[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[H.R. 10207 Introduced in House (IH)]
<DOC>
119th CONGRESS
2d Session
H. R. 10207
To prohibit covered platforms from processing personal data with
respect to covered minors without obtaining the verifiable consent of a
parent of the covered minor, and for other purposes.
_______________________________________________________________________
IN THE HOUSE OF REPRESENTATIVES
September 1, 2026
Mrs. Houchin introduced the following bill; which was referred to the
Committee on Energy and Commerce
_______________________________________________________________________
A BILL
To prohibit covered platforms from processing personal data with
respect to covered minors without obtaining the verifiable consent of a
parent of the covered minor, and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Governing Underage Access and
Requiring Data Consent In All Networks Act'' or the ``GUARDIAN Act''.
SEC. 2. DEFINITIONS.
In this Act:
(1) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(2) Covered platform.--The term ``covered platform'' means
a platform that is a website, software, application, or
electronic service connected to the internet that meets the
following requirements:
(A) Is publicly available for use by consumers.
(B) Enables the creation of a username or user
identifier--
(i) that is searchable on the platform by
other users through a function made available
by the platform; and
(ii) that can be followed by or is
similarly accessible to other users of the
platform.
(C) As the primary purpose of the platform,
facilitates the sharing and access to user-generated
content through text, images, video, audio, or any
other interactive medium.
(D) Uses a design feature to promote user
engagement on the platform.
(E) Uses the personal information of the user to
advertise, market, or make content recommendations.
(3) Covered minor.--
(A) The term ``covered minor'' means a user who the
provider of a covered online platform knows or should
have known is under the age of 16.
(B) Notwithstanding subparagraph (A), an individual
who is under the age of 16 and is emancipated from a
parent is not a covered minor.
(4) Design feature.--The term ``design feature''--
(A) means any feature or component of a covered
platform that encourages an increase in or increases
the frequency of use or time spent by a user who is a
covered minor with respect to such covered platform;
and
(B) includes--
(i) infinite scrolling or auto play;
(ii) rewards or incentives based on
frequency of use or time spent;
(iii) notifications and push alerts;
(iv) badges or other visual award symbols
based on frequency of use or time spent;
(v) appearance altering filters; and
(vi) personalized recommendation systems.
(5) Fully automated system.--The term ``fully automated
system'' means an algorithm the final outputs of which are,
once computed, displayed directly to a covered minor without
review or alteration by a covered platform.
(6) Parent.--The term ``parent'', with respect to a minor,
means an adult with the legal right to make decisions on behalf
of the minor, including any of the following:
(A) A natural parent.
(B) An adoptive parent.
(C) A legal guardian.
(D) An individual with legal custody over the
minor.
(7) Personal data.--The term ``personal data'' has the
meaning given the term ``personal information'' in section 1302
of the Children's Online Privacy Protection Act of 1998 (15
U.S.C. 6501).
(8) Personalized recommendation system.--The term
``personalized recommendation system''--
(A) means a fully automated system used to suggest,
promote, or rank content, including other users,
hashtags, and posts, based on the personal data of a
user; and
(B) does not include a fully automated system that
suggests, promotes, or ranks content based solely on
the language, city or town, or age of a user.
(9) Process.--The term ``process'' means any operation or
set of operations performed, whether by manual or automated
means, on personal data or on sets of personal data, such as
the collection, use, storage, disclosure, analysis, deletion,
or modification of personal data.
(10) User.--The term ``user'' means, with respect to a
covered platform, an individual who creates or maintains an
account or profile on the covered platform.
(11) Verifiable consent.--The term ``verifiable consent''
means any reasonable effort (taking into consideration
available technology) by the provider of a covered platform,
including a request for authorization for future collection,
use, and disclosure described in the notice, to ensure that a
parent of a covered minor--
(A) receives direct notice of the collection, use,
maintenance, disclosure, and other relevant processing
practices of the provider of a covered platform with
respect to personal data; and
(B) before the personal data of the covered minor
is collected, freely and unambiguously authorizes--
(i) the collection, use, maintenance,
disclosure, and other relevant processing
practices, as applicable, of the personal data;
and
(ii) any subsequent use of the personal
data.
SEC. 3. PARENTAL CONSENT REQUIREMENT.
(a) Prohibition.--A provider of a covered platform may not process
the personal data of a covered minor without obtaining the verifiable
consent of a parent of the covered minor.
(b) Age Determination.--Notwithstanding subsection (a), a provider
of a covered platform may process the personal data of a covered minor
if--
(1) the provider of the covered platform processes such
personal data for the sole purpose of determining the age of a
user;
(2) the provider of the covered platform does not retain
such personal data any longer than the period strictly
necessary to determine the age of the user and deletes such
personal data promptly upon determining the age of the user;
(3) prior to processing any personal data for the purpose
of determining the age of the user, the provider of the covered
platform provides the user with clear and conspicuous notice
that such personal data is processed for determining the age of
the user;
(4) the provider of the covered platform employs reasonable
administrative, technical, and physical data security practices
to protect the confidentiality, integrity, and accessibility of
personal data processed for determining the age of the user and
such security practices are appropriate to the volume,
sensitivity, and nature of such personal data;
(5) the provider of the covered platform reasonably
determines that any product, service, method, or third party
used for determining the age of the user is likely to provide
reasonably accurate results as to the age of the user; and
(6) in the case that the provider of the covered platform
discloses such personal data to a third party to determine the
age of the user, the provider of the covered platform takes
reasonable steps to determine the third party is capable of
maintaining the confidentiality, integrity, and accessibility
of such personal data, including by obtaining written
assurances that such third party will employ reasonable
administrative, technical, and physical data security practices
to do so, will not process such personal data for any purpose
other than determining the age of the user, and will delete the
personal data promptly after determining the age of the user.
(c) Written Confirmation.--Upon obtaining verifiable consent from a
parent of a covered minor, the provider of a covered platform shall
provide the parent of such covered minor with written or electronic
confirmation of the consent and a description of the account and data
practices to which it applies.
(d) Withdrawal of Parental Consent.--
(1) In general.--A parent may withdraw consent for a
covered minor at any time through a method that is at least as
easy to use as the method by which consent was granted.
(2) Termination required.--Not later than 10 days after
withdrawal, the provider of a covered platform shall terminate
the covered minor's account and comply with the deletion
obligations of section 5.
(e) Re-Consent.--A provider of a covered platform shall obtain
renewed verifiable parental consent upon a material change to the
covered platform's design features or data practices the covered
minor's transition across an age band, if a tiered structure is adopted
every 24 months.
SEC. 4. RIGHT TO CURE.
A provider of a covered platform may not be held liable for a
violation of section 3(a) if, within five days of identifying or being
notified that a user is a covered minor, the provider--
(1) promptly deletes all personal data about the covered
minor that is processed in connection with the account of the
user; or
(2) the provider obtains the verifiable consent of a parent
of the covered minor.
SEC. 5. DATA DELETION AND PORTABILITY.
(a) In General.--Upon termination of a covered minor's account
under this Act, the provider of a covered platform shall delete the
personal data of the covered minor, except data the provider of a
covered platform is required by law to retain.
(b) Graduation.--
(1) In general.--Except as provided in paragraph (2), the
provider of a covered platform may not retain the personal data
associated with an account of a covered minor after the date on
which the covered minor attains the age of 16.
(2) Parental consent.--Paragraph (1) shall not apply if a
parent of a covered minor submits to the provider of a covered
platform a request to retain the personal data associated with
the account of the covered minor after the covered minor
attains the age of 16.
(c) Availability.--The operator shall, for a period of not fewer
than 90 days before deletion pursuant to subsection (a) or subsection
(b), make available to the parent a means to download the covered
minor's personal data in a portable, machine-readable format.
SEC. 6. RULE OF CONSTRUCTION.
(a) In General.--Nothing in this Act shall be construed to impose
liability on a provider of a covered platform on the basis of--
(1) the viewpoint, subject matter, or content of any user-
generated content or of the covered platform; or
(2) a covered minor's or provider of a covered platform's
access to, or dissemination of, any particular category of
speech.
(b) Coverage.--Coverage under this Act is determined solely by
reference to the structural and design characteristics enumerated in
paragraph (4) of section 2.
SEC. 7. ENFORCEMENT.
(a) Enforcement by Federal Trade Commission.--
(1) Unfair or deceptive acts or practices.--A violation of
this Act or a regulation promulgated under this Act shall be
treated as a violation of a regulation under section
18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C.
57a(a)(1)(B)) regarding unfair or deceptive acts or practices.
(2) Powers of commission.--The Federal Trade Commission
shall enforce this Act and the regulations promulgated under
this Act in the same manner, by the same means, and with the
same jurisdiction, powers, and duties as though all applicable
terms and provisions of the Federal Trade Commission Act (15
U.S.C. 41 et seq.) were incorporated into and made a part of
this Act. Any person who violates this Act or a regulation
promulgated under this Act shall be subject to the penalties
and entitled to the privileges and immunities provided in the
Federal Trade Commission Act.
(b) Actions by States.--
(1) In general.--In any case in which the attorney general
of a State, or an official or agency of a State, has reason to
believe that an interest of the residents of such State has
been or is threatened or adversely affected by an act or
practice in violation of this Act or a regulation promulgated
under this Act, the State, as parens patriae, may bring a civil
action on behalf of the residents of the State in an
appropriate State court or an appropriate district court of the
United States to--
(A) enjoin such act or practice;
(B) enforce compliance with this Act or such
regulation;
(C) obtain damages, restitution, or other
compensation on behalf of residents of the State; or
(D) obtain such other legal and equitable relief as
the court may consider to be appropriate.
(2) Notice.--Before filing an action under this subsection,
the attorney general of the State involved shall provide to the
Federal Trade Commission a written notice of such action and a
copy of the complaint for such action. If the attorney general
determines that it is not feasible to provide the notice
described in this paragraph before the filing of the action,
the attorney general shall provide written notice of the action
and a copy of the complaint to the Federal Trade Commission
immediately upon the filing of the action.
(3) Authority of federal trade commission.--
(A) In general.--On receiving notice under
paragraph (2) of an action under this subsection, the
Federal Trade Commission shall have the right--
(i) to intervene in the action;
(ii) upon so intervening, to be heard on
all matters arising therein; and
(iii) to file petitions for appeal.
(B) Limitation on state action while federal action
is pending.--If the Federal Trade Commission or the
Attorney General of the United States has instituted a
civil action for violation of this Act or a regulation
promulgated under this Act (referred to in this
subparagraph as the ``Federal action''), no State
attorney general may bring an action under this
subsection during the pendency of the Federal action
against any defendant named in the complaint in the
Federal action for any violation of this Act or
regulation alleged in such complaint.
(4) Rule of construction.--For purposes of bringing a civil
action under this subsection, nothing in this Act shall be
construed to prevent an attorney general of a State from
exercising the powers conferred on the attorney general by the
laws of such State to conduct investigations, administer oaths
and affirmations, or compel the attendance of witnesses or the
production of documentary and other evidence.
SEC. 8. RELATIONSHIP TO STATE LAWS.
(a) In General.--The provisions of this Act shall preempt any law,
rule, requirement, or regulation of a State, or a political subdivision
of a State, only to the extent that such law, rule, requirement, or
regulation conflicts with a provision of this Act.
(b) Exception.--Notwithstanding subsection (a), nothing in this Act
may be construed--
(1) to preempt any law, rule, requirement, or regulation of
a State, or political subdivision of a State, with respect to
contract, tort, or product liability; or
(2) to prohibit a State, or a political subdivision of a
State, from enacting or enforcing any law, rule, requirement,
or regulation that provides greater protection to minors than
the protection provided by the provisions of this Act.
SEC. 9. EFFECTIVE DATE.
This Act shall take effect on the date that is 18 months after the
date of the enactment of this Act.
<all>