[Congressional Record Volume 170, Number 76 (Thursday, May 2, 2024)]
[Senate]
[Pages S3341-S3344]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

  SA 1956. Mr. CASSIDY (for himself and Mr. Markey) submitted an 
amendment intended to be proposed to amendment SA 1911 submitted by Ms. 
Cantwell (for herself, Mr. Cruz, Ms. Duckworth, and Mr. Moran) and 
intended to be proposed to the bill H.R. 3935, to amend title 49, 
United States Code, to reauthorize and improve the Federal Aviation 
Administration and other civil aviation programs, and for other 
purposes; which was ordered to lie on the table; as follows:

       At the appropriate place, insert the following:

      TITLE __--CHILDREN AND TEENS' ONLINE PRIVACY PROTECTION ACT

     SEC. __1. SHORT TITLE.

       This title may be cited as the ``Children and Teens' Online 
     Privacy Protection Act''.

     SEC. __2. ONLINE COLLECTION, USE, DISCLOSURE, AND DELETION OF 
                   PERSONAL INFORMATION OF CHILDREN AND TEENS.

       (a) Definitions.--Section 1302 of the Children's Online 
     Privacy Protection Act of 1998 (15 U.S.C. 6501) is amended--
       (1) by amending paragraph (2) to read as follows:
       ``(2) Operator.--The term `operator'--
       ``(A) means any person--
       ``(i) who, for commercial purposes, in interstate or 
     foreign commerce operates or provides a website on the 
     internet, an online service, an online application, or a 
     mobile application; and
       ``(ii) who--

       ``(I) collects or maintains, either directly or through a 
     service provider, personal information from or about the 
     users of that website, service, or application;
       ``(II) allows another person to collect personal 
     information directly from users of that website, service, or 
     application (in which case, the operator is deemed to have 
     collected the information); or
       ``(III) allows users of that website, service, or 
     application to publicly disclose personal information (in 
     which case, the operator is deemed to have collected the 
     information); and

       ``(B) does not include any nonprofit entity that would 
     otherwise be exempt from coverage under section 5 of the 
     Federal Trade Commission Act (15 U.S.C. 45).'';
       (2) in paragraph (4)--
       (A) by amending subparagraph (A) to read as follows:
       ``(A) the release of personal information collected from a 
     child or teen by an operator for any purpose, except where 
     the personal information is provided to a person other than 
     an operator who--
       ``(i) provides support for the internal operations of the 
     website, online service, online application, or mobile 
     application of the operator, excluding any activity relating 
     to individual-specific advertising to children or teens; and
       ``(ii) does not disclose or use that personal information 
     for any other purpose; and''; and
       (B) in subparagraph (B)--
       (i) by inserting ``or teen'' after ``child'' each place the 
     term appears;
       (ii) by striking ``website or online service'' and 
     inserting ``website, online service, online application, or 
     mobile application''; and
       (iii) by striking ``actual knowledge'' and inserting 
     ``actual knowledge or knowledge fairly implied on the basis 
     of objective circumstances'';
       (3) by striking paragraph (8) and inserting the following:
       ``(8) Personal information.--
       ``(A) In general.--The term `personal information' means 
     individually identifiable information about an individual 
     collected online, including--
       ``(i) a first and last name;
       ``(ii) a home or other physical address including street 
     name and name of a city or town;
       ``(iii) an e-mail address;
       ``(iv) a telephone number;
       ``(v) a Social Security number;
       ``(vi) any other identifier that the Commission determines 
     permits the physical or online contacting of a specific 
     individual;
       ``(vii) a persistent identifier that can be used to 
     recognize a specific child or teen over time and across 
     different websites, online services, online applications, or 
     mobile applications, including but not limited to a customer 
     number held in a cookie, an Internet Protocol (IP) address, a 
     processor or device serial number, or unique device 
     identifier, but excluding an identifier that is used by an 
     operator solely for providing support for the internal 
     operations of the website, online service, online 
     application, or mobile application;
       ``(viii) a photograph, video, or audio file where such file 
     contains a specific child's or teen's image or voice;
       ``(ix) geolocation information;
       ``(x) information generated from the measurement or 
     technological processing of an individual's biological, 
     physical, or physiological characteristics that is used to 
     identify an individual, including--

       ``(I) fingerprints;
       ``(II) voice prints;
       ``(III) iris or retina imagery scans;
       ``(IV) facial templates;
       ``(V) deoxyribonucleic acid (DNA) information; or
       ``(VI) gait; or

       ``(xi) information linked or reasonably linkable to a child 
     or teen or the parents of that child or teen (including any 
     unique identifier) that an operator collects online from the 
     child or teen and combines with an identifier described in 
     this subparagraph.
       ``(B) Exclusion.--The term `personal information' shall not 
     include an audio file that contains a child's or teen's voice 
     so long as the operator--
       ``(i) does not request information via voice that would 
     otherwise be considered personal information under this 
     paragraph;
       ``(ii) provides clear notice of its collection and use of 
     the audio file and its deletion policy in its privacy policy;
       ``(iii) only uses the voice within the audio file solely as 
     a replacement for written words, to perform a task, or engage 
     with a website, online service, online application, or mobile 
     application, such as to perform a search or fulfill a verbal 
     instruction or request; and
       ``(iv) only maintains the audio file long enough to 
     complete the stated purpose and then immediately deletes the 
     audio file and does not make any other use of the audio file 
     prior to deletion.
       ``(C) Support for the internal operations of a website, 
     online service, online application, or mobile application.--
       ``(i) In general.--For purposes of subparagraph (A)(vii), 
     the term `support for the internal operations of a website, 
     online service, online application, or mobile application' 
     means those activities necessary to--

       ``(I) maintain or analyze the functioning of the website, 
     online service, online application, or mobile application;
       ``(II) perform network communications;
       ``(III) authenticate users of, or personalize the content 
     on, the website, online service, online application, or 
     mobile application;
       ``(IV) serve contextual advertising, provided that any 
     persistent identifier is only used as necessary for technical 
     purposes to serve the contextual advertisement, or cap the 
     frequency of advertising;
       ``(V) protect the security or integrity of the user, 
     website, online service, online application, or mobile 
     application;
       ``(VI) ensure legal or regulatory compliance, or
       ``(VII) fulfill a request of a child or teen as permitted 
     by subparagraphs (A) through (C) of section 1303(b)(2).

       ``(ii) Condition.--Except as specifically permitted under 
     clause (i), information collected for the activities listed 
     in clause (i) cannot be used or disclosed to contact a 
     specific individual, including through individual-specific 
     advertising to children or teens, to amass a profile on a 
     specific individual, in connection with processes that 
     encourage or prompt use of a website or online service, or 
     for any other purpose.'';
       (4) by amending paragraph (9) to read as follows:
       ``(9) Verifiable consent.--The term `verifiable consent' 
     means any reasonable effort (taking into consideration 
     available technology), including a request for authorization 
     for future collection, use, and disclosure described in the 
     notice, to ensure that, in the case of a child, a parent of 
     the child, or, in the case of a teen, the teen--
       ``(A) receives direct notice of the personal information 
     collection, use, and disclosure practices of the operator; 
     and
       ``(B) before the personal information of the child or teen 
     is collected, freely and unambiguously authorizes--
       ``(i) the collection, use, and disclosure, as applicable, 
     of that personal information; and
       ``(ii) any subsequent use of that personal information.'';
       (5) in paragraph (10)--
       (A) in the paragraph header, by striking ``Website or 
     online service directed to children'' and inserting 
     ``Website, online service, online application, or mobile 
     application directed to children'';
       (B) by striking ``website or online service'' each place it 
     appears and inserting ``website, online service, online 
     application, or mobile application''; and
       (C) by adding at the end the following new subparagraph:

[[Page S3342]]

       ``(C) Rule of construction.--In considering whether a 
     website, online service, online application, or mobile 
     application, or portion thereof, is directed to children, the 
     Commission shall apply a totality of circumstances test and 
     will also consider competent and reliable empirical evidence 
     regarding audience composition and evidence regarding the 
     intended audience of the website, online service, online 
     application, or mobile application.''; and
       (6) by adding at the end the following:
       ``(13) Connected device.--The term `connected device' means 
     a device that is capable of connecting to the internet, 
     directly or indirectly, or to another connected device.
       ``(14) Online application.--The term `online application'--
       ``(A) means an internet-connected software program; and
       ``(B) includes a service or application offered via a 
     connected device.
       ``(15) Mobile application.--The term `mobile application'--
       ``(A) means a software program that runs on the operating 
     system of--
       ``(i) a cellular telephone;
       ``(ii) a tablet computer; or
       ``(iii) a similar portable computing device that transmits 
     data over a wireless connection; and
       ``(B) includes a service or application offered via a 
     connected device.
       ``(16) Geolocation information.--The term `geolocation 
     information' means information sufficient to identify a 
     street name and name of a city or town.
       ``(17) Teen.--The term `teen' means an individual who has 
     attained age 13 and is under the age of 17.
       ``(18) Individual-specific advertising to children or 
     teens.--
       ``(A) In general.--The term `individual-specific 
     advertising to children or teens' means advertising or any 
     other effort to market a product or service that is directed 
     to a specific child or teen or a connected device that is 
     linked or reasonably linkable to a child or teen based on--
       ``(i) the personal information from--

       ``(I) the child or teen; or
       ``(II) a group of children or teens who are similar in sex, 
     age, household income level, race, or ethnicity to the 
     specific child or teen to whom the product or service is 
     marketed;

       ``(ii) profiling of a child or teen or group of children or 
     teens; or
       ``(iii) a unique identifier of the connected device.
       ``(B) Exclusions.--The term `individual-specific 
     advertising to children or teens' shall not include--
       ``(i) advertising or marketing to an individual or the 
     device of an individual in response to the individual's 
     specific request for information or feedback, such as a 
     child's or teen's current search query;
       ``(ii) contextual advertising, such as when an 
     advertisement is displayed based on the content of the 
     website, online service, online application, mobile 
     application, or connected device in which the advertisement 
     appears and does not vary based on personal information 
     related to the viewer; or
       ``(iii) processing personal information solely for 
     measuring or reporting advertising or content performance, 
     reach, or frequency, including independent measurement.
       ``(C) Rule of construction.--Nothing in subparagraph (A) 
     shall be construed to prohibit an operator with actual 
     knowledge or knowledge fairly implied on the basis of 
     objective circumstances that a user is under the age of 17 
     from delivering advertising or marketing that is age-
     appropriate and intended for a child or teen audience, so 
     long as the operator does not use any personal information 
     other than whether the user is under the age of 17.''.
       (b) Online Collection, Use, Disclosure, and Deletion of 
     Personal Information of Children and Teens.--Section 1303 of 
     the Children's Online Privacy Protection Act of 1998 (15 
     U.S.C. 6502) is amended--
       (1) by striking the heading and inserting the following: 
     ``online collection, use, disclosure, and deletion of 
     personal information of children and teens.'';
       (2) in subsection (a)--
       (A) by amending paragraph (1) to read as follows:
       ``(1) In general.--It is unlawful for an operator of a 
     website, online service, online application, or mobile 
     application directed to children or for any operator of a 
     website, online service, online application, or mobile 
     application with actual knowledge or knowledge fairly implied 
     on the basis of objective circumstances that a user is a 
     child or teen--
       ``(A) to collect personal information from a child or teen 
     in a manner that violates the regulations prescribed under 
     subsection (b);
       ``(B) except as provided in subparagraphs (B) and (C) of 
     section 1302(18), to collect, use, disclose to third parties, 
     or maintain personal information of a child or teen for 
     purposes of individual-specific advertising to children or 
     teens (or to allow another person to collect, use, disclose, 
     or maintain such information for such purpose);
       ``(C) to collect the personal information of a child or 
     teen except when the collection of the personal information 
     is--
       ``(i) consistent with the context of a particular 
     transaction or service or the relationship of the child or 
     teen with the operator, including collection necessary to 
     fulfill a transaction or provide a product or service 
     requested by the child or teen; or
       ``(ii) required or specifically authorized by Federal or 
     State law; or
       ``(D) to store or transfer the personal information of a 
     child or teen outside of the United States unless the 
     operator provides direct notice to the parent of the child, 
     in the case of a child, or to the teen, in the case of a 
     teen, that the child's or teen's personal information is 
     being stored or transferred outside of the United States; or
       ``(E) to retain the personal information of a child or teen 
     for longer than is reasonably necessary to fulfill a 
     transaction or provide a service requested by the child or 
     teen except as required or specifically authorized by Federal 
     or State law.''; and
       (B) in paragraph (2)--
       (i) in the header, by striking ``parent'' and inserting `` 
     `parent or teen' ''
       (ii) by striking ``Notwithstanding paragraph (1)'' and 
     inserting ``Notwithstanding paragraph (1)(A)'';
       (iii) by striking ``of such a website or online service''; 
     and
       (iv) by striking ``subsection (b)(1)(B)(iii) to the parent 
     of a child'' and inserting ``subsection (b)(1)(B)(iv) to the 
     parent of a child or under subsection (b)(1)(C)(iv) to a 
     teen'';
       (3) in subsection (b)--
       (A) in paragraph (1)--
       (i) in subparagraph (A)--

       (I) by striking ``operator of any website'' and all that 
     follows through ``from a child'' and inserting ``operator of 
     a website, online service, online application, or mobile 
     application directed to children or that has actual knowledge 
     or knowledge fairly implied on the basis of objective 
     circumstances that a user is a child or teen'';
       (II) in clause (i)--

       (aa) by striking ``notice on the website'' and inserting 
     ``clear and conspicuous notice on the website'';
       (bb) by inserting ``or teens'' after ``children'';
       (cc) by striking ``, and the operator's'' and inserting ``, 
     the operator's''; and
       (dd) by striking ``; and'' and inserting ``, the rights and 
     opportunities available to the parent of the child or teen 
     under subparagraphs (B) and (C), and the procedures or 
     mechanisms the operator uses to ensure that personal 
     information is not collected from children or teens except in 
     accordance with the regulations promulgated under this 
     paragraph;'';

       (III) in clause (ii)--

       (aa) by striking ``parental'';
       (bb) by inserting ``or teens'' after ``children'';
       (cc) by striking the semicolon at the end and inserting ``; 
     and''; and

       (IV) by inserting after clause (ii) the following new 
     clause:

       ``(iii) to obtain verifiable consent from a parent of a 
     child or from a teen before using or disclosing personal 
     information of the child or teen for any purpose that is a 
     material change from the original purposes and disclosure 
     practices specified to the parent of the child or the teen 
     under clause (i);'';
       (ii) in subparagraph (B)--

       (I) in the matter preceding clause (i), by striking 
     ``website or online service'' and inserting ``operator'';
       (II) in clause (i), by inserting ``and the method by which 
     the operator obtained the personal information, and the 
     purposes for which the operator collects, uses, discloses, 
     and retains the personal information'' before the semicolon;
       (III) in clause (ii)--

       (aa) by inserting ``to delete personal information 
     collected from the child or content or information submitted 
     by the child to a website, online service, online 
     application, or mobile application and'' after ``the 
     opportunity at any time''; and
       (bb) by striking ``; and'' and inserting a semicolon;

       (IV) by redesignating clause (iii) as clause (iv) and 
     inserting after clause (ii) the following new clause:

       ``(iii) the opportunity to challenge the accuracy of the 
     personal information and, if the parent of the child 
     establishes the inaccuracy of the personal information, to 
     have the inaccurate personal information corrected;''; and

       (V) in clause (iv), as so redesignated, by inserting ``, if 
     such information is available to the operator at the time the 
     parent makes the request'' before the semicolon;

       (iii) by redesignating subparagraphs (C) and (D) as 
     subparagraphs (D) and (E), respectively;
       (iv) by inserting after subparagraph (B) the following new 
     subparagraph:
       ``(C) require the operator to provide, upon the request of 
     a teen under this subparagraph who has provided personal 
     information to the operator, upon proper identification of 
     that teen--
       ``(i) a description of the specific types of personal 
     information collected from the teen by the operator, the 
     method by which the operator obtained the personal 
     information, and the purposes for which the operator 
     collects, uses, discloses, and retains the personal 
     information;
       ``(ii) the opportunity at any time to delete personal 
     information collected from the teen or content or information 
     submitted by the teen to a website, online service, online 
     application, or mobile application and to refuse to permit 
     the operator's further use or maintenance in retrievable 
     form, or online collection, of personal information from the 
     teen;
       ``(iii) the opportunity to challenge the accuracy of the 
     personal information and, if the teen establishes the 
     inaccuracy of the personal information, to have the 
     inaccurate personal information corrected; and

[[Page S3343]]

       ``(iv) a means that is reasonable under the circumstances 
     for the teen to obtain any personal information collected 
     from the teen, if such information is available to the 
     operator at the time the teen makes the request;'';
       (v) in subparagraph (D), as so redesignated--

       (I) by striking ``a child's'' and inserting ``a child's or 
     teen's''; and
       (II) by inserting ``or teen'' after ``the child''; and

       (vi) by amending subparagraph (E), as so redesignated, to 
     read as follows:
       ``(E) require the operator to establish, implement, and 
     maintain reasonable security practices to protect the 
     confidentiality, integrity, and accessibility of personal 
     information of children or teens collected by the operator, 
     and to protect such personal information against unauthorized 
     access.'';
       (B) in paragraph (2)--
       (i) in the matter preceding subparagraph (A), by striking 
     ``verifiable parental consent'' and inserting ``verifiable 
     consent'';
       (ii) in subparagraph (A)--

       (I) by inserting ``or teen'' after ``collected from a 
     child'';
       (II) by inserting ``or teen'' after ``request from the 
     child''; and
       (III) by inserting ``or teen or to contact another child or 
     teen'' after ``to recontact the child'';

       (iii) in subparagraph (B)--

       (I) by striking ``parent or child'' and inserting ``parent 
     or teen''; and
       (II) by striking ``parental consent'' each place the term 
     appears and inserting ``verifiable consent'';

       (iv) in subparagraph (C)--

       (I) in the matter preceding clause (i), by inserting ``or 
     teen'' after ``child'' each place the term appears;
       (II) in clause (i)--

       (aa) by inserting ``or teen'' after ``child'' each place 
     the term appears; and
       (bb) by inserting ``or teen, as applicable,'' after 
     ``parent'' each place the term appears; and

       (III) in clause (ii)--

       (aa) by striking ``without notice to the parent'' and 
     inserting ``without notice to the parent or teen, as 
     applicable,''; and
       (bb) by inserting ``or teen'' after ``child'' each place 
     the term appears; and
       (v) in subparagraph (D)--

       (I) in the matter preceding clause (i), by inserting ``or 
     teen'' after ``child'' each place the term appears;
       (II) in clause (ii), by inserting ``or teen'' after 
     ``child''; and
       (III) in the flush text following clause (iii)--

       (aa) by inserting ``or teen, as applicable,'' after 
     ``parent'' each place the term appears; and
       (bb) by inserting ``or teen'' after ``child'';
       (C) by redesignating paragraph (3) as paragraph (4) and 
     inserting after paragraph (2) the following new paragraph:
       ``(3) Application to operators acting under agreements with 
     educational agencies or institutions.--The regulations may 
     provide that verifiable consent under paragraph (1)(A)(ii) is 
     not required for an operator that is acting under a written 
     agreement with an educational agency or institution (as 
     defined in section 444 of the General Education Provisions 
     Act (commonly known as the `Family Educational Rights and 
     Privacy Act of 1974') (20 U.S.C. 1232g(a)(3)) that, at a 
     minimum, requires the--
       ``(A) operator to--
       ``(i) limit its collection, use, and disclosure of the 
     personal information from a child or teen to solely 
     educational purposes and for no other commercial purposes;
       ``(ii) provide the educational agency or institution with a 
     notice of the specific types of personal information the 
     operator will collect from the child or teen, the method by 
     which the operator will obtain the personal information, and 
     the purposes for which the operator will collect, use, 
     disclose, and retain the personal information;
       ``(iii) provide the educational agency or institution with 
     a link to the operator's online notice of information 
     practices as required under subsection (b)(1)(A)(i); and
       ``(iv) provide the educational agency or institution, upon 
     request, with a means to review the personal information 
     collected from a child or teen, to prevent further use or 
     maintenance or future collection of personal information from 
     a child or teen, and to delete personal information collected 
     from a child or teen or content or information submitted by a 
     child or teen to the operator's website, online service, 
     online application, or mobile application;
       ``(B) representative of the educational agency or 
     institution to acknowledge and agree that they have authority 
     to authorize the collection, use, and disclosure of personal 
     information from children or teens on behalf of the 
     educational agency or institution, along with such 
     authorization, their name, and title at the educational 
     agency or institution; and
       ``(C) educational agency or institution to--
       ``(i) provide on its website a notice that identifies the 
     operator with which it has entered into a written agreement 
     under this subsection and provides a link to the operator's 
     online notice of information practices as required under 
     paragraph (1)(A)(i);
       ``(ii) provide the operator's notice regarding its 
     information practices, as required under subparagraph 
     (A)(ii), upon request, to a parent, in the case of a child, 
     or a parent or teen, in the case of a teen; and
       ``(iii) upon the request of a parent, in the case of a 
     child, or a parent or teen, in the case of a teen, request 
     the operator provide a means to review the personal 
     information from the child or teen and provide the parent, in 
     the case of a child, or parent or teen, in the case of the 
     teen, a means to review the personal information.'';
       (D) by amending paragraph (4), as so redesignated, to read 
     as follows:
       ``(4) Termination of service.--The regulations shall permit 
     the operator of a website, online service, online 
     application, or mobile application to terminate service 
     provided to a child whose parent has refused, or a teen who 
     has refused, under the regulations prescribed under 
     paragraphs (1)(B)(ii) and (1)(C)(ii), to permit the 
     operator's further use or maintenance in retrievable form, or 
     future online collection of, personal information from that 
     child or teen.''; and
       (E) by adding at the end the following new paragraphs:
       ``(5) Continuation of service.--The regulations shall 
     prohibit an operator from discontinuing service provided to a 
     child or teen on the basis of a request by the parent of the 
     child or by the teen, under the regulations prescribed under 
     subparagraph (B) or (C) of paragraph (1), respectively, to 
     delete personal information collected from the child or teen, 
     to the extent that the operator is capable of providing such 
     service without such information.
       ``(6) Rule of construction.--A request made pursuant to 
     subparagraph (B) or (C) of paragraph (1) to delete or correct 
     personal information of a child or teen shall not be 
     construed--
       ``(A) to limit the authority of a law enforcement agency to 
     obtain any content or information from an operator pursuant 
     to a lawfully executed warrant or an order of a court of 
     competent jurisdiction;
       ``(B) to require an operator or third party delete or 
     correct information that--
       ``(i) any other provision of Federal or State law requires 
     the operator or third party to maintain; or
       ``(ii) was submitted to the website, online service, online 
     application, or mobile application of the operator by any 
     person other than the user who is attempting to erase or 
     otherwise eliminate the content or information, including 
     content or information submitted by the user that was 
     republished or resubmitted by another person; or
       ``(C) to prohibit an operator from--
       ``(i) retaining a record of the deletion request and the 
     minimum information necessary for the purposes of ensuring 
     compliance with a request made pursuant to subparagraph (B) 
     or (C);
       ``(ii) preventing, detecting, protecting against, or 
     responding to security incidents, identity theft, or fraud, 
     or reporting those responsible for such actions;
       ``(iii) protecting the integrity or security of a website, 
     online service, online application or mobile application; or
       ``(iv) ensuring that the child's or teen's information 
     remains deleted.
       ``(7) Common verifiable consent mechanism.--
       ``(A) In general.--
       ``(i) Feasibility of mechanism.--The Commission shall 
     assess the feasibility, with notice and public comment, of 
     allowing operators the option to use a common verifiable 
     consent mechanism that fully meets the requirements of this 
     title.
       ``(ii) Requirements.--The feasibility assessment described 
     in clause (i) shall consider whether a single operator could 
     use a common verifiable consent mechanism to obtain 
     verifiable consent, as required under this title, from a 
     parent of a child or from a teen on behalf of multiple, 
     listed operators that provide a joint or related service.
       ``(B) Report.--Not later than 1 year after the date of 
     enactment of this paragraph, the Commission shall submit a 
     report to the Committee on Commerce, Science, and 
     Transportation of the Senate and the Committee on Energy and 
     Commerce of the House of Representatives with the findings of 
     the assessment required by subparagraph (A).
       ``(C) Regulations.--If the Commission finds that the use of 
     a common verifiable consent mechanism is feasible and would 
     meet the requirements of this title, the Commission shall 
     issue regulations to permit the use of a common verifiable 
     consent mechanism in accordance with the findings outlined in 
     such report.'';
       (4) in subsection (c), by striking ``a regulation 
     prescribed under subsection (a)'' and inserting 
     ``subparagraph (B), (C), (D), or (E) of subsection (a)(1), or 
     of a regulation prescribed under subsection (b),''; and
       (5) by striking subsection (d) and inserting the following:
       ``(d) Relationship to State Law.--The provisions of this 
     title shall preempt any State law, rule, or regulation only 
     to the extent that such State law, rule, or regulation 
     conflicts with a provision of this title. Nothing in this 
     title shall be construed to prohibit any State from enacting 
     a law, rule, or regulation that provides greater protection 
     to children or teens than the provisions of this title.''.
       (c) Safe Harbors.--Section 1304 of the Children's Online 
     Privacy Protection Act of 1998 (15 U.S.C. 6503) is amended--
       (1) in subsection (b)(1), by inserting ``and teens'' after 
     ``children''; and
       (2) by adding at the end the following:
       ``(d) Publication.--
       ``(1) In general.--Subject to the restrictions described in 
     paragraph (2), the Commission shall publish on the internet 
     website of

[[Page S3344]]

     the Commission any report or documentation required by 
     regulation to be submitted to the Commission to carry out 
     this section.
       ``(2) Restrictions on publication.--The restrictions 
     described in section 6(f) and section 21 of the Federal Trade 
     Commission Act (15 U.S.C. 46(f), 57b-2) applicable to the 
     disclosure of information obtained by the Commission shall 
     apply in same manner to the disclosure under this subsection 
     of information obtained by the Commission from a report or 
     documentation described in paragraph (1).''.
       (d) Actions by States.--Section 1305 of the Children's 
     Online Privacy Protection Act of 1998 (15 U.S.C. 6504) is 
     amended--
       (1) in subsection (a)(1)--
       (A) in the matter preceding subparagraph (A), by inserting 
     ``section 1303(a)(1) or'' before ``any regulation''; and
       (B) in subparagraph (B), by inserting ``section 1303(a)(1) 
     or'' before ``the regulation''; and
       (2) in subsection (d)--
       (A) by inserting ``section 1303(a)(1) or'' before ``any 
     regulation''; and
       (B) by inserting ``section 1303(a)(1) or'' before ``that 
     regulation''.
       (e) Administration and Applicability of Act.--Section 1306 
     of the Children's Online Privacy Protection Act of 1998 (15 
     U.S.C. 6505) is amended--
       (1) in subsection (b)--
       (A) in paragraph (1), by striking ``, in the case of'' and 
     all that follows through ``the Board of Directors of the 
     Federal Deposit Insurance Corporation;'' and inserting the 
     following: ``by the appropriate Federal banking agency, with 
     respect to any insured depository institution (as those terms 
     are defined in section 3 of that Act (12 U.S.C. 1813));''; 
     and
       (B) by striking paragraph (2) and redesignating paragraphs 
     (3) through (6) as paragraphs (2) through (5), respectively;
       (2) in subsection (d)--
       (A) by inserting ``section 1303(a)(1) or'' before ``a 
     rule''; and
       (B) by striking ``such rule'' and inserting ``section 
     1303(a)(1) or a rule of the Commission under section 1303''; 
     and
       (3) by adding at the end the following new subsections:
       ``(f) Determination of Whether an Operator Has Knowledge 
     Fairly Implied on the Basis of Objective Circumstances.--
       ``(1) Rule of construction.--For purposes of enforcing this 
     title or a regulation promulgated under this title, in making 
     a determination as to whether an operator has knowledge 
     fairly implied on the basis of objective circumstances that a 
     specific user is a child or teen, the Commission or State 
     attorneys general shall rely on competent and reliable 
     evidence, taking into account any guidance issued by the 
     Commission under paragraph (2) and the totality of the 
     circumstances, including whether a reasonable and prudent 
     person under the circumstances would have known that the user 
     is a child or teen. Nothing in this title, including a 
     determination described in the preceding sentence, shall be 
     construed to require an operator to--
       ``(A) affirmatively collect any personal information with 
     respect to the age of a child or teen that an operator is not 
     already collecting in the normal course of business; or
       ``(B) implement an age gating or age verification 
     functionality.
       ``(2) Commission guidance.--
       ``(A) In general.--Within 180 days of enactment, the 
     Commission shall issue guidance to provide information, 
     including best practices and examples for operators to 
     understand the Commission's determination of whether an 
     operator has knowledge fairly implied on the basis of 
     objective circumstances that a user is a child or teen.
       ``(B) Limitation.--No guidance issued by the Commission 
     with respect to this title shall confer any rights on any 
     person, State, or locality, nor shall operate to bind the 
     Commission or any person to the approach recommended in such 
     guidance. In any enforcement action brought pursuant to this 
     title, the Commission or State attorney general, as 
     applicable, shall allege a specific violation of a provision 
     of this title. The Commission or State attorney general, as 
     applicable, may not base an enforcement action on, or execute 
     a consent order based on, practices that are alleged to be 
     inconsistent with any such guidance, unless the practices 
     allegedly violate this title. For purposes of enforcing this 
     title or a regulation promulgated under this title, State 
     attorneys general shall take into account any guidance issued 
     by the Commission under subparagraph (A).
       ``(g) Additional Requirement.--Any regulations issued under 
     this title shall include a description and analysis of the 
     impact of proposed and final Rules on small entities per the 
     Regulatory Flexibility Act of 1980 (5 U.S.C. 601 et seq.).''.

     SEC. __3. STUDY AND REPORTS OF MOBILE AND ONLINE APPLICATION 
                   OVERSIGHT AND ENFORCEMENT.

       (a) Oversight Report.--Not later than 3 years after the 
     date of enactment of this title, the Federal Trade Commission 
     shall submit to the Committee on Commerce, Science, and 
     Transportation of the Senate and the Committee on Energy and 
     Commerce of the House of Representatives a report on the 
     processes of platforms that offer mobile and online 
     applications for ensuring that, of those applications that 
     are websites, online services, online applications, or mobile 
     applications directed to children, the applications operate 
     in accordance with--
       (1) this title, the amendments made by this title, and 
     rules promulgated under this title; and
       (2) rules promulgated by the Commission under section 18 of 
     the Federal Trade Commission Act (15 U.S.C. 57a) relating to 
     unfair or deceptive acts or practices in marketing.
       (b) Enforcement Report.--Not later than 1 year after the 
     date of enactment of this title, and each year thereafter, 
     the Federal Trade Commission shall submit to the Committee on 
     Commerce, Science, and Transportation of the Senate and the 
     Committee on Energy and Commerce of the House of 
     Representatives a report that addresses, at a minimum--
       (1) the number of actions brought by the Commission during 
     the reporting year to enforce the Children's Online Privacy 
     Protection Act of 1998 (15 U.S.C. 6501) (referred to in this 
     subsection as the ``Act'') and the outcome of each such 
     action;
       (2) the total number of investigations or inquiries into 
     potential violations of the Act; during the reporting year;
       (3) the total number of open investigations or inquiries 
     into potential violations of the Act as of the time the 
     report is submitted;
       (4) the number and nature of complaints received by the 
     Commission relating to an allegation of a violation of the 
     Act during the reporting year; and
       (5) policy or legislative recommendations to strengthen 
     online protections for children and teens.

     SEC. __4. GAO STUDY.

       (a) Study.--The Comptroller General of the United States 
     (in this section referred to as the ``Comptroller General'') 
     shall conduct a study on the privacy of teens who use 
     financial technology products. Such study shall--
       (1) identify the type of financial technology products that 
     teens are using;
       (2) identify the potential risks to teens' privacy from 
     using such financial technology products; and
       (3) determine whether existing laws are sufficient to 
     address such risks to teens' privacy.
       (b) Report.--Not later than 1 year after the date of 
     enactment of this section, the Comptroller General shall 
     submit to Congress a report containing the results of the 
     study conducted under subsection (a), together with 
     recommendations for such legislation and administrative 
     action as the Comptroller General determines appropriate.

     SEC. __5. SEVERABILITY.

       If any provision of this title, or an amendment made by 
     this title, is determined to be unenforceable or invalid, the 
     remaining provisions of this title and the amendments made by 
     this title shall not be affected.
                                 ______