[Congressional Record Volume 169, Number 29 (Monday, February 13, 2023)]
[Senate]
[Page S353]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

      By Mr. DURBIN (for himself, Mr. Blumenthal, and Ms. Hirono):
  S. 395. A bill to amend the Children's Online Privacy Protection Act 
of 1998 to give Americans the option to delete personal information 
collected by internet operators as a result of the person's internet 
activity prior to age 13; to the Committee on Commerce, Science, and 
Transportation.
  Mr. DURBIN. Madam President, I ask unanimous consent that the text of 
the bill be printed in the Record.
  There being no objection, the text of the bill was ordered to be 
printed in the Record, as follows:

                                 S. 395

       Be it enacted by the Senate and House of Representatives of 
     the United States of America in Congress assembled,

     SECTION 1. SHORT TITLE.

       This Act may be cited as the ``Clean Slate for Kids Online 
     Act of 2023''.

     SEC. 2. ENHANCING THE CHILDREN'S ONLINE PRIVACY PROTECTION 
                   ACT OF 1998.

       (a) Definitions.--Section 1302 of the Children's Online 
     Privacy Protection Act of 1998 (15 U.S.C. 6501) is amended by 
     adding at the end the following:
       ``(13) Delete.--The term `delete' means to remove personal 
     information such that the information is not maintained in 
     retrievable form and cannot be retrieved in the normal course 
     of business.''.
       (b) Regulation of Unfair and Deceptive Acts and Practices 
     in Connection With the Collection and Use of Personal 
     Information From and About Children on the Internet.--Section 
     1303 of the Children's Online Privacy Protection Act of 1998 
     (15 U.S.C. 6502) is amended--
       (1) in subsection (a), by adding at the end the following:
       ``(3) Failure to delete.--It is unlawful for an operator of 
     a website or online service directed to children, or any 
     operator that has actual knowledge that it is collecting 
     personal information from a child, to fail to delete personal 
     information collected from or about a child if a request for 
     deletion is made pursuant to regulations prescribed under 
     subsection (e).''; and
       (2) by adding at the end the following:
       ``(e) Right of an Individual To Delete Personal Information 
     Collected When the Person Was a Child.--
       ``(1) In general.--Not later than 1 year after the date of 
     enactment of this subsection, the Commission shall promulgate 
     under section 553 of title 5, United States Code, regulations 
     that require the operator of any website or online service 
     directed to children, or any operator that has actual 
     knowledge that it has collected personal information from a 
     child or maintains such personal information--
       ``(A) to provide notice in a prominent place on the website 
     of how an individual over the age of 13, or a legal guardian 
     of an individual over the age of 13 acting with the knowledge 
     and consent of the individual, can request that the operator 
     delete all personal information in the possession of the 
     operator that was collected from or about the individual when 
     the individual was a child notwithstanding any parental 
     consent that may have been provided when the individual was a 
     child;
       ``(B) to promptly delete all personal information in the 
     possession of the operator that was collected from or about 
     an individual when the individual was a child when such 
     deletion is requested by an individual over the age of 13 or 
     by the legal guardian of such individual acting with the 
     knowledge and consent of the individual, notwithstanding any 
     parental consent that may have been provided when the 
     individual was a child;
       ``(C) to provide written confirmation of deletion, after 
     the deletion has occurred, to an individual or legal guardian 
     of such individual who has requested such deletion pursuant 
     to this subsection; and
       ``(D) to except from deletion personal information 
     collected from or about a child--
       ``(i) only to the extent that the personal information is 
     necessary--

       ``(I) to respond to judicial process; or
       ``(II) to the extent permitted under any other provision of 
     law, to provide information to law enforcement agencies or 
     for an investigation on a matter related to public safety; 
     and

       ``(ii) if the operator retain such excepted personal 
     information for only as long as reasonably necessary to 
     fulfill the purpose for which the information has been 
     excepted and that the excepted information not be used, 
     disseminated or maintained in a form retrievable to anyone 
     except for the purposes specified in this subparagraph.''.
       (c) Safe Harbors.--Section 1304 of the Children's Online 
     Privacy Protection Act of 1998 (15 U.S.C. 6503) is amended--
       (1) in subsection (a), by striking ``section 1303(b)'' and 
     inserting ``subsections (b) and (e) of section 1303''; and
       (2) in subsection (b)(1), by striking ``subsection (b)'' 
     and inserting ``subsections (b) and (e)''.
       (d) Actions by States.--Section 1305(a)(1) of the 
     Children's Online Privacy Protection Act of 1998 (15 U.S.C. 
     6504(a)(1)) is amended by striking ``1303(b)'' and inserting 
     ``subsection (b) or (e) of section 1303''.

                          ____________________