendation systems to 
                        mitigate reasonably foreseeable risk of harms 
                        to minors, as described in section 102(a);
                    (D) a description of internal processes for 
                handling reports and automated detection mechanisms for 
                harms to minors, including the rate, timeliness, and 
                effectiveness of responses under the requirement of 
                section 103(c);
                    (E) the status of implementing prevention and 
                mitigation measures identified in prior assessments; 
                and
                    (F) a description of the additional measures to be 
                taken by the covered platform to address the 
                circumvention of safeguards for minors and parental 
                tools.
    (d) Reasonable Inspection.--In conducting an inspection of the 
reasonably foreseeable risk of harm to minors under this section, an 
independent, third-party auditor shall--
            (1) take into consideration the function of personalized 
        recommendation systems;
            (2) consult parents and youth experts, including youth and 
        families with relevant past or current experience, public 
        health and mental health nonprofit organizations, health and 
        development organizations, and civil society with respect to 
        the prevention of harms to minors;
            (3) conduct research based on experiences of minors that 
        use the covered platform, including reports under section 
        103(c) and information provided by law enforcement;
            (4) take account of research, including research regarding 
        design features, marketing, or product integrity, industry best 
        practices, or outside research;
            (5) consider indicia or inferences of age of users, in 
        addition to any self-declared information about the age of 
        users; and
            (6) take into consideration differences in risk of 
        reasonably foreseeable harms and effectiveness of safeguards 
        across English and non-English languages.
    (e) Cooperation With Independent, Third-party Audit.--To facilitate 
the report required by subsection (c), a covered platform shall--
            (1) provide or otherwise make available to the independent 
        third-party conducting the audit all information and material 
        in its possession, custody, or control that is relevant to the 
        audit;
            (2) provide or otherwise make available to the independent 
        third-party conducting the audit access to all network, 
        systems, and assets relevant to the audit; and
            (3) disclose all relevant facts to the independent third-
        party conducting the audit, and not misrepresent in any manner, 
        expressly or by implication, any relevant fact.
    (f) Privacy Safeguards.--
            (1) In general.--In issuing the public reports required 
        under this section, a covered platform shall take steps to 
        safeguard the privacy of its users, including ensuring that 
        data is presented in a de-identified, aggregated format such 
        that it is not reasonably linkable to any user.
            (2) Rule of construction.--This section shall not be 
        construed to require the disclosure of information that will 
        lead to material vulnerabilities for the privacy of users or 
        the security of a covered platform's service or create a 
        significant risk of the violation of Federal or State law.
            (3) Definition of de-identified.--As used in this 
        subsection, the term ``de-identified'' means data that does not 
        identify and is not linked or reasonably linkable to a device 
        that is linked or reasonably linkable to an individual, 
        regardless of whether the information is aggregated
    (g) Location.--The public reports required under this section 
should be posted by a covered platform on an easy to find location on a 
publicly-available website.

SEC. 106. RESEARCH ON SOCIAL MEDIA AND MINORS.

    (a) Definitions.--In this section:
            (1) Commission.--The term ``Commission'' means the Federal 
        Trade Commission.
            (2) National academy.--The term ``National Academy'' means 
        the National Academy of Sciences.
            (3) Secretary.--The term ``Secretary'' means the Secretary 
        of Health and Human Services.
    (b) Research on Social Media Harms.--Not later than 12 months after 
the date of enactment of this Act, the Commission shall seek to enter 
into a contract with the National Academy, under which the National 
Academy shall conduct no less than 5 scientific, comprehensive studies 
and reports on the risk of harms to minors by use of social media and 
other online platforms, including in English and non-English languages.
    (c) Matters to Be Addressed.--In contracting with the National 
Academy, the Commission, in consultation with the Secretary, shall seek 
to commission separate studies and reports, using the Commission's 
authority under section 6(b) of the Federal Trade Commission Act (15 
U.S.C. 46(b)), on the relationship between social media and other 
online platforms as defined in this subtitle on the following matters:
            (1) Anxiety, depression, eating disorders, and suicidal 
        behaviors.
            (2) Substance use disorders and the use of narcotic drugs, 
        tobacco products, gambling, or alcohol by minors.
            (3) Sexual exploitation and abuse.
            (4) Addiction-like use of social media and design factors 
        that lead to unhealthy and harmful overuse of social media.
    (d) Additional Study.--Not earlier than 4 years after enactment, 
the Commission shall seek to enter into a contract with the National 
Academy under which the National Academy shall conduct an additional 
study and report covering the matters described in subsection (c) for 
the purposes of providing additional information, considering new 
research, and other matters.
    (e) Content of Reports.-- The comprehensive studies and reports 
conducted pursuant to this section shall seek to evaluate impacts and 
advance understanding, knowledge, and remedies regarding the harms to 
minors posed by social media and other online platforms, and may 
include recommendations related to public policy.
    (f) Active Studies.--If the National Academy is engaged in any 
active studies on the matters described in subsection (c) at the time 
that it enters into a contract with the Commission to conduct a study 
under this section, it may base the study to be conducted under this 
section on the active study, so long as it otherwise incorporates the 
requirements of this section.
    (g) Collaboration.--In designing and conducting the studies under 
this section, the Commission, the Secretary, and the National Academy 
shall consult with the Surgeon General and the Kids Online Safety 
Council.
    (h) Access to Data.--
            (1) Fact-finding authority.--The Commission may issue 
        orders under section 6(b) of the Federal Trade Commission Act 
        (15 U.S.C. 46(b)) to require covered platforms to provide 
        reports, data, or answers in writing as necessary to conduct 
        the studies required under this section.
            (2) Scope.--In exercising its authority under paragraph 
        (1), the Commission may issue orders to no more than 5 covered 
        platforms per study under this section.
            (3) Confidential access.--Notwithstanding section 6(f) or 
        21 of the Federal Trade Commission Act (15 U.S.C. 46, 57b-2), 
        the Commission shall enter in agreements with the National 
        Academy to share appropriate information received from a 
        covered platform pursuant to an order under such subsection (b) 
        for a comprehensive study under this section in a confidential 
        and secure manner, and to prohibit the disclosure or sharing of 
        such information by the National Academy. Nothing in this 
        paragraph shall be construed to preclude the disclosure of any 
        such information if authorized or required by any other law.

SEC. 107. MARKET RESEARCH.

    (a) Market Research by Covered Platforms.--The Federal Trade 
Commission, in consultation with the Secretary of Commerce, shall issue 
guidance for covered platforms seeking to conduct market- and product-
focused research on minors. Such guidance shall include--
            (1) a standard consent form that provides minors and their 
        parents a clear, conspicuous, and easy-to-understand 
        explanation of the scope and purpose of the research to be 
        conducted that is available in English and the top 5 non-
        English languages used in the United States;
            (2) information on how to obtain informed consent from the 
        parent of a minor prior to conducting such market- and product-
        focused research; and
            (3) recommendations for research practices for studies that 
        may include minors, disaggregated by the age ranges of 0-5, 6-
        9, 10-12, and 13-16.
    (b) Timing.--The Federal Trade Commission shall issue such guidance 
not later than 18 months after the date of enactment of this Act. In 
doing so, they shall seek input from members of the public and the 
representatives of the Kids Online Safety Council established under 
section 111.

SEC. 108. AGE VERIFICATION STUDY AND REPORT.

    (a) Study.--The Secretary of Commerce, in coordination with the 
Federal Communications Commission and the Federal Trade Commission, 
shall conduct a study evaluating the most technologically feasible 
methods and options for developing systems to verify age at the device 
or operating system level.
    (b) Contents.--Such study shall consider --
            (1) the benefits of creating a device or operating system 
        level age verification system;
            (2) what information may need to be collected to create 
        this type of age verification system;
            (3) the accuracy of such systems and their impact or steps 
        to improve accessibility, including for individuals with 
        disabilities;
            (4) how such a system or systems could verify age while 
        mitigating risks to user privacy and data security and 
        safeguarding minors' personal data, emphasizing minimizing the 
        amount of data collected and processed by covered platforms and 
        age verification providers for such a system;
            (5) the technical feasibility, including the need for 
        potential hardware and software changes, including for devices 
        currently in commerce and owned by consumers; and
            (6) the impact of different age verification systems on 
        competition, particularly the risk of different age 
        verification systems creating barriers to entry for small 
        companies.
    (c) Report.--Not later than 1 year after the date of enactment of 
this Act, the agencies described in subsection (a) shall submit a 
report containing the results of the study conducted under such 
subsection to the Committee on Commerce, Science, and Transportation of 
the Senate and the Committee on Energy and Commerce of the House of 
Representatives.

SEC. 109. GUIDANCE.

    (a) In General.--Not later than 18 months after the date of 
enactment of this Act, the Federal Trade Commission, in consultation 
with the Kids Online Safety Council established under section 111, 
shall issue guidance to--
            (1) provide information and examples for covered platforms 
        and auditors regarding the following, with consideration given 
        to differences across English and non-English languages--
                    (A) identifying design features that encourage or 
                increase the frequency, time spent, or activity of 
                minors on the covered platform;
                    (B) safeguarding minors against the possible misuse 
                of parental tools;
                    (C) best practices in providing minors and parents 
                the most protective level of control over privacy and 
                safety;
                    (D) using indicia or inferences of age of users for 
                assessing use of the covered platform by minors;
                    (E) methods for evaluating the efficacy of 
                safeguards set forth in this subtitle; and
                    (F) providing additional parental tool options that 
                allow parents to address the harms described in section 
                102(a); and
            (2) outline conduct that does not have the purpose or 
        substantial effect of subverting or impairing user autonomy, 
        decision-making, or choice, or of causing, increasing, or 
        encouraging compulsive usage for a minor, such as--
                    (A) de minimis user interface changes derived from 
                testing consumer preferences, including different 
                styles, layouts, or text, where such changes are not 
                done with the purpose of weakening or disabling 
                safeguards or parental tools;
                    (B) algorithms or data outputs outside the control 
                of a covered platform; and
                    (C) establishing default settings that provide 
                enhanced privacy protection to users or otherwise 
                enhance their autonomy and decision-making ability.
    (b) Guidance on Knowledge Standard.--Not later than 18 months after 
the date of enactment of this Act, the Federal Trade Commission shall 
issue guidance to provide information, including best practices and 
examples, for covered platforms to understand how the Commission would 
determine whether a covered platform ``had knowledge fairly implied on 
the basis of objective circumstances'' for purposes of this subtitle.
    (c) Limitation on Federal Trade Commission Guidance.--
            (1) Effect of guidance.--No guidance issued by the Federal 
        Trade Commission with respect to this subtitle shall--
                    (A) confer any rights on any person, State, or 
                locality; or
                    (B) operate to bind the Federal Trade Commission or 
                any court, person, State, or locality to the approach 
                recommended in such guidance.
            (2) Use in enforcement actions.--In any enforcement action 
        brought pursuant to this subtitle, the Federal Trade Commission 
        or a State attorney general, as applicable--
                    (A) shall allege a violation of a provision of this 
                subtitle; and
                    (B) may not base such enforcement action on, or 
                execute a consent order based on, practices that are 
                alleged to be inconsistent with guidance issued by the 
                Federal Trade Commission with respect to this subtitle, 
                unless the practices are alleged to violate a provision 
                of this subtitle.
        For purposes of enforcing this subtitle, State attorneys 
        general shall take into account any guidance issued by the 
        Commission under subsection (b).

SEC. 110. ENFORCEMENT.

    (a) Enforcement by Federal Trade Commission.--
            (1) Unfair and deceptive acts or practices.--A violation of 
        this subtitle shall be treated as a violation of a rule 
        defining an unfair or deceptive act or practice prescribed 
        under section 18(a)(1)(B) of the Federal Trade Commission Act 
        (15 U.S.C. 57a(a)(1)(B)).
            (2) Powers of the commission.--
                    (A) In general.--The Federal Trade Commission 
                (referred to in this section as the ``Commission'') 
                shall enforce this subtitle in the same manner, by the 
                same means, and with the same jurisdiction, powers, and 
                duties as though all applicable terms and provisions of 
                the Federal Trade Commission Act (15 U.S.C. 41 et seq.) 
                were incorporated into and made a part of this 
                subtitle.
                    (B) Privileges and immunities.--Any person that 
                violates this subtitle shall be subject to the 
                penalties, and entitled to the privileges and 
                immunities, provided in the Federal Trade Commission 
                Act (15 U.S.C. 41 et seq.).
            (3) Authority preserved.--Nothing in this subtitle shall be 
        construed to limit the authority of the Commission under any 
        other provision of law.
    (b) Enforcement by State Attorneys General.--
            (1) In general.--
                    (A) Civil actions.--In any case in which the 
                attorney general of a State has reason to believe that 
                a covered platform has violated or is violating section 
                103, 104, or 105, the State, as parens patriae, may 
                bring a civil action on behalf of the residents of the 
                State in a district court of the United States or a 
                State court of appropriate jurisdiction to--
                            (i) enjoin any practice that violates 
                        section 103, 104, or 105;
                            (ii) enforce compliance with section 103, 
                        104, or 105;
                            (iii) on behalf of residents of the State, 
                        obtain damages, restitution, or other 
                        compensation, each of which shall be 
                        distributed in accordance with State law; or
                            (iv) obtain such other relief as the court 
                        may consider to be appropriate.
                    (B) Notice.--
                            (i) In general.--Before filing an action 
                        under subparagraph (A), the attorney general of 
                        the State involved shall provide to the 
                        Commission--
                                    (I) written notice of that action; 
                                and
                                    (II) a copy of the complaint for 
                                that action.
                            (ii) Exemption.--
                                    (I) In general.--Clause (i) shall 
                                not apply with respect to the filing of 
                                an action by an attorney general of a 
                                State under this paragraph if the 
                                attorney general of the State 
                                determines that it is not feasible to 
                                provide the notice described in that 
                                clause before the filing of the action.
                                    (II) Notification.--In an action 
                                described in subclause (I), the 
                                attorney general of a State shall 
                                provide notice and a copy of the 
                                complaint to the Commission at the same 
                                time as the attorney general files the 
                                action.
            (2) Intervention.--
                    (A) In general.--On receiving notice under 
                paragraph (1)(B), the Commission shall have the right 
                to intervene in the action that is the subject of the 
                notice.
                    (B) Effect of intervention.--If the Commission 
                intervenes in an action under paragraph (1), it shall 
                have the right--
                            (i) to be heard with respect to any matter 
                        that arises in that action; and
                            (ii) to file a petition for appeal.
            (3) Construction.--For purposes of bringing any civil 
        action under paragraph (1), nothing in this subtitle shall be 
        construed to prevent an attorney general of a State from 
        exercising the powers conferred on the attorney general by the 
        laws of that State to--
                    (A) conduct investigations;
                    (B) administer oaths or affirmations; or
                    (C) compel the attendance of witnesses or the 
                production of documentary and other evidence.
            (4) Actions by the commission.--In any case in which an 
        action is instituted by or on behalf of the Commission for 
        violation of this subtitle, no State may, during the pendency 
        of that action, institute a separate action under paragraph (1) 
        against any defendant named in the complaint in the action 
        instituted by or on behalf of the Commission for that 
        violation.
            (5) Venue; service of process.--
                    (A) Venue.--Any action brought under paragraph (1) 
                may be brought in--
                            (i) the district court of the United States 
                        that meets applicable requirements relating to 
                        venue under section 1391 of title 28, United 
                        States Code; or
                            (ii) a State court of competent 
                        jurisdiction.
                    (B) Service of process.--In an action brought under 
                paragraph (1) in a district court of the United States, 
                process may be served wherever defendant--
                            (i) is an inhabitant; or
                            (ii) may be found.
            (6) Limitation.--A violation of section 102 shall not form 
        the basis of liability in any action brought by the attorney 
        general of a State under a State law.

SEC. 111. KIDS ONLINE SAFETY COUNCIL.

    (a) Establishment.--Not later than 180 days after the date of 
enactment of this Act, the Secretary of Commerce shall establish and 
convene the Kids Online Safety Council for the purpose of providing 
advice on matters related to this subtitle.
    (b) Participation.--The Kids Online Safety Council shall include 
diverse participation from--
            (1) academic experts, health professionals, and members of 
        civil society with expertise in mental health, substance use 
        disorders, and the prevention of harms to minors;
            (2) representatives in academia and civil society with 
        specific expertise in privacy, free expression, access to 
        information, and civil liberties;
            (3) parents and youth representation;
            (4) representatives of covered platforms;
            (5) representatives of the National Telecommunications and 
        Information Administration, the National Institute of Standards 
        and Technology, the Federal Trade Commission, the Department of 
        Justice, and the Department of Health and Human Services;
            (6) State attorneys general or their designees acting in 
        State or local government;
            (7) educators; and
            (8) representatives of communities of socially 
        disadvantaged individuals (as defined in section 8 of the Small 
        Business Act (15 U.S.C. 637)).
    (c) Activities.--The matters to be addressed by the Kids Online 
Safety Council shall include--
            (1) identifying emerging or current risks of harms to 
        minors associated with online platforms;
            (2) recommending measures and methods for assessing, 
        preventing, and mitigating harms to minors online;
            (3) recommending methods and themes for conducting research 
        regarding online harms to minors, including in English and non-
        English languages; and
            (4) recommending best practices and clear, consensus-based 
        technical standards for transparency reports and audits, as 
        required under this subtitle, including methods, criteria, and 
        scope to promote overall accountability.
    (d) Non-applicability of FACA.--The Kids Online Safety Council 
shall not be subject to chapter 10 of title 5, United States Code 
(commonly referred to as the ``Federal Advisory Committee Act'').

SEC. 112. EFFECTIVE DATE.

    Except as otherwise provided in this subtitle, this subtitle shall 
take effect on the date that is 18 months after the date of enactment 
of this Act.

SEC. 113. RULES OF CONSTRUCTION AND OTHER MATTERS.

    (a) Relationship to Other Laws.--Nothing in this subtitle shall be 
construed to--
            (1) preempt section 444 of the General Education Provisions 
        Act (20 U.S.C. 1232g, commonly known as the ``Family 
        Educational Rights and Privacy Act of 1974'') or other Federal 
        or State laws governing student privacy;
            (2) preempt the Children's Online Privacy Protection Act of 
        1998 (15 U.S.C. 6501 et seq.) or any rule or regulation 
        promulgated under such Act;
            (3) authorize any action that would conflict with section 
        18(h) of the Federal Trade Commission Act (15 U.S.C. 57a(h)); 
        or
            (4) expand or limit the scope of section 230 of the 
        Communications Act of 1934 (commonly known as ``section 230 of 
        the Communications Decency Act of 1996'') (47 U.S.C. 230).
    (b) Determination of ``Fairly Implied on the Basis of Objective 
Circumstances''.--For purposes of enforcing this subtitle, in making a 
determination as to whether covered platform has knowledge fairly 
implied on the basis of objective circumstances that a specific user is 
a minor, the Federal Trade Commission or a State attorney general shall 
rely on competent and reliable evidence, taking into account the 
totality of the circumstances, including whether a reasonable and 
prudent person under the circumstances would have known that the user 
is a minor.
    (c) Protections for Privacy.--Nothing in this subtitle, including a 
determination described in subsection (b), shall be construed to 
require--
            (1) the affirmative collection of any personal data with 
        respect to the age of users that a covered platform is not 
        already collecting in the normal course of business; or
            (2) a covered platform to implement an age gating or age 
        verification functionality.
    (d) Compliance.--Nothing in this subtitle shall be construed to 
restrict a covered platform's ability to--
            (1) cooperate with law enforcement agencies regarding 
        activity that the covered platform reasonably and in good faith 
        believes may violate Federal, State, or local laws, rules, or 
        regulations;
            (2) comply with a lawful civil, criminal, or regulatory 
        inquiry, subpoena, or summons by Federal, State, local, or 
        other government authorities; or
            (3) investigate, establish, exercise, respond to, or defend 
        against legal claims.
    (e) Application to Video Streaming Services.--A video streaming 
service shall be deemed to be in compliance with this subtitle if it 
predominantly consists of news, sports, entertainment, or other video 
programming content that is preselected by the provider and not user-
generated, and--
            (1) any chat, comment, or interactive functionality is 
        provided incidental to, directly related to, or dependent on 
        provision of such content;
            (2) if such video streaming service requires account owner 
        registration and is not predominantly news or sports, the 
        service includes the capability--
                    (A) to limit a minor's access to the service, which 
                may utilize a system of age-rating;
                    (B) to limit the automatic playing of on-demand 
                content selected by a personalized recommendation 
                system for an individual that the service knows is a 
                minor;
                    (C) for a parent to manage a minor's privacy and 
                account settings, and restrict purchases and financial 
                transactions by a minor, where applicable;
                    (D) to provide an electronic point of contact 
                specific to matters described in this paragraph;
                    (E) to offer a clear, conspicuous, and easy-to-
                understand notice of its policies and practices with 
                respect to the capabilities described in this 
                paragraph; and
                    (F) when providing on-demand content, to employ 
                measures that safeguard against serving advertising for 
                narcotic drugs (as defined in section 102 of the 
                Controlled Substances Act (21 U.S.C. 802)), tobacco 
                products, gambling, or alcohol directly to the account 
                or profile of an individual that the service knows is a 
                minor.

                 Subtitle B--Filter Bubble Transparency

SEC. 120. DEFINITIONS.

    In this subtitle:
            (1) Algorithmic ranking system.--The term ``algorithmic 
        ranking system'' means a computational process, including one 
        derived from algorithmic decision-making, machine learning, 
        statistical analysis, or other data processing or artificial 
        intelligence techniques, used to determine the selection, 
        order, relative prioritization, or relative prominence of 
        content from a set of information that is provided to a user on 
        an online platform, including the ranking of search results, 
        the provision of content recommendations, the display of social 
        media posts, or any other method of automated content 
        selection.
            (2) Approximate geolocation information.--The term 
        ``approximate geolocation information'' means information that 
        identifies the location of an individual, but with a precision 
        of less than 5 miles.
            (3) Commission.--The term ``Commission'' means the Federal 
        Trade Commission.
            (4) Connected device.--The term ``connected device'' means 
        an electronic device that--
                    (A) is capable of connecting to the internet, 
                either directly or indirectly through a network, to 
                communicate information at the direction of an 
                individual;
                    (B) has computer processing capabilities for 
                collecting, sending, receiving, or analyzing data; and
                    (C) is primarily designed for or marketed to 
                consumers.
            (5) Input-transparent algorithm.--
                    (A) In general.--The term ``input-transparent 
                algorithm'' means an algorithmic ranking system that 
                does not use the user-specific data of a user to 
                determine the selection, order, relative 
                prioritization, or relative prominence of information 
                that is furnished to such user on an online platform, 
                unless the user-specific data is expressly provided to 
                the platform by the user for such purpose.
                    (B) Data expressly provided to the platform.--For 
                purposes of subparagraph (A), user-specific data that 
                is provided by a user for the express purpose of 
                determining the selection, order, relative 
                prioritization, or relative prominence of information 
                that is furnished to such user on an online platform--
                            (i) shall include user-supplied search 
                        terms, filters, speech patterns (if provided 
                        for the purpose of enabling the platform to 
                        accept spoken input or selecting the language 
                        in which the user interacts with the platform), 
                        saved preferences, the resumption of a previous 
                        search, and the current precise geolocation 
                        information that is supplied by the user;
                            (ii) shall include the user's current 
                        approximate geolocation information;
                            (iii) shall include data submitted to the 
                        platform by the user that expresses the user's 
                        desire to receive particular information, such 
                        as the social media profiles the user follows, 
                        the video channels the user subscribes to, or 
                        other content or sources of content on the 
                        platform the user has selected;
                            (iv) shall not include the history of the 
                        user's connected device, including the user's 
                        history of web searches and browsing, previous 
                        geographical locations, physical activity, 
                        device interaction, and financial transactions; 
                        and
                            (v) shall not include inferences about the 
                        user or the user's connected device, without 
                        regard to whether such inferences are based on 
                        data described in clause (i) or (iii).
            (6) Online platform.--The term ``online platform'' means 
        any public-facing website, online service, online application, 
        or mobile application that predominantly provides a community 
        forum for user-generated content, such as sharing videos, 
        images, games, audio files, or other content, including a 
        social media service, social network, or virtual reality 
        environment.
            (7) Opaque algorithm.--
                    (A) In general.--The term ``opaque algorithm'' 
                means an algorithmic ranking system that determines the 
                selection, order, relative prioritization, or relative 
                prominence of information that is furnished to such 
                user on an online platform based, in whole or part, on 
                user-specific data that was not expressly provided by 
                the user to the platform for such purpose.
                    (B) Exception for age-appropriate content 
                filters.--Such term shall not include an algorithmic 
                ranking system used by an online platform if--
                            (i) the only user-specific data (including 
                        inferences about the user) that the system uses 
                        is information relating to the age of the user; 
                        and
                            (ii) such information is only used to 
                        restrict a user's access to content on the 
                        basis that the individual is not old enough to 
                        access such content.
            (8) Precise geolocation information.--The term ``precise 
        geolocation information'' means geolocation information that 
        identifies an individual's location to within a range of 5 
        miles or less.
            (9) User-specific data.--The term ``user-specific data'' 
        means information relating to an individual or a specific 
        connected device that would not necessarily be true of every 
        individual or device.

SEC. 121. REQUIREMENT TO ALLOW USERS TO SEE UNMANIPULATED CONTENT ON 
              INTERNET PLATFORMS.

    (a) In General.--Beginning on the date that is 1 year after the 
date of enactment of this Act, it shall be unlawful for any person to 
operate an online platform that uses an opaque algorithm unless the 
person complies with the requirements of subsection (b).
    (b) Opaque Algorithm Requirements.--
            (1) In general.--The requirements of this subsection with 
        respect to a person that operates an online platform that uses 
        an opaque algorithm are the following:
                    (A) The person provides users of the platform with 
                the following notices:
                            (i) Notice that the platform uses an opaque 
                        algorithm that uses user-specific data to 
                        select the content the user sees. Such notice 
                        shall be presented in a clear and conspicuous 
                        manner on the platform whenever the user 
                        interacts with an opaque algorithm for the 
                        first time, and may be a one-time notice that 
                        can be dismissed by the user.
                            (ii) Notice, to be included in the terms 
                        and conditions of the online platform, in a 
                        clear, accessible, and easily comprehensible 
                        manner that is to be updated whenever the 
                        online platform makes a material change, of--
                                    (I) the most salient features, 
                                inputs, and parameters used by the 
                                algorithm;
                                    (II) how any user-specific data 
                                used by the algorithm is collected or 
                                inferred about a user of the platform, 
                                and the categories of such data;
                                    (III) any options that the online 
                                platform makes available for a user of 
                                the platform to opt out or exercise 
                                options under subparagraph (B), modify 
                                the profile of the user or to influence 
                                the features, inputs, or parameters 
                                used by the algorithm; and
                                    (IV) any quantities, such as time 
                                spent using a product or specific 
                                measures of engagement or social 
                                interaction, that the algorithm is 
                                designed to optimize, as well as a 
                                general description of the relative 
                                importance of each quantity for such 
                                ranking.
                    (B) The online platform enables users to easily 
                switch between the opaque algorithm and an input-
                transparent algorithm in their use of the platform.
            (2) Rule of construction.--Nothing in this subsection shall 
        be construed to require an online platform to disclose any 
        information, including data or algorithms--
                    (A) relating to a trade secret or other protected 
                intellectual property;
                    (B) that is confidential business information; or
                    (C) that is privileged.
            (3) Prohibition on differential pricing.--An online 
        platform shall not deny, charge different prices or rates for, 
        or condition the provision of a service or product to a user 
        based on the user's election to use an input-transparent 
        algorithm in their use of the platform, as provided under 
        paragraph (1)(B).
    (c) Enforcement by Federal Trade Commission.--
            (1) Unfair or deceptive acts or practices.--A violation of 
        this section by an operator of an online platform shall be 
        treated as a violation of a rule defining an unfair or 
        deceptive act or practice prescribed under section 18(a)(1)(B) 
        of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
            (2) Powers of commission.--
                    (A) In general.--The Federal Trade Commission shall 
                enforce this section in the same manner, by the same 
                means, and with the same jurisdiction, powers, and 
                duties as though all applicable terms and provisions of 
                the Federal Trade Commission Act (15 U.S.C. 41 et seq.) 
                were incorporated into and made a part of this section.
                    (B) Privileges and immunities.--Any person who 
                violates this section shall be subject to the penalties 
                and entitled to the privileges and immunities provided 
                in the Federal Trade Commission Act (15 U.S.C. 41 et 
                seq.).
                    (C) Authority preserved.--Nothing in this section 
                shall be construed to limit the authority of the 
                Commission under any other provision of law.
    (d) Rule of Construction to Preserve Personalized Blocks.--Nothing 
in this section shall be construed to limit or prohibit an online 
platform's ability to, at the direction of an individual user or group 
of users, restrict another user from searching for, finding, accessing, 
or interacting with such user's or group's account, content, data, or 
online community.

          Subtitle C--Relationship to State Laws; Severability

SEC. 130. RELATIONSHIP TO STATE LAWS.

    The provisions of this title shall preempt any State law, rule, or 
regulation only to the extent that such State law, rule, or regulation 
conflicts with a provision of this title. Nothing in this title shall 
be construed to prohibit a State from enacting a law, rule, or 
regulation that provides greater protection to minors than the 
protection provided by the provisions of this title.

SEC. 131. SEVERABILITY.

    If any provision of this title, or an amendment made by this title, 
is determined to be unenforceable or invalid, the remaining provisions 
of this title and the amendments made by this title shall not be 
affected.

              TITLE II--CHILDREN AND TEEN'S ONLINE PRIVACY

SEC. 201. ONLINE COLLECTION, USE, DISCLOSURE, AND DELETION OF PERSONAL 
              INFORMATION OF CHILDREN AND TEENS.

    (a) Definitions.--Section 1302 of the Children's Online Privacy 
Protection Act of 1998 (15 U.S.C. 6501) is amended--
            (1) by amending paragraph (2) to read as follows:
            ``(2) Operator.--The term `operator'--
                    ``(A) means any person--
                            ``(i) who, for commercial purposes, in 
                        interstate or foreign commerce operates or 
                        provides a website on the internet, an online 
                        service, an online application, or a mobile 
                        application; and
                            ``(ii) who--
                                    ``(I) collects or maintains, either 
                                directly or through a service provider, 
                                personal information from or about the 
                                users of that website, service, or 
                                application;
                                    ``(II) allows another person to 
                                collect personal information directly 
                                from users of that website, service, or 
                                application (in which case, the 
                                operator is deemed to have collected 
                                the information); or
                                    ``(III) allows users of that 
                                website, service, or application to 
                                publicly disclose personal information 
                                (in which case, the operator is deemed 
                                to have collected the information); and
                    ``(B) does not include any nonprofit entity that 
                would otherwise be exempt from coverage under section 5 
                of the Federal Trade Commission Act (15 U.S.C. 45).'';
            (2) in paragraph (4)--
                    (A) by amending subparagraph (A) to read as 
                follows:
                    ``(A) the release of personal information collected 
                from a child or teen by an operator for any purpose, 
                except where the personal information is provided to a 
                person other than an operator who--
                            ``(i) provides support for the internal 
                        operations of the website, online service, 
                        online application, or mobile application of 
                        the operator, excluding any activity relating 
                        to individual-specific advertising to children 
                        or teens; and
                            ``(ii) does not disclose or use that 
                        personal information for any other purpose; 
                        and''; and
                    (B) in subparagraph (B)--
                            (i) by inserting ``or teen'' after 
                        ``child'' each place the term appears;
                            (ii) by striking ``website or online 
                        service'' and inserting ``website, online 
                        service, online application, or mobile 
                        application''; and
                            (iii) by striking ``actual knowledge'' and 
                        inserting ``actual knowledge or knowledge 
                        fairly implied on the basis of objective 
                        circumstances'';
            (3) by striking paragraph (8) and inserting the following:
            ``(8) Personal information.--
                    ``(A) In general.--The term `personal information' 
                means individually identifiable information about an 
                individual collected online, including--
                            ``(i) a first and last name;
                            ``(ii) a home or other physical address 
                        including street name and name of a city or 
                        town;
                            ``(iii) an e-mail address;
                            ``(iv) a telephone number;
                            ``(v) a Social Security number;
                            ``(vi) any other identifier that the 
                        Commission determines permits the physical or 
                        online contacting of a specific individual;
                            ``(vii) a persistent identifier that can be 
                        used to recognize a specific child or teen over 
                        time and across different websites, online 
                        services, online applications, or mobile 
                        applications, including but not limited to a 
                        customer number held in a cookie, an Internet 
                        Protocol (IP) address, a processor or device 
                        serial number, or unique device identifier, but 
                        excluding an identifier that is used by an 
                        operator solely for providing support for the 
                        internal operations of the website, online 
                        service, online application, or mobile 
                        application;
                            ``(viii) a photograph, video, or audio file 
                        where such file contains a specific child's or 
                        teen's image or voice;
                            ``(ix) geolocation information;
                            ``(x) information generated from the 
                        measurement or technological processing of an 
                        individual's biological, physical, or 
                        physiological characteristics that is used to 
                        identify an individual, including--
                                    ``(I) fingerprints;
                                    ``(II) voice prints;
                                    ``(III) iris or retina imagery 
                                scans;
                                    ``(IV) facial templates;
                                    ``(V) deoxyribonucleic acid (DNA) 
                                information; or
                                    ``(VI) gait; or
                            ``(xi) information linked or reasonably 
                        linkable to a child or teen or the parents of 
                        that child or teen (including any unique 
                        identifier) that an operator collects online 
                        from the child or teen and combines with an 
                        identifier described in this subparagraph.
                    ``(B) Exclusion.--The term `personal information' 
                shall not include an audio file that contains a child's 
                or teen's voice so long as the operator--
                            ``(i) does not request information via 
                        voice that would otherwise be considered 
                        personal information under this paragraph;
                            ``(ii) provides clear notice of its 
                        collection and use of the audio file and its 
                        deletion policy in its privacy policy;
                            ``(iii) only uses the voice within the 
                        audio file solely as a replacement for written 
                        words, to perform a task, or engage with a 
                        website, online service, online application, or 
                        mobile application, such as to perform a search 
                        or fulfill a verbal instruction or request; and
                            ``(iv) only maintains the audio file long 
                        enough to complete the stated purpose and then 
                        immediately deletes the audio file and does not 
                        make any other use of the audio file prior to 
                        deletion.
                    ``(C) Support for the internal operations of a 
                website, online service, online application, or mobile 
                application.--
                            ``(i) In general.--For purposes of 
                        subparagraph (A)(vii), the term `support for 
                        the internal operations of a website, online 
                        service, online application, or mobile 
                        application' means those activities necessary 
                        to--
                                    ``(I) maintain or analyze the 
                                functioning of the website, online 
                                service, online application, or mobile 
                                application;
                                    ``(II) perform network 
                                communications;
                                    ``(III) authenticate users of, or 
                                personalize the content on, the 
                                website, online service, online 
                                application, or mobile application;
                                    ``(IV) serve contextual 
                                advertising, provided that any 
                                persistent identifier is only used as 
                                necessary for technical purposes to 
                                serve the contextual advertisement, or 
                                cap the frequency of advertising;
                                    ``(V) protect the security or 
                                integrity of the user, website, online 
                                service, online application, or mobile 
                                application;
                                    ``(VI) ensure legal or regulatory 
                                compliance, or
                                    ``(VII) fulfill a request of a 
                                child or teen as permitted by 
                                subparagraphs (A) through (C) of 
                                section 1303(b)(2).
                            ``(ii) Condition.--Except as specifically 
                        permitted under clause (i), information 
                        collected for the activities listed in clause 
                        (i) cannot be used or disclosed to contact a 
                        specific individual, including through 
                        individual-specific advertising to children or 
                        teens, to amass a profile on a specific 
                        individual, in connection with processes that 
                        encourage or prompt use of a website or online 
                        service, or for any other purpose.'';
            (4) by amending paragraph (9) to read as follows:
            ``(9) Verifiable consent.--The term `verifiable consent' 
        means any reasonable effort (taking into consideration 
        available technology), including a request for authorization 
        for future collection, use, and disclosure described in the 
        notice, to ensure that, in the case of a child, a parent of the 
        child, or, in the case of a teen, the teen--
                    ``(A) receives direct notice of the personal 
                information collection, use, and disclosure practices 
                of the operator; and
                    ``(B) before the personal information of the child 
                or teen is collected, freely and unambiguously 
                authorizes--
                            ``(i) the collection, use, and disclosure, 
                        as applicable, of that personal information; 
                        and
                            ``(ii) any subsequent use of that personal 
                        information.'';
            (5) in paragraph (10)--
                    (A) in the paragraph header, by striking ``Website 
                or online service directed to children'' and inserting 
                ``Website, online service, online application, or 
                mobile application directed to children'';
                    (B) by striking ``website or online service'' each 
                place it appears and inserting ``website, online 
                service, online application, or mobile application''; 
                and
                    (C) by adding at the end the following new 
                subparagraph:
                    ``(C) Rule of construction.--In considering whether 
                a website, online service, online application, or 
                mobile application, or portion thereof, is directed to 
                children, the Commission shall apply a totality of 
                circumstances test and will also consider competent and 
                reliable empirical evidence regarding audience 
                composition and evidence regarding the intended 
                audience of the website, online service, online 
                application, or mobile application.''; and
            (6) by adding at the end the following:
            ``(13) Connected device.--The term `connected device' means 
        a device that is capable of connecting to the internet, 
        directly or indirectly, or to another connected device.
            ``(14) Online application.--The term `online application'--
                    ``(A) means an internet-connected software program; 
                and
                    ``(B) includes a service or application offered via 
                a connected device.
            ``(15) Mobile application.--The term `mobile application'--
                    ``(A) means a software program that runs on the 
                operating system of--
                            ``(i) a cellular telephone;
                            ``(ii) a tablet computer; or
                            ``(iii) a similar portable computing device 
                        that transmits data over a wireless connection; 
                        and
                    ``(B) includes a service or application offered via 
                a connected device.
            ``(16) Geolocation information.--The term `geolocation 
        information' means information sufficient to identify a street 
        name and name of a city or town.
            ``(17) Teen.--The term `teen' means an individual who has 
        attained age 13 and is under the age of 17.
            ``(18) Individual-specific advertising to children or 
        teens.--
                    ``(A) In general.--The term `individual-specific 
                advertising to children or teens' means advertising or 
                any other effort to market a product or service that is 
                directed to a specific child or teen or a connected 
                device that is linked or reasonably linkable to a child 
                or teen based on--
                            ``(i) the personal information from--
                                    ``(I) the child or teen; or
                                    ``(II) a group of children or teens 
                                who are similar in sex, age, household 
                                income level, race, or ethnicity to the 
                                specific child or teen to whom the 
                                product or service is marketed;
                            ``(ii) profiling of a child or teen or 
                        group of children or teens; or
                            ``(iii) a unique identifier of the 
                        connected device.
                    ``(B) Exclusions.--The term `individual-specific 
                advertising to children or teens' shall not include--
                            ``(i) advertising or marketing to an 
                        individual or the device of an individual in 
                        response to the individual's specific request 
                        for information or feedback, such as a child's 
                        or teen's current search query;
                            ``(ii) contextual advertising, such as when 
                        an advertisement is displayed based on the 
                        content of the website, online service, online 
                        application, mobile application, or connected 
                        device in which the advertisement appears and 
                        does not vary based on personal information 
                        related to the viewer; or
                            ``(iii) processing personal information 
                        solely for measuring or reporting advertising 
                        or content performance, reach, or frequency, 
                        including independent measurement.
                    ``(C) Rule of construction.--Nothing in 
                subparagraph (A) shall be construed to prohibit an 
                operator with actual knowledge or knowledge fairly 
                implied on the basis of objective circumstances that a 
                user is under the age of 17 from delivering advertising 
                or marketing that is age-appropriate and intended for a 
                child or teen audience, so long as the operator does 
                not use any personal information other than whether the 
                user is under the age of 17.''.
    (b) Online Collection, Use, Disclosure, and Deletion of Personal 
Information of Children and Teens.--Section 1303 of the Children's 
Online Privacy Protection Act of 1998 (15 U.S.C. 6502) is amended--
            (1) by striking the heading and inserting the following: 
        ``online collection, use, disclosure, and deletion of personal 
        information of children and teens.'';
            (2) in subsection (a)--
                    (A) by amending paragraph (1) to read as follows:
            ``(1) In general.--It is unlawful for an operator of a 
        website, online service, online application, or mobile 
        application directed to children or for any operator of a 
        website, online service, online application, or mobile 
        application with actual knowledge or knowledge fairly implied 
        on the basis of objective circumstances that a user is a child 
        or teen--
                    ``(A) to collect personal information from a child 
                or teen in a manner that violates the regulations 
                prescribed under subsection (b);
                    ``(B) except as provided in subparagraphs (B) and 
                (C) of section 1302(18), to collect, use, disclose to 
                third parties, or maintain personal information of a 
                child or teen for purposes of individual-specific 
                advertising to children or teens (or to allow another 
                person to collect, use, disclose, or maintain such 
                information for such purpose);
                    ``(C) to collect the personal information of a 
                child or teen except when the collection of the 
                personal information is--
                            ``(i) consistent with the context of a 
                        particular transaction or service or the 
                        relationship of the child or teen with the 
                        operator, including collection necessary to 
                        fulfill a transaction or provide a product or 
                        service requested by the child or teen; or
                            ``(ii) required or specifically authorized 
                        by Federal or State law; or
                    ``(D) to store or transfer the personal information 
                of a child or teen outside of the United States unless 
                the operator provides direct notice to the parent of 
                the child, in the case of a child, or to the teen, in 
                the case of a teen, that the child's or teen's personal 
                information is being stored or transferred outside of 
                the United States; or
                    ``(E) to retain the personal information of a child 
                or teen for longer than is reasonably necessary to 
                fulfill a transaction or provide a service requested by 
                the child or teen except as required or specifically 
                authorized by Federal or State law.''; and
                    (B) in paragraph (2)--
                            (i) in the header, by striking ``parent'' 
                        and inserting ```parent or teen'''
                            (ii) by striking ``Notwithstanding 
                        paragraph (1)'' and inserting ``Notwithstanding 
                        paragraph (1)(A)'';
                            (iii) by striking ``of such a website or 
                        online service''; and
                            (iv) by striking ``subsection 
                        (b)(1)(B)(iii) to the parent of a child'' and 
                        inserting ``subsection (b)(1)(B)(iv) to the 
                        parent of a child or under subsection 
                        (b)(1)(C)(iv) to a teen'';
            (3) in subsection (b)--
                    (A) in paragraph (1)--
                            (i) in subparagraph (A)--
                                    (I) by striking ``operator of any 
                                website'' and all that follows through 
                                ``from a child'' and inserting 
                                ``operator of a website, online 
                                service, online application, or mobile 
                                application directed to children or 
                                that has actual knowledge or knowledge 
                                fairly implied on the basis of 
                                objective circumstances that a user is 
                                a child or teen'';
                                    (II) in clause (i)--
                                            (aa) by striking ``notice 
                                        on the website'' and inserting 
                                        ``clear and conspicuous notice 
                                        on the website'';
                                            (bb) by inserting ``or 
                                        teens'' after ``children'';
                                            (cc) by striking ``, and 
                                        the operator's'' and inserting 
                                        ``, the operator's''; and
                                            (dd) by striking ``; and'' 
                                        and inserting ``, the rights 
                                        and opportunities available to 
                                        the parent of the child or teen 
                                        under subparagraphs (B) and 
                                        (C), and the procedures or 
                                        mechanisms the operator uses to 
                                        ensure that personal 
                                        information is not collected 
                                        from children or teens except 
                                        in accordance with the 
                                        regulations promulgated under 
                                        this paragraph;'';
                                    (III) in clause (ii)--
                                            (aa) by striking 
                                        ``parental'';
                                            (bb) by inserting ``or 
                                        teens'' after ``children'';
                                            (cc) by striking the 
                                        semicolon at the end and 
                                        inserting ``; and''; and
                                    (IV) by inserting after clause (ii) 
                                the following new clause:
                            ``(iii) to obtain verifiable consent from a 
                        parent of a child or from a teen before using 
                        or disclosing personal information of the child 
                        or teen for any purpose that is a material 
                        change from the original purposes and 
                        disclosure practices specified to the parent of 
                        the child or the teen under clause (i);'';
                            (ii) in subparagraph (B)--
                                    (I) in the matter preceding clause 
                                (i), by striking ``website or online 
                                service'' and inserting ``operator'';
                                    (II) in clause (i), by inserting 
                                ``and the method by which the operator 
                                obtained the personal information, and 
                                the purposes for which the operator 
                                collects, uses, discloses, and retains 
                                the personal information'' before the 
                                semicolon;
                                    (III) in clause (ii)--
                                            (aa) by inserting ``to 
                                        delete personal information 
                                        collected from the child or 
                                        content or information 
                                        submitted by the child to a 
                                        website, online service, online 
                                        application, or mobile 
                                        application and'' after ``the 
                                        opportunity at any time''; and
                                            (bb) by striking ``; and'' 
                                        and inserting a semicolon;
                                    (IV) by redesignating clause (iii) 
                                as clause (iv) and inserting after 
                                clause (ii) the following new clause:
                            ``(iii) the opportunity to challenge the 
                        accuracy of the personal information and, if 
                        the parent of the child establishes the 
                        inaccuracy of the personal information, to have 
                        the inaccurate personal information 
                        corrected;''; and
                                    (V) in clause (iv), as so 
                                redesignated, by inserting ``, if such 
                                information is available to the 
                                operator at the time the parent makes 
                                the request'' before the semicolon;
                            (iii) by redesignating subparagraphs (C) 
                        and (D) as subparagraphs (D) and (E), 
                        respectively;
                            (iv) by inserting after subparagraph (B) 
                        the following new subparagraph:
                    ``(C) require the operator to provide, upon the 
                request of a teen under this subparagraph who has 
                provided personal information to the operator, upon 
                proper identification of that teen--
                            ``(i) a description of the specific types 
                        of personal information collected from the teen 
                        by the operator, the method by which the 
                        operator obtained the personal information, and 
                        the purposes for which the operator collects, 
                        uses, discloses, and retains the personal 
                        information;
                            ``(ii) the opportunity at any time to 
                        delete personal information collected from the 
                        teen or content or information submitted by the 
                        teen to a website, online service, online 
                        application, or mobile application and to 
                        refuse to permit the operator's further use or 
                        maintenance in retrievable form, or online 
                        collection, of personal information from the 
                        teen;
                            ``(iii) the opportunity to challenge the 
                        accuracy of the personal information and, if 
                        the teen establishes the inaccuracy of the 
                        personal information, to have the inaccurate 
                        personal information corrected; and
                            ``(iv) a means that is reasonable under the 
                        circumstances for the teen to obtain any 
                        personal information collected from the teen, 
                        if such information is available to the 
                        operator at the time the teen makes the 
                        request;'';
                            (v) in subparagraph (D), as so 
                        redesignated--
                                    (I) by striking ``a child's'' and 
                                inserting ``a child's or teen's''; and
                                    (II) by inserting ``or teen'' after 
                                ``the child''; and
                            (vi) by amending subparagraph (E), as so 
                        redesignated, to read as follows:
                    ``(E) require the operator to establish, implement, 
                and maintain reasonable security practices to protect 
                the confidentiality, integrity, and accessibility of 
                personal information of children or teens collected by 
                the operator, and to protect such personal information 
                against unauthorized access.'';
                    (B) in paragraph (2)--
                            (i) in the matter preceding subparagraph 
                        (A), by striking ``verifiable parental 
                        consent'' and inserting ``verifiable consent'';
                            (ii) in subparagraph (A)--
                                    (I) by inserting ``or teen'' after 
                                ``collected from a child'';
                                    (II) by inserting ``or teen'' after 
                                ``request from the child''; and
                                    (III) by inserting ``or teen or to 
                                contact another child or teen'' after 
                                ``to recontact the child'';
                            (iii) in subparagraph (B)--
                                    (I) by striking ``parent or child'' 
                                and inserting ``parent or teen''; and
                                    (II) by striking ``parental 
                                consent'' each place the term appears 
                                and inserting ``verifiable consent'';
                            (iv) in subparagraph (C)--
                                    (I) in the matter preceding clause 
                                (i), by inserting ``or teen'' after 
                                ``child'' each place the term appears;
                                    (II) in clause (i)--
                                            (aa) by inserting ``or 
                                        teen'' after ``child'' each 
                                        place the term appears; and
                                            (bb) by inserting ``or 
                                        teen, as applicable,'' after 
                                        ``parent'' each place the term 
                                        appears; and
                                    (III) in clause (ii)--
                                            (aa) by striking ``without 
                                        notice to the parent'' and 
                                        inserting ``without notice to 
                                        the parent or teen, as 
                                        applicable,''; and
                                            (bb) by inserting ``or 
                                        teen'' after ``child'' each 
                                        place the term appears; and
                            (v) in subparagraph (D)--
                                    (I) in the matter preceding clause 
                                (i), by inserting ``or teen'' after 
                                ``child'' each place the term appears;
                                    (II) in clause (ii), by inserting 
                                ``or teen'' after ``child''; and
                                    (III) in the flush text following 
                                clause (iii)--
                                            (aa) by inserting ``or 
                                        teen, as applicable,'' after 
                                        ``parent'' each place the term 
                                        appears; and
                                            (bb) by inserting ``or 
                                        teen'' after ``child'';
                    (C) by redesignating paragraph (3) as paragraph (4) 
                and inserting after paragraph (2) the following new 
                paragraph:
            ``(3) Application to operators acting under agreements with 
        educational agencies or institutions.--The regulations may 
        provide that verifiable consent under paragraph (1)(A)(ii) is 
        not required for an operator that is acting under a written 
        agreement with an educational agency or institution (as defined 
        in section 444 of the General Education Provisions Act 
        (commonly known as the `Family Educational Rights and Privacy 
        Act of 1974') (20 U.S.C. 1232g(a)(3)) that, at a minimum, 
        requires the--
                    ``(A) operator to--
                            ``(i) limit its collection, use, and 
                        disclosure of the personal information from a 
                        child or teen to solely educational purposes 
                        and for no other commercial purposes;
                            ``(ii) provide the educational agency or 
                        institution with a notice of the specific types 
                        of personal information the operator will 
                        collect from the child or teen, the method by 
                        which the operator will obtain the personal 
                        information, and the purposes for which the 
                        operator will collect, use, disclose, and 
                        retain the personal information;
                            ``(iii) provide the educational agency or 
                        institution with a link to the operator's 
                        online notice of information practices as 
                        required under subsection (b)(1)(A)(i); and
                            ``(iv) provide the educational agency or 
                        institution, upon request, with a means to 
                        review the personal information collected from 
                        a child or teen, to prevent further use or 
                        maintenance or future collection of personal 
                        information from a child or teen, and to delete 
                        personal information collected from a child or 
                        teen or content or information submitted by a 
                        child or teen to the operator's website, online 
                        service, online application, or mobile 
                        application;
                    ``(B) representative of the educational agency or 
                institution to acknowledge and agree that they have 
                authority to authorize the collection, use, and 
                disclosure of personal information from children or 
                teens on behalf of the educational agency or 
                institution, along with such authorization, their name, 
                and title at the educational agency or institution; and
                    ``(C) educational agency or institution to--
                            ``(i) provide on its website a notice that 
                        identifies the operator with which it has 
                        entered into a written agreement under this 
                        subsection and provides a link to the 
                        operator's online notice of information 
                        practices as required under paragraph 
                        (1)(A)(i);
                            ``(ii) provide the operator's notice 
                        regarding its information practices, as 
                        required under subparagraph (A)(ii), upon 
                        request, to a parent, in the case of a child, 
                        or a parent or teen, in the case of a teen; and
                            ``(iii) upon the request of a parent, in 
                        the case of a child, or a parent or teen, in 
                        the case of a teen, request the operator 
                        provide a means to review the personal 
                        information from the child or teen and provide 
                        the parent, in the case of a child, or parent 
                        or teen, in the case of the teen, a means to 
                        review the personal information.'';
                    (D) by amending paragraph (4), as so redesignated, 
                to read as follows:
            ``(4) Termination of service.--The regulations shall permit 
        the operator of a website, online service, online application, 
        or mobile application to terminate service provided to a child 
        whose parent has refused, or a teen who has refused, under the 
        regulations prescribed under paragraphs (1)(B)(ii) and 
        (1)(C)(ii), to permit the operator's further use or maintenance 
        in retrievable form, or future online collection of, personal 
        information from that child or teen.''; and
                    (E) by adding at the end the following new 
                paragraphs:
            ``(5) Continuation of service.--The regulations shall 
        prohibit an operator from discontinuing service provided to a 
        child or teen on the basis of a request by the parent of the 
        child or by the teen, under the regulations prescribed under 
        subparagraph (B) or (C) of paragraph (1), respectively, to 
        delete personal information collected from the child or teen, 
        to the extent that the operator is capable of providing such 
        service without such information.
            ``(6) Rule of construction.--A request made pursuant to 
        subparagraph (B) or (C) of paragraph (1) to delete or correct 
        personal information of a child or teen shall not be 
        construed--
                    ``(A) to limit the authority of a law enforcement 
                agency to obtain any content or information from an 
                operator pursuant to a lawfully executed warrant or an 
                order of a court of competent jurisdiction;
                    ``(B) to require an operator or third party delete 
                or correct information that--
                            ``(i) any other provision of Federal or 
                        State law requires the operator or third party 
                        to maintain; or
                            ``(ii) was submitted to the website, online 
                        service, online application, or mobile 
                        application of the operator by any person other 
                        than the user who is attempting to erase or 
                        otherwise eliminate the content or information, 
                        including content or information submitted by 
                        the user that was republished or resubmitted by 
                        another person; or
                    ``(C) to prohibit an operator from--
                            ``(i) retaining a record of the deletion 
                        request and the minimum information necessary 
                        for the purposes of ensuring compliance with a 
                        request made pursuant to subparagraph (B) or 
                        (C);
                            ``(ii) preventing, detecting, protecting 
                        against, or responding to security incidents, 
                        identity theft, or fraud, or reporting those 
                        responsible for such actions;
                            ``(iii) protecting the integrity or 
                        security of a website, online service, online 
                        application or mobile application; or
                            ``(iv) ensuring that the child's or teen's 
                        information remains deleted.
            ``(7) Common verifiable consent mechanism.--
                    ``(A) In general.--
                            ``(i) Feasibility of mechanism.--The 
                        Commission shall assess the feasibility, with 
                        notice and public comment, of allowing 
                        operators the option to use a common verifiable 
                        consent mechanism that fully meets the 
                        requirements of this title.
                            ``(ii) Requirements.--The feasibility 
                        assessment described in clause (i) shall 
                        consider whether a single operator could use a 
                        common verifiable consent mechanism to obtain 
                        verifiable consent, as required under this 
                        title, from a parent of a child or from a teen 
                        on behalf of multiple, listed operators that 
                        provide a joint or related service.
                    ``(B) Report.--Not later than 1 year after the date 
                of enactment of this paragraph, the Commission shall 
                submit a report to the Committee on Commerce, Science, 
                and Transportation of the Senate and the Committee on 
                Energy and Commerce of the House of Representatives 
                with the findings of the assessment required by 
                subparagraph (A).
                    ``(C) Regulations.--If the Commission finds that 
                the use of a common verifiable consent mechanism is 
                feasible and would meet the requirements of this title, 
                the Commission shall issue regulations to permit the 
                use of a common verifiable consent mechanism in 
                accordance with the findings outlined in such 
                report.'';
            (4) in subsection (c), by striking ``a regulation 
        prescribed under subsection (a)'' and inserting ``subparagraph 
        (B), (C), (D), or (E) of subsection (a)(1), or of a regulation 
        prescribed under subsection (b),''; and
            (5) by striking subsection (d) and inserting the following:
    ``(d) Relationship to State Law.--The provisions of this title 
shall preempt any State law, rule, or regulation only to the extent 
that such State law, rule, or regulation conflicts with a provision of 
this title. Nothing in this title shall be construed to prohibit any 
State from enacting a law, rule, or regulation that provides greater 
protection to children or teens than the provisions of this title.''.
    (c) Safe Harbors.--Section 1304 of the Children's Online Privacy 
Protection Act of 1998 (15 U.S.C. 6503) is amended--
            (1) in subsection (b)(1), by inserting ``and teens'' after 
        ``children''; and
            (2) by adding at the end the following:
    ``(d) Publication.--
            ``(1) In general.--Subject to the restrictions described in 
        paragraph (2), the Commission shall publish on the internet 
        website of the Commission any report or documentation required 
        by regulation to be submitted to the Commission to carry out 
        this section.
            ``(2) Restrictions on publication.--The restrictions 
        described in section 6(f) and section 21 of the Federal Trade 
        Commission Act (15 U.S.C. 46(f), 57b-2) applicable to the 
        disclosure of information obtained by the Commission shall 
        apply in same manner to the disclosure under this subsection of 
        information obtained by the Commission from a report or 
        documentation described in paragraph (1).''.
    (d) Actions by States.--Section 1305 of the Children's Online 
Privacy Protection Act of 1998 (15 U.S.C. 6504) is amended--
            (1) in subsection (a)(1)--
                    (A) in the matter preceding subparagraph (A), by 
                inserting ``section 1303(a)(1) or'' before ``any 
                regulation''; and
                    (B) in subparagraph (B), by inserting ``section 
                1303(a)(1) or'' before ``the regulation''; and
            (2) in subsection (d)--
                    (A) by inserting ``section 1303(a)(1) or'' before 
                ``any regulation''; and
                    (B) by inserting ``section 1303(a)(1) or'' before 
                ``that regulation''.
    (e) Administration and Applicability of Act.--Section 1306 of the 
Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6505) is 
amended--
            (1) in subsection (b)--
                    (A) in paragraph (1), by striking ``, in the case 
                of'' and all that follows through ``the Board of 
                Directors of the Federal Deposit Insurance 
                Corporation;'' and inserting the following: ``by the 
                appropriate Federal banking agency, with respect to any 
                insured depository institution (as those terms are 
                defined in section 3 of that Act (12 U.S.C. 1813));''; 
                and
                    (B) by striking paragraph (2) and redesignating 
                paragraphs (3) through (6) as paragraphs (2) through 
                (5), respectively;
            (2) in subsection (d)--
                    (A) by inserting ``section 1303(a)(1) or'' before 
                ``a rule''; and
                    (B) by striking ``such rule'' and inserting 
                ``section 1303(a)(1) or a rule of the Commission under 
                section 1303''; and
            (3) by adding at the end the following new subsections:
    ``(f) Determination of Whether an Operator Has Knowledge Fairly 
Implied on the Basis of Objective Circumstances.--
            ``(1) Rule of construction.--For purposes of enforcing this 
        title or a regulation promulgated under this title, in making a 
        determination as to whether an operator has knowledge fairly 
        implied on the basis of objective circumstances that a specific 
        user is a child or teen, the Commission or State attorneys 
        general shall rely on competent and reliable evidence, taking 
        into account the totality of the circumstances, including 
        whether a reasonable and prudent person under the circumstances 
        would have known that the user is a child or teen. Nothing in 
        this title, including a determination described in the 
        preceding sentence, shall be construed to require an operator 
        to--
                    ``(A) affirmatively collect any personal 
                information with respect to the age of a child or teen 
                that an operator is not already collecting in the 
                normal course of business; or
                    ``(B) implement an age gating or age verification 
                functionality.
            ``(2) Commission guidance.--
                    ``(A) In general.--Within 180 days of enactment, 
                the Commission shall issue guidance to provide 
                information, including best practices and examples for 
                operators to understand the Commission's determination 
                of whether an operator has knowledge fairly implied on 
                the basis of objective circumstances that a user is a 
                child or teen.
                    ``(B) Limitation.--No guidance issued by the 
                Commission with respect to this title shall confer any 
                rights on any person, State, or locality, nor shall 
                operate to bind the Commission or any person to the 
                approach recommended in such guidance. In any 
                enforcement action brought pursuant to this title, the 
                Commission or State attorney general, as applicable, 
                shall allege a specific violation of a provision of 
                this title. The Commission or State attorney general, 
                as applicable, may not base an enforcement action on, 
                or execute a consent order based on, practices that are 
                alleged to be inconsistent with any such guidance, 
                unless the practices allegedly violate this title. For 
                purposes of enforcing this title or a regulation 
                promulgated under this title, State attorneys general 
                shall take into account any guidance issued by the 
                Commission under subparagraph (A).
    ``(g) Additional Requirement.--Any regulations issued under this 
title shall include a description and analysis of the impact of 
proposed and final Rules on small entities per the Regulatory 
Flexibility Act of 1980 (5 U.S.C. 601 et seq.).''.

SEC. 202. STUDY AND REPORTS OF MOBILE AND ONLINE APPLICATION OVERSIGHT 
              AND ENFORCEMENT.

    (a) Oversight Report.--Not later than 3 years after the date of 
enactment of this Act, the Federal Trade Commission shall submit to the 
Committee on Commerce, Science, and Transportation of the Senate and 
the Committee on Energy and Commerce of the House of Representatives a 
report on the processes of platforms that offer mobile and online 
applications for ensuring that, of those applications that are 
websites, online services, online applications, or mobile applications 
directed to children, the applications operate in accordance with--
            (1) this title, the amendments made by this title, and 
        rules promulgated under this title; and
            (2) rules promulgated by the Commission under section 18 of 
        the Federal Trade Commission Act (15 U.S.C. 57a) relating to 
        unfair or deceptive acts or practices in marketing.
    (b) Enforcement Report.--Not later than 1 year after the date of 
enactment of this Act, and each year thereafter, the Federal Trade 
Commission shall submit to the Committee on Commerce, Science, and 
Transportation of the Senate and the Committee on Energy and Commerce 
of the House of Representatives a report that addresses, at a minimum--
            (1) the number of actions brought by the Commission during 
        the reporting year to enforce the Children's Online Privacy 
        Protection Act of 1998 (15 U.S.C. 6501) (referred to in this 
        subsection as the ``Act'') and the outcome of each such action;
            (2) the total number of investigations or inquiries into 
        potential violations of the Act; during the reporting year;
            (3) the total number of open investigations or inquiries 
        into potential violations of the Act as of the time the report 
        is submitted;
            (4) the number and nature of complaints received by the 
        Commission relating to an allegation of a violation of the Act 
        during the reporting year; and
            (5) policy or legislative recommendations to strengthen 
        online protections for children and teens.

SEC. 203. GAO STUDY.

    (a) Study.--The Comptroller General of the United States (in this 
section referred to as the ``Comptroller General'') shall conduct a 
study on the privacy of teens who use financial technology products. 
Such study shall--
            (1) identify the type of financial technology products that 
        teens are using;
            (2) identify the potential risks to teens' privacy from 
        using such financial technology products; and
            (3) determine whether existing laws are sufficient to 
        address such risks to teens' privacy.
    (b) Report.--Not later than 1 year after the date of enactment of 
this section, the Comptroller General shall submit to Congress a report 
containing the results of the study conducted under subsection (a), 
together with recommendations for such legislation and administrative 
action as the Comptroller General determines appropriate.

SEC. 204. SEVERABILITY.

    If any provision of this title, or an amendment made by this title, 
is determined to be unenforceable or invalid, the remaining provisions 
of this title and the amendments made by this title shall not be 
affected.

                 TITLE III--ELIMINATING USELESS REPORTS

SEC. 301. SUNSETS FOR AGENCY REPORTS.

    (a) In General.--Section 1125 of title 31, United States Code, is 
amended--
            (1) by redesignating subsection (c) as subsection (d);
            (2) by striking subsections (a) and (b) and inserting the 
        following:
    ``(a) Definitions.--In this section:
            ``(1) Budget justification materials.--The term `budget 
        justification materials' has the meaning given the term in 
        section 3(b)(2) of the Federal Funding Accountability and 
        Transparency Act of 2006 (31 U.S.C. 6101 note; Public Law 109-
        282).
            ``(2) Plan or report.--The term `plan or report' means any 
        plan or report submitted to Congress, any committee of 
        Congress, or subcommittee thereof, by not less than 1 agency--
                    ``(A) in accordance with Federal law; or
                    ``(B) at the direction or request of a 
                congressional report.
            ``(3) Recurring plan or report.--The term `recurring plan 
        or report' means a plan or report submitted on a recurring 
        basis.
            ``(4) Relevant congressional committee.--The term `relevant 
        congressional committee'--
                    ``(A) means a congressional committee to which a 
                recurring plan or report is required to be submitted; 
                and
                    ``(B) does not include any plan or report that is 
                required to be submitted solely to the Committee on 
                Armed Services of the House of Representatives or the 
                Senate.
    ``(b) Agency Identification of Unnecessary Reports.--
            ``(1) In general.--The head of each agency shall include in 
        the budget justification materials of the agency the following:
                    ``(A) Subject to paragraphs (2) and (3), the 
                following:
                            ``(i) A list of each recurring plan or 
                        report submitted by the agency.
                            ``(ii) An identification of whether the 
                        recurring plan or report listed in clause (i) 
                        was included in the most recent report issued 
                        by the Clerk of the House of Representatives 
                        concerning the reports that any agency is 
                        required by law or directed or requested by a 
                        committee report to make to Congress, any 
                        committee of Congress, or subcommittee thereof.
                            ``(iii) If applicable, the unique 
                        alphanumeric identifier for the recurring plan 
                        or report as required by section 
                        7243(b)(1)(C)(vii) of the James M. Inhofe 
                        National Defense Authorization Act for Fiscal 
                        Year 2023 (Public Law 117-263).
                            ``(iv) The identification of any recurring 
                        plan or report the head of the agency 
                        determines to be outdated or duplicative.
                    ``(B) With respect to each recurring plan or report 
                identified in subparagraph (A)(iv), the following:
                            ``(i) A recommendation on whether to 
                        sunset, modify, consolidate, or reduce the 
                        frequency of the submission of the recurring 
                        plan or report.
                            ``(ii) A citation to each provision of law 
                        or directive or request in a congressional 
                        report that requires or requests the submission 
                        of the recurring plan or report.
                            ``(iii) A list of the relevant 
                        congressional committees for the recurring plan 
                        or report.
                    ``(C) A justification explaining, with respect to 
                each recommendation described in subparagraph (B)(i) 
                relating to a recurring plan or report--
                            ``(i) why the head of the agency made the 
                        recommendation, which may include an estimate 
                        of the resources expended by the agency to 
                        prepare and submit the recurring plan or 
                        report; and
                            ``(ii) the understanding of the head of the 
                        agency of the purpose of the recurring plan or 
                        report.
            ``(2) Agency consultation.--
                    ``(A) In general.--In preparing the list required 
                under paragraph (1)(A), if, in submitting a recurring 
                plan or report, an agency is required to coordinate or 
                consult with another agency or entity, the head of the 
                agency submitting the recurring plan or report shall 
                consult with the head of each agency or entity with 
                whom consultation or coordination is required.
                    ``(B) Inclusion in list.--If, after a consultation 
                under subparagraph (A), the head of each agency or 
                entity consulted under that subparagraph agrees that a 
                recurring plan or report is outdated or duplicative, 
                the head of the agency required to submit the recurring 
                plan or report shall--
                            ``(i) include the recurring plan or report 
                        in the list described in paragraph (1)(A); and
                            ``(ii) identify each agency or entity with 
                        which the head of the agency is required to 
                        coordinate or consult in submitting the 
                        recurring plan or report.
                    ``(C) Disagreement.--If the head of any agency or 
                entity consulted under subparagraph (A) does not agree 
                that a recurring plan or report is outdated or 
                duplicative, the head of the agency required to submit 
                the recurring plan or report shall not include the 
                recurring plan or report in the list described in 
                paragraph (1)(A).
            ``(3) Government-wide or multi-agency plan and report 
        submissions.--With respect to a recurring plan or report 
        required to be submitted by not less than 2 agencies, the 
        Director of the Office of Management and Budget shall--
                    ``(A) determine whether the requirement to submit 
                the recurring plan or report is outdated or 
                duplicative; and
                    ``(B) make recommendations to Congress accordingly.
            ``(4) Plan and report submissions conformity to the access 
        to congressionally mandated reports act.--With respect to an 
        agency recommendation, citation, or justification made under 
        subparagraph (B) or (C) of paragraph (1) or a recommendation by 
        the Director of the Office of Management and Budget under 
        paragraph (3), the agency or Director, as applicable, shall 
        also provide this information to the Director of the Government 
        Publishing Office in conformity with the agency submission 
        requirements under section 7244(a) of the James M. Inhofe 
        National Defense Authorization Act for Fiscal Year 2023 (Public 
        Law 117-263; chapter 41 of title 44 note) in conformity with 
        guidance issued by the Director of the Office of Management and 
        Budget under section 7244(b) of such Act.
    ``(c) Rule of Construction on Agency Requirements.--Nothing in this 
section shall be construed to exempt the head of an agency from a 
requirement to submit a recurring plan or report.''; and
            (3) in subsection (d), as so redesignated, by striking ``in 
        the budget of the United States Government, as provided by 
        section 1105(a)(37)'' and inserting ``in the budget 
        justification materials of each agency''.
    (b) Budget Contents.--Section 1105(a) of title 31, United States 
Code, is amended by striking paragraph (39).
    (c) Conformity to the Access to Congressionally Mandated Reports 
Act.--
            (1) Amendment.--Subsections (a) and (b) of section 7244 of 
        the James M. Inhofe National Defense Authorization Act for 
        Fiscal Year 2023 (Public Law 117-263; chapter 41 of title 44, 
        United States Code, note), are amended to read as follows:
    ``(a) Submission of Electronic Copies of Reports.--Not earlier than 
30 days or later than 60 days after the date on which a congressionally 
mandated report is submitted to either House of Congress or to any 
committee of Congress or subcommittee thereof, the head of the Federal 
agency submitting the congressionally mandated report shall submit to 
the Director the information required under subparagraphs (A) through 
(D) of section 7243(b)(1) with respect to the congressionally mandated 
report. Notwithstanding section 7246, nothing in this subtitle shall 
relieve a Federal agency of any other requirement to publish the 
congressionally mandated report on the online portal of the Federal 
agency or otherwise submit the congressionally mandated report to 
Congress or specific committees of Congress, or subcommittees thereof.
    ``(b) Guidance.--Not later than 180 days after the date of the 
enactment of this subsection and periodically thereafter as 
appropriate, the Director of the Office of Management and Budget, in 
consultation with the Director, shall issue guidance to agencies on the 
implementation of this subtitle as well as the requirements of section 
1125(b) of title 31, United States Code.''.
            (2) Updated omb guidance.--Not later than 180 days after 
        the date of the enactment of this Act, the Director of the 
        Office of Management and Budget shall issue updated guidance to 
        agencies to ensure that the requirements under subsections (a) 
        and (b) of section 1125 of title 31, United States Code, as 
        amended by this Act, for agency submissions of recommendations 
        and justifications for plans and reports to sunset, modify, 
        consolidate, or reduce the frequency of the submission of are 
        also submitted as a separate attachment in conformity with the 
        agency submission requirements of electronic copies of reports 
        submitted by agencies under section 7244(a) of the James M. 
        Inhofe National Defense Authorization Act for Fiscal Year 2023 
        (Public Law 117-263; chapter 41 of title 44, United States 
        Code, note) for publication on the online portal established 
        under section 7243 of such Act.

            Amend the title so as to read: ``An Act to protect the 
        safety and privacy of children on the internet.''.

            Attest:

                                                             Secretary.
118th CONGRESS

  2d Session

                                S. 2073

_______________________________________________________________________

                  SENATE AMENDMENTS TO HOUSE AMENDMENT