[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 2073 Engrossed Amendment Senate (EAS)]
<DOC>
In the Senate of the United States,
July 30, 2024.
Resolved, That the Senate agree to the amendment of the House of
Representatives to the bill (S. 2073) ``An Act to amend title 31,
United States Code, to require agencies to include a list of outdated
or duplicative reporting requirements in annual budget justifications,
and for other purposes.'', with the following
SENATE AMENDMENTS TO HOUSE AMENDMENT:
In lieu of the matter proposed to be inserted, insert the
following:
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) Short Title.--This Act may be cited as the ``Kids Online Safety
and Privacy Act''.
(b) Table of Contents.--The table of contents for this Act is as
follows:
Sec. 1. Short title; table of contents.
TITLE I--KEEPING KIDS SAFE ONLINE
Subtitle A--Kids Online Safety
Sec. 101. Definitions.
Sec. 102. Duty of care.
Sec. 103. Safeguards for minors.
Sec. 104. Disclosure.
Sec. 105. Transparency.
Sec. 106. Research on social media and minors.
Sec. 107. Market research.
Sec. 108. Age verification study and report.
Sec. 109. Guidance.
Sec. 110. Enforcement.
Sec. 111. Kids online safety council.
Sec. 112. Effective date.
Sec. 113. Rules of construction and other matters.
Subtitle B--Filter Bubble Transparency
Sec. 120. Definitions.
Sec. 121. Requirement to allow users to see unmanipulated content on
internet platforms.
Subtitle C--Relationship to State Laws; Severability
Sec. 130. Relationship to State laws.
Sec. 131. Severability.
TITLE II--CHILDREN AND TEENS' ONLINE PRIVACY
Sec. 201. Online collection, use, disclosure, and deletion of personal
information of children and teens.
Sec. 202. Study and reports of mobile and online application oversight
and enforcement.
Sec. 203. GAO study.
Sec. 204. Severability.
TITLE III--ELIMINATING USELESS REPORTS
Sec. 301. Sunsets for agency reports.
TITLE I--KEEPING KIDS SAFE ONLINE
Subtitle A--Kids Online Safety
SEC. 101. DEFINITIONS.
In this subtitle:
(1) Child.--The term ``child'' means an individual who is
under the age of 13.
(2) Compulsive usage.--The term ``compulsive usage'' means
any response stimulated by external factors that causes an
individual to engage in repetitive behavior reasonably likely
to cause psychological distress.
(3) Covered platform.--
(A) In general.--The term ``covered platform''
means an online platform, online video game, messaging
application, or video streaming service that connects
to the internet and that is used, or is reasonably
likely to be used, by a minor.
(B) Exceptions.--The term ``covered platform'' does
not include--
(i) an entity acting in its capacity as a
provider of--
(I) a common carrier service
subject to the Communications Act of
1934 (47 U.S.C. 151 et seq.) and all
Acts amendatory thereof and
supplementary thereto;
(II) a broadband internet access
service (as such term is defined for
purposes of section 8.1(b) of title 47,
Code of Federal Regulations, or any
successor regulation);
(III) an email service;
(IV) a teleconferencing or video
conferencing service that allows
reception and transmission of audio or
video signals for real-time
communication, provided that--
(aa) the service is not an
online platform, including a
social media service or social
network; and
(bb) the real-time
communication is initiated by
using a unique link or
identifier to facilitate
access; or
(V) a wireless messaging service,
including such a service provided
through short messaging service or
multimedia messaging service protocols,
that is not a component of, or linked
to, an online platform and where the
predominant or exclusive function is
direct messaging consisting of the
transmission of text, photos or videos
that are sent by electronic means,
where messages are transmitted from the
sender to a recipient, and are not
posted within an online platform or
publicly;
(ii) an organization not organized to carry
on business for its own profit or that of its
members;
(iii) any public or private preschool,
elementary, or secondary school, or any
institution of vocational, professional, or
higher education;
(iv) a library (as defined in section
213(1) of the Library Services and Technology
Act (20 U.S.C. 9122(1)));
(v) a news or sports coverage website or
app where--
(I) the inclusion of video content
on the website or app is related to the
website or app's own gathering,
reporting, or publishing of news
content or sports coverage; and
(II) the website or app is not
otherwise an online platform;
(vi) a product or service that primarily
functions as business-to-business software, a
cloud storage, file sharing, or file
collaboration service, provided that the
product or service is not an online platform;
or
(vii) a virtual private network or similar
service that exists solely to route internet
traffic between locations.
(4) Design feature.--The term ``design feature'' means any
feature or component of a covered platform that will encourage
or increase the frequency, time spent, or activity of minors on
the covered platform. Design features include but are not
limited to--
(A) infinite scrolling or auto play;
(B) rewards for time spent on the platform;
(C) notifications;
(D) personalized recommendation systems;
(E) in-game purchases; or
(F) appearance altering filters.
(5) Geolocation.--The term ``geolocation'' has the meaning
given the term ``geolocation information'' in section 1302 of
the Children's Online Privacy Protection Act of 1998 (15 U.S.C.
6501), as added by section 201(a).
(6) Know or knows.--The term ``know'' or ``knows'' means to
have actual knowledge or knowledge fairly implied on the basis
of objective circumstances.
(7) Mental health disorder.--The term ``mental health
disorder'' has the meaning given the term ``mental disorder''
in the Diagnostic and Statistical Manual of Mental Health
Disorders, 5th Edition (or the most current successor edition).
(8) Microtransaction.--
(A) In general.--The term ``microtransaction''
means a purchase made in an online video game
(including a purchase made using a virtual currency
that is purchasable or redeemable using cash or credit
or that is included as part of a paid subscription
service).
(B) Inclusions.--Such term includes a purchase
involving surprise mechanics, new characters, or in-
game items.
(C) Exclusions.--Such term does not include--
(i) a purchase made in an online video game
using a virtual currency that is earned through
gameplay and is not otherwise purchasable or
redeemable using cash or credit or included as
part of a paid subscription service; or
(ii) a purchase of additional levels within
the game or an overall expansion of the game.
(9) Minor.--The term ``minor'' means an individual who is
under the age of 17.
(10) Online platform.--The term ``online platform'' means
any public-facing website, online service, online application,
or mobile application that predominantly provides a community
forum for user generated content, such as sharing videos,
images, games, audio files, or other content, including a
social media service, social network, or virtual reality
environment.
(11) Online video game.--The term ``online video game''
means a video game, including an educational video game, that
connects to the internet and that allows a user to--
(A) create and upload content other than content
that is incidental to gameplay, such as character or
level designs created by the user, preselected phrases,
or short interactions with other users;
(B) engage in microtransactions within the game; or
(C) communicate with other users.
(12) Parent.--The term ``parent'' has the meaning given
that term in section 1302 of the Children's Online Privacy
Protection Act (15 U.S.C. 6501).
(13) Personal data.--The term ``personal data'' has the
same meaning as the term ``personal information'' as defined in
section 1302 of the Children's Online Privacy Protection Act
(15 U.S.C. 6501).
(14) Personalized recommendation system.--The term
``personalized recommendation system'' means a fully or
partially automated system used to suggest, promote, or rank
content, including other users, hashtags, or posts, based on
the personal data of users. A recommendation system that
suggests, promotes, or ranks content based solely on the user's
language, city or town, or age shall not be considered a
personalized recommendation system.
(15) Sexual exploitation and abuse.--The term ``sexual
exploitation and abuse'' means any of the following:
(A) Coercion and enticement, as described in
section 2422 of title 18, United States Code.
(B) Child sexual abuse material, as described in
sections 2251, 2252, 2252A, and 2260 of title 18,
United States Code.
(C) Trafficking for the production of images, as
described in section 2251A of title 18, United States
Code.
(D) Sex trafficking of children, as described in
section 1591 of title 18, United States Code.
(16) User.--The term ``user'' means, with respect to a
covered platform, an individual who registers an account or
creates a profile on the covered platform.
SEC. 102. DUTY OF CARE.
(a) Prevention of Harm to Minors.--A covered platform shall
exercise reasonable care in the creation and implementation of any
design feature to prevent and mitigate the following harms to minors:
(1) Consistent with evidence-informed medical information,
the following mental health disorders: anxiety, depression,
eating disorders, substance use disorders, and suicidal
behaviors.
(2) Patterns of use that indicate or encourage addiction-
like behaviors by minors.
(3) Physical violence, online bullying, and harassment of
the minor.
(4) Sexual exploitation and abuse of minors.
(5) Promotion and marketing of narcotic drugs (as defined
in section 102 of the Controlled Substances Act (21 U.S.C.
802)), tobacco products, gambling, or alcohol.
(6) Predatory, unfair, or deceptive marketing practices, or
other financial harms.
(b) Limitation.--Nothing in subsection (a) shall be construed to
require a covered platform to prevent or preclude any minor from--
(1) deliberately and independently searching for, or
specifically requesting, content; or
(2) accessing resources and information regarding the
prevention or mitigation of the harms described in subsection
(a).
SEC. 103. SAFEGUARDS FOR MINORS.
(a) Safeguards for Minors.--
(1) Safeguards.--A covered platform shall provide a user or
visitor that the covered platform knows is a minor with
readily-accessible and easy-to-use safeguards to, as
applicable--
(A) limit the ability of other users or visitors to
communicate with the minor;
(B) prevent other users or visitors, whether
registered or not, from viewing the minor's personal
data collected by or shared on the covered platform, in
particular restricting public access to personal data;
(C) limit design features that encourage or
increase the frequency, time spent, or activity of
minors on the covered platform, such as infinite
scrolling, auto playing, rewards for time spent on the
platform, notifications, and other design features that
result in compulsive usage of the covered platform by
the minor;
(D) control personalized recommendation systems,
including the ability for a minor to have at least 1 of
the following options--
(i) opt out of such personalized
recommendation systems, while still allowing
the display of content based on a chronological
format; or
(ii) limit types or categories of
recommendations from such systems; and
(E) restrict the sharing of the geolocation of the
minor and provide notice regarding the tracking of the
minor's geolocation.
(2) Option.--A covered platform shall provide a user that
the covered platform knows is a minor with a readily-accessible
and easy-to-use option to limit the amount of time spent by the
minor on the covered platform.
(3) Default safeguard settings for minors.--A covered
platform shall provide that, in the case of a user or visitor
that the platform knows is a minor, the default setting for any
safeguard described under paragraph (1) shall be the option
available on the platform that provides the most protective
level of control that is offered by the platform over privacy
and safety for that user or visitor.
(b) Parental Tools.--
(1) Tools.--A covered platform shall provide readily-
accessible and easy-to-use settings for parents to support a
user that the platform knows is a minor with respect to the
user's use of the platform.
(2) Requirements.--The parental tools provided by a covered
platform shall include--
(A) the ability to manage a minor's privacy and
account settings, including the safeguards and options
established under subsection (a), in a manner that
allows parents to--
(i) view the privacy and account settings;
and
(ii) in the case of a user that the
platform knows is a child, change and control
the privacy and account settings;
(B) the ability to restrict purchases and financial
transactions by the minor, where applicable; and
(C) the ability to view metrics of total time spent
on the covered platform and restrict time spent on the
covered platform by the minor.
(3) Notice to minors.--A covered platform shall provide
clear and conspicuous notice to a user when the tools described
in this subsection are in effect and what settings or controls
have been applied.
(4) Default tools.--A covered platform shall provide that,
in the case of a user that the platform knows is a child, the
tools required under paragraph (1) shall be enabled by default.
(5) Application to existing accounts.--If, prior to the
effective date of this subsection, a covered platform provided
a parent of a user that the platform knows is a child with
notice and the ability to enable the parental tools described
under this subsection in a manner that would otherwise comply
with this subsection, and the parent opted out of enabling such
tools, the covered platform is not required to enable such
tools with respect to such user by default when this subsection
takes effect.
(c) Reporting Mechanism.--
(1) Reports submitted by parents, minors, and schools.--A
covered platform shall provide--
(A) a readily-accessible and easy-to-use means to
submit reports to the covered platform of harms to a
minor;
(B) an electronic point of contact specific to
matters involving harms to a minor; and
(C) confirmation of the receipt of such a report
and, within the applicable time period described in
paragraph (2), a substantive response to the individual
that submitted the report.
(2) Timing.--A covered platform shall establish an internal
process to receive and substantively respond to such reports in
a reasonable and timely manner, but in no case later than--
(A) 10 days after the receipt of a report, if, for
the most recent calendar year, the platform averaged
more than 10,000,000 active users on a monthly basis in
the United States;
(B) 21 days after the receipt of a report, if, for
the most recent calendar year, the platform averaged
less than 10,000,000 active users on a monthly basis in
the United States; and
(C) notwithstanding subparagraphs (A) and (B), if
the report involves an imminent threat to the safety of
a minor, as promptly as needed to address the reported
threat to safety.
(d) Advertising of Illegal Products.--A covered platform shall not
facilitate the advertising of narcotic drugs (as defined in section 102
of the Controlled Substances Act (21 U.S.C. 802)), tobacco products,
gambling, or alcohol to an individual that the covered platform knows
is a minor.
(e) Rules of Application.--
(1) Accessibility.--With respect to safeguards and parental
tools described under subsections (a) and (b), a covered
platform shall provide--
(A) information and control options in a clear and
conspicuous manner that takes into consideration the
differing ages, capacities, and developmental needs of
the minors most likely to access the covered platform
and does not encourage minors or parents to weaken or
disable safeguards or parental tools;
(B) readily-accessible and easy-to-use controls to
enable or disable safeguards or parental tools, as
appropriate; and
(C) information and control options in the same
language, form, and manner as the covered platform
provides the product or service used by minors and
their parents.
(2) Dark patterns prohibition.--It shall be unlawful for
any covered platform to design, modify, or manipulate a user
interface of a covered platform with the purpose or substantial
effect of subverting or impairing user autonomy, decision-
making, or choice with respect to safeguards or parental tools
required under this section.
(3) Timing considerations.--
(A) No interruption to gameplay.--Subsections
(a)(1)(C) and (b)(3) shall not require an online video
game to interrupt the natural sequence of game play,
such as progressing through game levels or finishing a
competition.
(B) Application of changes to offline devices or
accounts.--If a user's device or user account does not
have access to the internet at the time of a change to
parental tools, a covered platform shall apply changes
the next time the device or user is connected to the
internet.
(4) Rules of construction.--Nothing in this section shall
be construed to--
(A) prevent a covered platform from taking
reasonable measures to--
(i) block, detect, or prevent the
distribution of unlawful, obscene, or other
harmful material to minors as described in
section 102(a); or
(ii) block or filter spam, prevent criminal
activity, or protect the security of a platform
or service;
(B) require the disclosure of a minor's browsing
behavior, search history, messages, contact list, or
other content or metadata of their communications;
(C) prevent a covered platform from using a
personalized recommendation system to display content
to a minor if the system only uses information on--
(i) the language spoken by the minor;
(ii) the city the minor is located in; or
(iii) the minor's age; or
(D) prevent an online video game from disclosing a
username or other user identification for the purpose
of competitive gameplay or to allow for the reporting
of users.
(f) Device or Console Controls.--
(1) In general.--Nothing in this section shall be construed
to prohibit a covered platform from integrating its products or
service with, or duplicate controls or tools provided by,
third-party systems, including operating systems or gaming
consoles, to meet the requirements imposed under subsections
(a) and (b) relating to safeguards for minors and parental
tools, provided that--
(A) the controls or tools meet such requirements;
and
(B) the minor or parent is provided sufficient
notice of the integration and use of the parental
tools.
(2) Preservation of protections.--In the event of a
conflict between the controls or tools of a third-party system,
including operating systems or gaming consoles, and a covered
platform, the covered platform is not required to override the
controls or tools of a third-party system if it would undermine
the protections for minors from the safeguards or parental
tools imposed under subsections (a) and (b).
SEC. 104. DISCLOSURE.
(a) Notice.--
(1) Registration or purchase.--Prior to registration or
purchase of a covered platform by an individual that the
platform knows is a minor, the platform shall provide clear,
conspicuous, and easy-to-understand--
(A) notice of the policies and practices of the
covered platform with respect to safeguards for minors
required under section 103;
(B) information about how to access the safeguards
and parental tools required under section 103; and
(C) notice about whether the covered platform uses
or makes available to minors a product, service, or
design feature, including any personalized
recommendation system, that poses any heightened risk
of harm to minors.
(2) Notification.--
(A) Notice and acknowledgment.--In the case of an
individual that a covered platform knows is a child,
the platform shall additionally provide information
about the parental tools and safeguards required under
section 103 to a parent of the child and obtain
verifiable consent (as defined in section 1302(9) of
the Children's Online Privacy Protection Act (15 U.S.C.
6501(9))) from the parent prior to the initial use of
the covered platform by the child.
(B) Reasonable effort.--A covered platform shall be
deemed to have satisfied the requirement described in
subparagraph (A) if the covered platform is in
compliance with the requirements of the Children's
Online Privacy Protection Act (15 U.S.C. 6501 et seq.)
to use reasonable efforts (taking into consideration
available technology) to provide a parent with the
information described in subparagraph (A) and to obtain
verifiable consent as required.
(3) Consolidated notices.--For purposes of this subtitle, a
covered platform may consolidate the process for providing
information under this subsection and obtaining verifiable
consent or the consent of the minor involved (as applicable) as
required under this subsection with its obligations to provide
relevant notice and obtain verifiable consent under the
Children's Online Privacy Protection Act (15 U.S.C. 6501 et
seq.).
(4) Guidance.--The Federal Trade Commission may issue
guidance to assist covered platforms in complying with the
specific notice requirements of this subsection.
(b) Personalized Recommendation System.--A covered platform that
operates a personalized recommendation system shall set out in its
terms and conditions, in a clear, conspicuous, and easy-to-understand
manner--
(1) an overview of how such personalized recommendation
system is used by the covered platform to provide information
to minors, including how such systems use the personal data of
minors; and
(2) information about options for minors or their parents
to opt out of or control the personalized recommendation system
(as applicable).
(c) Advertising and Marketing Information and Labels.--
(1) Information and labels.--A covered platform shall
provide clear, conspicuous, and easy-to-understand labels and
information, which can be provided through a link to another
web page or disclosure, to minors on advertisements regarding--
(A) the name of the product, service, or brand and
the subject matter of an advertisement; and
(B) whether particular media displayed to the minor
is an advertisement or marketing material, including
disclosure of endorsements of products, services, or
brands made for commercial consideration by other users
of the platform.
(2) Guidance.--The Federal Trade Commission may issue
guidance to assist covered platforms in complying with the
requirements of this subsection, including guidance about the
minimum level of information and labels for the disclosures
required under paragraph (1).
(d) Resources for Parents and Minors.--A covered platform shall
provide to minors and parents clear, conspicuous, easy-to-understand,
and comprehensive information in a prominent location, which may
include a link to a web page, regarding--
(1) its policies and practices with respect to safeguards
for minors required under section 103; and
(2) how to access the safeguards and tools required under
section 103.
(e) Resources in Additional Languages.--A covered platform shall
ensure, to the extent practicable, that the disclosures required by
this section are made available in the same language, form, and manner
as the covered platform provides any product or service used by minors
and their parents.
SEC. 105. TRANSPARENCY.
(a) In General.--Subject to subsection (b), not less frequently
than once a year, a covered platform shall issue a public report
describing the reasonably foreseeable risks of harms to minors and
assessing the prevention and mitigation measures taken to address such
risk based on an independent, third-party audit conducted through
reasonable inspection of the covered platform.
(b) Scope of Application.--The requirements of this section shall
apply to a covered platform if--
(1) for the most recent calendar year, the platform
averaged more than 10,000,000 active users on a monthly basis
in the United States; and
(2) the platform predominantly provides a community forum
for user-generated content and discussion, including sharing
videos, images, games, audio files, discussion in a virtual
setting, or other content, such as acting as a social media
platform, virtual reality environment, or a social network
service.
(c) Content.--
(1) Transparency.--The public reports required of a covered
platform under this section shall include--
(A) an assessment of the extent to which the
platform is likely to be accessed by minors;
(B) a description of the commercial interests of
the covered platform in use by minors;
(C) an accounting, based on the data held by the
covered platform, of--
(i) the number of users using the covered
platform that the platform knows to be minors
in the United States;
(ii) the median and mean amounts of time
spent on the platform by users known to be
minors in the United States who have accessed
the platform during the reporting year on a
daily, weekly, and monthly basis; and
(iii) the amount of content being accessed
by users that the platform knows to be minors
in the United States that is in English, and
the top 5 non-English languages used by users
accessing the platform in the United States;
(D) an accounting of total reports received
regarding, and the prevalence (which can be based on
scientifically valid sampling methods using the content
available to the covered platform in the normal course
of business) of content related to, the harms described
in section 102(a), disaggregated by category of harm
and language, including English and the top 5 non-
English languages used by users accessing the platform
from the United States (as identified under
subparagraph (C)(iii)); and
(E) a description of any material breaches of
parental tools or assurances regarding minors,
representations regarding the use of the personal data
of minors, and other matters regarding non-compliance
with this subtitle.
(2) Reasonably foreseeable risk of harm to minors.--The
public reports required of a covered platform under this
section shall include--
(A) an assessment of the reasonably foreseeable
risk of harms to minors posed by the covered platform,
specifically identifying those physical, mental,
developmental, or financial harms described in section
102(a);
(B) a description of whether and how the covered
platform uses design features that encourage or
increase the frequency, time spent, or activity of
minors on the covered platform, such as infinite
scrolling, auto playing, rewards for time spent on the
platform, notifications, and other design features that
result in compulsive usage of the covered platform by
the minor;
(C) a description of whether, how, and for what
purpose the platform collects or processes categories
of personal data that may cause reasonably foreseeable
risk of harms to minors;
(D) an evaluation of the efficacy of safeguards for
minors and parental tools under section 103, and any
issues in delivering such safeguards and the associated
parental tools;
(E) an evaluation of any other relevant matters of
public concern over risk of harms to minors associated
with the use of the covered platform; and
(F) an assessment of differences in risk of harm to
minors across different English and non-English
languages and efficacy of safeguards in those
languages.
(3) Mitigation.--The public reports required of a covered
platform under this section shall include, for English and the
top 5 non-English languages used by users accessing the
platform from the United States (as identified under paragraph
(2)(C)(iii)))--
(A) a description of the safeguards and parental
tools available to minors and parents on the covered
platform;
(B) a description of interventions by the covered
platform when it had or has reason to believe that
harms to minors could occur;
(C) a description of the prevention and mitigation
measures intended to be taken in response to the known
and emerging risks identified in its assessment of
reasonably foreseeable risks of harms to minors,
including steps taken to--
(i) prevent harms to minors, including
adapting or removing design features or
addressing through parental tools;
(ii) provide the most protective level of
control over privacy and safety by default; and
(iii) adapt recommendation systems to
mitigate reasonably foreseeable risk of harms
to minors, as described in section 102(a);
(D) a description of internal processes for
handling reports and automated detection mechanisms for
harms to minors, including the rate, timeliness, and
effectiveness of responses under the requirement of
section 103(c);
(E) the status of implementing prevention and
mitigation measures identified in prior assessments;
and
(F) a description of the additional measures to be
taken by the covered platform to address the
circumvention of safeguards for minors and parental
tools.
(d) Reasonable Inspection.--In conducting an inspection of the
reasonably foreseeable risk of harm to minors under this section, an
independent, third-party auditor shall--
(1) take into consideration the function of personalized
recommendation systems;
(2) consult parents and youth experts, including youth and
families with relevant past or current experience, public
health and mental health nonprofit organizations, health and
development organizations, and civil society with respect to
the prevention of harms to minors;
(3) conduct research based on experiences of minors that
use the covered platform, including reports under section
103(c) and information provided by law enforcement;
(4) take account of research, including research regarding
design features, marketing, or product integrity, industry best
practices, or outside research;
(5) consider indicia or inferences of age of users, in
addition to any self-declared information about the age of
users; and
(6) take into consideration differences in risk of
reasonably foreseeable harms and effectiveness of safeguards
across English and non-English languages.
(e) Cooperation With Independent, Third-party Audit.--To facilitate
the report required by subsection (c), a covered platform shall--
(1) provide or otherwise make available to the independent
third-party conducting the audit all information and material
in its possession, custody, or control that is relevant to the
audit;
(2) provide or otherwise make available to the independent
third-party conducting the audit access to all network,
systems, and assets relevant to the audit; and
(3) disclose all relevant facts to the independent third-
party conducting the audit, and not misrepresent in any manner,
expressly or by implication, any relevant fact.
(f) Privacy Safeguards.--
(1) In general.--In issuing the public reports required
under this section, a covered platform shall take steps to
safeguard the privacy of its users, including ensuring that
data is presented in a de-identified, aggregated format such
that it is not reasonably linkable to any user.
(2) Rule of construction.--This section shall not be
construed to require the disclosure of information that will
lead to material vulnerabilities for the privacy of users or
the security of a covered platform's service or create a
significant risk of the violation of Federal or State law.
(3) Definition of de-identified.--As used in this
subsection, the term ``de-identified'' means data that does not
identify and is not linked or reasonably linkable to a device
that is linked or reasonably linkable to an individual,
regardless of whether the information is aggregated
(g) Location.--The public reports required under this section
should be posted by a covered platform on an easy to find location on a
publicly-available website.
SEC. 106. RESEARCH ON SOCIAL MEDIA AND MINORS.
(a) Definitions.--In this section:
(1) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(2) National academy.--The term ``National Academy'' means
the National Academy of Sciences.
(3) Secretary.--The term ``Secretary'' means the Secretary
of Health and Human Services.
(b) Research on Social Media Harms.--Not later than 12 months after
the date of enactment of this Act, the Commission shall seek to enter
into a contract with the National Academy, under which the National
Academy shall conduct no less than 5 scientific, comprehensive studies
and reports on the risk of harms to minors by use of social media and
other online platforms, including in English and non-English languages.
(c) Matters to Be Addressed.--In contracting with the National
Academy, the Commission, in consultation with the Secretary, shall seek
to commission separate studies and reports, using the Commission's
authority under section 6(b) of the Federal Trade Commission Act (15
U.S.C. 46(b)), on the relationship between social media and other
online platforms as defined in this subtitle on the following matters:
(1) Anxiety, depression, eating disorders, and suicidal
behaviors.
(2) Substance use disorders and the use of narcotic drugs,
tobacco products, gambling, or alcohol by minors.
(3) Sexual exploitation and abuse.
(4) Addiction-like use of social media and design factors
that lead to unhealthy and harmful overuse of social media.
(d) Additional Study.--Not earlier than 4 years after enactment,
the Commission shall seek to enter into a contract with the National
Academy under which the National Academy shall conduct an additional
study and report covering the matters described in subsection (c) for
the purposes of providing additional information, considering new
research, and other matters.
(e) Content of Reports.-- The comprehensive studies and reports
conducted pursuant to this section shall seek to evaluate impacts and
advance understanding, knowledge, and remedies regarding the harms to
minors posed by social media and other online platforms, and may
include recommendations related to public policy.
(f) Active Studies.--If the National Academy is engaged in any
active studies on the matters described in subsection (c) at the time
that it enters into a contract with the Commission to conduct a study
under this section, it may base the study to be conducted under this
section on the active study, so long as it otherwise incorporates the
requirements of this section.
(g) Collaboration.--In designing and conducting the studies under
this section, the Commission, the Secretary, and the National Academy
shall consult with the Surgeon General and the Kids Online Safety
Council.
(h) Access to Data.--
(1) Fact-finding authority.--The Commission may issue
orders under section 6(b) of the Federal Trade Commission Act
(15 U.S.C. 46(b)) to require covered platforms to provide
reports, data, or answers in writing as necessary to conduct
the studies required under this section.
(2) Scope.--In exercising its authority under paragraph
(1), the Commission may issue orders to no more than 5 covered
platforms per study under this section.
(3) Confidential access.--Notwithstanding section 6(f) or
21 of the Federal Trade Commission Act (15 U.S.C. 46, 57b-2),
the Commission shall enter in agreements with the National
Academy to share appropriate information received from a
covered platform pursuant to an order under such subsection (b)
for a comprehensive study under this section in a confidential
and secure manner, and to prohibit the disclosure or sharing of
such information by the National Academy. Nothing in this
paragraph shall be construed to preclude the disclosure of any
such information if authorized or required by any other law.
SEC. 107. MARKET RESEARCH.
(a) Market Research by Covered Platforms.--The Federal Trade
Commission, in consultation with the Secretary of Commerce, shall issue
guidance for covered platforms seeking to conduct market- and product-
focused research on minors. Such guidance shall include--
(1) a standard consent form that provides minors and their
parents a clear, conspicuous, and easy-to-understand
explanation of the scope and purpose of the research to be
conducted that is available in English and the top 5 non-
English languages used in the United States;
(2) information on how to obtain informed consent from the
parent of a minor prior to conducting such market- and product-
focused research; and
(3) recommendations for research practices for studies that
may include minors, disaggregated by the age ranges of 0-5, 6-
9, 10-12, and 13-16.
(b) Timing.--The Federal Trade Commission shall issue such guidance
not later than 18 months after the date of enactment of this Act. In
doing so, they shall seek input from members of the public and the
representatives of the Kids Online Safety Council established under
section 111.
SEC. 108. AGE VERIFICATION STUDY AND REPORT.
(a) Study.--The Secretary of Commerce, in coordination with the
Federal Communications Commission and the Federal Trade Commission,
shall conduct a study evaluating the most technologically feasible
methods and options for developing systems to verify age at the device
or operating system level.
(b) Contents.--Such study shall consider --
(1) the benefits of creating a device or operating system
level age verification system;
(2) what information may need to be collected to create
this type of age verification system;
(3) the accuracy of such systems and their impact or steps
to improve accessibility, including for individuals with
disabilities;
(4) how such a system or systems could verify age while
mitigating risks to user privacy and data security and
safeguarding minors' personal data, emphasizing minimizing the
amount of data collected and processed by covered platforms and
age verification providers for such a system;
(5) the technical feasibility, including the need for
potential hardware and software changes, including for devices
currently in commerce and owned by consumers; and
(6) the impact of different age verification systems on
competition, particularly the risk of different age
verification systems creating barriers to entry for small
companies.
(c) Report.--Not later than 1 year after the date of enactment of
this Act, the agencies described in subsection (a) shall submit a
report containing the results of the study conducted under such
subsection to the Committee on Commerce, Science, and Transportation of
the Senate and the Committee on Energy and Commerce of the House of
Representatives.
SEC. 109. GUIDANCE.
(a) In General.--Not later than 18 months after the date of
enactment of this Act, the Federal Trade Commission, in consultation
with the Kids Online Safety Council established under section 111,
shall issue guidance to--
(1) provide information and examples for covered platforms
and auditors regarding the following, with consideration given
to differences across English and non-English languages--
(A) identifying design features that encourage or
increase the frequency, time spent, or activity of
minors on the covered platform;
(B) safeguarding minors against the possible misuse
of parental tools;
(C) best practices in providing minors and parents
the most protective level of control over privacy and
safety;
(D) using indicia or inferences of age of users for
assessing use of the covered platform by minors;
(E) methods for evaluating the efficacy of
safeguards set forth in this subtitle; and
(F) providing additional parental tool options that
allow parents to address the harms described in section
102(a); and
(2) outline conduct that does not have the purpose or
substantial effect of subverting or impairing user autonomy,
decision-making, or choice, or of causing, increasing, or
encouraging compulsive usage for a minor, such as--
(A) de minimis user interface changes derived from
testing consumer preferences, including different
styles, layouts, or text, where such changes are not
done with the purpose of weakening or disabling
safeguards or parental tools;
(B) algorithms or data outputs outside the control
of a covered platform; and
(C) establishing default settings that provide
enhanced privacy protection to users or otherwise
enhance their autonomy and decision-making ability.
(b) Guidance on Knowledge Standard.--Not later than 18 months after
the date of enactment of this Act, the Federal Trade Commission shall
issue guidance to provide information, including best practices and
examples, for covered platforms to understand how the Commission would
determine whether a covered platform ``had knowledge fairly implied on
the basis of objective circumstances'' for purposes of this subtitle.
(c) Limitation on Federal Trade Commission Guidance.--
(1) Effect of guidance.--No guidance issued by the Federal
Trade Commission with respect to this subtitle shall--
(A) confer any rights on any person, State, or
locality; or
(B) operate to bind the Federal Trade Commission or
any court, person, State, or locality to the approach
recommended in such guidance.
(2) Use in enforcement actions.--In any enforcement action
brought pursuant to this subtitle, the Federal Trade Commission
or a State attorney general, as applicable--
(A) shall allege a violation of a provision of this
subtitle; and
(B) may not base such enforcement action on, or
execute a consent order based on, practices that are
alleged to be inconsistent with guidance issued by the
Federal Trade Commission with respect to this subtitle,
unless the practices are alleged to violate a provision
of this subtitle.
For purposes of enforcing this subtitle, State attorneys
general shall take into account any guidance issued by the
Commission under subsection (b).
SEC. 110. ENFORCEMENT.
(a) Enforcement by Federal Trade Commission.--
(1) Unfair and deceptive acts or practices.--A violation of
this subtitle shall be treated as a violation of a rule
defining an unfair or deceptive act or practice prescribed
under section 18(a)(1)(B) of the Federal Trade Commission Act
(15 U.S.C. 57a(a)(1)(B)).
(2) Powers of the commission.--
(A) In general.--The Federal Trade Commission
(referred to in this section as the ``Commission'')
shall enforce this subtitle in the same manner, by the
same means, and with the same jurisdiction, powers, and
duties as though all applicable terms and provisions of
the Federal Trade Commission Act (15 U.S.C. 41 et seq.)
were incorporated into and made a part of this
subtitle.
(B) Privileges and immunities.--Any person that
violates this subtitle shall be subject to the
penalties, and entitled to the privileges and
immunities, provided in the Federal Trade Commission
Act (15 U.S.C. 41 et seq.).
(3) Authority preserved.--Nothing in this subtitle shall be
construed to limit the authority of the Commission under any
other provision of law.
(b) Enforcement by State Attorneys General.--
(1) In general.--
(A) Civil actions.--In any case in which the
attorney general of a State has reason to believe that
a covered platform has violated or is violating section
103, 104, or 105, the State, as parens patriae, may
bring a civil action on behalf of the residents of the
State in a district court of the United States or a
State court of appropriate jurisdiction to--
(i) enjoin any practice that violates
section 103, 104, or 105;
(ii) enforce compliance with section 103,
104, or 105;
(iii) on behalf of residents of the State,
obtain damages, restitution, or other
compensation, each of which shall be
distributed in accordance with State law; or
(iv) obtain such other relief as the court
may consider to be appropriate.
(B) Notice.--
(i) In general.--Before filing an action
under subparagraph (A), the attorney general of
the State involved shall provide to the
Commission--
(I) written notice of that action;
and
(II) a copy of the complaint for
that action.
(ii) Exemption.--
(I) In general.--Clause (i) shall
not apply with respect to the filing of
an action by an attorney general of a
State under this paragraph if the
attorney general of the State
determines that it is not feasible to
provide the notice described in that
clause before the filing of the action.
(II) Notification.--In an action
described in subclause (I), the
attorney general of a State shall
provide notice and a copy of the
complaint to the Commission at the same
time as the attorney general files the
action.
(2) Intervention.--
(A) In general.--On receiving notice under
paragraph (1)(B), the Commission shall have the right
to intervene in the action that is the subject of the
notice.
(B) Effect of intervention.--If the Commission
intervenes in an action under paragraph (1), it shall
have the right--
(i) to be heard with respect to any matter
that arises in that action; and
(ii) to file a petition for appeal.
(3) Construction.--For purposes of bringing any civil
action under paragraph (1), nothing in this subtitle shall be
construed to prevent an attorney general of a State from
exercising the powers conferred on the attorney general by the
laws of that State to--
(A) conduct investigations;
(B) administer oaths or affirmations; or
(C) compel the attendance of witnesses or the
production of documentary and other evidence.
(4) Actions by the commission.--In any case in which an
action is instituted by or on behalf of the Commission for
violation of this subtitle, no State may, during the pendency
of that action, institute a separate action under paragraph (1)
against any defendant named in the complaint in the action
instituted by or on behalf of the Commission for that
violation.
(5) Venue; service of process.--
(A) Venue.--Any action brought under paragraph (1)
may be brought in--
(i) the district court of the United States
that meets applicable requirements relating to
venue under section 1391 of title 28, United
States Code; or
(ii) a State court of competent
jurisdiction.
(B) Service of process.--In an action brought under
paragraph (1) in a district court of the United States,
process may be served wherever defendant--
(i) is an inhabitant; or
(ii) may be found.
(6) Limitation.--A violation of section 102 shall not form
the basis of liability in any action brought by the attorney
general of a State under a State law.
SEC. 111. KIDS ONLINE SAFETY COUNCIL.
(a) Establishment.--Not later than 180 days after the date of
enactment of this Act, the Secretary of Commerce shall establish and
convene the Kids Online Safety Council for the purpose of providing
advice on matters related to this subtitle.
(b) Participation.--The Kids Online Safety Council shall include
diverse participation from--
(1) academic experts, health professionals, and members of
civil society with expertise in mental health, substance use
disorders, and the prevention of harms to minors;
(2) representatives in academia and civil society with
specific expertise in privacy, free expression, access to
information, and civil liberties;
(3) parents and youth representation;
(4) representatives of covered platforms;
(5) representatives of the National Telecommunications and
Information Administration, the National Institute of Standards
and Technology, the Federal Trade Commission, the Department of
Justice, and the Department of Health and Human Services;
(6) State attorneys general or their designees acting in
State or local government;
(7) educators; and
(8) representatives of communities of socially
disadvantaged individuals (as defined in section 8 of the Small
Business Act (15 U.S.C. 637)).
(c) Activities.--The matters to be addressed by the Kids Online
Safety Council shall include--
(1) identifying emerging or current risks of harms to
minors associated with online platforms;
(2) recommending measures and methods for assessing,
preventing, and mitigating harms to minors online;
(3) recommending methods and themes for conducting research
regarding online harms to minors, including in English and non-
English languages; and
(4) recommending best practices and clear, consensus-based
technical standards for transparency reports and audits, as
required under this subtitle, including methods, criteria, and
scope to promote overall accountability.
(d) Non-applicability of FACA.--The Kids Online Safety Council
shall not be subject to chapter 10 of title 5, United States Code
(commonly referred to as the ``Federal Advisory Committee Act'').
SEC. 112. EFFECTIVE DATE.
Except as otherwise provided in this subtitle, this subtitle shall
take effect on the date that is 18 months after the date of enactment
of this Act.
SEC. 113. RULES OF CONSTRUCTION AND OTHER MATTERS.
(a) Relationship to Other Laws.--Nothing in this subtitle shall be
construed to--
(1) preempt section 444 of the General Education Provisions
Act (20 U.S.C. 1232g, commonly known as the ``Family
Educational Rights and Privacy Act of 1974'') or other Federal
or State laws governing student privacy;
(2) preempt the Children's Online Privacy Protection Act of
1998 (15 U.S.C. 6501 et seq.) or any rule or regulation
promulgated under such Act;
(3) authorize any action that would conflict with section
18(h) of the Federal Trade Commission Act (15 U.S.C. 57a(h));
or
(4) expand or limit the scope of section 230 of the
Communications Act of 1934 (commonly known as ``section 230 of
the Communications Decency Act of 1996'') (47 U.S.C. 230).
(b) Determination of ``Fairly Implied on the Basis of Objective
Circumstances''.--For purposes of enforcing this subtitle, in making a
determination as to whether covered platform has knowledge fairly
implied on the basis of objective circumstances that a specific user is
a minor, the Federal Trade Commission or a State attorney general shall
rely on competent and reliable evidence, taking into account the
totality of the circumstances, including whether a reasonable and
prudent person under the circumstances would have known that the user
is a minor.
(c) Protections for Privacy.--Nothing in this subtitle, including a
determination described in subsection (b), shall be construed to
require--
(1) the affirmative collection of any personal data with
respect to the age of users that a covered platform is not
already collecting in the normal course of business; or
(2) a covered platform to implement an age gating or age
verification functionality.
(d) Compliance.--Nothing in this subtitle shall be construed to
restrict a covered platform's ability to--
(1) cooperate with law enforcement agencies regarding
activity that the covered platform reasonably and in good faith
believes may violate Federal, State, or local laws, rules, or
regulations;
(2) comply with a lawful civil, criminal, or regulatory
inquiry, subpoena, or summons by Federal, State, local, or
other government authorities; or
(3) investigate, establish, exercise, respond to, or defend
against legal claims.
(e) Application to Video Streaming Services.--A video streaming
service shall be deemed to be in compliance with this subtitle if it
predominantly consists of news, sports, entertainment, or other video
programming content that is preselected by the provider and not user-
generated, and--
(1) any chat, comment, or interactive functionality is
provided incidental to, directly related to, or dependent on
provision of such content;
(2) if such video streaming service requires account owner
registration and is not predominantly news or sports, the
service includes the capability--
(A) to limit a minor's access to the service, which
may utilize a system of age-rating;
(B) to limit the automatic playing of on-demand
content selected by a personalized recommendation
system for an individual that the service knows is a
minor;
(C) for a parent to manage a minor's privacy and
account settings, and restrict purchases and financial
transactions by a minor, where applicable;
(D) to provide an electronic point of contact
specific to matters described in this paragraph;
(E) to offer a clear, conspicuous, and easy-to-
understand notice of its policies and practices with
respect to the capabilities described in this
paragraph; and
(F) when providing on-demand content, to employ
measures that safeguard against serving advertising for
narcotic drugs (as defined in section 102 of the
Controlled Substances Act (21 U.S.C. 802)), tobacco
products, gambling, or alcohol directly to the account
or profile of an individual that the service knows is a
minor.
Subtitle B--Filter Bubble Transparency
SEC. 120. DEFINITIONS.
In this subtitle:
(1) Algorithmic ranking system.--The term ``algorithmic
ranking system'' means a computational process, including one
derived from algorithmic decision-making, machine learning,
statistical analysis, or other data processing or artificial
intelligence techniques, used to determine the selection,
order, relative prioritization, or relative prominence of
content from a set of information that is provided to a user on
an online platform, including the ranking of search results,
the provision of content recommendations, the display of social
media posts, or any other method of automated content
selection.
(2) Approximate geolocation information.--The term
``approximate geolocation information'' means information that
identifies the location of an individual, but with a precision
of less than 5 miles.
(3) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(4) Connected device.--The term ``connected device'' means
an electronic device that--
(A) is capable of connecting to the internet,
either directly or indirectly through a network, to
communicate information at the direction of an
individual;
(B) has computer processing capabilities for
collecting, sending, receiving, or analyzing data; and
(C) is primarily designed for or marketed to
consumers.
(5) Input-transparent algorithm.--
(A) In general.--The term ``input-transparent
algorithm'' means an algorithmic ranking system that
does not use the user-specific data of a user to
determine the selection, order, relative
prioritization, or relative prominence of information
that is furnished to such user on an online platform,
unless the user-specific data is expressly provided to
the platform by the user for such purpose.
(B) Data expressly provided to the platform.--For
purposes of subparagraph (A), user-specific data that
is provided by a user for the express purpose of
determining the selection, order, relative
prioritization, or relative prominence of information
that is furnished to such user on an online platform--
(i) shall include user-supplied search
terms, filters, speech patterns (if provided
for the purpose of enabling the platform to
accept spoken input or selecting the language
in which the user interacts with the platform),
saved preferences, the resumption of a previous
search, and the current precise geolocation
information that is supplied by the user;
(ii) shall include the user's current
approximate geolocation information;
(iii) shall include data submitted to the
platform by the user that expresses the user's
desire to receive particular information, such
as the social media profiles the user follows,
the video channels the user subscribes to, or
other content or sources of content on the
platform the user has selected;
(iv) shall not include the history of the
user's connected device, including the user's
history of web searches and browsing, previous
geographical locations, physical activity,
device interaction, and financial transactions;
and
(v) shall not include inferences about the
user or the user's connected device, without
regard to whether such inferences are based on
data described in clause (i) or (iii).
(6) Online platform.--The term ``online platform'' means
any public-facing website, online service, online application,
or mobile application that predominantly provides a community
forum for user-generated content, such as sharing videos,
images, games, audio files, or other content, including a
social media service, social network, or virtual reality
environment.
(7) Opaque algorithm.--
(A) In general.--The term ``opaque algorithm''
means an algorithmic ranking system that determines the
selection, order, relative prioritization, or relative
prominence of information that is furnished to such
user on an online platform based, in whole or part, on
user-specific data that was not expressly provided by
the user to the platform for such purpose.
(B) Exception for age-appropriate content
filters.--Such term shall not include an algorithmic
ranking system used by an online platform if--
(i) the only user-specific data (including
inferences about the user) that the system uses
is information relating to the age of the user;
and
(ii) such information is only used to
restrict a user's access to content on the
basis that the individual is not old enough to
access such content.
(8) Precise geolocation information.--The term ``precise
geolocation information'' means geolocation information that
identifies an individual's location to within a range of 5
miles or less.
(9) User-specific data.--The term ``user-specific data''
means information relating to an individual or a specific
connected device that would not necessarily be true of every
individual or device.
SEC. 121. REQUIREMENT TO ALLOW USERS TO SEE UNMANIPULATED CONTENT ON
INTERNET PLATFORMS.
(a) In General.--Beginning on the date that is 1 year after the
date of enactment of this Act, it shall be unlawful for any person to
operate an online platform that uses an opaque algorithm unless the
person complies with the requirements of subsection (b).
(b) Opaque Algorithm Requirements.--
(1) In general.--The requirements of this subsection with
respect to a person that operates an online platform that uses
an opaque algorithm are the following:
(A) The person provides users of the platform with
the following notices:
(i) Notice that the platform uses an opaque
algorithm that uses user-specific data to
select the content the user sees. Such notice
shall be presented in a clear and conspicuous
manner on the platform whenever the user
interacts with an opaque algorithm for the
first time, and may be a one-time notice that
can be dismissed by the user.
(ii) Notice, to be included in the terms
and conditions of the online platform, in a
clear, accessible, and easily comprehensible
manner that is to be updated whenever the
online platform makes a material change, of--
(I) the most salient features,
inputs, and parameters used by the
algorithm;
(II) how any user-specific data
used by the algorithm is collected or
inferred about a user of the platform,
and the categories of such data;
(III) any options that the online
platform makes available for a user of
the platform to opt out or exercise
options under subparagraph (B), modify
the profile of the user or to influence
the features, inputs, or parameters
used by the algorithm; and
(IV) any quantities, such as time
spent using a product or specific
measures of engagement or social
interaction, that the algorithm is
designed to optimize, as well as a
general description of the relative
importance of each quantity for such
ranking.
(B) The online platform enables users to easily
switch between the opaque algorithm and an input-
transparent algorithm in their use of the platform.
(2) Rule of construction.--Nothing in this subsection shall
be construed to require an online platform to disclose any
information, including data or algorithms--
(A) relating to a trade secret or other protected
intellectual property;
(B) that is confidential business information; or
(C) that is privileged.
(3) Prohibition on differential pricing.--An online
platform shall not deny, charge different prices or rates for,
or condition the provision of a service or product to a user
based on the user's election to use an input-transparent
algorithm in their use of the platform, as provided under
paragraph (1)(B).
(c) Enforcement by Federal Trade Commission.--
(1) Unfair or deceptive acts or practices.--A violation of
this section by an operator of an online platform shall be
treated as a violation of a rule defining an unfair or
deceptive act or practice prescribed under section 18(a)(1)(B)
of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
(2) Powers of commission.--
(A) In general.--The Federal Trade Commission shall
enforce this section in the same manner, by the same
means, and with the same jurisdiction, powers, and
duties as though all applicable terms and provisions of
the Federal Trade Commission Act (15 U.S.C. 41 et seq.)
were incorporated into and made a part of this section.
(B) Privileges and immunities.--Any person who
violates this section shall be subject to the penalties
and entitled to the privileges and immunities provided
in the Federal Trade Commission Act (15 U.S.C. 41 et
seq.).
(C) Authority preserved.--Nothing in this section
shall be construed to limit the authority of the
Commission under any other provision of law.
(d) Rule of Construction to Preserve Personalized Blocks.--Nothing
in this section shall be construed to limit or prohibit an online
platform's ability to, at the direction of an individual user or group
of users, restrict another user from searching for, finding, accessing,
or interacting with such user's or group's account, content, data, or
online community.
Subtitle C--Relationship to State Laws; Severability
SEC. 130. RELATIONSHIP TO STATE LAWS.
The provisions of this title shall preempt any State law, rule, or
regulation only to the extent that such State law, rule, or regulation
conflicts with a provision of this title. Nothing in this title shall
be construed to prohibit a State from enacting a law, rule, or
regulation that provides greater protection to minors than the
protection provided by the provisions of this title.
SEC. 131. SEVERABILITY.
If any provision of this title, or an amendment made by this title,
is determined to be unenforceable or invalid, the remaining provisions
of this title and the amendments made by this title shall not be
affected.
TITLE II--CHILDREN AND TEEN'S ONLINE PRIVACY
SEC. 201. ONLINE COLLECTION, USE, DISCLOSURE, AND DELETION OF PERSONAL
INFORMATION OF CHILDREN AND TEENS.
(a) Definitions.--Section 1302 of the Children's Online Privacy
Protection Act of 1998 (15 U.S.C. 6501) is amended--
(1) by amending paragraph (2) to read as follows:
``(2) Operator.--The term `operator'--
``(A) means any person--
``(i) who, for commercial purposes, in
interstate or foreign commerce operates or
provides a website on the internet, an online
service, an online application, or a mobile
application; and
``(ii) who--
``(I) collects or maintains, either
directly or through a service provider,
personal information from or about the
users of that website, service, or
application;
``(II) allows another person to
collect personal information directly
from users of that website, service, or
application (in which case, the
operator is deemed to have collected
the information); or
``(III) allows users of that
website, service, or application to
publicly disclose personal information
(in which case, the operator is deemed
to have collected the information); and
``(B) does not include any nonprofit entity that
would otherwise be exempt from coverage under section 5
of the Federal Trade Commission Act (15 U.S.C. 45).'';
(2) in paragraph (4)--
(A) by amending subparagraph (A) to read as
follows:
``(A) the release of personal information collected
from a child or teen by an operator for any purpose,
except where the personal information is provided to a
person other than an operator who--
``(i) provides support for the internal
operations of the website, online service,
online application, or mobile application of
the operator, excluding any activity relating
to individual-specific advertising to children
or teens; and
``(ii) does not disclose or use that
personal information for any other purpose;
and''; and
(B) in subparagraph (B)--
(i) by inserting ``or teen'' after
``child'' each place the term appears;
(ii) by striking ``website or online
service'' and inserting ``website, online
service, online application, or mobile
application''; and
(iii) by striking ``actual knowledge'' and
inserting ``actual knowledge or knowledge
fairly implied on the basis of objective
circumstances'';
(3) by striking paragraph (8) and inserting the following:
``(8) Personal information.--
``(A) In general.--The term `personal information'
means individually identifiable information about an
individual collected online, including--
``(i) a first and last name;
``(ii) a home or other physical address
including street name and name of a city or
town;
``(iii) an e-mail address;
``(iv) a telephone number;
``(v) a Social Security number;
``(vi) any other identifier that the
Commission determines permits the physical or
online contacting of a specific individual;
``(vii) a persistent identifier that can be
used to recognize a specific child or teen over
time and across different websites, online
services, online applications, or mobile
applications, including but not limited to a
customer number held in a cookie, an Internet
Protocol (IP) address, a processor or device
serial number, or unique device identifier, but
excluding an identifier that is used by an
operator solely for providing support for the
internal operations of the website, online
service, online application, or mobile
application;
``(viii) a photograph, video, or audio file
where such file contains a specific child's or
teen's image or voice;
``(ix) geolocation information;
``(x) information generated from the
measurement or technological processing of an
individual's biological, physical, or
physiological characteristics that is used to
identify an individual, including--
``(I) fingerprints;
``(II) voice prints;
``(III) iris or retina imagery
scans;
``(IV) facial templates;
``(V) deoxyribonucleic acid (DNA)
information; or
``(VI) gait; or
``(xi) information linked or reasonably
linkable to a child or teen or the parents of
that child or teen (including any unique
identifier) that an operator collects online
from the child or teen and combines with an
identifier described in this subparagraph.
``(B) Exclusion.--The term `personal information'
shall not include an audio file that contains a child's
or teen's voice so long as the operator--
``(i) does not request information via
voice that would otherwise be considered
personal information under this paragraph;
``(ii) provides clear notice of its
collection and use of the audio file and its
deletion policy in its privacy policy;
``(iii) only uses the voice within the
audio file solely as a replacement for written
words, to perform a task, or engage with a
website, online service, online application, or
mobile application, such as to perform a search
or fulfill a verbal instruction or request; and
``(iv) only maintains the audio file long
enough to complete the stated purpose and then
immediately deletes the audio file and does not
make any other use of the audio file prior to
deletion.
``(C) Support for the internal operations of a
website, online service, online application, or mobile
application.--
``(i) In general.--For purposes of
subparagraph (A)(vii), the term `support for
the internal operations of a website, online
service, online application, or mobile
application' means those activities necessary
to--
``(I) maintain or analyze the
functioning of the website, online
service, online application, or mobile
application;
``(II) perform network
communications;
``(III) authenticate users of, or
personalize the content on, the
website, online service, online
application, or mobile application;
``(IV) serve contextual
advertising, provided that any
persistent identifier is only used as
necessary for technical purposes to
serve the contextual advertisement, or
cap the frequency of advertising;
``(V) protect the security or
integrity of the user, website, online
service, online application, or mobile
application;
``(VI) ensure legal or regulatory
compliance, or
``(VII) fulfill a request of a
child or teen as permitted by
subparagraphs (A) through (C) of
section 1303(b)(2).
``(ii) Condition.--Except as specifically
permitted under clause (i), information
collected for the activities listed in clause
(i) cannot be used or disclosed to contact a
specific individual, including through
individual-specific advertising to children or
teens, to amass a profile on a specific
individual, in connection with processes that
encourage or prompt use of a website or online
service, or for any other purpose.'';
(4) by amending paragraph (9) to read as follows:
``(9) Verifiable consent.--The term `verifiable consent'
means any reasonable effort (taking into consideration
available technology), including a request for authorization
for future collection, use, and disclosure described in the
notice, to ensure that, in the case of a child, a parent of the
child, or, in the case of a teen, the teen--
``(A) receives direct notice of the personal
information collection, use, and disclosure practices
of the operator; and
``(B) before the personal information of the child
or teen is collected, freely and unambiguously
authorizes--
``(i) the collection, use, and disclosure,
as applicable, of that personal information;
and
``(ii) any subsequent use of that personal
information.'';
(5) in paragraph (10)--
(A) in the paragraph header, by striking ``Website
or online service directed to children'' and inserting
``Website, online service, online application, or
mobile application directed to children'';
(B) by striking ``website or online service'' each
place it appears and inserting ``website, online
service, online application, or mobile application'';
and
(C) by adding at the end the following new
subparagraph:
``(C) Rule of construction.--In considering whether
a website, online service, online application, or
mobile application, or portion thereof, is directed to
children, the Commission shall apply a totality of
circumstances test and will also consider competent and
reliable empirical evidence regarding audience
composition and evidence regarding the intended
audience of the website, online service, online
application, or mobile application.''; and
(6) by adding at the end the following:
``(13) Connected device.--The term `connected device' means
a device that is capable of connecting to the internet,
directly or indirectly, or to another connected device.
``(14) Online application.--The term `online application'--
``(A) means an internet-connected software program;
and
``(B) includes a service or application offered via
a connected device.
``(15) Mobile application.--The term `mobile application'--
``(A) means a software program that runs on the
operating system of--
``(i) a cellular telephone;
``(ii) a tablet computer; or
``(iii) a similar portable computing device
that transmits data over a wireless connection;
and
``(B) includes a service or application offered via
a connected device.
``(16) Geolocation information.--The term `geolocation
information' means information sufficient to identify a street
name and name of a city or town.
``(17) Teen.--The term `teen' means an individual who has
attained age 13 and is under the age of 17.
``(18) Individual-specific advertising to children or
teens.--
``(A) In general.--The term `individual-specific
advertising to children or teens' means advertising or
any other effort to market a product or service that is
directed to a specific child or teen or a connected
device that is linked or reasonably linkable to a child
or teen based on--
``(i) the personal information from--
``(I) the child or teen; or
``(II) a group of children or teens
who are similar in sex, age, household
income level, race, or ethnicity to the
specific child or teen to whom the
product or service is marketed;
``(ii) profiling of a child or teen or
group of children or teens; or
``(iii) a unique identifier of the
connected device.
``(B) Exclusions.--The term `individual-specific
advertising to children or teens' shall not include--
``(i) advertising or marketing to an
individual or the device of an individual in
response to the individual's specific request
for information or feedback, such as a child's
or teen's current search query;
``(ii) contextual advertising, such as when
an advertisement is displayed based on the
content of the website, online service, online
application, mobile application, or connected
device in which the advertisement appears and
does not vary based on personal information
related to the viewer; or
``(iii) processing personal information
solely for measuring or reporting advertising
or content performance, reach, or frequency,
including independent measurement.
``(C) Rule of construction.--Nothing in
subparagraph (A) shall be construed to prohibit an
operator with actual knowledge or knowledge fairly
implied on the basis of objective circumstances that a
user is under the age of 17 from delivering advertising
or marketing that is age-appropriate and intended for a
child or teen audience, so long as the operator does
not use any personal information other than whether the
user is under the age of 17.''.
(b) Online Collection, Use, Disclosure, and Deletion of Personal
Information of Children and Teens.--Section 1303 of the Children's
Online Privacy Protection Act of 1998 (15 U.S.C. 6502) is amended--
(1) by striking the heading and inserting the following:
``online collection, use, disclosure, and deletion of personal
information of children and teens.'';
(2) in subsection (a)--
(A) by amending paragraph (1) to read as follows:
``(1) In general.--It is unlawful for an operator of a
website, online service, online application, or mobile
application directed to children or for any operator of a
website, online service, online application, or mobile
application with actual knowledge or knowledge fairly implied
on the basis of objective circumstances that a user is a child
or teen--
``(A) to collect personal information from a child
or teen in a manner that violates the regulations
prescribed under subsection (b);
``(B) except as provided in subparagraphs (B) and
(C) of section 1302(18), to collect, use, disclose to
third parties, or maintain personal information of a
child or teen for purposes of individual-specific
advertising to children or teens (or to allow another
person to collect, use, disclose, or maintain such
information for such purpose);
``(C) to collect the personal information of a
child or teen except when the collection of the
personal information is--
``(i) consistent with the context of a
particular transaction or service or the
relationship of the child or teen with the
operator, including collection necessary to
fulfill a transaction or provide a product or
service requested by the child or teen; or
``(ii) required or specifically authorized
by Federal or State law; or
``(D) to store or transfer the personal information
of a child or teen outside of the United States unless
the operator provides direct notice to the parent of
the child, in the case of a child, or to the teen, in
the case of a teen, that the child's or teen's personal
information is being stored or transferred outside of
the United States; or
``(E) to retain the personal information of a child
or teen for longer than is reasonably necessary to
fulfill a transaction or provide a service requested by
the child or teen except as required or specifically
authorized by Federal or State law.''; and
(B) in paragraph (2)--
(i) in the header, by striking ``parent''
and inserting ```parent or teen'''
(ii) by striking ``Notwithstanding
paragraph (1)'' and inserting ``Notwithstanding
paragraph (1)(A)'';
(iii) by striking ``of such a website or
online service''; and
(iv) by striking ``subsection
(b)(1)(B)(iii) to the parent of a child'' and
inserting ``subsection (b)(1)(B)(iv) to the
parent of a child or under subsection
(b)(1)(C)(iv) to a teen'';
(3) in subsection (b)--
(A) in paragraph (1)--
(i) in subparagraph (A)--
(I) by striking ``operator of any
website'' and all that follows through
``from a child'' and inserting
``operator of a website, online
service, online application, or mobile
application directed to children or
that has actual knowledge or knowledge
fairly implied on the basis of
objective circumstances that a user is
a child or teen'';
(II) in clause (i)--
(aa) by striking ``notice
on the website'' and inserting
``clear and conspicuous notice
on the website'';
(bb) by inserting ``or
teens'' after ``children'';
(cc) by striking ``, and
the operator's'' and inserting
``, the operator's''; and
(dd) by striking ``; and''
and inserting ``, the rights
and opportunities available to
the parent of the child or teen
under subparagraphs (B) and
(C), and the procedures or
mechanisms the operator uses to
ensure that personal
information is not collected
from children or teens except
in accordance with the
regulations promulgated under
this paragraph;'';
(III) in clause (ii)--
(aa) by striking
``parental'';
(bb) by inserting ``or
teens'' after ``children'';
(cc) by striking the
semicolon at the end and
inserting ``; and''; and
(IV) by inserting after clause (ii)
the following new clause:
``(iii) to obtain verifiable consent from a
parent of a child or from a teen before using
or disclosing personal information of the child
or teen for any purpose that is a material
change from the original purposes and
disclosure practices specified to the parent of
the child or the teen under clause (i);'';
(ii) in subparagraph (B)--
(I) in the matter preceding clause
(i), by striking ``website or online
service'' and inserting ``operator'';
(II) in clause (i), by inserting
``and the method by which the operator
obtained the personal information, and
the purposes for which the operator
collects, uses, discloses, and retains
the personal information'' before the
semicolon;
(III) in clause (ii)--
(aa) by inserting ``to
delete personal information
collected from the child or
content or information
submitted by the child to a
website, online service, online
application, or mobile
application and'' after ``the
opportunity at any time''; and
(bb) by striking ``; and''
and inserting a semicolon;
(IV) by redesignating clause (iii)
as clause (iv) and inserting after
clause (ii) the following new clause:
``(iii) the opportunity to challenge the
accuracy of the personal information and, if
the parent of the child establishes the
inaccuracy of the personal information, to have
the inaccurate personal information
corrected;''; and
(V) in clause (iv), as so
redesignated, by inserting ``, if such
information is available to the
operator at the time the parent makes
the request'' before the semicolon;
(iii) by redesignating subparagraphs (C)
and (D) as subparagraphs (D) and (E),
respectively;
(iv) by inserting after subparagraph (B)
the following new subparagraph:
``(C) require the operator to provide, upon the
request of a teen under this subparagraph who has
provided personal information to the operator, upon
proper identification of that teen--
``(i) a description of the specific types
of personal information collected from the teen
by the operator, the method by which the
operator obtained the personal information, and
the purposes for which the operator collects,
uses, discloses, and retains the personal
information;
``(ii) the opportunity at any time to
delete personal information collected from the
teen or content or information submitted by the
teen to a website, online service, online
application, or mobile application and to
refuse to permit the operator's further use or
maintenance in retrievable form, or online
collection, of personal information from the
teen;
``(iii) the opportunity to challenge the
accuracy of the personal information and, if
the teen establishes the inaccuracy of the
personal information, to have the inaccurate
personal information corrected; and
``(iv) a means that is reasonable under the
circumstances for the teen to obtain any
personal information collected from the teen,
if such information is available to the
operator at the time the teen makes the
request;'';
(v) in subparagraph (D), as so
redesignated--
(I) by striking ``a child's'' and
inserting ``a child's or teen's''; and
(II) by inserting ``or teen'' after
``the child''; and
(vi) by amending subparagraph (E), as so
redesignated, to read as follows:
``(E) require the operator to establish, implement,
and maintain reasonable security practices to protect
the confidentiality, integrity, and accessibility of
personal information of children or teens collected by
the operator, and to protect such personal information
against unauthorized access.'';
(B) in paragraph (2)--
(i) in the matter preceding subparagraph
(A), by striking ``verifiable parental
consent'' and inserting ``verifiable consent'';
(ii) in subparagraph (A)--
(I) by inserting ``or teen'' after
``collected from a child'';
(II) by inserting ``or teen'' after
``request from the child''; and
(III) by inserting ``or teen or to
contact another child or teen'' after
``to recontact the child'';
(iii) in subparagraph (B)--
(I) by striking ``parent or child''
and inserting ``parent or teen''; and
(II) by striking ``parental
consent'' each place the term appears
and inserting ``verifiable consent'';
(iv) in subparagraph (C)--
(I) in the matter preceding clause
(i), by inserting ``or teen'' after
``child'' each place the term appears;
(II) in clause (i)--
(aa) by inserting ``or
teen'' after ``child'' each
place the term appears; and
(bb) by inserting ``or
teen, as applicable,'' after
``parent'' each place the term
appears; and
(III) in clause (ii)--
(aa) by striking ``without
notice to the parent'' and
inserting ``without notice to
the parent or teen, as
applicable,''; and
(bb) by inserting ``or
teen'' after ``child'' each
place the term appears; and
(v) in subparagraph (D)--
(I) in the matter preceding clause
(i), by inserting ``or teen'' after
``child'' each place the term appears;
(II) in clause (ii), by inserting
``or teen'' after ``child''; and
(III) in the flush text following
clause (iii)--
(aa) by inserting ``or
teen, as applicable,'' after
``parent'' each place the term
appears; and
(bb) by inserting ``or
teen'' after ``child'';
(C) by redesignating paragraph (3) as paragraph (4)
and inserting after paragraph (2) the following new
paragraph:
``(3) Application to operators acting under agreements with
educational agencies or institutions.--The regulations may
provide that verifiable consent under paragraph (1)(A)(ii) is
not required for an operator that is acting under a written
agreement with an educational agency or institution (as defined
in section 444 of the General Education Provisions Act
(commonly known as the `Family Educational Rights and Privacy
Act of 1974') (20 U.S.C. 1232g(a)(3)) that, at a minimum,
requires the--
``(A) operator to--
``(i) limit its collection, use, and
disclosure of the personal information from a
child or teen to solely educational purposes
and for no other commercial purposes;
``(ii) provide the educational agency or
institution with a notice of the specific types
of personal information the operator will
collect from the child or teen, the method by
which the operator will obtain the personal
information, and the purposes for which the
operator will collect, use, disclose, and
retain the personal information;
``(iii) provide the educational agency or
institution with a link to the operator's
online notice of information practices as
required under subsection (b)(1)(A)(i); and
``(iv) provide the educational agency or
institution, upon request, with a means to
review the personal information collected from
a child or teen, to prevent further use or
maintenance or future collection of personal
information from a child or teen, and to delete
personal information collected from a child or
teen or content or information submitted by a
child or teen to the operator's website, online
service, online application, or mobile
application;
``(B) representative of the educational agency or
institution to acknowledge and agree that they have
authority to authorize the collection, use, and
disclosure of personal information from children or
teens on behalf of the educational agency or
institution, along with such authorization, their name,
and title at the educational agency or institution; and
``(C) educational agency or institution to--
``(i) provide on its website a notice that
identifies the operator with which it has
entered into a written agreement under this
subsection and provides a link to the
operator's online notice of information
practices as required under paragraph
(1)(A)(i);
``(ii) provide the operator's notice
regarding its information practices, as
required under subparagraph (A)(ii), upon
request, to a parent, in the case of a child,
or a parent or teen, in the case of a teen; and
``(iii) upon the request of a parent, in
the case of a child, or a parent or teen, in
the case of a teen, request the operator
provide a means to review the personal
information from the child or teen and provide
the parent, in the case of a child, or parent
or teen, in the case of the teen, a means to
review the personal information.'';
(D) by amending paragraph (4), as so redesignated,
to read as follows:
``(4) Termination of service.--The regulations shall permit
the operator of a website, online service, online application,
or mobile application to terminate service provided to a child
whose parent has refused, or a teen who has refused, under the
regulations prescribed under paragraphs (1)(B)(ii) and
(1)(C)(ii), to permit the operator's further use or maintenance
in retrievable form, or future online collection of, personal
information from that child or teen.''; and
(E) by adding at the end the following new
paragraphs:
``(5) Continuation of service.--The regulations shall
prohibit an operator from discontinuing service provided to a
child or teen on the basis of a request by the parent of the
child or by the teen, under the regulations prescribed under
subparagraph (B) or (C) of paragraph (1), respectively, to
delete personal information collected from the child or teen,
to the extent that the operator is capable of providing such
service without such information.
``(6) Rule of construction.--A request made pursuant to
subparagraph (B) or (C) of paragraph (1) to delete or correct
personal information of a child or teen shall not be
construed--
``(A) to limit the authority of a law enforcement
agency to obtain any content or information from an
operator pursuant to a lawfully executed warrant or an
order of a court of competent jurisdiction;
``(B) to require an operator or third party delete
or correct information that--
``(i) any other provision of Federal or
State law requires the operator or third party
to maintain; or
``(ii) was submitted to the website, online
service, online application, or mobile
application of the operator by any person other
than the user who is attempting to erase or
otherwise eliminate the content or information,
including content or information submitted by
the user that was republished or resubmitted by
another person; or
``(C) to prohibit an operator from--
``(i) retaining a record of the deletion
request and the minimum information necessary
for the purposes of ensuring compliance with a
request made pursuant to subparagraph (B) or
(C);
``(ii) preventing, detecting, protecting
against, or responding to security incidents,
identity theft, or fraud, or reporting those
responsible for such actions;
``(iii) protecting the integrity or
security of a website, online service, online
application or mobile application; or
``(iv) ensuring that the child's or teen's
information remains deleted.
``(7) Common verifiable consent mechanism.--
``(A) In general.--
``(i) Feasibility of mechanism.--The
Commission shall assess the feasibility, with
notice and public comment, of allowing
operators the option to use a common verifiable
consent mechanism that fully meets the
requirements of this title.
``(ii) Requirements.--The feasibility
assessment described in clause (i) shall
consider whether a single operator could use a
common verifiable consent mechanism to obtain
verifiable consent, as required under this
title, from a parent of a child or from a teen
on behalf of multiple, listed operators that
provide a joint or related service.
``(B) Report.--Not later than 1 year after the date
of enactment of this paragraph, the Commission shall
submit a report to the Committee on Commerce, Science,
and Transportation of the Senate and the Committee on
Energy and Commerce of the House of Representatives
with the findings of the assessment required by
subparagraph (A).
``(C) Regulations.--If the Commission finds that
the use of a common verifiable consent mechanism is
feasible and would meet the requirements of this title,
the Commission shall issue regulations to permit the
use of a common verifiable consent mechanism in
accordance with the findings outlined in such
report.'';
(4) in subsection (c), by striking ``a regulation
prescribed under subsection (a)'' and inserting ``subparagraph
(B), (C), (D), or (E) of subsection (a)(1), or of a regulation
prescribed under subsection (b),''; and
(5) by striking subsection (d) and inserting the following:
``(d) Relationship to State Law.--The provisions of this title
shall preempt any State law, rule, or regulation only to the extent
that such State law, rule, or regulation conflicts with a provision of
this title. Nothing in this title shall be construed to prohibit any
State from enacting a law, rule, or regulation that provides greater
protection to children or teens than the provisions of this title.''.
(c) Safe Harbors.--Section 1304 of the Children's Online Privacy
Protection Act of 1998 (15 U.S.C. 6503) is amended--
(1) in subsection (b)(1), by inserting ``and teens'' after
``children''; and
(2) by adding at the end the following:
``(d) Publication.--
``(1) In general.--Subject to the restrictions described in
paragraph (2), the Commission shall publish on the internet
website of the Commission any report or documentation required
by regulation to be submitted to the Commission to carry out
this section.
``(2) Restrictions on publication.--The restrictions
described in section 6(f) and section 21 of the Federal Trade
Commission Act (15 U.S.C. 46(f), 57b-2) applicable to the
disclosure of information obtained by the Commission shall
apply in same manner to the disclosure under this subsection of
information obtained by the Commission from a report or
documentation described in paragraph (1).''.
(d) Actions by States.--Section 1305 of the Children's Online
Privacy Protection Act of 1998 (15 U.S.C. 6504) is amended--
(1) in subsection (a)(1)--
(A) in the matter preceding subparagraph (A), by
inserting ``section 1303(a)(1) or'' before ``any
regulation''; and
(B) in subparagraph (B), by inserting ``section
1303(a)(1) or'' before ``the regulation''; and
(2) in subsection (d)--
(A) by inserting ``section 1303(a)(1) or'' before
``any regulation''; and
(B) by inserting ``section 1303(a)(1) or'' before
``that regulation''.
(e) Administration and Applicability of Act.--Section 1306 of the
Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6505) is
amended--
(1) in subsection (b)--
(A) in paragraph (1), by striking ``, in the case
of'' and all that follows through ``the Board of
Directors of the Federal Deposit Insurance
Corporation;'' and inserting the following: ``by the
appropriate Federal banking agency, with respect to any
insured depository institution (as those terms are
defined in section 3 of that Act (12 U.S.C. 1813));'';
and
(B) by striking paragraph (2) and redesignating
paragraphs (3) through (6) as paragraphs (2) through
(5), respectively;
(2) in subsection (d)--
(A) by inserting ``section 1303(a)(1) or'' before
``a rule''; and
(B) by striking ``such rule'' and inserting
``section 1303(a)(1) or a rule of the Commission under
section 1303''; and
(3) by adding at the end the following new subsections:
``(f) Determination of Whether an Operator Has Knowledge Fairly
Implied on the Basis of Objective Circumstances.--
``(1) Rule of construction.--For purposes of enforcing this
title or a regulation promulgated under this title, in making a
determination as to whether an operator has knowledge fairly
implied on the basis of objective circumstances that a specific
user is a child or teen, the Commission or State attorneys
general shall rely on competent and reliable evidence, taking
into account the totality of the circumstances, including
whether a reasonable and prudent person under the circumstances
would have known that the user is a child or teen. Nothing in
this title, including a determination described in the
preceding sentence, shall be construed to require an operator
to--
``(A) affirmatively collect any personal
information with respect to the age of a child or teen
that an operator is not already collecting in the
normal course of business; or
``(B) implement an age gating or age verification
functionality.
``(2) Commission guidance.--
``(A) In general.--Within 180 days of enactment,
the Commission shall issue guidance to provide
information, including best practices and examples for
operators to understand the Commission's determination
of whether an operator has knowledge fairly implied on
the basis of objective circumstances that a user is a
child or teen.
``(B) Limitation.--No guidance issued by the
Commission with respect to this title shall confer any
rights on any person, State, or locality, nor shall
operate to bind the Commission or any person to the
approach recommended in such guidance. In any
enforcement action brought pursuant to this title, the
Commission or State attorney general, as applicable,
shall allege a specific violation of a provision of
this title. The Commission or State attorney general,
as applicable, may not base an enforcement action on,
or execute a consent order based on, practices that are
alleged to be inconsistent with any such guidance,
unless the practices allegedly violate this title. For
purposes of enforcing this title or a regulation
promulgated under this title, State attorneys general
shall take into account any guidance issued by the
Commission under subparagraph (A).
``(g) Additional Requirement.--Any regulations issued under this
title shall include a description and analysis of the impact of
proposed and final Rules on small entities per the Regulatory
Flexibility Act of 1980 (5 U.S.C. 601 et seq.).''.
SEC. 202. STUDY AND REPORTS OF MOBILE AND ONLINE APPLICATION OVERSIGHT
AND ENFORCEMENT.
(a) Oversight Report.--Not later than 3 years after the date of
enactment of this Act, the Federal Trade Commission shall submit to the
Committee on Commerce, Science, and Transportation of the Senate and
the Committee on Energy and Commerce of the House of Representatives a
report on the processes of platforms that offer mobile and online
applications for ensuring that, of those applications that are
websites, online services, online applications, or mobile applications
directed to children, the applications operate in accordance with--
(1) this title, the amendments made by this title, and
rules promulgated under this title; and
(2) rules promulgated by the Commission under section 18 of
the Federal Trade Commission Act (15 U.S.C. 57a) relating to
unfair or deceptive acts or practices in marketing.
(b) Enforcement Report.--Not later than 1 year after the date of
enactment of this Act, and each year thereafter, the Federal Trade
Commission shall submit to the Committee on Commerce, Science, and
Transportation of the Senate and the Committee on Energy and Commerce
of the House of Representatives a report that addresses, at a minimum--
(1) the number of actions brought by the Commission during
the reporting year to enforce the Children's Online Privacy
Protection Act of 1998 (15 U.S.C. 6501) (referred to in this
subsection as the ``Act'') and the outcome of each such action;
(2) the total number of investigations or inquiries into
potential violations of the Act; during the reporting year;
(3) the total number of open investigations or inquiries
into potential violations of the Act as of the time the report
is submitted;
(4) the number and nature of complaints received by the
Commission relating to an allegation of a violation of the Act
during the reporting year; and
(5) policy or legislative recommendations to strengthen
online protections for children and teens.
SEC. 203. GAO STUDY.
(a) Study.--The Comptroller General of the United States (in this
section referred to as the ``Comptroller General'') shall conduct a
study on the privacy of teens who use financial technology products.
Such study shall--
(1) identify the type of financial technology products that
teens are using;
(2) identify the potential risks to teens' privacy from
using such financial technology products; and
(3) determine whether existing laws are sufficient to
address such risks to teens' privacy.
(b) Report.--Not later than 1 year after the date of enactment of
this section, the Comptroller General shall submit to Congress a report
containing the results of the study conducted under subsection (a),
together with recommendations for such legislation and administrative
action as the Comptroller General determines appropriate.
SEC. 204. SEVERABILITY.
If any provision of this title, or an amendment made by this title,
is determined to be unenforceable or invalid, the remaining provisions
of this title and the amendments made by this title shall not be
affected.
TITLE III--ELIMINATING USELESS REPORTS
SEC. 301. SUNSETS FOR AGENCY REPORTS.
(a) In General.--Section 1125 of title 31, United States Code, is
amended--
(1) by redesignating subsection (c) as subsection (d);
(2) by striking subsections (a) and (b) and inserting the
following:
``(a) Definitions.--In this section:
``(1) Budget justification materials.--The term `budget
justification materials' has the meaning given the term in
section 3(b)(2) of the Federal Funding Accountability and
Transparency Act of 2006 (31 U.S.C. 6101 note; Public Law 109-
282).
``(2) Plan or report.--The term `plan or report' means any
plan or report submitted to Congress, any committee of
Congress, or subcommittee thereof, by not less than 1 agency--
``(A) in accordance with Federal law; or
``(B) at the direction or request of a
congressional report.
``(3) Recurring plan or report.--The term `recurring plan
or report' means a plan or report submitted on a recurring
basis.
``(4) Relevant congressional committee.--The term `relevant
congressional committee'--
``(A) means a congressional committee to which a
recurring plan or report is required to be submitted;
and
``(B) does not include any plan or report that is
required to be submitted solely to the Committee on
Armed Services of the House of Representatives or the
Senate.
``(b) Agency Identification of Unnecessary Reports.--
``(1) In general.--The head of each agency shall include in
the budget justification materials of the agency the following:
``(A) Subject to paragraphs (2) and (3), the
following:
``(i) A list of each recurring plan or
report submitted by the agency.
``(ii) An identification of whether the
recurring plan or report listed in clause (i)
was included in the most recent report issued
by the Clerk of the House of Representatives
concerning the reports that any agency is
required by law or directed or requested by a
committee report to make to Congress, any
committee of Congress, or subcommittee thereof.
``(iii) If applicable, the unique
alphanumeric identifier for the recurring plan
or report as required by section
7243(b)(1)(C)(vii) of the James M. Inhofe
National Defense Authorization Act for Fiscal
Year 2023 (Public Law 117-263).
``(iv) The identification of any recurring
plan or report the head of the agency
determines to be outdated or duplicative.
``(B) With respect to each recurring plan or report
identified in subparagraph (A)(iv), the following:
``(i) A recommendation on whether to
sunset, modify, consolidate, or reduce the
frequency of the submission of the recurring
plan or report.
``(ii) A citation to each provision of law
or directive or request in a congressional
report that requires or requests the submission
of the recurring plan or report.
``(iii) A list of the relevant
congressional committees for the recurring plan
or report.
``(C) A justification explaining, with respect to
each recommendation described in subparagraph (B)(i)
relating to a recurring plan or report--
``(i) why the head of the agency made the
recommendation, which may include an estimate
of the resources expended by the agency to
prepare and submit the recurring plan or
report; and
``(ii) the understanding of the head of the
agency of the purpose of the recurring plan or
report.
``(2) Agency consultation.--
``(A) In general.--In preparing the list required
under paragraph (1)(A), if, in submitting a recurring
plan or report, an agency is required to coordinate or
consult with another agency or entity, the head of the
agency submitting the recurring plan or report shall
consult with the head of each agency or entity with
whom consultation or coordination is required.
``(B) Inclusion in list.--If, after a consultation
under subparagraph (A), the head of each agency or
entity consulted under that subparagraph agrees that a
recurring plan or report is outdated or duplicative,
the head of the agency required to submit the recurring
plan or report shall--
``(i) include the recurring plan or report
in the list described in paragraph (1)(A); and
``(ii) identify each agency or entity with
which the head of the agency is required to
coordinate or consult in submitting the
recurring plan or report.
``(C) Disagreement.--If the head of any agency or
entity consulted under subparagraph (A) does not agree
that a recurring plan or report is outdated or
duplicative, the head of the agency required to submit
the recurring plan or report shall not include the
recurring plan or report in the list described in
paragraph (1)(A).
``(3) Government-wide or multi-agency plan and report
submissions.--With respect to a recurring plan or report
required to be submitted by not less than 2 agencies, the
Director of the Office of Management and Budget shall--
``(A) determine whether the requirement to submit
the recurring plan or report is outdated or
duplicative; and
``(B) make recommendations to Congress accordingly.
``(4) Plan and report submissions conformity to the access
to congressionally mandated reports act.--With respect to an
agency recommendation, citation, or justification made under
subparagraph (B) or (C) of paragraph (1) or a recommendation by
the Director of the Office of Management and Budget under
paragraph (3), the agency or Director, as applicable, shall
also provide this information to the Director of the Government
Publishing Office in conformity with the agency submission
requirements under section 7244(a) of the James M. Inhofe
National Defense Authorization Act for Fiscal Year 2023 (Public
Law 117-263; chapter 41 of title 44 note) in conformity with
guidance issued by the Director of the Office of Management and
Budget under section 7244(b) of such Act.
``(c) Rule of Construction on Agency Requirements.--Nothing in this
section shall be construed to exempt the head of an agency from a
requirement to submit a recurring plan or report.''; and
(3) in subsection (d), as so redesignated, by striking ``in
the budget of the United States Government, as provided by
section 1105(a)(37)'' and inserting ``in the budget
justification materials of each agency''.
(b) Budget Contents.--Section 1105(a) of title 31, United States
Code, is amended by striking paragraph (39).
(c) Conformity to the Access to Congressionally Mandated Reports
Act.--
(1) Amendment.--Subsections (a) and (b) of section 7244 of
the James M. Inhofe National Defense Authorization Act for
Fiscal Year 2023 (Public Law 117-263; chapter 41 of title 44,
United States Code, note), are amended to read as follows:
``(a) Submission of Electronic Copies of Reports.--Not earlier than
30 days or later than 60 days after the date on which a congressionally
mandated report is submitted to either House of Congress or to any
committee of Congress or subcommittee thereof, the head of the Federal
agency submitting the congressionally mandated report shall submit to
the Director the information required under subparagraphs (A) through
(D) of section 7243(b)(1) with respect to the congressionally mandated
report. Notwithstanding section 7246, nothing in this subtitle shall
relieve a Federal agency of any other requirement to publish the
congressionally mandated report on the online portal of the Federal
agency or otherwise submit the congressionally mandated report to
Congress or specific committees of Congress, or subcommittees thereof.
``(b) Guidance.--Not later than 180 days after the date of the
enactment of this subsection and periodically thereafter as
appropriate, the Director of the Office of Management and Budget, in
consultation with the Director, shall issue guidance to agencies on the
implementation of this subtitle as well as the requirements of section
1125(b) of title 31, United States Code.''.
(2) Updated omb guidance.--Not later than 180 days after
the date of the enactment of this Act, the Director of the
Office of Management and Budget shall issue updated guidance to
agencies to ensure that the requirements under subsections (a)
and (b) of section 1125 of title 31, United States Code, as
amended by this Act, for agency submissions of recommendations
and justifications for plans and reports to sunset, modify,
consolidate, or reduce the frequency of the submission of are
also submitted as a separate attachment in conformity with the
agency submission requirements of electronic copies of reports
submitted by agencies under section 7244(a) of the James M.
Inhofe National Defense Authorization Act for Fiscal Year 2023
(Public Law 117-263; chapter 41 of title 44, United States
Code, note) for publication on the online portal established
under section 7243 of such Act.
Amend the title so as to read: ``An Act to protect the
safety and privacy of children on the internet.''.
Attest:
Secretary.
118th CONGRESS
2d Session
S. 2073
_______________________________________________________________________
SENATE AMENDMENTS TO HOUSE AMENDMENT