H. R. 10207 (Introduced-in-House)

To prohibit covered platforms from processing personal data with respect to covered minors without obtaining the verifiable consent of a parent of the covered minor, and for other purposes.

September 1, 2026

Mrs. Houchin introduced the following bill; which was referred to the Committee on Energy and Commerce

To prohibit covered platforms from processing personal data with respect to covered minors without obtaining the verifiable consent of a parent of the covered minor, and for other purposes.

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,

This Act may be cited as the “Governing Underage Access and Requiring Data Consent In All Networks Act” or the “GUARDIAN Act”.

In this Act:

(2) COVERED PLATFORM.—The term “covered platform” means a platform that is a website, software, application, or electronic service connected to the internet that meets the following requirements:

(i) that is searchable on the platform by other users through a function made available by the platform; and

(ii) that can be followed by or is similarly accessible to other users of the platform.

(C) As the primary purpose of the platform, facilitates the sharing and access to user-generated content through text, images, video, audio, or any other interactive medium.

(E) Uses the personal information of the user to advertise, market, or make content recommendations.

(A) The term “covered minor” means a user who the provider of a covered online platform knows or should have known is under the age of 16.

(B) Notwithstanding subparagraph (A), an individual who is under the age of 16 and is emancipated from a parent is not a covered minor.

(A) means any feature or component of a covered platform that encourages an increase in or increases the frequency of use or time spent by a user who is a covered minor with respect to such covered platform; and

(iv) badges or other visual award symbols based on frequency of use or time spent;

(5) FULLY AUTOMATED SYSTEM.—The term “fully automated system” means an algorithm the final outputs of which are, once computed, displayed directly to a covered minor without review or alteration by a covered platform.

(6) PARENT.—The term “parent”, with respect to a minor, means an adult with the legal right to make decisions on behalf of the minor, including any of the following:

(7) PERSONAL DATA.—The term “personal data” has the meaning given the term “personal information” in section 1302 of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501).

(8) PERSONALIZED RECOMMENDATION SYSTEM.—The term “personalized recommendation system”—

(A) means a fully automated system used to suggest, promote, or rank content, including other users, hashtags, and posts, based on the personal data of a user; and

(B) does not include a fully automated system that suggests, promotes, or ranks content based solely on the language, city or town, or age of a user.

(9) PROCESS.—The term “process” means any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.

(10) USER.—The term “user” means, with respect to a covered platform, an individual who creates or maintains an account or profile on the covered platform.

(11) VERIFIABLE CONSENT.—The term “verifiable consent” means any reasonable effort (taking into consideration available technology) by the provider of a covered platform, including a request for authorization for future collection, use, and disclosure described in the notice, to ensure that a parent of a covered minor—

(A) receives direct notice of the collection, use, maintenance, disclosure, and other relevant processing practices of the provider of a covered platform with respect to personal data; and

(B) before the personal data of the covered minor is collected, freely and unambiguously authorizes—

(i) the collection, use, maintenance, disclosure, and other relevant processing practices, as applicable, of the personal data; and

(a) Prohibition.—A provider of a covered platform may not process the personal data of a covered minor without obtaining the verifiable consent of a parent of the covered minor.

(b) Age determination.—Notwithstanding subsection (a), a provider of a covered platform may process the personal data of a covered minor if—

(1) the provider of the covered platform processes such personal data for the sole purpose of determining the age of a user;

(2) the provider of the covered platform does not retain such personal data any longer than the period strictly necessary to determine the age of the user and deletes such personal data promptly upon determining the age of the user;

(3) prior to processing any personal data for the purpose of determining the age of the user, the provider of the covered platform provides the user with clear and conspicuous notice that such personal data is processed for determining the age of the user;

(4) the provider of the covered platform employs reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data processed for determining the age of the user and such security practices are appropriate to the volume, sensitivity, and nature of such personal data;

(5) the provider of the covered platform reasonably determines that any product, service, method, or third party used for determining the age of the user is likely to provide reasonably accurate results as to the age of the user; and

(6) in the case that the provider of the covered platform discloses such personal data to a third party to determine the age of the user, the provider of the covered platform takes reasonable steps to determine the third party is capable of maintaining the confidentiality, integrity, and accessibility of such personal data, including by obtaining written assurances that such third party will employ reasonable administrative, technical, and physical data security practices to do so, will not process such personal data for any purpose other than determining the age of the user, and will delete the personal data promptly after determining the age of the user.

(c) Written confirmation.—Upon obtaining verifiable consent from a parent of a covered minor, the provider of a covered platform shall provide the parent of such covered minor with written or electronic confirmation of the consent and a description of the account and data practices to which it applies.

(1) IN GENERAL.—A parent may withdraw consent for a covered minor at any time through a method that is at least as easy to use as the method by which consent was granted.

(2) TERMINATION REQUIRED.—Not later than 10 days after withdrawal, the provider of a covered platform shall terminate the covered minor’s account and comply with the deletion obligations of section 5.

(e) Re-Consent.—A provider of a covered platform shall obtain renewed verifiable parental consent upon a material change to the covered platform’s design features or data practices the covered minor’s transition across an age band, if a tiered structure is adopted every 24 months.

A provider of a covered platform may not be held liable for a violation of section 3(a) if, within five days of identifying or being notified that a user is a covered minor, the provider—

(1) promptly deletes all personal data about the covered minor that is processed in connection with the account of the user; or

(2) the provider obtains the verifiable consent of a parent of the covered minor.

(a) In general.—Upon termination of a covered minor’s account under this Act, the provider of a covered platform shall delete the personal data of the covered minor, except data the provider of a covered platform is required by law to retain.

(1) IN GENERAL.—Except as provided in paragraph (2), the provider of a covered platform may not retain the personal data associated with an account of a covered minor after the date on which the covered minor attains the age of 16.

(2) PARENTAL CONSENT.—Paragraph (1) shall not apply if a parent of a covered minor submits to the provider of a covered platform a request to retain the personal data associated with the account of the covered minor after the covered minor attains the age of 16.

(c) Availability.—The operator shall, for a period of not fewer than 90 days before deletion pursuant to subsection (a) or subsection (b), make available to the parent a means to download the covered minor’s personal data in a portable, machine-readable format.

(a) In general.—Nothing in this Act shall be construed to impose liability on a provider of a covered platform on the basis of—

(1) the viewpoint, subject matter, or content of any user-generated content or of the covered platform; or

(2) a covered minor’s or provider of a covered platform’s access to, or dissemination of, any particular category of speech.

(b) Coverage.—Coverage under this Act is determined solely by reference to the structural and design characteristics enumerated in paragraph (4) of section 2.

(1) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.—A violation of this Act or a regulation promulgated under this Act shall be treated as a violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices.

(2) POWERS OF COMMISSION.—The Federal Trade Commission shall enforce this Act and the regulations promulgated under this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act. Any person who violates this Act or a regulation promulgated under this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act.

(1) IN GENERAL.—In any case in which the attorney general of a State, or an official or agency of a State, has reason to believe that an interest of the residents of such State has been or is threatened or adversely affected by an act or practice in violation of this Act or a regulation promulgated under this Act, the State, as parens patriae, may bring a civil action on behalf of the residents of the State in an appropriate State court or an appropriate district court of the United States to—

(D) obtain such other legal and equitable relief as the court may consider to be appropriate.

(2) NOTICE.—Before filing an action under this subsection, the attorney general of the State involved shall provide to the Federal Trade Commission a written notice of such action and a copy of the complaint for such action. If the attorney general determines that it is not feasible to provide the notice described in this paragraph before the filing of the action, the attorney general shall provide written notice of the action and a copy of the complaint to the Federal Trade Commission immediately upon the filing of the action.

(A) IN GENERAL.—On receiving notice under paragraph (2) of an action under this subsection, the Federal Trade Commission shall have the right—

(B) LIMITATION ON STATE ACTION WHILE FEDERAL ACTION IS PENDING.—If the Federal Trade Commission or the Attorney General of the United States has instituted a civil action for violation of this Act or a regulation promulgated under this Act (referred to in this subparagraph as the “Federal action”), no State attorney general may bring an action under this subsection during the pendency of the Federal action against any defendant named in the complaint in the Federal action for any violation of this Act or regulation alleged in such complaint.

(4) RULE OF CONSTRUCTION.—For purposes of bringing a civil action under this subsection, nothing in this Act shall be construed to prevent an attorney general of a State from exercising the powers conferred on the attorney general by the laws of such State to conduct investigations, administer oaths and affirmations, or compel the attendance of witnesses or the production of documentary and other evidence.

(a) In general.—The provisions of this Act shall preempt any law, rule, requirement, or regulation of a State, or a political subdivision of a State, only to the extent that such law, rule, requirement, or regulation conflicts with a provision of this Act.

(b) Exception.—Notwithstanding subsection (a), nothing in this Act may be construed—

(1) to preempt any law, rule, requirement, or regulation of a State, or political subdivision of a State, with respect to contract, tort, or product liability; or

(2) to prohibit a State, or a political subdivision of a State, from enacting or enforcing any law, rule, requirement, or regulation that provides greater protection to minors than the protection provided by the provisions of this Act.

This Act shall take effect on the date that is 18 months after the date of the enactment of this Act.