[Congressional Record Volume 170, Number 119 (Tuesday, July 23, 2024)]
[Senate]
[Pages S5295-S5305]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

  SA 3021. Mr. SCHUMER proposed an amendment to the bill S. 2073, to 
amend title 31, United States Code, to require agencies to include a 
list of outdated or duplicative reporting requirements in annual budget 
justifications, and for other purposes; as follows:

       In lieu of the matter proposed to be inserted, insert the 
     following:

     SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

       (a) Short Title.--This Act may be cited as the ``Kids 
     Online Safety and Privacy Act''.
       (b) Table of Contents.--The table of contents for this Act 
     is as follows:

Sec. 1. Short title; table of contents.

                   TITLE I--KEEPING KIDS SAFE ONLINE

                     Subtitle A--Kids Online Safety

Sec. 101. Definitions.
Sec. 102. Duty of care.
Sec. 103. Safeguards for minors.
Sec. 104. Disclosure.
Sec. 105. Transparency.
Sec. 106. Research on social media and minors.
Sec. 107. Market research.
Sec. 108. Age verification study and report.
Sec. 109. Guidance.
Sec. 110. Enforcement.
Sec. 111. Kids online safety council.
Sec. 112. Effective date.
Sec. 113. Rules of construction and other matters.

                 Subtitle B--Filter Bubble Transparency

Sec. 120. Definitions.
Sec. 121. Requirement to allow users to see unmanipulated content on 
              internet platforms.

          Subtitle C--Relationship to State Laws; Severability

Sec. 130. Relationship to State laws.
Sec. 131. Severability.

              TITLE II--CHILDREN AND TEENS' ONLINE PRIVACY

Sec. 201. Online collection, use, disclosure, and deletion of personal 
              information of children and teens.
Sec. 202. Study and reports of mobile and online application oversight 
              and enforcement.
Sec. 203. GAO study.
Sec. 204. Severability.

                 TITLE III--ELIMINATING USELESS REPORTS

Sec. 301. Sunsets for agency reports.

                   TITLE I--KEEPING KIDS SAFE ONLINE

                     Subtitle A--Kids Online Safety

     SEC. 101. DEFINITIONS.

       In this subtitle:
       (1) Child.--The term ``child'' means an individual who is 
     under the age of 13.
       (2) Compulsive usage.--The term ``compulsive usage'' means 
     any response stimulated by external factors that causes an 
     individual to engage in repetitive behavior reasonably likely 
     to cause psychological distress.
       (3) Covered platform.--
       (A) In general.--The term ``covered platform'' means an 
     online platform, online video game, messaging application, or 
     video streaming service that connects to the internet and 
     that is used, or is reasonably likely to be used, by a minor.
       (B) Exceptions.--The term ``covered platform'' does not 
     include--
       (i) an entity acting in its capacity as a provider of--

       (I) a common carrier service subject to the Communications 
     Act of 1934 (47 U.S.C. 151 et seq.) and all Acts amendatory 
     thereof and supplementary thereto;
       (II) a broadband internet access service (as such term is 
     defined for purposes of section 8.1(b) of title 47, Code of 
     Federal Regulations, or any successor regulation);
       (III) an email service;
       (IV) a teleconferencing or video conferencing service that 
     allows reception and transmission of audio or video signals 
     for real-time communication, provided that--

       (aa) the service is not an online platform, including a 
     social media service or social network; and
       (bb) the real-time communication is initiated by using a 
     unique link or identifier to facilitate access; or

       (V) a wireless messaging service, including such a service 
     provided through short messaging service or multimedia 
     messaging service protocols, that is not a component of, or 
     linked to, an online platform and where the predominant or 
     exclusive function is direct messaging consisting of the 
     transmission of text, photos or videos that are sent by 
     electronic means, where messages are transmitted from the 
     sender to a recipient, and are not posted within an online 
     platform or publicly;

       (ii) an organization not organized to carry on business for 
     its own profit or that of its members;
       (iii) any public or private preschool, elementary, or 
     secondary school, or any institution of vocational, 
     professional, or higher education;
       (iv) a library (as defined in section 213(1) of the Library 
     Services and Technology Act (20 U.S.C. 9122(1)));
       (v) a news or sports coverage website or app where--

       (I) the inclusion of video content on the website or app is 
     related to the website or app's own gathering, reporting, or 
     publishing of news content or sports coverage; and
       (II) the website or app is not otherwise an online 
     platform;

       (vi) a product or service that primarily functions as 
     business-to-business software, a cloud storage, file sharing, 
     or file collaboration service, provided that the product or 
     service is not an online platform; or
       (vii) a virtual private network or similar service that 
     exists solely to route internet traffic between locations.
       (4) Design feature.--The term ``design feature'' means any 
     feature or component of a covered platform that will 
     encourage or increase the frequency, time spent, or activity 
     of minors on the covered platform. Design features include 
     but are not limited to--
       (A) infinite scrolling or auto play;
       (B) rewards for time spent on the platform;
       (C) notifications;
       (D) personalized recommendation systems;
       (E) in-game purchases; or
       (F) appearance altering filters.
       (5) Geolocation.--The term ``geolocation'' has the meaning 
     given the term ``geolocation information'' in section 1302 of 
     the Children's Online Privacy Protection Act of 1998 (15 
     U.S.C. 6501), as added by section 201(a).
       (6) Know or knows.--The term ``know'' or ``knows'' means to 
     have actual knowledge or knowledge fairly implied on the 
     basis of objective circumstances.
       (7) Mental health disorder.--The term ``mental health 
     disorder'' has the meaning given the term ``mental disorder'' 
     in the Diagnostic and Statistical Manual of Mental Health 
     Disorders, 5th Edition (or the most current successor 
     edition).
       (8) Microtransaction.--
       (A) In general.--The term ``microtransaction'' means a 
     purchase made in an online video game (including a purchase 
     made using a virtual currency that is purchasable or 
     redeemable using cash or credit or that is included as part 
     of a paid subscription service).
       (B) Inclusions.--Such term includes a purchase involving 
     surprise mechanics, new characters, or in-game items.
       (C) Exclusions.--Such term does not include--
       (i) a purchase made in an online video game using a virtual 
     currency that is earned through gameplay and is not otherwise 
     purchasable or redeemable using cash or credit or included as 
     part of a paid subscription service; or
       (ii) a purchase of additional levels within the game or an 
     overall expansion of the game.
       (9) Minor.--The term ``minor'' means an individual who is 
     under the age of 17.
       (10) Online platform.--The term ``online platform'' means 
     any public-facing website, online service, online 
     application, or mobile application that predominantly 
     provides a community forum for user generated content, such 
     as sharing videos, images, games, audio files, or other 
     content, including a social media service, social network, or 
     virtual reality environment.
       (11) Online video game.--The term ``online video game'' 
     means a video game, including an educational video game, that 
     connects to the internet and that allows a user to--
       (A) create and upload content other than content that is 
     incidental to gameplay, such as character or level designs 
     created by the user, preselected phrases, or short 
     interactions with other users;
       (B) engage in microtransactions within the game; or
       (C) communicate with other users.
       (12) Parent.--The term ``parent'' has the meaning given 
     that term in section 1302 of the Children's Online Privacy 
     Protection Act (15 U.S.C. 6501).
       (13) Personal data.--The term ``personal data'' has the 
     same meaning as the term ``personal information'' as defined 
     in section 1302 of the Children's Online Privacy Protection 
     Act (15 U.S.C. 6501).
       (14) Personalized recommendation system.--The term 
     ``personalized recommendation system'' means a fully or 
     partially automated system used to suggest, promote, or rank 
     content, including other users, hashtags, or posts, based on 
     the personal data of users. A recommendation system that 
     suggests, promotes, or ranks content based solely on the 
     user's language, city or town, or age shall not be considered 
     a personalized recommendation system.
       (15) Sexual exploitation and abuse.--The term ``sexual 
     exploitation and abuse'' means any of the following:
       (A) Coercion and enticement, as described in section 2422 
     of title 18, United States Code.
       (B) Child sexual abuse material, as described in sections 
     2251, 2252, 2252A, and 2260 of title 18, United States Code.
       (C) Trafficking for the production of images, as described 
     in section 2251A of title 18, United States Code.

[[Page S5296]]

       (D) Sex trafficking of children, as described in section 
     1591 of title 18, United States Code.
       (16) User.--The term ``user'' means, with respect to a 
     covered platform, an individual who registers an account or 
     creates a profile on the covered platform.

     SEC. 102. DUTY OF CARE.

       (a) Prevention of Harm to Minors.--A covered platform shall 
     exercise reasonable care in the creation and implementation 
     of any design feature to prevent and mitigate the following 
     harms to minors:
       (1) Consistent with evidence-informed medical information, 
     the following mental health disorders: anxiety, depression, 
     eating disorders, substance use disorders, and suicidal 
     behaviors.
       (2) Patterns of use that indicate or encourage addiction-
     like behaviors by minors.
       (3) Physical violence, online bullying, and harassment of 
     the minor.
       (4) Sexual exploitation and abuse of minors.
       (5) Promotion and marketing of narcotic drugs (as defined 
     in section 102 of the Controlled Substances Act (21 U.S.C. 
     802)), tobacco products, gambling, or alcohol.
       (6) Predatory, unfair, or deceptive marketing practices, or 
     other financial harms.
       (b) Limitation.--Nothing in subsection (a) shall be 
     construed to require a covered platform to prevent or 
     preclude any minor from--
       (1) deliberately and independently searching for, or 
     specifically requesting, content; or
       (2) accessing resources and information regarding the 
     prevention or mitigation of the harms described in subsection 
     (a).

     SEC. 103. SAFEGUARDS FOR MINORS.

       (a) Safeguards for Minors.--
       (1) Safeguards.--A covered platform shall provide a user or 
     visitor that the covered platform knows is a minor with 
     readily-accessible and easy-to-use safeguards to, as 
     applicable--
       (A) limit the ability of other users or visitors to 
     communicate with the minor;
       (B) prevent other users or visitors, whether registered or 
     not, from viewing the minor's personal data collected by or 
     shared on the covered platform, in particular restricting 
     public access to personal data;
       (C) limit design features that encourage or increase the 
     frequency, time spent, or activity of minors on the covered 
     platform, such as infinite scrolling, auto playing, rewards 
     for time spent on the platform, notifications, and other 
     design features that result in compulsive usage of the 
     covered platform by the minor;
       (D) control personalized recommendation systems, including 
     the ability for a minor to have at least 1 of the following 
     options--
       (i) opt out of such personalized recommendation systems, 
     while still allowing the display of content based on a 
     chronological format; or
       (ii) limit types or categories of recommendations from such 
     systems; and
       (E) restrict the sharing of the geolocation of the minor 
     and provide notice regarding the tracking of the minor's 
     geolocation.
       (2) Option.--A covered platform shall provide a user that 
     the covered platform knows is a minor with a readily-
     accessible and easy-to-use option to limit the amount of time 
     spent by the minor on the covered platform.
       (3) Default safeguard settings for minors.--A covered 
     platform shall provide that, in the case of a user or visitor 
     that the platform knows is a minor, the default setting for 
     any safeguard described under paragraph (1) shall be the 
     option available on the platform that provides the most 
     protective level of control that is offered by the platform 
     over privacy and safety for that user or visitor.
       (b) Parental Tools.--
       (1) Tools.--A covered platform shall provide readily-
     accessible and easy-to-use settings for parents to support a 
     user that the platform knows is a minor with respect to the 
     user's use of the platform.
       (2) Requirements.--The parental tools provided by a covered 
     platform shall include--
       (A) the ability to manage a minor's privacy and account 
     settings, including the safeguards and options established 
     under subsection (a), in a manner that allows parents to--
       (i) view the privacy and account settings; and
       (ii) in the case of a user that the platform knows is a 
     child, change and control the privacy and account settings;
       (B) the ability to restrict purchases and financial 
     transactions by the minor, where applicable; and
       (C) the ability to view metrics of total time spent on the 
     covered platform and restrict time spent on the covered 
     platform by the minor.
       (3) Notice to minors.--A covered platform shall provide 
     clear and conspicuous notice to a user when the tools 
     described in this subsection are in effect and what settings 
     or controls have been applied.
       (4) Default tools.--A covered platform shall provide that, 
     in the case of a user that the platform knows is a child, the 
     tools required under paragraph (1) shall be enabled by 
     default.
       (5) Application to existing accounts.--If, prior to the 
     effective date of this subsection, a covered platform 
     provided a parent of a user that the platform knows is a 
     child with notice and the ability to enable the parental 
     tools described under this subsection in a manner that would 
     otherwise comply with this subsection, and the parent opted 
     out of enabling such tools, the covered platform is not 
     required to enable such tools with respect to such user by 
     default when this subsection takes effect.
       (c) Reporting Mechanism.--
       (1) Reports submitted by parents, minors, and schools.--A 
     covered platform shall provide--
       (A) a readily-accessible and easy-to-use means to submit 
     reports to the covered platform of harms to a minor;
       (B) an electronic point of contact specific to matters 
     involving harms to a minor; and
       (C) confirmation of the receipt of such a report and, 
     within the applicable time period described in paragraph (2), 
     a substantive response to the individual that submitted the 
     report.
       (2) Timing.--A covered platform shall establish an internal 
     process to receive and substantively respond to such reports 
     in a reasonable and timely manner, but in no case later 
     than--
       (A) 10 days after the receipt of a report, if, for the most 
     recent calendar year, the platform averaged more than 
     10,000,000 active users on a monthly basis in the United 
     States;
       (B) 21 days after the receipt of a report, if, for the most 
     recent calendar year, the platform averaged less than 
     10,000,000 active users on a monthly basis in the United 
     States; and
       (C) notwithstanding subparagraphs (A) and (B), if the 
     report involves an imminent threat to the safety of a minor, 
     as promptly as needed to address the reported threat to 
     safety.
       (d) Advertising of Illegal Products.--A covered platform 
     shall not facilitate the advertising of narcotic drugs (as 
     defined in section 102 of the Controlled Substances Act (21 
     U.S.C. 802)), tobacco products, gambling, or alcohol to an 
     individual that the covered platform knows is a minor.
       (e) Rules of Application.--
       (1) Accessibility.--With respect to safeguards and parental 
     tools described under subsections (a) and (b), a covered 
     platform shall provide--
       (A) information and control options in a clear and 
     conspicuous manner that takes into consideration the 
     differing ages, capacities, and developmental needs of the 
     minors most likely to access the covered platform and does 
     not encourage minors or parents to weaken or disable 
     safeguards or parental tools;
       (B) readily-accessible and easy-to-use controls to enable 
     or disable safeguards or parental tools, as appropriate; and
       (C) information and control options in the same language, 
     form, and manner as the covered platform provides the product 
     or service used by minors and their parents.
       (2) Dark patterns prohibition.--It shall be unlawful for 
     any covered platform to design, modify, or manipulate a user 
     interface of a covered platform with the purpose or 
     substantial effect of subverting or impairing user autonomy, 
     decision-making, or choice with respect to safeguards or 
     parental tools required under this section.
       (3) Timing considerations.--
       (A) No interruption to gameplay.--Subsections (a)(1)(C) and 
     (b)(3) shall not require an online video game to interrupt 
     the natural sequence of game play, such as progressing 
     through game levels or finishing a competition.
       (B) Application of changes to offline devices or 
     accounts.--If a user's device or user account does not have 
     access to the internet at the time of a change to parental 
     tools, a covered platform shall apply changes the next time 
     the device or user is connected to the internet.
       (4) Rules of construction.--Nothing in this section shall 
     be construed to--
       (A) prevent a covered platform from taking reasonable 
     measures to--
       (i) block, detect, or prevent the distribution of unlawful, 
     obscene, or other harmful material to minors as described in 
     section 102(a); or
       (ii) block or filter spam, prevent criminal activity, or 
     protect the security of a platform or service;
       (B) require the disclosure of a minor's browsing behavior, 
     search history, messages, contact list, or other content or 
     metadata of their communications;
       (C) prevent a covered platform from using a personalized 
     recommendation system to display content to a minor if the 
     system only uses information on--
       (i) the language spoken by the minor;
       (ii) the city the minor is located in; or
       (iii) the minor's age; or
       (D) prevent an online video game from disclosing a username 
     or other user identification for the purpose of competitive 
     gameplay or to allow for the reporting of users.
       (f) Device or Console Controls.--
       (1) In general.--Nothing in this section shall be construed 
     to prohibit a covered platform from integrating its products 
     or service with, or duplicate controls or tools provided by, 
     third-party systems, including operating systems or gaming 
     consoles, to meet the requirements imposed under subsections 
     (a) and (b) relating to safeguards for minors and parental 
     tools, provided that--
       (A) the controls or tools meet such requirements; and
       (B) the minor or parent is provided sufficient notice of 
     the integration and use of the parental tools.
       (2) Preservation of protections.--In the event of a 
     conflict between the controls or

[[Page S5297]]

     tools of a third-party system, including operating systems or 
     gaming consoles, and a covered platform, the covered platform 
     is not required to override the controls or tools of a third-
     party system if it would undermine the protections for minors 
     from the safeguards or parental tools imposed under 
     subsections (a) and (b).

     SEC. 104. DISCLOSURE.

       (a) Notice.--
       (1) Registration or purchase.--Prior to registration or 
     purchase of a covered platform by an individual that the 
     platform knows is a minor, the platform shall provide clear, 
     conspicuous, and easy-to-understand--
       (A) notice of the policies and practices of the covered 
     platform with respect to safeguards for minors required under 
     section 103;
       (B) information about how to access the safeguards and 
     parental tools required under section 103; and
       (C) notice about whether the covered platform uses or makes 
     available to minors a product, service, or design feature, 
     including any personalized recommendation system, that poses 
     any heightened risk of harm to minors.
       (2) Notification.--
       (A) Notice and acknowledgment.--In the case of an 
     individual that a covered platform knows is a child, the 
     platform shall additionally provide information about the 
     parental tools and safeguards required under section 103 to a 
     parent of the child and obtain verifiable consent (as defined 
     in section 1302(9) of the Children's Online Privacy 
     Protection Act (15 U.S.C. 6501(9))) from the parent prior to 
     the initial use of the covered platform by the child.
       (B) Reasonable effort.--A covered platform shall be deemed 
     to have satisfied the requirement described in subparagraph 
     (A) if the covered platform is in compliance with the 
     requirements of the Children's Online Privacy Protection Act 
     (15 U.S.C. 6501 et seq.) to use reasonable efforts (taking 
     into consideration available technology) to provide a parent 
     with the information described in subparagraph (A) and to 
     obtain verifiable consent as required.
       (3) Consolidated notices.--For purposes of this subtitle, a 
     covered platform may consolidate the process for providing 
     information under this subsection and obtaining verifiable 
     consent or the consent of the minor involved (as applicable) 
     as required under this subsection with its obligations to 
     provide relevant notice and obtain verifiable consent under 
     the Children's Online Privacy Protection Act (15 U.S.C. 6501 
     et seq.).
       (4) Guidance.--The Federal Trade Commission may issue 
     guidance to assist covered platforms in complying with the 
     specific notice requirements of this subsection.
       (b) Personalized Recommendation System.--A covered platform 
     that operates a personalized recommendation system shall set 
     out in its terms and conditions, in a clear, conspicuous, and 
     easy-to-understand manner--
       (1) an overview of how such personalized recommendation 
     system is used by the covered platform to provide information 
     to minors, including how such systems use the personal data 
     of minors; and
       (2) information about options for minors or their parents 
     to opt out of or control the personalized recommendation 
     system (as applicable).
       (c) Advertising and Marketing Information and Labels.--
       (1) Information and labels.--A covered platform shall 
     provide clear, conspicuous, and easy-to-understand labels and 
     information, which can be provided through a link to another 
     web page or disclosure, to minors on advertisements 
     regarding--
       (A) the name of the product, service, or brand and the 
     subject matter of an advertisement; and
       (B) whether particular media displayed to the minor is an 
     advertisement or marketing material, including disclosure of 
     endorsements of products, services, or brands made for 
     commercial consideration by other users of the platform.
       (2) Guidance.--The Federal Trade Commission may issue 
     guidance to assist covered platforms in complying with the 
     requirements of this subsection, including guidance about the 
     minimum level of information and labels for the disclosures 
     required under paragraph (1).
       (d) Resources for Parents and Minors.--A covered platform 
     shall provide to minors and parents clear, conspicuous, easy-
     to-understand, and comprehensive information in a prominent 
     location, which may include a link to a web page, regarding--
       (1) its policies and practices with respect to safeguards 
     for minors required under section 103; and
       (2) how to access the safeguards and tools required under 
     section 103.
       (e) Resources in Additional Languages.--A covered platform 
     shall ensure, to the extent practicable, that the disclosures 
     required by this section are made available in the same 
     language, form, and manner as the covered platform provides 
     any product or service used by minors and their parents.

     SEC. 105. TRANSPARENCY.

       (a) In General.--Subject to subsection (b), not less 
     frequently than once a year, a covered platform shall issue a 
     public report describing the reasonably foreseeable risks of 
     harms to minors and assessing the prevention and mitigation 
     measures taken to address such risk based on an independent, 
     third-party audit conducted through reasonable inspection of 
     the covered platform.
       (b) Scope of Application.--The requirements of this section 
     shall apply to a covered platform if--
       (1) for the most recent calendar year, the platform 
     averaged more than 10,000,000 active users on a monthly basis 
     in the United States; and
       (2) the platform predominantly provides a community forum 
     for user-generated content and discussion, including sharing 
     videos, images, games, audio files, discussion in a virtual 
     setting, or other content, such as acting as a social media 
     platform, virtual reality environment, or a social network 
     service.
       (c) Content.--
       (1) Transparency.--The public reports required of a covered 
     platform under this section shall include--
       (A) an assessment of the extent to which the platform is 
     likely to be accessed by minors;
       (B) a description of the commercial interests of the 
     covered platform in use by minors;
       (C) an accounting, based on the data held by the covered 
     platform, of--
       (i) the number of users using the covered platform that the 
     platform knows to be minors in the United States;
       (ii) the median and mean amounts of time spent on the 
     platform by users known to be minors in the United States who 
     have accessed the platform during the reporting year on a 
     daily, weekly, and monthly basis; and
       (iii) the amount of content being accessed by users that 
     the platform knows to be minors in the United States that is 
     in English, and the top 5 non-English languages used by users 
     accessing the platform in the United States;
       (D) an accounting of total reports received regarding, and 
     the prevalence (which can be based on scientifically valid 
     sampling methods using the content available to the covered 
     platform in the normal course of business) of content related 
     to, the harms described in section 102(a), disaggregated by 
     category of harm and language, including English and the top 
     5 non-English languages used by users accessing the platform 
     from the United States (as identified under subparagraph 
     (C)(iii)); and
       (E) a description of any material breaches of parental 
     tools or assurances regarding minors, representations 
     regarding the use of the personal data of minors, and other 
     matters regarding non-compliance with this subtitle.
       (2) Reasonably foreseeable risk of harm to minors.--The 
     public reports required of a covered platform under this 
     section shall include--
       (A) an assessment of the reasonably foreseeable risk of 
     harms to minors posed by the covered platform, specifically 
     identifying those physical, mental, developmental, or 
     financial harms described in section 102(a);
       (B) a description of whether and how the covered platform 
     uses design features that encourage or increase the 
     frequency, time spent, or activity of minors on the covered 
     platform, such as infinite scrolling, auto playing, rewards 
     for time spent on the platform, notifications, and other 
     design features that result in compulsive usage of the 
     covered platform by the minor;
       (C) a description of whether, how, and for what purpose the 
     platform collects or processes categories of personal data 
     that may cause reasonably foreseeable risk of harms to 
     minors;
       (D) an evaluation of the efficacy of safeguards for minors 
     and parental tools under section 103, and any issues in 
     delivering such safeguards and the associated parental tools;
       (E) an evaluation of any other relevant matters of public 
     concern over risk of harms to minors associated with the use 
     of the covered platform; and
       (F) an assessment of differences in risk of harm to minors 
     across different English and non-English languages and 
     efficacy of safeguards in those languages.
       (3) Mitigation.--The public reports required of a covered 
     platform under this section shall include, for English and 
     the top 5 non-English languages used by users accessing the 
     platform from the United States (as identified under 
     paragraph (2)(C)(iii)))--
       (A) a description of the safeguards and parental tools 
     available to minors and parents on the covered platform;
       (B) a description of interventions by the covered platform 
     when it had or has reason to believe that harms to minors 
     could occur;
       (C) a description of the prevention and mitigation measures 
     intended to be taken in response to the known and emerging 
     risks identified in its assessment of reasonably foreseeable 
     risks of harms to minors, including steps taken to--
       (i) prevent harms to minors, including adapting or removing 
     design features or addressing through parental tools;
       (ii) provide the most protective level of control over 
     privacy and safety by default; and
       (iii) adapt recommendation systems to mitigate reasonably 
     foreseeable risk of harms to minors, as described in section 
     102(a);
       (D) a description of internal processes for handling 
     reports and automated detection mechanisms for harms to 
     minors, including the rate, timeliness, and effectiveness of 
     responses under the requirement of section 103(c);
       (E) the status of implementing prevention and mitigation 
     measures identified in prior assessments; and

[[Page S5298]]

       (F) a description of the additional measures to be taken by 
     the covered platform to address the circumvention of 
     safeguards for minors and parental tools.
       (d) Reasonable Inspection.--In conducting an inspection of 
     the reasonably foreseeable risk of harm to minors under this 
     section, an independent, third-party auditor shall--
       (1) take into consideration the function of personalized 
     recommendation systems;
       (2) consult parents and youth experts, including youth and 
     families with relevant past or current experience, public 
     health and mental health nonprofit organizations, health and 
     development organizations, and civil society with respect to 
     the prevention of harms to minors;
       (3) conduct research based on experiences of minors that 
     use the covered platform, including reports under section 
     103(c) and information provided by law enforcement;
       (4) take account of research, including research regarding 
     design features, marketing, or product integrity, industry 
     best practices, or outside research;
       (5) consider indicia or inferences of age of users, in 
     addition to any self-declared information about the age of 
     users; and
       (6) take into consideration differences in risk of 
     reasonably foreseeable harms and effectiveness of safeguards 
     across English and non-English languages.
       (e) Cooperation With Independent, Third-party Audit.--To 
     facilitate the report required by subsection (c), a covered 
     platform shall--
       (1) provide or otherwise make available to the independent 
     third-party conducting the audit all information and material 
     in its possession, custody, or control that is relevant to 
     the audit;
       (2) provide or otherwise make available to the independent 
     third-party conducting the audit access to all network, 
     systems, and assets relevant to the audit; and
       (3) disclose all relevant facts to the independent third-
     party conducting the audit, and not misrepresent in any 
     manner, expressly or by implication, any relevant fact.
       (f) Privacy Safeguards.--
       (1) In general.--In issuing the public reports required 
     under this section, a covered platform shall take steps to 
     safeguard the privacy of its users, including ensuring that 
     data is presented in a de-identified, aggregated format such 
     that it is not reasonably linkable to any user.
       (2) Rule of construction.--This section shall not be 
     construed to require the disclosure of information that will 
     lead to material vulnerabilities for the privacy of users or 
     the security of a covered platform's service or create a 
     significant risk of the violation of Federal or State law.
       (3) Definition of de-identified.--As used in this 
     subsection, the term ``de-identified'' means data that does 
     not identify and is not linked or reasonably linkable to a 
     device that is linked or reasonably linkable to an 
     individual, regardless of whether the information is 
     aggregated
       (g) Location.--The public reports required under this 
     section should be posted by a covered platform on an easy to 
     find location on a publicly-available website.

     SEC. 106. RESEARCH ON SOCIAL MEDIA AND MINORS.

       (a) Definitions.--In this section:
       (1) Commission.--The term ``Commission'' means the Federal 
     Trade Commission.
       (2) National academy.--The term ``National Academy'' means 
     the National Academy of Sciences.
       (3) Secretary.--The term ``Secretary'' means the Secretary 
     of Health and Human Services.
       (b) Research on Social Media Harms.--Not later than 12 
     months after the date of enactment of this Act, the 
     Commission shall seek to enter into a contract with the 
     National Academy, under which the National Academy shall 
     conduct no less than 5 scientific, comprehensive studies and 
     reports on the risk of harms to minors by use of social media 
     and other online platforms, including in English and non-
     English languages.
       (c) Matters to Be Addressed.--In contracting with the 
     National Academy, the Commission, in consultation with the 
     Secretary, shall seek to commission separate studies and 
     reports, using the Commission's authority under section 6(b) 
     of the Federal Trade Commission Act (15 U.S.C. 46(b)), on the 
     relationship between social media and other online platforms 
     as defined in this subtitle on the following matters:
       (1) Anxiety, depression, eating disorders, and suicidal 
     behaviors.
       (2) Substance use disorders and the use of narcotic drugs, 
     tobacco products, gambling, or alcohol by minors.
       (3) Sexual exploitation and abuse.
       (4) Addiction-like use of social media and design factors 
     that lead to unhealthy and harmful overuse of social media.
       (d) Additional Study.--Not earlier than 4 years after 
     enactment, the Commission shall seek to enter into a contract 
     with the National Academy under which the National Academy 
     shall conduct an additional study and report covering the 
     matters described in subsection (c) for the purposes of 
     providing additional information, considering new research, 
     and other matters.
       (e) Content of Reports.-- The comprehensive studies and 
     reports conducted pursuant to this section shall seek to 
     evaluate impacts and advance understanding, knowledge, and 
     remedies regarding the harms to minors posed by social media 
     and other online platforms, and may include recommendations 
     related to public policy.
       (f) Active Studies.--If the National Academy is engaged in 
     any active studies on the matters described in subsection (c) 
     at the time that it enters into a contract with the 
     Commission to conduct a study under this section, it may base 
     the study to be conducted under this section on the active 
     study, so long as it otherwise incorporates the requirements 
     of this section.
       (g) Collaboration.--In designing and conducting the studies 
     under this section, the Commission, the Secretary, and the 
     National Academy shall consult with the Surgeon General and 
     the Kids Online Safety Council.
       (h) Access to Data.--
       (1) Fact-finding authority.--The Commission may issue 
     orders under section 6(b) of the Federal Trade Commission Act 
     (15 U.S.C. 46(b)) to require covered platforms to provide 
     reports, data, or answers in writing as necessary to conduct 
     the studies required under this section.
       (2) Scope.--In exercising its authority under paragraph 
     (1), the Commission may issue orders to no more than 5 
     covered platforms per study under this section.
       (3) Confidential access.--Notwithstanding section 6(f) or 
     21 of the Federal Trade Commission Act (15 U.S.C. 46, 57b-2), 
     the Commission shall enter in agreements with the National 
     Academy to share appropriate information received from a 
     covered platform pursuant to an order under such subsection 
     (b) for a comprehensive study under this section in a 
     confidential and secure manner, and to prohibit the 
     disclosure or sharing of such information by the National 
     Academy. Nothing in this paragraph shall be construed to 
     preclude the disclosure of any such information if authorized 
     or required by any other law.

     SEC. 107. MARKET RESEARCH.

       (a) Market Research by Covered Platforms.--The Federal 
     Trade Commission, in consultation with the Secretary of 
     Commerce, shall issue guidance for covered platforms seeking 
     to conduct market- and product-focused research on minors. 
     Such guidance shall include--
       (1) a standard consent form that provides minors and their 
     parents a clear, conspicuous, and easy-to-understand 
     explanation of the scope and purpose of the research to be 
     conducted that is available in English and the top 5 non-
     English languages used in the United States;
       (2) information on how to obtain informed consent from the 
     parent of a minor prior to conducting such market- and 
     product-focused research; and
       (3) recommendations for research practices for studies that 
     may include minors, disaggregated by the age ranges of 0-5, 
     6-9, 10-12, and 13-16.
       (b) Timing.--The Federal Trade Commission shall issue such 
     guidance not later than 18 months after the date of enactment 
     of this Act. In doing so, they shall seek input from members 
     of the public and the representatives of the Kids Online 
     Safety Council established under section 111.

     SEC. 108. AGE VERIFICATION STUDY AND REPORT.

       (a) Study.--The Secretary of Commerce, in coordination with 
     the Federal Communications Commission and the Federal Trade 
     Commission, shall conduct a study evaluating the most 
     technologically feasible methods and options for developing 
     systems to verify age at the device or operating system 
     level.
       (b) Contents.--Such study shall consider --
       (1) the benefits of creating a device or operating system 
     level age verification system;
       (2) what information may need to be collected to create 
     this type of age verification system;
       (3) the accuracy of such systems and their impact or steps 
     to improve accessibility, including for individuals with 
     disabilities;
       (4) how such a system or systems could verify age while 
     mitigating risks to user privacy and data security and 
     safeguarding minors' personal data, emphasizing minimizing 
     the amount of data collected and processed by covered 
     platforms and age verification providers for such a system;
       (5) the technical feasibility, including the need for 
     potential hardware and software changes, including for 
     devices currently in commerce and owned by consumers; and
       (6) the impact of different age verification systems on 
     competition, particularly the risk of different age 
     verification systems creating barriers to entry for small 
     companies.
       (c) Report.--Not later than 1 year after the date of 
     enactment of this Act, the agencies described in subsection 
     (a) shall submit a report containing the results of the study 
     conducted under such subsection to the Committee on Commerce, 
     Science, and Transportation of the Senate and the Committee 
     on Energy and Commerce of the House of Representatives.

     SEC. 109. GUIDANCE.

       (a) In General.--Not later than 18 months after the date of 
     enactment of this Act, the Federal Trade Commission, in 
     consultation with the Kids Online Safety Council established 
     under section 111, shall issue guidance to--
       (1) provide information and examples for covered platforms 
     and auditors regarding the following, with consideration 
     given to differences across English and non-English 
     languages--
       (A) identifying design features that encourage or increase 
     the frequency, time

[[Page S5299]]

     spent, or activity of minors on the covered platform;
       (B) safeguarding minors against the possible misuse of 
     parental tools;
       (C) best practices in providing minors and parents the most 
     protective level of control over privacy and safety;
       (D) using indicia or inferences of age of users for 
     assessing use of the covered platform by minors;
       (E) methods for evaluating the efficacy of safeguards set 
     forth in this subtitle; and
       (F) providing additional parental tool options that allow 
     parents to address the harms described in section 102(a); and
       (2) outline conduct that does not have the purpose or 
     substantial effect of subverting or impairing user autonomy, 
     decision-making, or choice, or of causing, increasing, or 
     encouraging compulsive usage for a minor, such as--
       (A) de minimis user interface changes derived from testing 
     consumer preferences, including different styles, layouts, or 
     text, where such changes are not done with the purpose of 
     weakening or disabling safeguards or parental tools;
       (B) algorithms or data outputs outside the control of a 
     covered platform; and
       (C) establishing default settings that provide enhanced 
     privacy protection to users or otherwise enhance their 
     autonomy and decision-making ability.
       (b) Guidance on Knowledge Standard.--Not later than 18 
     months after the date of enactment of this Act, the Federal 
     Trade Commission shall issue guidance to provide information, 
     including best practices and examples, for covered platforms 
     to understand how the Commission would determine whether a 
     covered platform ``had knowledge fairly implied on the basis 
     of objective circumstances'' for purposes of this subtitle.
       (c) Limitation on Federal Trade Commission Guidance.--
       (1) Effect of guidance.--No guidance issued by the Federal 
     Trade Commission with respect to this subtitle shall--
       (A) confer any rights on any person, State, or locality; or
       (B) operate to bind the Federal Trade Commission or any 
     court, person, State, or locality to the approach recommended 
     in such guidance.
       (2) Use in enforcement actions.--In any enforcement action 
     brought pursuant to this subtitle, the Federal Trade 
     Commission or a State attorney general, as applicable--
       (A) shall allege a violation of a provision of this 
     subtitle; and
       (B) may not base such enforcement action on, or execute a 
     consent order based on, practices that are alleged to be 
     inconsistent with guidance issued by the Federal Trade 
     Commission with respect to this subtitle, unless the 
     practices are alleged to violate a provision of this 
     subtitle.
     For purposes of enforcing this subtitle, State attorneys 
     general shall take into account any guidance issued by the 
     Commission under subsection (b).

     SEC. 110. ENFORCEMENT.

       (a) Enforcement by Federal Trade Commission.--
       (1) Unfair and deceptive acts or practices.--A violation of 
     this subtitle shall be treated as a violation of a rule 
     defining an unfair or deceptive act or practice prescribed 
     under section 18(a)(1)(B) of the Federal Trade Commission Act 
     (15 U.S.C. 57a(a)(1)(B)).
       (2) Powers of the commission.--
       (A) In general.--The Federal Trade Commission (referred to 
     in this section as the ``Commission'') shall enforce this 
     subtitle in the same manner, by the same means, and with the 
     same jurisdiction, powers, and duties as though all 
     applicable terms and provisions of the Federal Trade 
     Commission Act (15 U.S.C. 41 et seq.) were incorporated into 
     and made a part of this subtitle.
       (B) Privileges and immunities.--Any person that violates 
     this subtitle shall be subject to the penalties, and entitled 
     to the privileges and immunities, provided in the Federal 
     Trade Commission Act (15 U.S.C. 41 et seq.).
       (3) Authority preserved.--Nothing in this subtitle shall be 
     construed to limit the authority of the Commission under any 
     other provision of law.
       (b) Enforcement by State Attorneys General.--
       (1) In general.--
       (A) Civil actions.--In any case in which the attorney 
     general of a State has reason to believe that a covered 
     platform has violated or is violating section 103, 104, or 
     105, the State, as parens patriae, may bring a civil action 
     on behalf of the residents of the State in a district court 
     of the United States or a State court of appropriate 
     jurisdiction to--
       (i) enjoin any practice that violates section 103, 104, or 
     105;
       (ii) enforce compliance with section 103, 104, or 105;
       (iii) on behalf of residents of the State, obtain damages, 
     restitution, or other compensation, each of which shall be 
     distributed in accordance with State law; or
       (iv) obtain such other relief as the court may consider to 
     be appropriate.
       (B) Notice.--
       (i) In general.--Before filing an action under subparagraph 
     (A), the attorney general of the State involved shall provide 
     to the Commission--

       (I) written notice of that action; and
       (II) a copy of the complaint for that action.

       (ii) Exemption.--

       (I) In general.--Clause (i) shall not apply with respect to 
     the filing of an action by an attorney general of a State 
     under this paragraph if the attorney general of the State 
     determines that it is not feasible to provide the notice 
     described in that clause before the filing of the action.
       (II) Notification.--In an action described in subclause 
     (I), the attorney general of a State shall provide notice and 
     a copy of the complaint to the Commission at the same time as 
     the attorney general files the action.

       (2) Intervention.--
       (A) In general.--On receiving notice under paragraph 
     (1)(B), the Commission shall have the right to intervene in 
     the action that is the subject of the notice.
       (B) Effect of intervention.--If the Commission intervenes 
     in an action under paragraph (1), it shall have the right--
       (i) to be heard with respect to any matter that arises in 
     that action; and
       (ii) to file a petition for appeal.
       (3) Construction.--For purposes of bringing any civil 
     action under paragraph (1), nothing in this subtitle shall be 
     construed to prevent an attorney general of a State from 
     exercising the powers conferred on the attorney general by 
     the laws of that State to--
       (A) conduct investigations;
       (B) administer oaths or affirmations; or
       (C) compel the attendance of witnesses or the production of 
     documentary and other evidence.
       (4) Actions by the commission.--In any case in which an 
     action is instituted by or on behalf of the Commission for 
     violation of this subtitle, no State may, during the pendency 
     of that action, institute a separate action under paragraph 
     (1) against any defendant named in the complaint in the 
     action instituted by or on behalf of the Commission for that 
     violation.
       (5) Venue; service of process.--
       (A) Venue.--Any action brought under paragraph (1) may be 
     brought in--
       (i) the district court of the United States that meets 
     applicable requirements relating to venue under section 1391 
     of title 28, United States Code; or
       (ii) a State court of competent jurisdiction.
       (B) Service of process.--In an action brought under 
     paragraph (1) in a district court of the United States, 
     process may be served wherever defendant--
       (i) is an inhabitant; or
       (ii) may be found.
       (6) Limitation.--A violation of section 102 shall not form 
     the basis of liability in any action brought by the attorney 
     general of a State under a State law.

     SEC. 111. KIDS ONLINE SAFETY COUNCIL.

       (a) Establishment.--Not later than 180 days after the date 
     of enactment of this Act, the Secretary of Commerce shall 
     establish and convene the Kids Online Safety Council for the 
     purpose of providing advice on matters related to this 
     subtitle.
       (b) Participation.--The Kids Online Safety Council shall 
     include diverse participation from--
       (1) academic experts, health professionals, and members of 
     civil society with expertise in mental health, substance use 
     disorders, and the prevention of harms to minors;
       (2) representatives in academia and civil society with 
     specific expertise in privacy, free expression, access to 
     information, and civil liberties;
       (3) parents and youth representation;
       (4) representatives of covered platforms;
       (5) representatives of the National Telecommunications and 
     Information Administration, the National Institute of 
     Standards and Technology, the Federal Trade Commission, the 
     Department of Justice, and the Department of Health and Human 
     Services;
       (6) State attorneys general or their designees acting in 
     State or local government;
       (7) educators; and
       (8) representatives of communities of socially 
     disadvantaged individuals (as defined in section 8 of the 
     Small Business Act (15 U.S.C. 637)).
       (c) Activities.--The matters to be addressed by the Kids 
     Online Safety Council shall include--
       (1) identifying emerging or current risks of harms to 
     minors associated with online platforms;
       (2) recommending measures and methods for assessing, 
     preventing, and mitigating harms to minors online;
       (3) recommending methods and themes for conducting research 
     regarding online harms to minors, including in English and 
     non-English languages; and
       (4) recommending best practices and clear, consensus-based 
     technical standards for transparency reports and audits, as 
     required under this subtitle, including methods, criteria, 
     and scope to promote overall accountability.
       (d) Non-applicability of FACA.--The Kids Online Safety 
     Council shall not be subject to chapter 10 of title 5, United 
     States Code (commonly referred to as the ``Federal Advisory 
     Committee Act'').

     SEC. 112. EFFECTIVE DATE.

       Except as otherwise provided in this subtitle, this 
     subtitle shall take effect on the date that is 18 months 
     after the date of enactment of this Act.

     SEC. 113. RULES OF CONSTRUCTION AND OTHER MATTERS.

       (a) Relationship to Other Laws.--Nothing in this subtitle 
     shall be construed to--
       (1) preempt section 444 of the General Education Provisions 
     Act (20 U.S.C. 1232g, commonly known as the ``Family 
     Educational Rights and Privacy Act of 1974'') or other 
     Federal or State laws governing student privacy;

[[Page S5300]]

       (2) preempt the Children's Online Privacy Protection Act of 
     1998 (15 U.S.C. 6501 et seq.) or any rule or regulation 
     promulgated under such Act;
       (3) authorize any action that would conflict with section 
     18(h) of the Federal Trade Commission Act (15 U.S.C. 57a(h)); 
     or
       (4) expand or limit the scope of section 230 of the 
     Communications Act of 1934 (commonly known as ``section 230 
     of the Communications Decency Act of 1996'') (47 U.S.C. 230).
       (b) Determination of ``Fairly Implied on the Basis of 
     Objective Circumstances''.--For purposes of enforcing this 
     subtitle, in making a determination as to whether covered 
     platform has knowledge fairly implied on the basis of 
     objective circumstances that a specific user is a minor, the 
     Federal Trade Commission or a State attorney general shall 
     rely on competent and reliable evidence, taking into account 
     the totality of the circumstances, including whether a 
     reasonable and prudent person under the circumstances would 
     have known that the user is a minor.
       (c) Protections for Privacy.--Nothing in this subtitle, 
     including a determination described in subsection (b), shall 
     be construed to require--
       (1) the affirmative collection of any personal data with 
     respect to the age of users that a covered platform is not 
     already collecting in the normal course of business; or
       (2) a covered platform to implement an age gating or age 
     verification functionality.
       (d) Compliance.--Nothing in this subtitle shall be 
     construed to restrict a covered platform's ability to--
       (1) cooperate with law enforcement agencies regarding 
     activity that the covered platform reasonably and in good 
     faith believes may violate Federal, State, or local laws, 
     rules, or regulations;
       (2) comply with a lawful civil, criminal, or regulatory 
     inquiry, subpoena, or summons by Federal, State, local, or 
     other government authorities; or
       (3) investigate, establish, exercise, respond to, or defend 
     against legal claims.
       (e) Application to Video Streaming Services.--A video 
     streaming service shall be deemed to be in compliance with 
     this subtitle if it predominantly consists of news, sports, 
     entertainment, or other video programming content that is 
     preselected by the provider and not user-generated, and--
       (1) any chat, comment, or interactive functionality is 
     provided incidental to, directly related to, or dependent on 
     provision of such content;
       (2) if such video streaming service requires account owner 
     registration and is not predominantly news or sports, the 
     service includes the capability--
       (A) to limit a minor's access to the service, which may 
     utilize a system of age-rating;
       (B) to limit the automatic playing of on-demand content 
     selected by a personalized recommendation system for an 
     individual that the service knows is a minor;
       (C) for a parent to manage a minor's privacy and account 
     settings, and restrict purchases and financial transactions 
     by a minor, where applicable;
       (D) to provide an electronic point of contact specific to 
     matters described in this paragraph;
       (E) to offer a clear, conspicuous, and easy-to-understand 
     notice of its policies and practices with respect to the 
     capabilities described in this paragraph; and
       (F) when providing on-demand content, to employ measures 
     that safeguard against serving advertising for narcotic drugs 
     (as defined in section 102 of the Controlled Substances Act 
     (21 U.S.C. 802)), tobacco products, gambling, or alcohol 
     directly to the account or profile of an individual that the 
     service knows is a minor.

                 Subtitle B--Filter Bubble Transparency

     SEC. 120. DEFINITIONS.

       In this subtitle:
       (1) Algorithmic ranking system.--The term ``algorithmic 
     ranking system'' means a computational process, including one 
     derived from algorithmic decision-making, machine learning, 
     statistical analysis, or other data processing or artificial 
     intelligence techniques, used to determine the selection, 
     order, relative prioritization, or relative prominence of 
     content from a set of information that is provided to a user 
     on an online platform, including the ranking of search 
     results, the provision of content recommendations, the 
     display of social media posts, or any other method of 
     automated content selection.
       (2) Approximate geolocation information.--The term 
     ``approximate geolocation information'' means information 
     that identifies the location of an individual, but with a 
     precision of less than 5 miles.
       (3) Commission.--The term ``Commission'' means the Federal 
     Trade Commission.
       (4) Connected device.--The term ``connected device'' means 
     an electronic device that--
       (A) is capable of connecting to the internet, either 
     directly or indirectly through a network, to communicate 
     information at the direction of an individual;
       (B) has computer processing capabilities for collecting, 
     sending, receiving, or analyzing data; and
       (C) is primarily designed for or marketed to consumers.
       (5) Input-transparent algorithm.--
       (A) In general.--The term ``input-transparent algorithm'' 
     means an algorithmic ranking system that does not use the 
     user-specific data of a user to determine the selection, 
     order, relative prioritization, or relative prominence of 
     information that is furnished to such user on an online 
     platform, unless the user-specific data is expressly provided 
     to the platform by the user for such purpose.
       (B) Data expressly provided to the platform.--For purposes 
     of subparagraph (A), user-specific data that is provided by a 
     user for the express purpose of determining the selection, 
     order, relative prioritization, or relative prominence of 
     information that is furnished to such user on an online 
     platform--
       (i) shall include user-supplied search terms, filters, 
     speech patterns (if provided for the purpose of enabling the 
     platform to accept spoken input or selecting the language in 
     which the user interacts with the platform), saved 
     preferences, the resumption of a previous search, and the 
     current precise geolocation information that is supplied by 
     the user;
       (ii) shall include the user's current approximate 
     geolocation information;
       (iii) shall include data submitted to the platform by the 
     user that expresses the user's desire to receive particular 
     information, such as the social media profiles the user 
     follows, the video channels the user subscribes to, or other 
     content or sources of content on the platform the user has 
     selected;
       (iv) shall not include the history of the user's connected 
     device, including the user's history of web searches and 
     browsing, previous geographical locations, physical activity, 
     device interaction, and financial transactions; and
       (v) shall not include inferences about the user or the 
     user's connected device, without regard to whether such 
     inferences are based on data described in clause (i) or 
     (iii).
       (6) Online platform.--The term ``online platform'' means 
     any public-facing website, online service, online 
     application, or mobile application that predominantly 
     provides a community forum for user-generated content, such 
     as sharing videos, images, games, audio files, or other 
     content, including a social media service, social network, or 
     virtual reality environment.
       (7) Opaque algorithm.--
       (A) In general.--The term ``opaque algorithm'' means an 
     algorithmic ranking system that determines the selection, 
     order, relative prioritization, or relative prominence of 
     information that is furnished to such user on an online 
     platform based, in whole or part, on user-specific data that 
     was not expressly provided by the user to the platform for 
     such purpose.
       (B) Exception for age-appropriate content filters.--Such 
     term shall not include an algorithmic ranking system used by 
     an online platform if--
       (i) the only user-specific data (including inferences about 
     the user) that the system uses is information relating to the 
     age of the user; and
       (ii) such information is only used to restrict a user's 
     access to content on the basis that the individual is not old 
     enough to access such content.
       (8) Precise geolocation information.--The term ``precise 
     geolocation information'' means geolocation information that 
     identifies an individual's location to within a range of 5 
     miles or less.
       (9) User-specific data.--The term ``user-specific data'' 
     means information relating to an individual or a specific 
     connected device that would not necessarily be true of every 
     individual or device.

     SEC. 121. REQUIREMENT TO ALLOW USERS TO SEE UNMANIPULATED 
                   CONTENT ON INTERNET PLATFORMS.

       (a) In General.--Beginning on the date that is 1 year after 
     the date of enactment of this Act, it shall be unlawful for 
     any person to operate an online platform that uses an opaque 
     algorithm unless the person complies with the requirements of 
     subsection (b).
       (b) Opaque Algorithm Requirements.--
       (1) In general.--The requirements of this subsection with 
     respect to a person that operates an online platform that 
     uses an opaque algorithm are the following:
       (A) The person provides users of the platform with the 
     following notices:
       (i) Notice that the platform uses an opaque algorithm that 
     uses user-specific data to select the content the user sees. 
     Such notice shall be presented in a clear and conspicuous 
     manner on the platform whenever the user interacts with an 
     opaque algorithm for the first time, and may be a one-time 
     notice that can be dismissed by the user.
       (ii) Notice, to be included in the terms and conditions of 
     the online platform, in a clear, accessible, and easily 
     comprehensible manner that is to be updated whenever the 
     online platform makes a material change, of--

       (I) the most salient features, inputs, and parameters used 
     by the algorithm;
       (II) how any user-specific data used by the algorithm is 
     collected or inferred about a user of the platform, and the 
     categories of such data;
       (III) any options that the online platform makes available 
     for a user of the platform to opt out or exercise options 
     under subparagraph (B), modify the profile of the user or to 
     influence the features, inputs, or parameters used by the 
     algorithm; and
       (IV) any quantities, such as time spent using a product or 
     specific measures of engagement or social interaction, that 
     the algorithm is designed to optimize, as well as a general 
     description of the relative importance of each quantity for 
     such ranking.

[[Page S5301]]

       (B) The online platform enables users to easily switch 
     between the opaque algorithm and an input-transparent 
     algorithm in their use of the platform.
       (2) Rule of construction.--Nothing in this subsection shall 
     be construed to require an online platform to disclose any 
     information, including data or algorithms--
       (A) relating to a trade secret or other protected 
     intellectual property;
       (B) that is confidential business information; or
       (C) that is privileged.
       (3) Prohibition on differential pricing.--An online 
     platform shall not deny, charge different prices or rates 
     for, or condition the provision of a service or product to a 
     user based on the user's election to use an input-transparent 
     algorithm in their use of the platform, as provided under 
     paragraph (1)(B).
       (c) Enforcement by Federal Trade Commission.--
       (1) Unfair or deceptive acts or practices.--A violation of 
     this section by an operator of an online platform shall be 
     treated as a violation of a rule defining an unfair or 
     deceptive act or practice prescribed under section 
     18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 
     57a(a)(1)(B)).
       (2) Powers of commission.--
       (A) In general.--The Federal Trade Commission shall enforce 
     this section in the same manner, by the same means, and with 
     the same jurisdiction, powers, and duties as though all 
     applicable terms and provisions of the Federal Trade 
     Commission Act (15 U.S.C. 41 et seq.) were incorporated into 
     and made a part of this section.
       (B) Privileges and immunities.--Any person who violates 
     this section shall be subject to the penalties and entitled 
     to the privileges and immunities provided in the Federal 
     Trade Commission Act (15 U.S.C. 41 et seq.).
       (C) Authority preserved.--Nothing in this section shall be 
     construed to limit the authority of the Commission under any 
     other provision of law.
       (d) Rule of Construction to Preserve Personalized Blocks.--
     Nothing in this section shall be construed to limit or 
     prohibit an online platform's ability to, at the direction of 
     an individual user or group of users, restrict another user 
     from searching for, finding, accessing, or interacting with 
     such user's or group's account, content, data, or online 
     community.

          Subtitle C--Relationship to State Laws; Severability

     SEC. 130. RELATIONSHIP TO STATE LAWS.

       The provisions of this title shall preempt any State law, 
     rule, or regulation only to the extent that such State law, 
     rule, or regulation conflicts with a provision of this title. 
     Nothing in this title shall be construed to prohibit a State 
     from enacting a law, rule, or regulation that provides 
     greater protection to minors than the protection provided by 
     the provisions of this title.

     SEC. 131. SEVERABILITY.

       If any provision of this title, or an amendment made by 
     this title, is determined to be unenforceable or invalid, the 
     remaining provisions of this title and the amendments made by 
     this title shall not be affected.

              TITLE II--CHILDREN AND TEEN'S ONLINE PRIVACY

     SEC. 201. ONLINE COLLECTION, USE, DISCLOSURE, AND DELETION OF 
                   PERSONAL INFORMATION OF CHILDREN AND TEENS.

       (a) Definitions.--Section 1302 of the Children's Online 
     Privacy Protection Act of 1998 (15 U.S.C. 6501) is amended--
       (1) by amending paragraph (2) to read as follows:
       ``(2) Operator.--The term `operator'--
       ``(A) means any person--
       ``(i) who, for commercial purposes, in interstate or 
     foreign commerce operates or provides a website on the 
     internet, an online service, an online application, or a 
     mobile application; and
       ``(ii) who--

       ``(I) collects or maintains, either directly or through a 
     service provider, personal information from or about the 
     users of that website, service, or application;
       ``(II) allows another person to collect personal 
     information directly from users of that website, service, or 
     application (in which case, the operator is deemed to have 
     collected the information); or
       ``(III) allows users of that website, service, or 
     application to publicly disclose personal information (in 
     which case, the operator is deemed to have collected the 
     information); and

       ``(B) does not include any nonprofit entity that would 
     otherwise be exempt from coverage under section 5 of the 
     Federal Trade Commission Act (15 U.S.C. 45).'';
       (2) in paragraph (4)--
       (A) by amending subparagraph (A) to read as follows:
       ``(A) the release of personal information collected from a 
     child or teen by an operator for any purpose, except where 
     the personal information is provided to a person other than 
     an operator who--
       ``(i) provides support for the internal operations of the 
     website, online service, online application, or mobile 
     application of the operator, excluding any activity relating 
     to individual-specific advertising to children or teens; and
       ``(ii) does not disclose or use that personal information 
     for any other purpose; and''; and
       (B) in subparagraph (B)--
       (i) by inserting ``or teen'' after ``child'' each place the 
     term appears;
       (ii) by striking ``website or online service'' and 
     inserting ``website, online service, online application, or 
     mobile application''; and
       (iii) by striking ``actual knowledge'' and inserting 
     ``actual knowledge or knowledge fairly implied on the basis 
     of objective circumstances'';
       (3) by striking paragraph (8) and inserting the following:
       ``(8) Personal information.--
       ``(A) In general.--The term `personal information' means 
     individually identifiable information about an individual 
     collected online, including--
       ``(i) a first and last name;
       ``(ii) a home or other physical address including street 
     name and name of a city or town;
       ``(iii) an e-mail address;
       ``(iv) a telephone number;
       ``(v) a Social Security number;
       ``(vi) any other identifier that the Commission determines 
     permits the physical or online contacting of a specific 
     individual;
       ``(vii) a persistent identifier that can be used to 
     recognize a specific child or teen over time and across 
     different websites, online services, online applications, or 
     mobile applications, including but not limited to a customer 
     number held in a cookie, an Internet Protocol (IP) address, a 
     processor or device serial number, or unique device 
     identifier, but excluding an identifier that is used by an 
     operator solely for providing support for the internal 
     operations of the website, online service, online 
     application, or mobile application;
       ``(viii) a photograph, video, or audio file where such file 
     contains a specific child's or teen's image or voice;
       ``(ix) geolocation information;
       ``(x) information generated from the measurement or 
     technological processing of an individual's biological, 
     physical, or physiological characteristics that is used to 
     identify an individual, including--

       ``(I) fingerprints;
       ``(II) voice prints;
       ``(III) iris or retina imagery scans;
       ``(IV) facial templates;
       ``(V) deoxyribonucleic acid (DNA) information; or
       ``(VI) gait; or

       ``(xi) information linked or reasonably linkable to a child 
     or teen or the parents of that child or teen (including any 
     unique identifier) that an operator collects online from the 
     child or teen and combines with an identifier described in 
     this subparagraph.
       ``(B) Exclusion.--The term `personal information' shall not 
     include an audio file that contains a child's or teen's voice 
     so long as the operator--
       ``(i) does not request information via voice that would 
     otherwise be considered personal information under this 
     paragraph;
       ``(ii) provides clear notice of its collection and use of 
     the audio file and its deletion policy in its privacy policy;
       ``(iii) only uses the voice within the audio file solely as 
     a replacement for written words, to perform a task, or engage 
     with a website, online service, online application, or mobile 
     application, such as to perform a search or fulfill a verbal 
     instruction or request; and
       ``(iv) only maintains the audio file long enough to 
     complete the stated purpose and then immediately deletes the 
     audio file and does not make any other use of the audio file 
     prior to deletion.
       ``(C) Support for the internal operations of a website, 
     online service, online application, or mobile application.--
       ``(i) In general.--For purposes of subparagraph (A)(vii), 
     the term `support for the internal operations of a website, 
     online service, online application, or mobile application' 
     means those activities necessary to--

       ``(I) maintain or analyze the functioning of the website, 
     online service, online application, or mobile application;
       ``(II) perform network communications;
       ``(III) authenticate users of, or personalize the content 
     on, the website, online service, online application, or 
     mobile application;
       ``(IV) serve contextual advertising, provided that any 
     persistent identifier is only used as necessary for technical 
     purposes to serve the contextual advertisement, or cap the 
     frequency of advertising;
       ``(V) protect the security or integrity of the user, 
     website, online service, online application, or mobile 
     application;
       ``(VI) ensure legal or regulatory compliance, or
       ``(VII) fulfill a request of a child or teen as permitted 
     by subparagraphs (A) through (C) of section 1303(b)(2).

       ``(ii) Condition.--Except as specifically permitted under 
     clause (i), information collected for the activities listed 
     in clause (i) cannot be used or disclosed to contact a 
     specific individual, including through individual-specific 
     advertising to children or teens, to amass a profile on a 
     specific individual, in connection with processes that 
     encourage or prompt use of a website or online service, or 
     for any other purpose.'';
       (4) by amending paragraph (9) to read as follows:
       ``(9) Verifiable consent.--The term `verifiable consent' 
     means any reasonable effort (taking into consideration 
     available technology), including a request for authorization 
     for future collection, use, and disclosure described in the 
     notice, to ensure that, in the case of a child, a parent of 
     the child, or, in the case of a teen, the teen--
       ``(A) receives direct notice of the personal information 
     collection, use, and disclosure practices of the operator; 
     and

[[Page S5302]]

       ``(B) before the personal information of the child or teen 
     is collected, freely and unambiguously authorizes--
       ``(i) the collection, use, and disclosure, as applicable, 
     of that personal information; and
       ``(ii) any subsequent use of that personal information.'';
       (5) in paragraph (10)--
       (A) in the paragraph header, by striking ``Website or 
     online service directed to children'' and inserting 
     ``Website, online service, online application, or mobile 
     application directed to children'';
       (B) by striking ``website or online service'' each place it 
     appears and inserting ``website, online service, online 
     application, or mobile application''; and
       (C) by adding at the end the following new subparagraph:
       ``(C) Rule of construction.--In considering whether a 
     website, online service, online application, or mobile 
     application, or portion thereof, is directed to children, the 
     Commission shall apply a totality of circumstances test and 
     will also consider competent and reliable empirical evidence 
     regarding audience composition and evidence regarding the 
     intended audience of the website, online service, online 
     application, or mobile application.''; and
       (6) by adding at the end the following:
       ``(13) Connected device.--The term `connected device' means 
     a device that is capable of connecting to the internet, 
     directly or indirectly, or to another connected device.
       ``(14) Online application.--The term `online application'--
       ``(A) means an internet-connected software program; and
       ``(B) includes a service or application offered via a 
     connected device.
       ``(15) Mobile application.--The term `mobile application'--
       ``(A) means a software program that runs on the operating 
     system of--
       ``(i) a cellular telephone;
       ``(ii) a tablet computer; or
       ``(iii) a similar portable computing device that transmits 
     data over a wireless connection; and
       ``(B) includes a service or application offered via a 
     connected device.
       ``(16) Geolocation information.--The term `geolocation 
     information' means information sufficient to identify a 
     street name and name of a city or town.
       ``(17) Teen.--The term `teen' means an individual who has 
     attained age 13 and is under the age of 17.
       ``(18) Individual-specific advertising to children or 
     teens.--
       ``(A) In general.--The term `individual-specific 
     advertising to children or teens' means advertising or any 
     other effort to market a product or service that is directed 
     to a specific child or teen or a connected device that is 
     linked or reasonably linkable to a child or teen based on--
       ``(i) the personal information from--

       ``(I) the child or teen; or
       ``(II) a group of children or teens who are similar in sex, 
     age, household income level, race, or ethnicity to the 
     specific child or teen to whom the product or service is 
     marketed;

       ``(ii) profiling of a child or teen or group of children or 
     teens; or
       ``(iii) a unique identifier of the connected device.
       ``(B) Exclusions.--The term `individual-specific 
     advertising to children or teens' shall not include--
       ``(i) advertising or marketing to an individual or the 
     device of an individual in response to the individual's 
     specific request for information or feedback, such as a 
     child's or teen's current search query;
       ``(ii) contextual advertising, such as when an 
     advertisement is displayed based on the content of the 
     website, online service, online application, mobile 
     application, or connected device in which the advertisement 
     appears and does not vary based on personal information 
     related to the viewer; or
       ``(iii) processing personal information solely for 
     measuring or reporting advertising or content performance, 
     reach, or frequency, including independent measurement.
       ``(C) Rule of construction.--Nothing in subparagraph (A) 
     shall be construed to prohibit an operator with actual 
     knowledge or knowledge fairly implied on the basis of 
     objective circumstances that a user is under the age of 17 
     from delivering advertising or marketing that is age-
     appropriate and intended for a child or teen audience, so 
     long as the operator does not use any personal information 
     other than whether the user is under the age of 17.''.
       (b) Online Collection, Use, Disclosure, and Deletion of 
     Personal Information of Children and Teens.--Section 1303 of 
     the Children's Online Privacy Protection Act of 1998 (15 
     U.S.C. 6502) is amended--
       (1) by striking the heading and inserting the following: 
     ``online collection, use, disclosure, and deletion of 
     personal information of children and teens.'';
       (2) in subsection (a)--
       (A) by amending paragraph (1) to read as follows:
       ``(1) In general.--It is unlawful for an operator of a 
     website, online service, online application, or mobile 
     application directed to children or for any operator of a 
     website, online service, online application, or mobile 
     application with actual knowledge or knowledge fairly implied 
     on the basis of objective circumstances that a user is a 
     child or teen--
       ``(A) to collect personal information from a child or teen 
     in a manner that violates the regulations prescribed under 
     subsection (b);
       ``(B) except as provided in subparagraphs (B) and (C) of 
     section 1302(18), to collect, use, disclose to third parties, 
     or maintain personal information of a child or teen for 
     purposes of individual-specific advertising to children or 
     teens (or to allow another person to collect, use, disclose, 
     or maintain such information for such purpose);
       ``(C) to collect the personal information of a child or 
     teen except when the collection of the personal information 
     is--
       ``(i) consistent with the context of a particular 
     transaction or service or the relationship of the child or 
     teen with the operator, including collection necessary to 
     fulfill a transaction or provide a product or service 
     requested by the child or teen; or
       ``(ii) required or specifically authorized by Federal or 
     State law; or
       ``(D) to store or transfer the personal information of a 
     child or teen outside of the United States unless the 
     operator provides direct notice to the parent of the child, 
     in the case of a child, or to the teen, in the case of a 
     teen, that the child's or teen's personal information is 
     being stored or transferred outside of the United States; or
       ``(E) to retain the personal information of a child or teen 
     for longer than is reasonably necessary to fulfill a 
     transaction or provide a service requested by the child or 
     teen except as required or specifically authorized by Federal 
     or State law.''; and
       (B) in paragraph (2)--
       (i) in the header, by striking ``parent'' and inserting `` 
     `parent or teen' ''
       (ii) by striking ``Notwithstanding paragraph (1)'' and 
     inserting ``Notwithstanding paragraph (1)(A)'';
       (iii) by striking ``of such a website or online service''; 
     and
       (iv) by striking ``subsection (b)(1)(B)(iii) to the parent 
     of a child'' and inserting ``subsection (b)(1)(B)(iv) to the 
     parent of a child or under subsection (b)(1)(C)(iv) to a 
     teen'';
       (3) in subsection (b)--
       (A) in paragraph (1)--
       (i) in subparagraph (A)--

       (I) by striking ``operator of any website'' and all that 
     follows through ``from a child'' and inserting ``operator of 
     a website, online service, online application, or mobile 
     application directed to children or that has actual knowledge 
     or knowledge fairly implied on the basis of objective 
     circumstances that a user is a child or teen'';
       (II) in clause (i)--

       (aa) by striking ``notice on the website'' and inserting 
     ``clear and conspicuous notice on the website'';
       (bb) by inserting ``or teens'' after ``children'';
       (cc) by striking ``, and the operator's'' and inserting ``, 
     the operator's''; and
       (dd) by striking ``; and'' and inserting ``, the rights and 
     opportunities available to the parent of the child or teen 
     under subparagraphs (B) and (C), and the procedures or 
     mechanisms the operator uses to ensure that personal 
     information is not collected from children or teens except in 
     accordance with the regulations promulgated under this 
     paragraph;'';

       (III) in clause (ii)--

       (aa) by striking ``parental'';
       (bb) by inserting ``or teens'' after ``children'';
       (cc) by striking the semicolon at the end and inserting ``; 
     and''; and

       (IV) by inserting after clause (ii) the following new 
     clause:

       ``(iii) to obtain verifiable consent from a parent of a 
     child or from a teen before using or disclosing personal 
     information of the child or teen for any purpose that is a 
     material change from the original purposes and disclosure 
     practices specified to the parent of the child or the teen 
     under clause (i);'';
       (ii) in subparagraph (B)--

       (I) in the matter preceding clause (i), by striking 
     ``website or online service'' and inserting ``operator'';
       (II) in clause (i), by inserting ``and the method by which 
     the operator obtained the personal information, and the 
     purposes for which the operator collects, uses, discloses, 
     and retains the personal information'' before the semicolon;
       (III) in clause (ii)--

       (aa) by inserting ``to delete personal information 
     collected from the child or content or information submitted 
     by the child to a website, online service, online 
     application, or mobile application and'' after ``the 
     opportunity at any time''; and
       (bb) by striking ``; and'' and inserting a semicolon;

       (IV) by redesignating clause (iii) as clause (iv) and 
     inserting after clause (ii) the following new clause:

       ``(iii) the opportunity to challenge the accuracy of the 
     personal information and, if the parent of the child 
     establishes the inaccuracy of the personal information, to 
     have the inaccurate personal information corrected;''; and

       (V) in clause (iv), as so redesignated, by inserting ``, if 
     such information is available to the operator at the time the 
     parent makes the request'' before the semicolon;

       (iii) by redesignating subparagraphs (C) and (D) as 
     subparagraphs (D) and (E), respectively;
       (iv) by inserting after subparagraph (B) the following new 
     subparagraph:
       ``(C) require the operator to provide, upon the request of 
     a teen under this subparagraph who has provided personal 
     information to the operator, upon proper identification of 
     that teen--

[[Page S5303]]

       ``(i) a description of the specific types of personal 
     information collected from the teen by the operator, the 
     method by which the operator obtained the personal 
     information, and the purposes for which the operator 
     collects, uses, discloses, and retains the personal 
     information;
       ``(ii) the opportunity at any time to delete personal 
     information collected from the teen or content or information 
     submitted by the teen to a website, online service, online 
     application, or mobile application and to refuse to permit 
     the operator's further use or maintenance in retrievable 
     form, or online collection, of personal information from the 
     teen;
       ``(iii) the opportunity to challenge the accuracy of the 
     personal information and, if the teen establishes the 
     inaccuracy of the personal information, to have the 
     inaccurate personal information corrected; and
       ``(iv) a means that is reasonable under the circumstances 
     for the teen to obtain any personal information collected 
     from the teen, if such information is available to the 
     operator at the time the teen makes the request;'';
       (v) in subparagraph (D), as so redesignated--

       (I) by striking ``a child's'' and inserting ``a child's or 
     teen's''; and
       (II) by inserting ``or teen'' after ``the child''; and

       (vi) by amending subparagraph (E), as so redesignated, to 
     read as follows:
       ``(E) require the operator to establish, implement, and 
     maintain reasonable security practices to protect the 
     confidentiality, integrity, and accessibility of personal 
     information of children or teens collected by the operator, 
     and to protect such personal information against unauthorized 
     access.'';
       (B) in paragraph (2)--
       (i) in the matter preceding subparagraph (A), by striking 
     ``verifiable parental consent'' and inserting ``verifiable 
     consent'';
       (ii) in subparagraph (A)--

       (I) by inserting ``or teen'' after ``collected from a 
     child'';
       (II) by inserting ``or teen'' after ``request from the 
     child''; and
       (III) by inserting ``or teen or to contact another child or 
     teen'' after ``to recontact the child'';

       (iii) in subparagraph (B)--

       (I) by striking ``parent or child'' and inserting ``parent 
     or teen''; and
       (II) by striking ``parental consent'' each place the term 
     appears and inserting ``verifiable consent'';

       (iv) in subparagraph (C)--

       (I) in the matter preceding clause (i), by inserting ``or 
     teen'' after ``child'' each place the term appears;
       (II) in clause (i)--

       (aa) by inserting ``or teen'' after ``child'' each place 
     the term appears; and
       (bb) by inserting ``or teen, as applicable,'' after 
     ``parent'' each place the term appears; and

       (III) in clause (ii)--

       (aa) by striking ``without notice to the parent'' and 
     inserting ``without notice to the parent or teen, as 
     applicable,''; and
       (bb) by inserting ``or teen'' after ``child'' each place 
     the term appears; and
       (v) in subparagraph (D)--

       (I) in the matter preceding clause (i), by inserting ``or 
     teen'' after ``child'' each place the term appears;
       (II) in clause (ii), by inserting ``or teen'' after 
     ``child''; and
       (III) in the flush text following clause (iii)--

       (aa) by inserting ``or teen, as applicable,'' after 
     ``parent'' each place the term appears; and
       (bb) by inserting ``or teen'' after ``child'';
       (C) by redesignating paragraph (3) as paragraph (4) and 
     inserting after paragraph (2) the following new paragraph:
       ``(3) Application to operators acting under agreements with 
     educational agencies or institutions.--The regulations may 
     provide that verifiable consent under paragraph (1)(A)(ii) is 
     not required for an operator that is acting under a written 
     agreement with an educational agency or institution (as 
     defined in section 444 of the General Education Provisions 
     Act (commonly known as the `Family Educational Rights and 
     Privacy Act of 1974') (20 U.S.C. 1232g(a)(3)) that, at a 
     minimum, requires the--
       ``(A) operator to--
       ``(i) limit its collection, use, and disclosure of the 
     personal information from a child or teen to solely 
     educational purposes and for no other commercial purposes;
       ``(ii) provide the educational agency or institution with a 
     notice of the specific types of personal information the 
     operator will collect from the child or teen, the method by 
     which the operator will obtain the personal information, and 
     the purposes for which the operator will collect, use, 
     disclose, and retain the personal information;
       ``(iii) provide the educational agency or institution with 
     a link to the operator's online notice of information 
     practices as required under subsection (b)(1)(A)(i); and
       ``(iv) provide the educational agency or institution, upon 
     request, with a means to review the personal information 
     collected from a child or teen, to prevent further use or 
     maintenance or future collection of personal information from 
     a child or teen, and to delete personal information collected 
     from a child or teen or content or information submitted by a 
     child or teen to the operator's website, online service, 
     online application, or mobile application;
       ``(B) representative of the educational agency or 
     institution to acknowledge and agree that they have authority 
     to authorize the collection, use, and disclosure of personal 
     information from children or teens on behalf of the 
     educational agency or institution, along with such 
     authorization, their name, and title at the educational 
     agency or institution; and
       ``(C) educational agency or institution to--
       ``(i) provide on its website a notice that identifies the 
     operator with which it has entered into a written agreement 
     under this subsection and provides a link to the operator's 
     online notice of information practices as required under 
     paragraph (1)(A)(i);
       ``(ii) provide the operator's notice regarding its 
     information practices, as required under subparagraph 
     (A)(ii), upon request, to a parent, in the case of a child, 
     or a parent or teen, in the case of a teen; and
       ``(iii) upon the request of a parent, in the case of a 
     child, or a parent or teen, in the case of a teen, request 
     the operator provide a means to review the personal 
     information from the child or teen and provide the parent, in 
     the case of a child, or parent or teen, in the case of the 
     teen, a means to review the personal information.'';
       (D) by amending paragraph (4), as so redesignated, to read 
     as follows:
       ``(4) Termination of service.--The regulations shall permit 
     the operator of a website, online service, online 
     application, or mobile application to terminate service 
     provided to a child whose parent has refused, or a teen who 
     has refused, under the regulations prescribed under 
     paragraphs (1)(B)(ii) and (1)(C)(ii), to permit the 
     operator's further use or maintenance in retrievable form, or 
     future online collection of, personal information from that 
     child or teen.''; and
       (E) by adding at the end the following new paragraphs:
       ``(5) Continuation of service.--The regulations shall 
     prohibit an operator from discontinuing service provided to a 
     child or teen on the basis of a request by the parent of the 
     child or by the teen, under the regulations prescribed under 
     subparagraph (B) or (C) of paragraph (1), respectively, to 
     delete personal information collected from the child or teen, 
     to the extent that the operator is capable of providing such 
     service without such information.
       ``(6) Rule of construction.--A request made pursuant to 
     subparagraph (B) or (C) of paragraph (1) to delete or correct 
     personal information of a child or teen shall not be 
     construed--
       ``(A) to limit the authority of a law enforcement agency to 
     obtain any content or information from an operator pursuant 
     to a lawfully executed warrant or an order of a court of 
     competent jurisdiction;
       ``(B) to require an operator or third party delete or 
     correct information that--
       ``(i) any other provision of Federal or State law requires 
     the operator or third party to maintain; or
       ``(ii) was submitted to the website, online service, online 
     application, or mobile application of the operator by any 
     person other than the user who is attempting to erase or 
     otherwise eliminate the content or information, including 
     content or information submitted by the user that was 
     republished or resubmitted by another person; or
       ``(C) to prohibit an operator from--
       ``(i) retaining a record of the deletion request and the 
     minimum information necessary for the purposes of ensuring 
     compliance with a request made pursuant to subparagraph (B) 
     or (C);
       ``(ii) preventing, detecting, protecting against, or 
     responding to security incidents, identity theft, or fraud, 
     or reporting those responsible for such actions;
       ``(iii) protecting the integrity or security of a website, 
     online service, online application or mobile application; or
       ``(iv) ensuring that the child's or teen's information 
     remains deleted.
       ``(7) Common verifiable consent mechanism.--
       ``(A) In general.--
       ``(i) Feasibility of mechanism.--The Commission shall 
     assess the feasibility, with notice and public comment, of 
     allowing operators the option to use a common verifiable 
     consent mechanism that fully meets the requirements of this 
     title.
       ``(ii) Requirements.--The feasibility assessment described 
     in clause (i) shall consider whether a single operator could 
     use a common verifiable consent mechanism to obtain 
     verifiable consent, as required under this title, from a 
     parent of a child or from a teen on behalf of multiple, 
     listed operators that provide a joint or related service.
       ``(B) Report.--Not later than 1 year after the date of 
     enactment of this paragraph, the Commission shall submit a 
     report to the Committee on Commerce, Science, and 
     Transportation of the Senate and the Committee on Energy and 
     Commerce of the House of Representatives with the findings of 
     the assessment required by subparagraph (A).
       ``(C) Regulations.--If the Commission finds that the use of 
     a common verifiable consent mechanism is feasible and would 
     meet the requirements of this title, the Commission shall 
     issue regulations to permit the use of a common verifiable 
     consent mechanism in accordance with the findings outlined in 
     such report.'';
       (4) in subsection (c), by striking ``a regulation 
     prescribed under subsection (a)'' and inserting 
     ``subparagraph (B), (C), (D), or (E) of subsection (a)(1), or 
     of a regulation prescribed under subsection (b),''; and

[[Page S5304]]

       (5) by striking subsection (d) and inserting the following:
       ``(d) Relationship to State Law.--The provisions of this 
     title shall preempt any State law, rule, or regulation only 
     to the extent that such State law, rule, or regulation 
     conflicts with a provision of this title. Nothing in this 
     title shall be construed to prohibit any State from enacting 
     a law, rule, or regulation that provides greater protection 
     to children or teens than the provisions of this title.''.
       (c) Safe Harbors.--Section 1304 of the Children's Online 
     Privacy Protection Act of 1998 (15 U.S.C. 6503) is amended--
       (1) in subsection (b)(1), by inserting ``and teens'' after 
     ``children''; and
       (2) by adding at the end the following:
       ``(d) Publication.--
       ``(1) In general.--Subject to the restrictions described in 
     paragraph (2), the Commission shall publish on the internet 
     website of the Commission any report or documentation 
     required by regulation to be submitted to the Commission to 
     carry out this section.
       ``(2) Restrictions on publication.--The restrictions 
     described in section 6(f) and section 21 of the Federal Trade 
     Commission Act (15 U.S.C. 46(f), 57b-2) applicable to the 
     disclosure of information obtained by the Commission shall 
     apply in same manner to the disclosure under this subsection 
     of information obtained by the Commission from a report or 
     documentation described in paragraph (1).''.
       (d) Actions by States.--Section 1305 of the Children's 
     Online Privacy Protection Act of 1998 (15 U.S.C. 6504) is 
     amended--
       (1) in subsection (a)(1)--
       (A) in the matter preceding subparagraph (A), by inserting 
     ``section 1303(a)(1) or'' before ``any regulation''; and
       (B) in subparagraph (B), by inserting ``section 1303(a)(1) 
     or'' before ``the regulation''; and
       (2) in subsection (d)--
       (A) by inserting ``section 1303(a)(1) or'' before ``any 
     regulation''; and
       (B) by inserting ``section 1303(a)(1) or'' before ``that 
     regulation''.
       (e) Administration and Applicability of Act.--Section 1306 
     of the Children's Online Privacy Protection Act of 1998 (15 
     U.S.C. 6505) is amended--
       (1) in subsection (b)--
       (A) in paragraph (1), by striking ``, in the case of'' and 
     all that follows through ``the Board of Directors of the 
     Federal Deposit Insurance Corporation;'' and inserting the 
     following: ``by the appropriate Federal banking agency, with 
     respect to any insured depository institution (as those terms 
     are defined in section 3 of that Act (12 U.S.C. 1813));''; 
     and
       (B) by striking paragraph (2) and redesignating paragraphs 
     (3) through (6) as paragraphs (2) through (5), respectively;
       (2) in subsection (d)--
       (A) by inserting ``section 1303(a)(1) or'' before ``a 
     rule''; and
       (B) by striking ``such rule'' and inserting ``section 
     1303(a)(1) or a rule of the Commission under section 1303''; 
     and
       (3) by adding at the end the following new subsections:
       ``(f) Determination of Whether an Operator Has Knowledge 
     Fairly Implied on the Basis of Objective Circumstances.--
       ``(1) Rule of construction.--For purposes of enforcing this 
     title or a regulation promulgated under this title, in making 
     a determination as to whether an operator has knowledge 
     fairly implied on the basis of objective circumstances that a 
     specific user is a child or teen, the Commission or State 
     attorneys general shall rely on competent and reliable 
     evidence, taking into account the totality of the 
     circumstances, including whether a reasonable and prudent 
     person under the circumstances would have known that the user 
     is a child or teen. Nothing in this title, including a 
     determination described in the preceding sentence, shall be 
     construed to require an operator to--
       ``(A) affirmatively collect any personal information with 
     respect to the age of a child or teen that an operator is not 
     already collecting in the normal course of business; or
       ``(B) implement an age gating or age verification 
     functionality.
       ``(2) Commission guidance.--
       ``(A) In general.--Within 180 days of enactment, the 
     Commission shall issue guidance to provide information, 
     including best practices and examples for operators to 
     understand the Commission's determination of whether an 
     operator has knowledge fairly implied on the basis of 
     objective circumstances that a user is a child or teen.
       ``(B) Limitation.--No guidance issued by the Commission 
     with respect to this title shall confer any rights on any 
     person, State, or locality, nor shall operate to bind the 
     Commission or any person to the approach recommended in such 
     guidance. In any enforcement action brought pursuant to this 
     title, the Commission or State attorney general, as 
     applicable, shall allege a specific violation of a provision 
     of this title. The Commission or State attorney general, as 
     applicable, may not base an enforcement action on, or execute 
     a consent order based on, practices that are alleged to be 
     inconsistent with any such guidance, unless the practices 
     allegedly violate this title. For purposes of enforcing this 
     title or a regulation promulgated under this title, State 
     attorneys general shall take into account any guidance issued 
     by the Commission under subparagraph (A).
       ``(g) Additional Requirement.--Any regulations issued under 
     this title shall include a description and analysis of the 
     impact of proposed and final Rules on small entities per the 
     Regulatory Flexibility Act of 1980 (5 U.S.C. 601 et seq.).''.

     SEC. 202. STUDY AND REPORTS OF MOBILE AND ONLINE APPLICATION 
                   OVERSIGHT AND ENFORCEMENT.

       (a) Oversight Report.--Not later than 3 years after the 
     date of enactment of this Act, the Federal Trade Commission 
     shall submit to the Committee on Commerce, Science, and 
     Transportation of the Senate and the Committee on Energy and 
     Commerce of the House of Representatives a report on the 
     processes of platforms that offer mobile and online 
     applications for ensuring that, of those applications that 
     are websites, online services, online applications, or mobile 
     applications directed to children, the applications operate 
     in accordance with--
       (1) this title, the amendments made by this title, and 
     rules promulgated under this title; and
       (2) rules promulgated by the Commission under section 18 of 
     the Federal Trade Commission Act (15 U.S.C. 57a) relating to 
     unfair or deceptive acts or practices in marketing.
       (b) Enforcement Report.--Not later than 1 year after the 
     date of enactment of this Act, and each year thereafter, the 
     Federal Trade Commission shall submit to the Committee on 
     Commerce, Science, and Transportation of the Senate and the 
     Committee on Energy and Commerce of the House of 
     Representatives a report that addresses, at a minimum--
       (1) the number of actions brought by the Commission during 
     the reporting year to enforce the Children's Online Privacy 
     Protection Act of 1998 (15 U.S.C. 6501) (referred to in this 
     subsection as the ``Act'') and the outcome of each such 
     action;
       (2) the total number of investigations or inquiries into 
     potential violations of the Act; during the reporting year;
       (3) the total number of open investigations or inquiries 
     into potential violations of the Act as of the time the 
     report is submitted;
       (4) the number and nature of complaints received by the 
     Commission relating to an allegation of a violation of the 
     Act during the reporting year; and
       (5) policy or legislative recommendations to strengthen 
     online protections for children and teens.

     SEC. 203. GAO STUDY.

       (a) Study.--The Comptroller General of the United States 
     (in this section referred to as the ``Comptroller General'') 
     shall conduct a study on the privacy of teens who use 
     financial technology products. Such study shall--
       (1) identify the type of financial technology products that 
     teens are using;
       (2) identify the potential risks to teens' privacy from 
     using such financial technology products; and
       (3) determine whether existing laws are sufficient to 
     address such risks to teens' privacy.
       (b) Report.--Not later than 1 year after the date of 
     enactment of this section, the Comptroller General shall 
     submit to Congress a report containing the results of the 
     study conducted under subsection (a), together with 
     recommendations for such legislation and administrative 
     action as the Comptroller General determines appropriate.

     SEC. 204. SEVERABILITY.

       If any provision of this title, or an amendment made by 
     this title, is determined to be unenforceable or invalid, the 
     remaining provisions of this title and the amendments made by 
     this title shall not be affected.

                 TITLE III--ELIMINATING USELESS REPORTS

     SEC. 301. SUNSETS FOR AGENCY REPORTS.

       (a) In General.--Section 1125 of title 31, United States 
     Code, is amended--
       (1) by redesignating subsection (c) as subsection (d);
       (2) by striking subsections (a) and (b) and inserting the 
     following:
       ``(a) Definitions.--In this section:
       ``(1) Budget justification materials.--The term `budget 
     justification materials' has the meaning given the term in 
     section 3(b)(2) of the Federal Funding Accountability and 
     Transparency Act of 2006 (31 U.S.C. 6101 note; Public Law 
     109-282).
       ``(2) Plan or report.--The term `plan or report' means any 
     plan or report submitted to Congress, any committee of 
     Congress, or subcommittee thereof, by not less than 1 
     agency--
       ``(A) in accordance with Federal law; or
       ``(B) at the direction or request of a congressional 
     report.
       ``(3) Recurring plan or report.--The term `recurring plan 
     or report' means a plan or report submitted on a recurring 
     basis.
       ``(4) Relevant congressional committee.--The term `relevant 
     congressional committee'--
       ``(A) means a congressional committee to which a recurring 
     plan or report is required to be submitted; and
       ``(B) does not include any plan or report that is required 
     to be submitted solely to the Committee on Armed Services of 
     the House of Representatives or the Senate.
       ``(b) Agency Identification of Unnecessary Reports.--
       ``(1) In general.--The head of each agency shall include in 
     the budget justification materials of the agency the 
     following:
       ``(A) Subject to paragraphs (2) and (3), the following:
       ``(i) A list of each recurring plan or report submitted by 
     the agency.
       ``(ii) An identification of whether the recurring plan or 
     report listed in clause (i) was

[[Page S5305]]

     included in the most recent report issued by the Clerk of the 
     House of Representatives concerning the reports that any 
     agency is required by law or directed or requested by a 
     committee report to make to Congress, any committee of 
     Congress, or subcommittee thereof.
       ``(iii) If applicable, the unique alphanumeric identifier 
     for the recurring plan or report as required by section 
     7243(b)(1)(C)(vii) of the James M. Inhofe National Defense 
     Authorization Act for Fiscal Year 2023 (Public Law 117-263).
       ``(iv) The identification of any recurring plan or report 
     the head of the agency determines to be outdated or 
     duplicative.
       ``(B) With respect to each recurring plan or report 
     identified in subparagraph (A)(iv), the following:
       ``(i) A recommendation on whether to sunset, modify, 
     consolidate, or reduce the frequency of the submission of the 
     recurring plan or report.
       ``(ii) A citation to each provision of law or directive or 
     request in a congressional report that requires or requests 
     the submission of the recurring plan or report.
       ``(iii) A list of the relevant congressional committees for 
     the recurring plan or report.
       ``(C) A justification explaining, with respect to each 
     recommendation described in subparagraph (B)(i) relating to a 
     recurring plan or report--
       ``(i) why the head of the agency made the recommendation, 
     which may include an estimate of the resources expended by 
     the agency to prepare and submit the recurring plan or 
     report; and
       ``(ii) the understanding of the head of the agency of the 
     purpose of the recurring plan or report.
       ``(2) Agency consultation.--
       ``(A) In general.--In preparing the list required under 
     paragraph (1)(A), if, in submitting a recurring plan or 
     report, an agency is required to coordinate or consult with 
     another agency or entity, the head of the agency submitting 
     the recurring plan or report shall consult with the head of 
     each agency or entity with whom consultation or coordination 
     is required.
       ``(B) Inclusion in list.--If, after a consultation under 
     subparagraph (A), the head of each agency or entity consulted 
     under that subparagraph agrees that a recurring plan or 
     report is outdated or duplicative, the head of the agency 
     required to submit the recurring plan or report shall--
       ``(i) include the recurring plan or report in the list 
     described in paragraph (1)(A); and
       ``(ii) identify each agency or entity with which the head 
     of the agency is required to coordinate or consult in 
     submitting the recurring plan or report.
       ``(C) Disagreement.--If the head of any agency or entity 
     consulted under subparagraph (A) does not agree that a 
     recurring plan or report is outdated or duplicative, the head 
     of the agency required to submit the recurring plan or report 
     shall not include the recurring plan or report in the list 
     described in paragraph (1)(A).
       ``(3) Government-wide or multi-agency plan and report 
     submissions.--With respect to a recurring plan or report 
     required to be submitted by not less than 2 agencies, the 
     Director of the Office of Management and Budget shall--
       ``(A) determine whether the requirement to submit the 
     recurring plan or report is outdated or duplicative; and
       ``(B) make recommendations to Congress accordingly.
       ``(4) Plan and report submissions conformity to the access 
     to congressionally mandated reports act.--With respect to an 
     agency recommendation, citation, or justification made under 
     subparagraph (B) or (C) of paragraph (1) or a recommendation 
     by the Director of the Office of Management and Budget under 
     paragraph (3), the agency or Director, as applicable, shall 
     also provide this information to the Director of the 
     Government Publishing Office in conformity with the agency 
     submission requirements under section 7244(a) of the James M. 
     Inhofe National Defense Authorization Act for Fiscal Year 
     2023 (Public Law 117-263; chapter 41 of title 44 note) in 
     conformity with guidance issued by the Director of the Office 
     of Management and Budget under section 7244(b) of such Act.
       ``(c) Rule of Construction on Agency Requirements.--Nothing 
     in this section shall be construed to exempt the head of an 
     agency from a requirement to submit a recurring plan or 
     report.''; and
       (3) in subsection (d), as so redesignated, by striking ``in 
     the budget of the United States Government, as provided by 
     section 1105(a)(37)'' and inserting ``in the budget 
     justification materials of each agency''.
       (b) Budget Contents.--Section 1105(a) of title 31, United 
     States Code, is amended by striking paragraph (39).
       (c) Conformity to the Access to Congressionally Mandated 
     Reports Act.--
       (1) Amendment.--Subsections (a) and (b) of section 7244 of 
     the James M. Inhofe National Defense Authorization Act for 
     Fiscal Year 2023 (Public Law 117-263; chapter 41 of title 44, 
     United States Code, note), are amended to read as follows:
       ``(a) Submission of Electronic Copies of Reports.--Not 
     earlier than 30 days or later than 60 days after the date on 
     which a congressionally mandated report is submitted to 
     either House of Congress or to any committee of Congress or 
     subcommittee thereof, the head of the Federal agency 
     submitting the congressionally mandated report shall submit 
     to the Director the information required under subparagraphs 
     (A) through (D) of section 7243(b)(1) with respect to the 
     congressionally mandated report. Notwithstanding section 
     7246, nothing in this subtitle shall relieve a Federal agency 
     of any other requirement to publish the congressionally 
     mandated report on the online portal of the Federal agency or 
     otherwise submit the congressionally mandated report to 
     Congress or specific committees of Congress, or subcommittees 
     thereof.
       ``(b) Guidance.--Not later than 180 days after the date of 
     the enactment of this subsection and periodically thereafter 
     as appropriate, the Director of the Office of Management and 
     Budget, in consultation with the Director, shall issue 
     guidance to agencies on the implementation of this subtitle 
     as well as the requirements of section 1125(b) of title 31, 
     United States Code.''.
       (2) Updated omb guidance.--Not later than 180 days after 
     the date of the enactment of this Act, the Director of the 
     Office of Management and Budget shall issue updated guidance 
     to agencies to ensure that the requirements under subsections 
     (a) and (b) of section 1125 of title 31, United States Code, 
     as amended by this Act, for agency submissions of 
     recommendations and justifications for plans and reports to 
     sunset, modify, consolidate, or reduce the frequency of the 
     submission of are also submitted as a separate attachment in 
     conformity with the agency submission requirements of 
     electronic copies of reports submitted by agencies under 
     section 7244(a) of the James M. Inhofe National Defense 
     Authorization Act for Fiscal Year 2023 (Public Law 117-263; 
     chapter 41 of title 44, United States Code, note) for 
     publication on the online portal established under section 
     7243 of such Act.
                                 ______