[Congressional Record Volume 170, Number 120 (Wednesday, July 24, 2024)]
[Senate]
[Pages S5375-S5386]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]
SA 3075. Mr. THUNE (for Mr. Lee) submitted an amendment intended to
be proposed by Mr. Thune to the bill S. 2073, to amend title 31, United
States Code, to require agencies to include a list of outdated or
duplicative reporting requirements in annual budget justifications, and
for other purposes; which was ordered to lie on the table; as follows:
In lieu of the matter proposed to be inserted, insert the
following:
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) Short Title.--This Act may be cited as the ``Kids
Online Safety and Privacy Act''.
(b) Table of Contents.--The table of contents for this Act
is as follows:
Sec. 1. Short title; table of contents.
TITLE I--KIDS ONLINE SAFETY
Sec. 101. Definitions.
Sec. 102. Duty of care.
Sec. 103. Safeguards for minors.
Sec. 104. Disclosure.
Sec. 105. Transparency.
Sec. 106. Research on social media and minors.
Sec. 107. Market research.
Sec. 108. Age verification study and report.
Sec. 109. Guidance.
Sec. 110. Enforcement.
Sec. 111. Kids online safety council.
Sec. 112. Effective date.
Sec. 113. Rules of construction and other matters.
TITLE II--CHILDREN AND TEEN'S ONLINE PRIVACY
Sec. 201. Online collection, use, disclosure, and deletion of personal
information of children and teens.
Sec. 202. Study and reports of mobile and online application oversight
and enforcement.
Sec. 203. GAO study.
Sec. 204. Severability.
TITLE III--ELIMINATING USELESS REPORTS
Sec. 301. Sunsets for agency reports.
TITLE IV--SCREEN ACT
Sec. 401. Short title.
Sec. 402. Findings; sense of Congress.
Sec. 403. Definitions.
Sec. 404. Technology verification measures.
Sec. 405. Consultation requirements.
Sec. 406. Commission requirements.
Sec. 407. Enforcement.
Sec. 408. GAO report.
Sec. 409. Severability clause.
TITLE I--KIDS ONLINE SAFETY
SEC. 101. DEFINITIONS.
In this title:
(1) Child.--The term ``child'' means an individual who is
under the age of 13.
(2) Compulsive usage.--The term ``compulsive usage'' means
any response stimulated by external factors that causes an
individual to engage in repetitive behavior reasonably likely
to cause psychological distress.
(3) Covered platform.--
(A) In general.--The term ``covered platform'' means an
online platform, online video game, messaging application, or
video streaming service that connects to the internet and
that is used, or is reasonably likely to be used, by a minor.
(B) Exceptions.--The term ``covered platform'' does not
include--
(i) an entity acting in its capacity as a provider of--
(I) a common carrier service subject to the Communications
Act of 1934 (47 U.S.C. 151 et seq.) and all Acts amendatory
thereof and supplementary thereto;
(II) a broadband internet access service (as such term is
defined for purposes of section 8.1(b) of title 47, Code of
Federal Regulations, or any successor regulation);
(III) an email service;
(IV) a teleconferencing or video conferencing service that
allows reception and transmission of audio or video signals
for real-time communication, provided that--
(aa) the service is not an online platform, including a
social media service or social network; and
(bb) the real-time communication is initiated by using a
unique link or identifier to facilitate access; or
(V) a wireless messaging service, including such a service
provided through short messaging service or multimedia
messaging service protocols, that is not a component of, or
linked to, an online platform and where the predominant or
exclusive function is direct messaging consisting of the
transmission of text, photos or videos that are sent by
electronic means, where messages are transmitted from the
sender to a recipient, and are not posted within an online
platform or publicly;
(ii) an organization not organized to carry on business for
its own profit or that of its members;
(iii) any public or private preschool, elementary, or
secondary school, or any institution of vocational,
professional, or higher education;
(iv) a library (as defined in section 213(1) of the Library
Services and Technology Act (20 U.S.C. 9122(1)));
(v) a news or sports coverage website or app where--
(I) the inclusion of video content on the website or app is
related to the website or app's own gathering, reporting, or
publishing of news content or sports coverage; and
(II) the website or app is not otherwise an online
platform;
(vi) a product or service that primarily functions as
business-to-business software, a cloud storage, file sharing,
or file collaboration service, provided that the product or
service is not an online platform; or
(vii) a virtual private network or similar service that
exists solely to route internet traffic between locations.
(4) Design feature.--The term ``design feature'' means any
feature or component of a covered platform that will
encourage or increase the frequency, time spent, or activity
of minors on the covered platform. Design features include--
(A) infinite scrolling or auto play;
(B) rewards for time spent on the platform;
(C) notifications;
(D) personalized recommendation systems;
(E) in-game purchases; or
(F) appearance altering filters.
(5) Geolocation.--The term ``geolocation'' means
information sufficient to identify street name and name of a
city or town.
(6) Individual-specific advertising to minors.--
(A) In general.--The term ``individual-specific advertising
to minors'' means advertising or any other effort to market a
product or service that is directed to a specific minor or a
device that is linked or reasonably linkable to a minor based
on--
(i) the personal data of--
(I) the minor; or
(II) a group of minors who are similar in sex, age, income
level, race, or ethnicity to the specific minor to whom the
product or service is marketed;
(ii) profiling of a minor or group of minors; or
(iii) a unique identifier of the device.
(B) Exclusions.--The term ``individual-specific advertising
to minors'' shall not include--
(i) advertising or marketing to an individual or the device
of an individual in response to the individual's specific
request for information or feedback, such as a minor's
current search query;
(ii) contextual advertising, such as when an advertisement
is displayed based on the content of the covered platform on
which the advertisement appears and does not vary based on
personal data related to the viewer;
(iii) processing personal data solely for measuring or
reporting advertising or content performance, reach, or
frequency, including independent measurement;
(C) Rule of construction.--Nothing in subparagraph (A)
shall be construed to prohibit a covered platform that knows
an individual is under the age of 17 from delivering
advertising or marketing that is age-appropriate for the
individual involved and intended for a child or teen audience
(as applicable), so long as the covered platform does not use
any personal data other than whether the user is under the
age of 17 to deliver such advertising or marketing.
(7) Know or knows.--The term ``know'' or ``knows'' means to
have actual knowledge or
[[Page S5376]]
knowledge fairly implied on the basis of objective
circumstances.
(8) Mental health disorder.--The term ``mental health
disorder'' has the meaning given the term ``mental disorder''
in the Diagnostic and Statistical Manual of Mental Health
Disorders, 5th Edition (or the most current successor
edition).
(9) Microtransaction.--
(A) In general.--The term ``microtransaction'' means a
purchase made in an online video game (including a purchase
made using a virtual currency that is purchasable or
redeemable using cash or credit or that is included as part
of a paid subscription service).
(B) Inclusions.--Such term includes a purchase involving
surprise mechanics, new characters, or in-game items.
(C) Exclusions.--Such term does not include--
(i) a purchase made in an online video game using a virtual
currency that is earned through gameplay and is not otherwise
purchasable or redeemable using cash or credit or included as
part of a paid subscription service; or
(ii) a purchase of additional levels within the game or an
overall expansion of the game.
(10) Minor.--The term ``minor'' means an individual who is
under the age of 17.
(11) Online platform.--The term ``online platform'' means
any public-facing website, online service, online
application, or mobile application that predominantly
provides a community forum for user generated content, such
as sharing videos, images, games, audio files, or other
content, including a social media service, social network, or
virtual reality environment.
(12) Online video game.--The term ``online video game''
means a video game, including an educational video game, that
connects to the internet and that--
(A) allows a user to--
(i) create and upload content other than content that is
incidental to gameplay, such as character or level designs
created by the user, preselected phrases, or short
interactions with other users;
(ii) engage in microtransactions within the game; or
(iii) communicate with other users; or
(B) incorporates individual-specific advertising to minors.
(13) Parent.--The term ``parent'' has the meaning given
that term in section 1302 of the Children's Online Privacy
Protection Act (15 U.S.C. 6501).
(14) Personal data.--The term ``personal data'' has the
same meaning as the term ``personal information'' as defined
in section 1302 of the Children's Online Privacy Protection
Act (15 U.S.C. 6501).
(15) Personalized recommendation system.--The term
``personalized recommendation system'' means a fully or
partially automated system used to suggest, promote, or rank
content, including other users, hashtags, or posts, based on
the personal data of users. A recommendation system that
suggests, promotes, or ranks content based solely on the
user's language, city or town, or age shall not be considered
a personalized recommendation system.
(16) Sexual exploitation and abuse.--The term ``sexual
exploitation and abuse'' means any of the following:
(A) Coercion and enticement, as described in section 2422
of title 18, United States Code.
(B) Child sexual abuse material, as described in sections
2251, 2252, 2252A, and 2260 of title 18, United States Code.
(C) Trafficking for the production of images, as described
in section 2251A of title 18, United States Code.
(D) Sex trafficking of children, as described in section
1591 of title 18, United States Code.
(17) User.--The term ``user'' means, with respect to a
covered platform, an individual who registers an account or
creates a profile on the covered platform.
SEC. 102. DUTY OF CARE.
(a) Prevention of Harm to Minors.--A covered platform shall
exercise reasonable care in the creation and implementation
of any design feature to prevent and mitigate the following
harms to minors:
(1) Consistent with evidence-informed medical information,
content that is distributed with the intent to exacerbate the
following mental health disorders: anxiety, depression,
eating disorders, substance use disorders, and suicidal
behaviors.
(2) Patterns of use that indicate or encourage addiction-
like behaviors by minors.
(3) Physical violence, online bullying, and harassment of
the minor.
(4) Sexual exploitation and abuse of minors.
(5) Promotion and marketing of narcotic drugs (as defined
in section 102 of the Controlled Substances Act (21 U.S.C.
802)), tobacco products, gambling, or alcohol.
(6) Promotion and marketing of obscene matter (as that term
is used in section 1470 of title 18, United States Code).
(7) Predatory, unfair, or deceptive marketing practices, or
other financial harms.
(b) Limitation.--Nothing in subsection (a) shall be
construed to require a covered platform to prevent or
preclude any minor from--
(1) deliberately and independently searching for, or
specifically requesting, content; or
(2) accessing resources and information regarding the
prevention or mitigation of the harms described in subsection
(a).
SEC. 103. SAFEGUARDS FOR MINORS.
(a) Safeguards for Minors.--
(1) Safeguards.--A covered platform shall provide a user or
visitor that the covered platform knows is a minor with
readily-accessible and easy-to-use safeguards to, as
applicable--
(A) limit the ability of other users or visitors to
communicate with the minor;
(B) prevent other users or visitors, whether registered or
not, from viewing the minor's personal data collected by or
shared on the covered platform, in particular restricting
public access to personal data;
(C) limit design features that encourage or increase the
frequency, time spent, or activity of minors on the covered
platform, such as infinite scrolling, auto playing, rewards
for time spent on the platform, notifications, and other
design features that result in compulsive usage of the
covered platform by the minor;
(D) control personalized recommendation systems, including
the ability for a minor to have at least 1 of the following
options--
(i) opt out of such personalized recommendation systems,
while still allowing the display of content based on a
chronological format; or
(ii) limit types or categories of recommendations from such
systems; and
(E) restrict the sharing of the geolocation of the minor
and provide notice regarding the tracking of the minor's
geolocation.
(2) Options.--A covered platform shall provide a user that
the covered platform knows is a minor with readily-accessible
and easy-to-use options to--
(A) delete the minor's account and delete any personal data
collected from, or shared by, the minor on the covered
platform; or
(B) limit the amount of time spent by the minor on the
covered platform.
(3) Default safeguard settings for minors.--A covered
platform shall provide that, in the case of a user or visitor
that the platform knows is a minor, the default setting for
any safeguard described under paragraph (1) shall be the
option available on the platform that provides the most
protective level of control that is offered by the platform
over privacy and safety for that user or visitor.
(b) Parental Tools.--
(1) Tools.--A covered platform shall provide readily-
accessible and easy-to-use settings for parents to support a
user that the platform knows is a minor with respect to the
user's use of the platform.
(2) Requirements.--The parental tools provided by a covered
platform shall include--
(A) the ability to manage a minor's privacy and account
settings, including the safeguards and options established
under subsection (a), in a manner that allows parents to--
(i) view the privacy and account settings; and
(ii) in the case of a user that the platform knows is a
child, change and control the privacy and account settings;
(B) the ability to restrict purchases and financial
transactions by the minor, where applicable; and
(C) the ability to view metrics of total time spent on the
covered platform and restrict time spent on the covered
platform by the minor.
(3) Notice to minors.--A covered platform shall provide
clear and conspicuous notice to a user when the tools
described in this subsection are in effect and what settings
or controls have been applied.
(4) Default tools.--A covered platform shall provide that,
in the case of a user that the platform knows is a child, the
tools required under paragraph (1) shall be enabled by
default.
(5) Application to existing accounts.--If, prior to the
effective date of this subsection, a covered platform
provided a parent of a user that the platform knows is a
child with notice and the ability to enable the parental
tools described under this subsection in a manner that would
otherwise comply with this subsection, and the parent opted
out of enabling such tools, the covered platform is not
required to enable such tools with respect to such user by
default when this subsection takes effect.
(c) Reporting Mechanism.--
(1) Reports submitted by parents, minors, and schools.--A
covered platform shall provide--
(A) a readily-accessible and easy-to-use means to submit
reports to the covered platform of harms to a minor;
(B) an electronic point of contact specific to matters
involving harms to a minor; and
(C) confirmation of the receipt of such a report and,
within the applicable time period described in paragraph (2),
a substantive response to the individual that submitted the
report.
(2) Timing.--A covered platform shall establish an internal
process to receive and substantively respond to such reports
in a reasonable and timely manner, but in no case later
than--
(A) 10 days after the receipt of a report, if, for the most
recent calendar year, the platform averaged more than
10,000,000 active users on a monthly basis in the United
States;
(B) 21 days after the receipt of a report, if, for the most
recent calendar year, the platform averaged less than
10,000,000 active users on a monthly basis in the United
States; and
(C) notwithstanding subparagraphs (A) and (B), if the
report involves an imminent
[[Page S5377]]
threat to the safety of a minor, as promptly as needed to
address the reported threat to safety.
(d) Advertising of Illegal Products.--A covered platform
shall not facilitate the advertising of narcotic drugs (as
defined in section 102 of the Controlled Substances Act (21
U.S.C. 802)), tobacco products, gambling, or alcohol to an
individual that the covered platform knows is a minor.
(e) Rules of Application.--
(1) Accessibility.--With respect to safeguards and parental
tools described under subsections (a) and (b), a covered
platform shall provide--
(A) information and control options in a clear and
conspicuous manner that takes into consideration the
differing ages, capacities, and developmental needs of the
minors most likely to access the covered platform and does
not encourage minors or parents to weaken or disable
safeguards or parental tools;
(B) readily-accessible and easy-to-use controls to enable
or disable safeguards or parental tools, as appropriate; and
(C) information and control options in the same language,
form, and manner as the covered platform provides the product
or service used by minors and their parents.
(2) Dark patterns prohibition.--It shall be unlawful for
any covered platform to design, modify, or manipulate a user
interface of a covered platform with the purpose or
substantial effect of subverting or impairing user autonomy,
decision-making, or choice with respect to safeguards or
parental tools required under this section.
(3) Timing considerations.--
(A) No interruption to gameplay.--Subsections (a)(1)(C) and
(b)(3) shall not require an online video game to interrupt
the natural sequence of game play, such as progressing
through game levels or finishing a competition.
(B) Application of changes to offline devices or
accounts.--If a user's device or user account does not have
access to the internet at the time of a change to parental
tools, a covered platform shall apply changes the next time
the device or user is connected to the internet.
(4) Rules of construction.--Nothing in this section shall
be construed to--
(A) prevent a covered platform from taking reasonable
measures to--
(i) block, detect, or prevent the distribution of unlawful,
obscene, or other harmful material to minors as described in
section 102(a); or
(ii) block or filter spam, prevent criminal activity, or
protect the security of a platform or service;
(B) require the disclosure of a minor's browsing behavior,
search history, messages, contact list, or other content or
metadata of their communications;
(C) prevent a covered platform from using a personalized
recommendation system to display content to a minor if the
system only uses information on--
(i) the language spoken by the minor;
(ii) the city the minor is located in; or
(iii) the minor's age; or
(D) prevent an online video game from disclosing a username
or other user identification for the purpose of competitive
gameplay or to allow for the reporting of users.
(f) Device or Console Controls.--
(1) In general.--Nothing in this section shall be construed
to prohibit a covered platform from integrating its products
or service with, or duplicate controls or tools provided by,
third-party systems, including operating systems or gaming
consoles, to meet the requirements imposed under subsections
(a) and (b) relating to safeguards for minors and parental
tools, provided that--
(A) the controls or tools meet such requirements; and
(B) the minor or parent is provided sufficient notice of
the integration and use of the parental tools.
(2) Preservation of protections.--In the event of a
conflict between the controls or tools of a third-party
system, including operating systems or gaming consoles, and a
covered platform, the covered platform is not required to
override the controls or tools of a third-party system if it
would undermine the protections for minors from the
safeguards or parental tools imposed under subsections (a)
and (b).
SEC. 104. DISCLOSURE.
(a) Notice.--
(1) Registration or purchase.--Prior to registration or
purchase of a covered platform by an individual that the
platform knows is a minor, the platform shall provide clear,
conspicuous, and easy-to-understand--
(A) notice of the policies and practices of the covered
platform with respect to personal data and safeguards for
minors;
(B) information about how to access the safeguards and
parental tools required under section 103; and
(C) notice about whether the covered platform uses or makes
available to minors a product, service, or design feature,
including any personalized recommendation system, that poses
any heightened risk of harm to minors.
(2) Notification.--
(A) Notice and acknowledgment.--In the case of an
individual that a covered platform knows is a child, the
platform shall additionally provide information about the
parental tools and safeguards required under section 103 to a
parent of the child and obtain verifiable parental consent
(as defined in section 1302(9) of the Children's Online
Privacy Protection Act (15 U.S.C. 6501(9))) from the parent
prior to the initial use of the covered platform by the
child.
(B) Reasonable effort.--A covered platform shall be deemed
to have satisfied the requirement described in subparagraph
(A) if the covered platform is in compliance with the
requirements of the Children's Online Privacy Protection Act
(15 U.S.C. 6501 et seq.) to use reasonable efforts (taking
into consideration available technology) to provide a parent
with the information described in subparagraph (A) and to
obtain verifiable parental consent as required.
(3) Consolidated notices.--For purposes of this title, a
covered platform may consolidate the process for providing
information under this subsection and obtaining verifiable
parental consent or the consent of the minor involved (as
applicable) as required under this subsection with its
obligations to provide relevant notice and obtain verifiable
consent under the Children's Online Privacy Protection Act
(15 U.S.C. 6501 et seq.).
(4) Guidance.--The Federal Trade Commission may issue
guidance to assist covered platforms in complying with the
specific notice requirements of this subsection.
(b) Personalized Recommendation System.--A covered platform
that operates a personalized recommendation system shall set
out in its terms and conditions, in a clear, conspicuous, and
easy-to-understand manner--
(1) an overview of how such personalized recommendation
system is used by the covered platform to provide information
to minors, including how such systems use the personal data
of minors; and
(2) information about options for minors or their parents
to opt out of or control the personalized recommendation
system (as applicable).
(c) Advertising and Marketing Information and Labels.--
(1) Information and labels.--A covered platform that
facilitates advertising aimed at users that the platform
knows are minors shall provide clear, conspicuous, and easy-
to-understand labels and information, which can be provided
through a link to another web page or disclosure, to minors
on advertisements regarding--
(A) the name of the product, service, or brand and the
subject matter of an advertisement;
(B) if the covered platform engages in individual-specific
advertising to minors, why a particular advertisement is
directed to a specific minor, including material information
about how the minor's personal data is used to direct the
advertisement to the minor; and
(C) whether particular media displayed to the minor is an
advertisement or marketing material, including disclosure of
endorsements of products, services, or brands made for
commercial consideration by other users of the platform.
(2) Guidance.--The Federal Trade Commission may issue
guidance to assist covered platforms in complying with the
requirements of this subsection, including guidance about the
minimum level of information and labels for the disclosures
required under paragraph (1).
(d) Resources for Parents and Minors.--A covered platform
shall provide to minors and parents clear, conspicuous, easy-
to-understand, and comprehensive information in a prominent
location, which may include a link to a web page, regarding--
(1) its policies and practices with respect to personal
data and safeguards for minors; and
(2) how to access the safeguards and tools required under
section 103.
(e) Resources in Additional Languages.--A covered platform
shall ensure, to the extent practicable, that the disclosures
required by this section are made available in the same
language, form, and manner as the covered platform provides
any product or service used by minors and their parents.
SEC. 105. TRANSPARENCY.
(a) In General.--Subject to subsection (b), not less
frequently than once a year, a covered platform shall issue a
public report describing the reasonably foreseeable risks of
harms to minors and assessing the prevention and mitigation
measures taken to address such risk based on an independent,
third-party audit conducted through reasonable inspection of
the covered platform.
(b) Scope of Application.--The requirements of this section
shall apply to a covered platform if--
(1) for the most recent calendar year, the platform
averaged more than 10,000,000 active users on a monthly basis
in the United States; and
(2) the platform predominantly provides a community forum
for user-generated content and discussion, including sharing
videos, images, games, audio files, discussion in a virtual
setting, or other content, such as acting as a social media
platform, virtual reality environment, or a social network
service.
(c) Content.--
(1) Transparency.--The public reports required of a covered
platform under this section shall include--
(A) an assessment of the extent to which the platform is
likely to be accessed by minors;
(B) a description of the commercial interests of the
covered platform in use by minors;
(C) an accounting, based on the data held by the covered
platform, of--
[[Page S5378]]
(i) the number of users using the covered platform that the
platform knows to be minors in the United States;
(ii) the median and mean amounts of time spent on the
platform by users known to be minors in the United States who
have accessed the platform during the reporting year on a
daily, weekly, and monthly basis; and
(iii) the amount of content being accessed by users that
the platform knows to be minors in the United States that is
in English, and the top 5 non-English languages used by users
accessing the platform in the United States;
(D) an accounting of total reports received regarding, and
the prevalence (which can be based on scientifically valid
sampling methods using the content available to the covered
platform in the normal course of business) of content related
to, the harms described in section 102(a), disaggregated by
category of harm and language, including English and the top
5 non-English languages used by users accessing the platform
from the United States (as identified under subparagraph
(C)(iii)); and
(E) a description of any material breaches of parental
tools or assurances regarding minors, representations
regarding the use of the personal data of minors, and other
matters regarding non-compliance with this title.
(2) Reasonably foreseeable risk of harm to minors.--The
public reports required of a covered platform under this
section shall include--
(A) an assessment of the reasonably foreseeable risk of
harms to minors posed by the covered platform, specifically
identifying those physical, mental, developmental, or
financial harms described in section 102(a);
(B) a description of whether and how the covered platform
uses design features that encourage or increase the
frequency, time spent, or activity of minors on the covered
platform, such as infinite scrolling, auto playing, rewards
for time spent on the platform, notifications, and other
design features that result in compulsive usage of the
covered platform by the minor;
(C) a description of whether, how, and for what purpose the
platform collects or processes categories of personal data
that may cause reasonably foreseeable risk of harms to
minors;
(D) an evaluation of the efficacy of safeguards for minors
and parental tools under section 103, and any issues in
delivering such safeguards and the associated parental tools;
(E) an evaluation of any other relevant matters of public
concern over risk of harms to minors associated with the use
of the covered platform; and
(F) an assessment of differences in risk of harm to minors
across different English and non-English languages and
efficacy of safeguards in those languages.
(3) Mitigation.--The public reports required of a covered
platform under this section shall include, for English and
the top 5 non-English languages used by users accessing the
platform from the United States (as identified under
paragraph (2)(C)(iii)))--
(A) a description of the safeguards and parental tools
available to minors and parents on the covered platform;
(B) a description of interventions by the covered platform
when it had or has reason to believe that harms to minors
could occur;
(C) a description of the prevention and mitigation measures
intended to be taken in response to the known and emerging
risks identified in its assessment of reasonably foreseeable
risks of harms to minors, including steps taken to--
(i) prevent harms to minors, including adapting or removing
design features or addressing through parental tools;
(ii) provide the most protective level of control over
privacy and safety by default; and
(iii) adapt recommendation systems to mitigate reasonably
foreseeable risk of harms to minors, as described in section
102(a);
(D) a description of internal processes for handling
reports and automated detection mechanisms for harms to
minors, including the rate, timeliness, and effectiveness of
responses under the requirement of section 103(c);
(E) the status of implementing prevention and mitigation
measures identified in prior assessments; and
(F) a description of the additional measures to be taken by
the covered platform to address the circumvention of
safeguards for minors and parental tools.
(d) Reasonable Inspection.--In conducting an inspection of
the reasonably foreseeable risk of harm to minors under this
section, an independent, third-party auditor shall--
(1) take into consideration the function of personalized
recommendation systems;
(2) consult parents and youth experts, including youth and
families with relevant past or current experience, public
health and mental health nonprofit organizations, health and
development organizations, and civil society with respect to
the prevention of harms to minors;
(3) conduct research based on experiences of minors that
use the covered platform, including reports under section
103(c) and information provided by law enforcement;
(4) take account of research, including research regarding
design features, marketing, or product integrity, industry
best practices, or outside research;
(5) consider indicia or inferences of age of users, in
addition to any self-declared information about the age of
users; and
(6) take into consideration differences in risk of
reasonably foreseeable harms and effectiveness of safeguards
across English and non-English languages.
(e) Cooperation With Independent, Third-party Audit.--To
facilitate the report required by subsection (c), a covered
platform shall--
(1) provide or otherwise make available to the independent
third-party conducting the audit all information and material
in its possession, custody, or control that is relevant to
the audit;
(2) provide or otherwise make available to the independent
third-party conducting the audit access to all network,
systems, and assets relevant to the audit; and
(3) disclose all relevant facts to the independent third-
party conducting the audit, and not misrepresent in any
manner, expressly or by implication, any relevant fact.
(f) Privacy Safeguards.--
(1) In general.--In issuing the public reports required
under this section, a covered platform shall take steps to
safeguard the privacy of its users, including ensuring that
data is presented in a de-identified, aggregated format such
that it is not reasonably linkable to any user.
(2) Rule of construction.--This section shall not be
construed to require the disclosure of information that will
lead to material vulnerabilities for the privacy of users or
the security of a covered platform's service or create a
significant risk of the violation of Federal or State law.
(3) Definition of de-identified.--As used in this
subsection, the term ``de-identified'' means data that does
not identify and is not linked or reasonably linkable to a
device that is linked or reasonably linkable to an
individual, regardless of whether the information is
aggregated
(g) Location.--The public reports required under this
section should be posted by a covered platform on an easy to
find location on a publicly-available website.
SEC. 106. RESEARCH ON SOCIAL MEDIA AND MINORS.
(a) Definitions.--In this section:
(1) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(2) National academy.--The term ``National Academy'' means
the National Academy of Sciences.
(3) Secretary.--The term ``Secretary'' means the Secretary
of Health and Human Services.
(b) Research on Social Media Harms.--Not later than 12
months after the date of enactment of this Act, the
Commission shall seek to enter into a contract with the
National Academy, under which the National Academy shall
conduct no less than 5 scientific, comprehensive studies and
reports on the risk of harms to minors by use of social media
and other online platforms, including in English and non-
English languages.
(c) Matters to Be Addressed.--In contracting with the
National Academy, the Commission, in consultation with the
Secretary, shall seek to commission separate studies and
reports, using the Commission's authority under section 6(b)
of the Federal Trade Commission Act (15 U.S.C. 46(b)), on the
relationship between social media and other online platforms
as defined in this title on the following matters:
(1) Anxiety, depression, eating disorders, and suicidal
behaviors.
(2) Substance use disorders and the use of narcotic drugs,
tobacco products, gambling, or alcohol by minors.
(3) Sexual exploitation and abuse.
(4) Addiction-like use of social media and design factors
that lead to unhealthy and harmful overuse of social media.
(d) Additional Study.--Not earlier than 4 years after
enactment, the Commission shall seek to enter into a contract
with the National Academy under which the National Academy
shall conduct an additional study and report covering the
matters described in subsection (c) for the purposes of
providing additional information, considering new research,
and other matters.
(e) Content of Reports.-- The comprehensive studies and
reports conducted pursuant to this section shall seek to
evaluate impacts and advance understanding, knowledge, and
remedies regarding the harms to minors posed by social media
and other online platforms, and may include recommendations
related to public policy.
(f) Active Studies.--If the National Academy is engaged in
any active studies on the matters described in subsection (c)
at the time that it enters into a contract with the
Commission to conduct a study under this section, it may base
the study to be conducted under this section on the active
study, so long as it otherwise incorporates the requirements
of this section.
(g) Collaboration.--In designing and conducting the studies
under this section, the Commission, the Secretary, and the
National Academy shall consult with the Surgeon General and
the Kids Online Safety Council.
(h) Access to Data.--
(1) Fact-finding authority.--The Commission may issue
orders under section 6(b) of the Federal Trade Commission Act
(15 U.S.C. 46(b)) to require covered platforms to provide
reports, data, or answers in writing as necessary to conduct
the studies required under this section.
(2) Scope.--In exercising its authority under paragraph
(1), the Commission may
[[Page S5379]]
issue orders to no more than 5 covered platforms per study
under this section.
(3) Confidential access.--Notwithstanding section 6(f) or
21 of the Federal Trade Commission Act (15 U.S.C. 46, 57b-2),
the Commission shall enter in agreements with the National
Academy to share appropriate information received from a
covered platform pursuant to an order under such subsection
(b) for a comprehensive study under this section in a
confidential and secure manner, and to prohibit the
disclosure or sharing of such information by the National
Academy. Nothing in this paragraph shall be construed to
preclude the disclosure of any such information if authorized
or required by any other law.
SEC. 107. MARKET RESEARCH.
(a) Market Research by Covered Platforms.--The Federal
Trade Commission, in consultation with the Secretary of
Commerce, shall issue guidance for covered platforms seeking
to conduct market- and product-focused research on minors.
Such guidance shall include--
(1) a standard consent form that provides minors and their
parents a clear, conspicuous, and easy-to-understand
explanation of the scope and purpose of the research to be
conducted that is available in English and the top 5 non-
English languages used in the United States;
(2) information on how to obtain informed consent from the
parent of a minor prior to conducting such market- and
product-focused research; and
(3) recommendations for research practices for studies that
may include minors, disaggregated by the age ranges of 0-5,
6-9, 10-12, and 13-16.
(b) Timing.--The Federal Trade Commission shall issue such
guidance not later than 18 months after the date of enactment
of this Act. In doing so, they shall seek input from members
of the public and the representatives of the Kids Online
Safety Council established under section 111.
SEC. 108. AGE VERIFICATION STUDY AND REPORT.
(a) Study.--The Secretary of Commerce, in coordination with
the Federal Communications Commission and the Federal Trade
Commission, shall conduct a study evaluating the most
technologically feasible methods and options for developing
systems to verify age at the device or operating system
level.
(b) Contents.--Such study shall consider --
(1) the benefits of creating a device or operating system
level age verification system;
(2) what information may need to be collected to create
this type of age verification system;
(3) the accuracy of such systems and their impact or steps
to improve accessibility, including for individuals with
disabilities;
(4) how such a system or systems could verify age while
mitigating risks to user privacy and data security and
safeguarding minors' personal data, emphasizing minimizing
the amount of data collected and processed by covered
platforms and age verification providers for such a system;
(5) the technical feasibility, including the need for
potential hardware and software changes, including for
devices currently in commerce and owned by consumers; and
(6) the impact of different age verification systems on
competition, particularly the risk of different age
verification systems creating barriers to entry for small
companies.
(c) Report.--Not later than 1 year after the date of
enactment of this Act, the agencies described in subsection
(a) shall submit a report containing the results of the study
conducted under such subsection to the Committee on Commerce,
Science, and Transportation of the Senate and the Committee
on Energy and Commerce of the House of Representatives.
SEC. 109. GUIDANCE.
(a) In General.--Not later than 18 months after the date of
enactment of this Act, the Federal Trade Commission, in
consultation with the Kids Online Safety Council established
under section 111, shall issue guidance to--
(1) provide information and examples for covered platforms
and auditors regarding the following, with consideration
given to differences across English and non-English
languages--
(A) identifying design features that encourage or increase
the frequency, time spent, or activity of minors on the
covered platform;
(B) safeguarding minors against the possible misuse of
parental tools;
(C) best practices in providing minors and parents the most
protective level of control over privacy and safety;
(D) using indicia or inferences of age of users for
assessing use of the covered platform by minors;
(E) methods for evaluating the efficacy of safeguards set
forth in this title; and
(F) providing additional parental tool options that allow
parents to address the harms described in section 102(a); and
(2) outline conduct that does not have the purpose or
substantial effect of subverting or impairing user autonomy,
decision-making, or choice, or of causing, increasing, or
encouraging compulsive usage for a minor, such as--
(A) de minimis user interface changes derived from testing
consumer preferences, including different styles, layouts, or
text, where such changes are not done with the purpose of
weakening or disabling safeguards or parental tools;
(B) algorithms or data outputs outside the control of a
covered platform; and
(C) establishing default settings that provide enhanced
privacy protection to users or otherwise enhance their
autonomy and decision-making ability.
(b) Guidance on Knowledge Standard.--Not later than 18
months after the date of enactment of this Act, the Federal
Trade Commission shall issue guidance to provide information,
including best practices and examples, for covered platforms
to understand how the Commission would determine whether a
covered platform ``had knowledge fairly implied on the basis
of objective circumstances'' for purposes of this title.
(c) Limitation on Federal Trade Commission Guidance.--
(1) Effect of guidance.--No guidance issued by the Federal
Trade Commission with respect to this title shall--
(A) confer any rights on any person, State, or locality; or
(B) operate to bind the Federal Trade Commission or any
court, person, State, or locality to the approach recommended
in such guidance.
(2) Use in enforcement actions.--In any enforcement action
brought pursuant to this title, the Federal Trade Commission
or a State attorney general, as applicable--
(A) shall allege a violation of a provision of this title;
and
(B) may not base such enforcement action on, or execute a
consent order based on, practices that are alleged to be
inconsistent with guidance issued by the Federal Trade
Commission with respect to this title, unless the practices
are alleged to violate a provision of this title.
For purposes of enforcing this title, State attorneys general
shall take into account any guidance issued by the Commission
under subsection (b).
SEC. 110. ENFORCEMENT.
(a) Enforcement by Federal Trade Commission.--
(1) Unfair and deceptive acts or practices.--A violation of
this title shall be treated as a violation of a rule defining
an unfair or deceptive act or practice prescribed under
section 18(a)(1)(B) of the Federal Trade Commission Act (15
U.S.C. 57a(a)(1)(B)).
(2) Powers of the commission.--
(A) In general.--The Federal Trade Commission (referred to
in this section as the ``Commission'') shall enforce this
title in the same manner, by the same means, and with the
same jurisdiction, powers, and duties as though all
applicable terms and provisions of the Federal Trade
Commission Act (15 U.S.C. 41 et seq.) were incorporated into
and made a part of this title.
(B) Privileges and immunities.--Any person that violates
this title shall be subject to the penalties, and entitled to
the privileges and immunities, provided in the Federal Trade
Commission Act (15 U.S.C. 41 et seq.).
(3) Authority preserved.--Nothing in this title shall be
construed to limit the authority of the Commission under any
other provision of law.
(b) Enforcement by State Attorneys General.--
(1) In general.--
(A) Civil actions.--In any case in which the attorney
general of a State has reason to believe that a covered
platform has violated or is violating section 103, 104, or
105, the State, as parens patriae, may bring a civil action
on behalf of the residents of the State in a district court
of the United States or a State court of appropriate
jurisdiction to--
(i) enjoin any practice that violates section 103, 104, or
105;
(ii) enforce compliance with section 103, 104, or 105;
(iii) on behalf of residents of the State, obtain damages,
restitution, or other compensation, each of which shall be
distributed in accordance with State law; or
(iv) obtain such other relief as the court may consider to
be appropriate.
(B) Notice.--
(i) In general.--Before filing an action under subparagraph
(A), the attorney general of the State involved shall provide
to the Commission--
(I) written notice of that action; and
(II) a copy of the complaint for that action.
(ii) Exemption.--
(I) In general.--Clause (i) shall not apply with respect to
the filing of an action by an attorney general of a State
under this paragraph if the attorney general of the State
determines that it is not feasible to provide the notice
described in that clause before the filing of the action.
(II) Notification.--In an action described in subclause
(I), the attorney general of a State shall provide notice and
a copy of the complaint to the Commission at the same time as
the attorney general files the action.
(2) Intervention.--
(A) In general.--On receiving notice under paragraph
(1)(B), the Commission shall have the right to intervene in
the action that is the subject of the notice.
(B) Effect of intervention.--If the Commission intervenes
in an action under paragraph (1), it shall have the right--
(i) to be heard with respect to any matter that arises in
that action; and
(ii) to file a petition for appeal.
(3) Construction.--For purposes of bringing any civil
action under paragraph (1), nothing in this title shall be
construed to prevent an attorney general of a State from
exercising the powers conferred on the attorney general by
the laws of that State to--
[[Page S5380]]
(A) conduct investigations;
(B) administer oaths or affirmations; or
(C) compel the attendance of witnesses or the production of
documentary and other evidence.
(4) Actions by the commission.--In any case in which an
action is instituted by or on behalf of the Commission for
violation of this title, no State may, during the pendency of
that action, institute a separate action under paragraph (1)
against any defendant named in the complaint in the action
instituted by or on behalf of the Commission for that
violation.
(5) Venue; service of process.--
(A) Venue.--Any action brought under paragraph (1) may be
brought in--
(i) the district court of the United States that meets
applicable requirements relating to venue under section 1391
of title 28, United States Code; or
(ii) a State court of competent jurisdiction.
(B) Service of process.--In an action brought under
paragraph (1) in a district court of the United States,
process may be served wherever defendant--
(i) is an inhabitant; or
(ii) may be found.
(6) Limitation.--A violation of section 102 shall not form
the basis of liability in any action brought by the attorney
general of a State under a State law.
SEC. 111. KIDS ONLINE SAFETY COUNCIL.
(a) Establishment.--Not later than 180 days after the date
of enactment of this Act, the Secretary of Commerce shall
establish and convene the Kids Online Safety Council for the
purpose of providing advice on matters related to this title.
(b) Participation.--The Kids Online Safety Council shall
include diverse participation from--
(1) academic experts, health professionals, and members of
civil society with expertise in mental health, substance use
disorders, harm reduction as it relates to early exposures to
pornographic material, and the prevention of harms to minors;
(2) representatives in academia and civil society with
specific expertise in privacy, free expression, access to
information, and civil liberties;
(3) parents and youth representation;
(4) representatives of covered platforms;
(5) representatives of the National Telecommunications and
Information Administration, the National Institute of
Standards and Technology, the Federal Trade Commission, the
Department of Justice, and the Department of Health and Human
Services;
(6) State attorneys general or their designees acting in
State or local government;
(7) educators; and
(8) representatives of faith-based organizations.
(c) Activities.--The matters to be addressed by the Kids
Online Safety Council shall include--
(1) identifying emerging or current risks of harms to
minors associated with online platforms;
(2) recommending measures and methods for assessing,
preventing, and mitigating harms to minors online;
(3) recommending methods and themes for conducting research
regarding online harms to minors, including in English and
non-English languages; and
(4) recommending best practices and clear, consensus-based
technical standards for transparency reports and audits, as
required under this title, including methods, criteria, and
scope to promote overall accountability.
(d) Non-applicability of FACA.--The Kids Online Safety
Council shall not be subject to chapter 10 of title 5, United
States Code (commonly referred to as the ``Federal Advisory
Committee Act'').
SEC. 112. EFFECTIVE DATE.
Except as otherwise provided in this title, this title
shall take effect on the date that is 18 months after the
date of enactment of this Act.
SEC. 113. RULES OF CONSTRUCTION AND OTHER MATTERS.
(a) Relationship to Other Laws.--Nothing in this title
shall be construed to--
(1) preempt section 444 of the General Education Provisions
Act (20 U.S.C. 1232g, commonly known as the ``Family
Educational Rights and Privacy Act of 1974'') or other
Federal or State laws governing student privacy;
(2) preempt the Children's Online Privacy Protection Act of
1998 (15 U.S.C. 6501 et seq.) or any rule or regulation
promulgated under such Act;
(3) authorize any action that would conflict with section
18(h) of the Federal Trade Commission Act (15 U.S.C. 57a(h));
or
(4) expand or limit the scope of section 230 of the
Communications Act of 1934 (commonly known as ``section 230
of the Communications Decency Act of 1996'') (47 U.S.C. 230).
(b) Determination of ``Fairly Implied on the Basis of
Objective Circumstances''.--For purposes of enforcing this
title, in making a determination as to whether covered
platform has knowledge fairly implied on the basis of
objective circumstances that a specific user is a minor, the
Federal Trade Commission or a State attorney general shall
rely on competent and reliable evidence, taking into account
the totality of the circumstances, including whether a
reasonable and prudent person under the circumstances would
have known that the user is a minor.
(c) Protections for Privacy.--Nothing in this title,
including a determination described in subsection (b), shall
be construed to require--
(1) the affirmative collection of any personal data with
respect to the age of users that a covered platform is not
already collecting in the normal course of business; or
(2) a covered platform to implement an age gating or age
verification functionality.
(d) Compliance.--Nothing in this title shall be construed
to restrict a covered platform's ability to--
(1) cooperate with law enforcement agencies regarding
activity that the covered platform reasonably and in good
faith believes may violate Federal, State, or local laws,
rules, or regulations;
(2) comply with a lawful civil, criminal, or regulatory
inquiry, subpoena, or summons by Federal, State, local, or
other government authorities; or
(3) investigate, establish, exercise, respond to, or defend
against legal claims.
(e) Application to Video Streaming Services.--A video
streaming service shall be deemed to be in compliance with
this title if it predominantly consists of news, sports,
entertainment, or other video programming content that is
preselected by the provider and not user-generated, and--
(1) any chat, comment, or interactive functionality is
provided incidental to, directly related to, or dependent on
provision of such content;
(2) if such video streaming service requires account owner
registration and is not predominantly news or sports, the
service includes the capability--
(A) to limit a minor's access to the service, which may
utilize a system of age-rating;
(B) to limit the automatic playing of on-demand content
selected by a personalized recommendation system for an
individual that the service knows is a minor;
(C) to provide an individual that the service knows is a
minor with readily-accessible and easy-to-use options to
delete an account held by the minor and delete any personal
data collected from the minor on the service, or, in the case
of a service that allows a parent to create a profile for a
minor, to allow a parent to delete the minor's profile, and
to delete any personal data collected from the minor on the
service;
(D) for a parent to manage a minor's privacy and account
settings, and restrict purchases and financial transactions
by a minor, where applicable;
(E) to provide an electronic point of contact specific to
matters described in this paragraph;
(F) to offer a clear, conspicuous, and easy-to-understand
notice of its policies and practices with respect to personal
data and the capabilities described in this paragraph; and
(G) when providing on-demand content, to employ measures
that safeguard against serving advertising for narcotic drugs
(as defined in section 102 of the Controlled Substances Act
(21 U.S.C. 802)), tobacco products, gambling, or alcohol
directly to the account or profile of an individual that the
service knows is a minor.
(f) Application to Particular Viewpoints.--Nothing in this
title shall be construed to require a covered platform to
alter a design feature in such a manner that would result in
particular viewpoints being throttled, suppressed, or
censored.
TITLE II--CHILDREN AND TEEN'S ONLINE PRIVACY
SEC. 201. ONLINE COLLECTION, USE, DISCLOSURE, AND DELETION OF
PERSONAL INFORMATION OF CHILDREN AND TEENS.
(a) Definitions.--Section 1302 of the Children's Online
Privacy Protection Act of 1998 (15 U.S.C. 6501) is amended--
(1) by amending paragraph (2) to read as follows:
``(2) Operator.--The term `operator'--
``(A) means any person--
``(i) who, for commercial purposes, in interstate or
foreign commerce operates or provides a website on the
internet, an online service, an online application, or a
mobile application; and
``(ii) who--
``(I) collects or maintains, either directly or through a
service provider, personal information from or about the
users of that website, service, or application;
``(II) allows another person to collect personal
information directly from users of that website, service, or
application (in which case, the operator is deemed to have
collected the information); or
``(III) allows users of that website, service, or
application to publicly disclose personal information (in
which case, the operator is deemed to have collected the
information); and
``(B) does not include any nonprofit entity that would
otherwise be exempt from coverage under section 5 of the
Federal Trade Commission Act (15 U.S.C. 45).'';
(2) in paragraph (4)--
(A) by amending subparagraph (A) to read as follows:
``(A) the release of personal information collected from a
child or teen by an operator for any purpose, except where
the personal information is provided to a person other than
an operator who--
``(i) provides support for the internal operations of the
website, online service, online application, or mobile
application of the operator, excluding any activity relating
to individual-specific advertising to children or teens; and
``(ii) does not disclose or use that personal information
for any other purpose; and''; and
[[Page S5381]]
(B) in subparagraph (B)--
(i) by inserting ``or teen'' after ``child'' each place the
term appears;
(ii) by striking ``website or online service'' and
inserting ``website, online service, online application, or
mobile application''; and
(iii) by striking ``actual knowledge'' and inserting
``actual knowledge or knowledge fairly implied on the basis
of objective circumstances'';
(3) by striking paragraph (8) and inserting the following:
``(8) Personal information.--
``(A) In general.--The term `personal information' means
individually identifiable information about an individual
collected online, including--
``(i) a first and last name;
``(ii) a home or other physical address including street
name and name of a city or town;
``(iii) an e-mail address;
``(iv) a telephone number;
``(v) a Social Security number;
``(vi) any other identifier that the Commission determines
permits the physical or online contacting of a specific
individual;
``(vii) a persistent identifier that can be used to
recognize a specific child or teen over time and across
different websites, online services, online applications, or
mobile applications, including but not limited to a customer
number held in a cookie, an Internet Protocol (IP) address, a
processor or device serial number, or unique device
identifier, but excluding an identifier that is used by an
operator solely for providing support for the internal
operations of the website, online service, online
application, or mobile application;
``(viii) a photograph, video, or audio file where such file
contains a specific child's or teen's image or voice;
``(ix) geolocation information;
``(x) information generated from the measurement or
technological processing of an individual's biological,
physical, or physiological characteristics that is used to
identify an individual, including--
``(I) fingerprints;
``(II) voice prints;
``(III) iris or retina imagery scans;
``(IV) facial templates;
``(V) deoxyribonucleic acid (DNA) information; or
``(VI) gait; or
``(xi) information linked or reasonably linkable to a child
or teen or the parents of that child or teen (including any
unique identifier) that an operator collects online from the
child or teen and combines with an identifier described in
this subparagraph.
``(B) Exclusion.--The term `personal information' shall not
include an audio file that contains a child's or teen's voice
so long as the operator--
``(i) does not request information via voice that would
otherwise be considered personal information under this
paragraph;
``(ii) provides clear notice of its collection and use of
the audio file and its deletion policy in its privacy policy;
``(iii) only uses the voice within the audio file solely as
a replacement for written words, to perform a task, or engage
with a website, online service, online application, or mobile
application, such as to perform a search or fulfill a verbal
instruction or request; and
``(iv) only maintains the audio file long enough to
complete the stated purpose and then immediately deletes the
audio file and does not make any other use of the audio file
prior to deletion.
``(C) Support for the internal operations of a website,
online service, online application, or mobile application.--
``(i) In general.--For purposes of subparagraph (A)(vii),
the term `support for the internal operations of a website,
online service, online application, or mobile application'
means those activities necessary to--
``(I) maintain or analyze the functioning of the website,
online service, online application, or mobile application;
``(II) perform network communications;
``(III) authenticate users of, or personalize the content
on, the website, online service, online application, or
mobile application;
``(IV) serve contextual advertising, provided that any
persistent identifier is only used as necessary for technical
purposes to serve the contextual advertisement, or cap the
frequency of advertising;
``(V) protect the security or integrity of the user,
website, online service, online application, or mobile
application;
``(VI) ensure legal or regulatory compliance, or
``(VII) fulfill a request of a child or teen as permitted
by subparagraphs (A) through (C) of section 1303(b)(2).
``(ii) Condition.--Except as specifically permitted under
clause (i), information collected for the activities listed
in clause (i) cannot be used or disclosed to contact a
specific individual, including through individual-specific
advertising to children or teens, to amass a profile on a
specific individual, in connection with processes that
encourage or prompt use of a website or online service, or
for any other purpose.'';
(4) by amending paragraph (9) to read as follows:
``(9) Verifiable consent.--The term `verifiable consent'
means any reasonable effort (taking into consideration
available technology), including a request for authorization
for future collection, use, and disclosure described in the
notice, to ensure that, in the case of a child, a parent of
the child, or, in the case of a teen, the teen--
``(A) receives direct notice of the personal information
collection, use, and disclosure practices of the operator;
and
``(B) before the personal information of the child or teen
is collected, freely and unambiguously authorizes--
``(i) the collection, use, and disclosure, as applicable,
of that personal information; and
``(ii) any subsequent use of that personal information.'';
(5) in paragraph (10)--
(A) in the paragraph header, by striking ``Website or
online service directed to children'' and inserting
``Website, online service, online application, or mobile
application directed to children'';
(B) by striking ``website or online service'' each place it
appears and inserting ``website, online service, online
application, or mobile application''; and
(C) by adding at the end the following new subparagraph:
``(C) Rule of construction.--In considering whether a
website, online service, online application, or mobile
application, or portion thereof, is directed to children, the
Commission shall apply a totality of circumstances test and
will also consider competent and reliable empirical evidence
regarding audience composition and evidence regarding the
intended audience of the website, online service, online
application, or mobile application.''; and
(6) by adding at the end the following:
``(13) Connected device.--The term `connected device' means
a device that is capable of connecting to the internet,
directly or indirectly, or to another connected device.
``(14) Online application.--The term `online application'--
``(A) means an internet-connected software program; and
``(B) includes a service or application offered via a
connected device.
``(15) Mobile application.--The term `mobile application'--
``(A) means a software program that runs on the operating
system of--
``(i) a cellular telephone;
``(ii) a tablet computer; or
``(iii) a similar portable computing device that transmits
data over a wireless connection; and
``(B) includes a service or application offered via a
connected device.
``(16) Geolocation information.--The term `geolocation
information' means information sufficient to identify a
street name and name of a city or town.
``(17) Teen.--The term `teen' means an individual who has
attained age 13 and is under the age of 17.
``(18) Individual-specific advertising to children or
teens.--
``(A) In general.--The term `individual-specific
advertising to children or teens' means advertising or any
other effort to market a product or service that is directed
to a specific child or teen or a connected device that is
linked or reasonably linkable to a child or teen based on--
``(i) the personal information from--
``(I) the child or teen; or
``(II) a group of children or teens who are similar in sex,
age, household income level, race, or ethnicity to the
specific child or teen to whom the product or service is
marketed;
``(ii) profiling of a child or teen or group of children or
teens; or
``(iii) a unique identifier of the connected device.
``(B) Exclusions.--The term `individual-specific
advertising to children or teens' shall not include--
``(i) advertising or marketing to an individual or the
device of an individual in response to the individual's
specific request for information or feedback, such as a
child's or teen's current search query;
``(ii) contextual advertising, such as when an
advertisement is displayed based on the content of the
website, online service, online application, mobile
application, or connected device in which the advertisement
appears and does not vary based on personal information
related to the viewer; or
``(iii) processing personal information solely for
measuring or reporting advertising or content performance,
reach, or frequency, including independent measurement.
``(C) Rule of construction.--Nothing in subparagraph (A)
shall be construed to prohibit an operator with actual
knowledge or knowledge fairly implied on the basis of
objective circumstances that a user is under the age of 17
from delivering advertising or marketing that is age-
appropriate and intended for a child or teen audience, so
long as the operator does not use any personal information
other than whether the user is under the age of 17.''.
(b) Online Collection, Use, Disclosure, and Deletion of
Personal Information of Children and Teens.--Section 1303 of
the Children's Online Privacy Protection Act of 1998 (15
U.S.C. 6502) is amended--
(1) by striking the heading and inserting the following:
``online collection, use, disclosure, and deletion of
personal information of children and teens.'';
(2) in subsection (a)--
(A) by amending paragraph (1) to read as follows:
``(1) In general.--It is unlawful for an operator of a
website, online service, online application, or mobile
application directed to
[[Page S5382]]
children or for any operator of a website, online service,
online application, or mobile application with actual
knowledge or knowledge fairly implied on the basis of
objective circumstances that a user is a child or teen--
``(A) to collect personal information from a child or teen
in a manner that violates the regulations prescribed under
subsection (b);
``(B) except as provided in subparagraphs (B) and (C) of
section 1302(18), to collect, use, disclose to third parties,
or maintain personal information of a child or teen for
purposes of individual-specific advertising to children or
teens (or to allow another person to collect, use, disclose,
or maintain such information for such purpose);
``(C) to collect the personal information of a child or
teen except when the collection of the personal information
is--
``(i) consistent with the context of a particular
transaction or service or the relationship of the child or
teen with the operator, including collection necessary to
fulfill a transaction or provide a product or service
requested by the child or teen; or
``(ii) required or specifically authorized by Federal or
State law; or
``(D) to store or transfer the personal information of a
child or teen outside of the United States unless the
operator provides direct notice to the parent of the child,
in the case of a child, or to the teen, in the case of a
teen, that the child's or teen's personal information is
being stored or transferred outside of the United States; or
``(E) to retain the personal information of a child or teen
for longer than is reasonably necessary to fulfill a
transaction or provide a service requested by the child or
teen except as required or specifically authorized by Federal
or State law.''; and
(B) in paragraph (2)--
(i) in the header, by striking ``parent'' and inserting ``
`parent or teen' ''
(ii) by striking ``Notwithstanding paragraph (1)'' and
inserting ``Notwithstanding paragraph (1)(A)'';
(iii) by striking ``of such a website or online service'';
and
(iv) by striking ``subsection (b)(1)(B)(iii) to the parent
of a child'' and inserting ``subsection (b)(1)(B)(iv) to the
parent of a child or under subsection (b)(1)(C)(iv) to a
teen'';
(3) in subsection (b)--
(A) in paragraph (1)--
(i) in subparagraph (A)--
(I) by striking ``operator of any website'' and all that
follows through ``from a child'' and inserting ``operator of
a website, online service, online application, or mobile
application directed to children or that has actual knowledge
or knowledge fairly implied on the basis of objective
circumstances that a user is a child or teen'';
(II) in clause (i)--
(aa) by striking ``notice on the website'' and inserting
``clear and conspicuous notice on the website'';
(bb) by inserting ``or teens'' after ``children'';
(cc) by striking ``, and the operator's'' and inserting ``,
the operator's''; and
(dd) by striking ``; and'' and inserting ``, the rights and
opportunities available to the parent of the child or teen
under subparagraphs (B) and (C), and the procedures or
mechanisms the operator uses to ensure that personal
information is not collected from children or teens except in
accordance with the regulations promulgated under this
paragraph;'';
(III) in clause (ii)--
(aa) by striking ``parental'';
(bb) by inserting ``or teens'' after ``children'';
(cc) by striking the semicolon at the end and inserting ``;
and''; and
(IV) by inserting after clause (ii) the following new
clause:
``(iii) to obtain verifiable consent from a parent of a
child or from a teen before using or disclosing personal
information of the child or teen for any purpose that is a
material change from the original purposes and disclosure
practices specified to the parent of the child or the teen
under clause (i);'';
(ii) in subparagraph (B)--
(I) in the matter preceding clause (i), by striking
``website or online service'' and inserting ``operator'';
(II) in clause (i), by inserting ``and the method by which
the operator obtained the personal information, and the
purposes for which the operator collects, uses, discloses,
and retains the personal information'' before the semicolon;
(III) in clause (ii)--
(aa) by inserting ``to delete personal information
collected from the child or content or information submitted
by the child to a website, online service, online
application, or mobile application and'' after ``the
opportunity at any time''; and
(bb) by striking ``; and'' and inserting a semicolon;
(IV) by redesignating clause (iii) as clause (iv) and
inserting after clause (ii) the following new clause:
``(iii) the opportunity to challenge the accuracy of the
personal information and, if the parent of the child
establishes the inaccuracy of the personal information, to
have the inaccurate personal information corrected;''; and
(V) in clause (iv), as so redesignated, by inserting ``, if
such information is available to the operator at the time the
parent makes the request'' before the semicolon;
(iii) by redesignating subparagraphs (C) and (D) as
subparagraphs (D) and (E), respectively;
(iv) by inserting after subparagraph (B) the following new
subparagraph:
``(C) require the operator to provide, upon the request of
a teen under this subparagraph who has provided personal
information to the operator, upon proper identification of
that teen--
``(i) a description of the specific types of personal
information collected from the teen by the operator, the
method by which the operator obtained the personal
information, and the purposes for which the operator
collects, uses, discloses, and retains the personal
information;
``(ii) the opportunity at any time to delete personal
information collected from the teen or content or information
submitted by the teen to a website, online service, online
application, or mobile application and to refuse to permit
the operator's further use or maintenance in retrievable
form, or online collection, of personal information from the
teen;
``(iii) the opportunity to challenge the accuracy of the
personal information and, if the teen establishes the
inaccuracy of the personal information, to have the
inaccurate personal information corrected; and
``(iv) a means that is reasonable under the circumstances
for the teen to obtain any personal information collected
from the teen, if such information is available to the
operator at the time the teen makes the request;'';
(v) in subparagraph (D), as so redesignated--
(I) by striking ``a child's'' and inserting ``a child's or
teen's''; and
(II) by inserting ``or teen'' after ``the child''; and
(vi) by amending subparagraph (E), as so redesignated, to
read as follows:
``(E) require the operator to establish, implement, and
maintain reasonable security practices to protect the
confidentiality, integrity, and accessibility of personal
information of children or teens collected by the operator,
and to protect such personal information against unauthorized
access.'';
(B) in paragraph (2)--
(i) in the matter preceding subparagraph (A), by striking
``verifiable parental consent'' and inserting ``verifiable
consent'';
(ii) in subparagraph (A)--
(I) by inserting ``or teen'' after ``collected from a
child'';
(II) by inserting ``or teen'' after ``request from the
child''; and
(III) by inserting ``or teen or to contact another child or
teen'' after ``to recontact the child'';
(iii) in subparagraph (B)--
(I) by striking ``parent or child'' and inserting ``parent
or teen''; and
(II) by striking ``parental consent'' each place the term
appears and inserting ``verifiable consent'';
(iv) in subparagraph (C)--
(I) in the matter preceding clause (i), by inserting ``or
teen'' after ``child'' each place the term appears;
(II) in clause (i)--
(aa) by inserting ``or teen'' after ``child'' each place
the term appears; and
(bb) by inserting ``or teen, as applicable,'' after
``parent'' each place the term appears; and
(III) in clause (ii)--
(aa) by striking ``without notice to the parent'' and
inserting ``without notice to the parent or teen, as
applicable,''; and
(bb) by inserting ``or teen'' after ``child'' each place
the term appears; and
(v) in subparagraph (D)--
(I) in the matter preceding clause (i), by inserting ``or
teen'' after ``child'' each place the term appears;
(II) in clause (ii), by inserting ``or teen'' after
``child''; and
(III) in the flush text following clause (iii)--
(aa) by inserting ``or teen, as applicable,'' after
``parent'' each place the term appears; and
(bb) by inserting ``or teen'' after ``child'';
(C) by redesignating paragraph (3) as paragraph (4) and
inserting after paragraph (2) the following new paragraph:
``(3) Application to operators acting under agreements with
educational agencies or institutions.--The regulations may
provide that verifiable consent under paragraph (1)(A)(ii) is
not required for an operator that is acting under a written
agreement with an educational agency or institution (as
defined in section 444 of the General Education Provisions
Act (commonly known as the `Family Educational Rights and
Privacy Act of 1974') (20 U.S.C. 1232g(a)(3)) that, at a
minimum, requires the--
``(A) operator to--
``(i) limit its collection, use, and disclosure of the
personal information from a child or teen to solely
educational purposes and for no other commercial purposes;
``(ii) provide the educational agency or institution with a
notice of the specific types of personal information the
operator will collect from the child or teen, the method by
which the operator will obtain the personal information, and
the purposes for which the operator will collect, use,
disclose, and retain the personal information;
``(iii) provide the educational agency or institution with
a link to the operator's online notice of information
practices as required under subsection (b)(1)(A)(i); and
``(iv) provide the educational agency or institution, upon
request, with a means to review the personal information
collected from a child or teen, to prevent further use or
maintenance or future collection of personal information from
a child or teen, and to delete personal information collected
from a
[[Page S5383]]
child or teen or content or information submitted by a child
or teen to the operator's website, online service, online
application, or mobile application;
``(B) representative of the educational agency or
institution to acknowledge and agree that they have authority
to authorize the collection, use, and disclosure of personal
information from children or teens on behalf of the
educational agency or institution, along with such
authorization, their name, and title at the educational
agency or institution; and
``(C) educational agency or institution to--
``(i) provide on its website a notice that identifies the
operator with which it has entered into a written agreement
under this subsection and provides a link to the operator's
online notice of information practices as required under
paragraph (1)(A)(i);
``(ii) provide the operator's notice regarding its
information practices, as required under subparagraph
(A)(ii), upon request, to a parent, in the case of a child,
or a parent or teen, in the case of a teen; and
``(iii) upon the request of a parent, in the case of a
child, or a parent or teen, in the case of a teen, request
the operator provide a means to review the personal
information from the child or teen and provide the parent, in
the case of a child, or parent or teen, in the case of the
teen, a means to review the personal information.'';
(D) by amending paragraph (4), as so redesignated, to read
as follows:
``(4) Termination of service.--The regulations shall permit
the operator of a website, online service, online
application, or mobile application to terminate service
provided to a child whose parent has refused, or a teen who
has refused, under the regulations prescribed under
paragraphs (1)(B)(ii) and (1)(C)(ii), to permit the
operator's further use or maintenance in retrievable form, or
future online collection of, personal information from that
child or teen.''; and
(E) by adding at the end the following new paragraphs:
``(5) Continuation of service.--The regulations shall
prohibit an operator from discontinuing service provided to a
child or teen on the basis of a request by the parent of the
child or by the teen, under the regulations prescribed under
subparagraph (B) or (C) of paragraph (1), respectively, to
delete personal information collected from the child or teen,
to the extent that the operator is capable of providing such
service without such information.
``(6) Rule of construction.--A request made pursuant to
subparagraph (B) or (C) of paragraph (1) to delete or correct
personal information of a child or teen shall not be
construed--
``(A) to limit the authority of a law enforcement agency to
obtain any content or information from an operator pursuant
to a lawfully executed warrant or an order of a court of
competent jurisdiction;
``(B) to require an operator or third party delete or
correct information that--
``(i) any other provision of Federal or State law requires
the operator or third party to maintain; or
``(ii) was submitted to the website, online service, online
application, or mobile application of the operator by any
person other than the user who is attempting to erase or
otherwise eliminate the content or information, including
content or information submitted by the user that was
republished or resubmitted by another person; or
``(C) to prohibit an operator from--
``(i) retaining a record of the deletion request and the
minimum information necessary for the purposes of ensuring
compliance with a request made pursuant to subparagraph (B)
or (C);
``(ii) preventing, detecting, protecting against, or
responding to security incidents, identity theft, or fraud,
or reporting those responsible for such actions;
``(iii) protecting the integrity or security of a website,
online service, online application or mobile application; or
``(iv) ensuring that the child's or teen's information
remains deleted.
``(7) Common verifiable consent mechanism.--
``(A) In general.--
``(i) Feasibility of mechanism.--The Commission shall
assess the feasibility, with notice and public comment, of
allowing operators the option to use a common verifiable
consent mechanism that fully meets the requirements of this
title.
``(ii) Requirements.--The feasibility assessment described
in clause (i) shall consider whether a single operator could
use a common verifiable consent mechanism to obtain
verifiable consent, as required under this title, from a
parent of a child or from a teen on behalf of multiple,
listed operators that provide a joint or related service.
``(B) Report.--Not later than 1 year after the date of
enactment of this paragraph, the Commission shall submit a
report to the Committee on Commerce, Science, and
Transportation of the Senate and the Committee on Energy and
Commerce of the House of Representatives with the findings of
the assessment required by subparagraph (A).
``(C) Regulations.--If the Commission finds that the use of
a common verifiable consent mechanism is feasible and would
meet the requirements of this title, the Commission shall
issue regulations to permit the use of a common verifiable
consent mechanism in accordance with the findings outlined in
such report.'';
(4) in subsection (c), by striking ``a regulation
prescribed under subsection (a)'' and inserting
``subparagraph (B), (C), (D), or (E) of subsection (a)(1), or
of a regulation prescribed under subsection (b),''; and
(5) by striking subsection (d) and inserting the following:
``(d) Relationship to State Law.--The provisions of this
title shall preempt any State law, rule, or regulation only
to the extent that such State law, rule, or regulation
conflicts with a provision of this title. Nothing in this
title shall be construed to prohibit any State from enacting
a law, rule, or regulation that provides greater protection
to children or teens than the provisions of this title.''.
(c) Safe Harbors.--Section 1304 of the Children's Online
Privacy Protection Act of 1998 (15 U.S.C. 6503) is amended--
(1) in subsection (b)(1), by inserting ``and teens'' after
``children''; and
(2) by adding at the end the following:
``(d) Publication.--
``(1) In general.--Subject to the restrictions described in
paragraph (2), the Commission shall publish on the internet
website of the Commission any report or documentation
required by regulation to be submitted to the Commission to
carry out this section.
``(2) Restrictions on publication.--The restrictions
described in section 6(f) and section 21 of the Federal Trade
Commission Act (15 U.S.C. 46(f), 57b-2) applicable to the
disclosure of information obtained by the Commission shall
apply in same manner to the disclosure under this subsection
of information obtained by the Commission from a report or
documentation described in paragraph (1).''.
(d) Actions by States.--Section 1305 of the Children's
Online Privacy Protection Act of 1998 (15 U.S.C. 6504) is
amended--
(1) in subsection (a)(1)--
(A) in the matter preceding subparagraph (A), by inserting
``section 1303(a)(1) or'' before ``any regulation''; and
(B) in subparagraph (B), by inserting ``section 1303(a)(1)
or'' before ``the regulation''; and
(2) in subsection (d)--
(A) by inserting ``section 1303(a)(1) or'' before ``any
regulation''; and
(B) by inserting ``section 1303(a)(1) or'' before ``that
regulation''.
(e) Administration and Applicability of Act.--Section 1306
of the Children's Online Privacy Protection Act of 1998 (15
U.S.C. 6505) is amended--
(1) in subsection (b)--
(A) in paragraph (1), by striking ``, in the case of'' and
all that follows through ``the Board of Directors of the
Federal Deposit Insurance Corporation;'' and inserting the
following: ``by the appropriate Federal banking agency, with
respect to any insured depository institution (as those terms
are defined in section 3 of that Act (12 U.S.C. 1813));'';
and
(B) by striking paragraph (2) and redesignating paragraphs
(3) through (6) as paragraphs (2) through (5), respectively;
(2) in subsection (d)--
(A) by inserting ``section 1303(a)(1) or'' before ``a
rule''; and
(B) by striking ``such rule'' and inserting ``section
1303(a)(1) or a rule of the Commission under section 1303'';
and
(3) by adding at the end the following new subsections:
``(f) Determination of Whether an Operator Has Knowledge
Fairly Implied on the Basis of Objective Circumstances.--
``(1) Rule of construction.--For purposes of enforcing this
title or a regulation promulgated under this title, in making
a determination as to whether an operator has knowledge
fairly implied on the basis of objective circumstances that a
specific user is a child or teen, the Commission or State
attorneys general shall rely on competent and reliable
evidence, taking into account the totality of the
circumstances, including whether a reasonable and prudent
person under the circumstances would have known that the user
is a child or teen. Nothing in this title, including a
determination described in the preceding sentence, shall be
construed to require an operator to--
``(A) affirmatively collect any personal information with
respect to the age of a child or teen that an operator is not
already collecting in the normal course of business; or
``(B) implement an age gating or age verification
functionality.
``(2) Commission guidance.--
``(A) In general.--Within 180 days of enactment, the
Commission shall issue guidance to provide information,
including best practices and examples for operators to
understand the Commission's determination of whether an
operator has knowledge fairly implied on the basis of
objective circumstances that a user is a child or teen.
``(B) Limitation.--No guidance issued by the Commission
with respect to this title shall confer any rights on any
person, State, or locality, nor shall operate to bind the
Commission or any person to the approach recommended in such
guidance. In any enforcement action brought pursuant to this
title, the Commission or State attorney general, as
applicable, shall allege a specific violation of a provision
of this title. The Commission or State attorney general, as
applicable, may not base an enforcement action on, or execute
a consent order based on, practices that are alleged to be
inconsistent with any such guidance, unless the practices
allegedly violate this title. For purposes of
[[Page S5384]]
enforcing this title or a regulation promulgated under this
title, State attorneys general shall take into account any
guidance issued by the Commission under subparagraph (A).
``(g) Additional Requirement.--Any regulations issued under
this title shall include a description and analysis of the
impact of proposed and final Rules on small entities per the
Regulatory Flexibility Act of 1980 (5 U.S.C. 601 et seq.).''.
SEC. 202. STUDY AND REPORTS OF MOBILE AND ONLINE APPLICATION
OVERSIGHT AND ENFORCEMENT.
(a) Oversight Report.--Not later than 3 years after the
date of enactment of this Act, the Federal Trade Commission
shall submit to the Committee on Commerce, Science, and
Transportation of the Senate and the Committee on Energy and
Commerce of the House of Representatives a report on the
processes of platforms that offer mobile and online
applications for ensuring that, of those applications that
are websites, online services, online applications, or mobile
applications directed to children, the applications operate
in accordance with--
(1) this title, the amendments made by this title, and
rules promulgated under this title; and
(2) rules promulgated by the Commission under section 18 of
the Federal Trade Commission Act (15 U.S.C. 57a) relating to
unfair or deceptive acts or practices in marketing.
(b) Enforcement Report.--Not later than 1 year after the
date of enactment of this Act, and each year thereafter, the
Federal Trade Commission shall submit to the Committee on
Commerce, Science, and Transportation of the Senate and the
Committee on Energy and Commerce of the House of
Representatives a report that addresses, at a minimum--
(1) the number of actions brought by the Commission during
the reporting year to enforce the Children's Online Privacy
Protection Act of 1998 (15 U.S.C. 6501) (referred to in this
subsection as the ``Act'') and the outcome of each such
action;
(2) the total number of investigations or inquiries into
potential violations of the Act; during the reporting year;
(3) the total number of open investigations or inquiries
into potential violations of the Act as of the time the
report is submitted;
(4) the number and nature of complaints received by the
Commission relating to an allegation of a violation of the
Act during the reporting year; and
(5) policy or legislative recommendations to strengthen
online protections for children and teens.
SEC. 203. GAO STUDY.
(a) Study.--The Comptroller General of the United States
(in this section referred to as the ``Comptroller General'')
shall conduct a study on the privacy of teens who use
financial technology products. Such study shall--
(1) identify the type of financial technology products that
teens are using;
(2) identify the potential risks to teens' privacy from
using such financial technology products; and
(3) determine whether existing laws are sufficient to
address such risks to teens' privacy.
(b) Report.--Not later than 1 year after the date of
enactment of this section, the Comptroller General shall
submit to Congress a report containing the results of the
study conducted under subsection (a), together with
recommendations for such legislation and administrative
action as the Comptroller General determines appropriate.
SEC. 204. SEVERABILITY.
If any provision of this title, or an amendment made by
this title, is determined to be unenforceable or invalid, the
remaining provisions of this title and the amendments made by
this title shall not be affected.
TITLE III--ELIMINATING USELESS REPORTS
SEC. 301. SUNSETS FOR AGENCY REPORTS.
(a) In General.--Section 1125 of title 31, United States
Code, is amended--
(1) by redesignating subsection (c) as subsection (d);
(2) by striking subsections (a) and (b) and inserting the
following:
``(a) Definitions.--In this section:
``(1) Budget justification materials.--The term `budget
justification materials' has the meaning given the term in
section 3(b)(2) of the Federal Funding Accountability and
Transparency Act of 2006 (31 U.S.C. 6101 note; Public Law
109-282).
``(2) Plan or report.--The term `plan or report' means any
plan or report submitted to Congress, any committee of
Congress, or subcommittee thereof, by not less than 1
agency--
``(A) in accordance with Federal law; or
``(B) at the direction or request of a congressional
report.
``(3) Recurring plan or report.--The term `recurring plan
or report' means a plan or report submitted on a recurring
basis.
``(4) Relevant congressional committee.--The term `relevant
congressional committee'--
``(A) means a congressional committee to which a recurring
plan or report is required to be submitted; and
``(B) does not include any plan or report that is required
to be submitted solely to the Committee on Armed Services of
the House of Representatives or the Senate.
``(b) Agency Identification of Unnecessary Reports.--
``(1) In general.--The head of each agency shall include in
the budget justification materials of the agency the
following:
``(A) Subject to paragraphs (2) and (3), the following:
``(i) A list of each recurring plan or report submitted by
the agency.
``(ii) An identification of whether the recurring plan or
report listed in clause (i) was included in the most recent
report issued by the Clerk of the House of Representatives
concerning the reports that any agency is required by law or
directed or requested by a committee report to make to
Congress, any committee of Congress, or subcommittee thereof.
``(iii) If applicable, the unique alphanumeric identifier
for the recurring plan or report as required by section
7243(b)(1)(C)(vii) of the James M. Inhofe National Defense
Authorization Act for Fiscal Year 2023 (Public Law 117-263).
``(iv) The identification of any recurring plan or report
the head of the agency determines to be outdated or
duplicative.
``(B) With respect to each recurring plan or report
identified in subparagraph (A)(iv), the following:
``(i) A recommendation on whether to sunset, modify,
consolidate, or reduce the frequency of the submission of the
recurring plan or report.
``(ii) A citation to each provision of law or directive or
request in a congressional report that requires or requests
the submission of the recurring plan or report.
``(iii) A list of the relevant congressional committees for
the recurring plan or report.
``(C) A justification explaining, with respect to each
recommendation described in subparagraph (B)(i) relating to a
recurring plan or report--
``(i) why the head of the agency made the recommendation,
which may include an estimate of the resources expended by
the agency to prepare and submit the recurring plan or
report; and
``(ii) the understanding of the head of the agency of the
purpose of the recurring plan or report.
``(2) Agency consultation.--
``(A) In general.--In preparing the list required under
paragraph (1)(A), if, in submitting a recurring plan or
report, an agency is required to coordinate or consult with
another agency or entity, the head of the agency submitting
the recurring plan or report shall consult with the head of
each agency or entity with whom consultation or coordination
is required.
``(B) Inclusion in list.--If, after a consultation under
subparagraph (A), the head of each agency or entity consulted
under that subparagraph agrees that a recurring plan or
report is outdated or duplicative, the head of the agency
required to submit the recurring plan or report shall--
``(i) include the recurring plan or report in the list
described in paragraph (1)(A); and
``(ii) identify each agency or entity with which the head
of the agency is required to coordinate or consult in
submitting the recurring plan or report.
``(C) Disagreement.--If the head of any agency or entity
consulted under subparagraph (A) does not agree that a
recurring plan or report is outdated or duplicative, the head
of the agency required to submit the recurring plan or report
shall not include the recurring plan or report in the list
described in paragraph (1)(A).
``(3) Government-wide or multi-agency plan and report
submissions.--With respect to a recurring plan or report
required to be submitted by not less than 2 agencies, the
Director of the Office of Management and Budget shall--
``(A) determine whether the requirement to submit the
recurring plan or report is outdated or duplicative; and
``(B) make recommendations to Congress accordingly.
``(4) Plan and report submissions conformity to the access
to congressionally mandated reports act.--With respect to an
agency recommendation, citation, or justification made under
subparagraph (B) or (C) of paragraph (1) or a recommendation
by the Director of the Office of Management and Budget under
paragraph (3), the agency or Director, as applicable, shall
also provide this information to the Director of the
Government Publishing Office in conformity with the agency
submission requirements under section 7244(a) of the James M.
Inhofe National Defense Authorization Act for Fiscal Year
2023 (Public Law 117-263; chapter 41 of title 44 note) in
conformity with guidance issued by the Director of the Office
of Management and Budget under section 7244(b) of such Act.
``(c) Rule of Construction on Agency Requirements.--Nothing
in this section shall be construed to exempt the head of an
agency from a requirement to submit a recurring plan or
report.''; and
(3) in subsection (d), as so redesignated, by striking ``in
the budget of the United States Government, as provided by
section 1105(a)(37)'' and inserting ``in the budget
justification materials of each agency''.
(b) Budget Contents.--Section 1105(a) of title 31, United
States Code, is amended by striking paragraph (39).
(c) Conformity to the Access to Congressionally Mandated
Reports Act.--
(1) Amendment.--Subsections (a) and (b) of section 7244 of
the James M. Inhofe National Defense Authorization Act for
Fiscal Year 2023 (Public Law 117-263; chapter 41 of title 44,
United States Code, note), are amended to read as follows:
[[Page S5385]]
``(a) Submission of Electronic Copies of Reports.--Not
earlier than 30 days or later than 60 days after the date on
which a congressionally mandated report is submitted to
either House of Congress or to any committee of Congress or
subcommittee thereof, the head of the Federal agency
submitting the congressionally mandated report shall submit
to the Director the information required under subparagraphs
(A) through (D) of section 7243(b)(1) with respect to the
congressionally mandated report. Notwithstanding section
7246, nothing in this subtitle shall relieve a Federal agency
of any other requirement to publish the congressionally
mandated report on the online portal of the Federal agency or
otherwise submit the congressionally mandated report to
Congress or specific committees of Congress, or subcommittees
thereof.
``(b) Guidance.--Not later than 180 days after the date of
the enactment of this subsection and periodically thereafter
as appropriate, the Director of the Office of Management and
Budget, in consultation with the Director, shall issue
guidance to agencies on the implementation of this subtitle
as well as the requirements of section 1125(b) of title 31,
United States Code.''.
(2) Updated omb guidance.--Not later than 180 days after
the date of the enactment of this Act, the Director of the
Office of Management and Budget shall issue updated guidance
to agencies to ensure that the requirements under subsections
(a) and (b) of section 1125 of title 31, United States Code,
as amended by this Act, for agency submissions of
recommendations and justifications for plans and reports to
sunset, modify, consolidate, or reduce the frequency of the
submission of are also submitted as a separate attachment in
conformity with the agency submission requirements of
electronic copies of reports submitted by agencies under
section 7244(a) of the James M. Inhofe National Defense
Authorization Act for Fiscal Year 2023 (Public Law 117-263;
chapter 41 of title 44, United States Code, note) for
publication on the online portal established under section
7243 of such Act.
TITLE IV--SCREEN ACT
SEC. 401. SHORT TITLE.
This title may be cited as the ``Shielding Children's
Retinas from Egregious Exposure on the Net Act'' or the
``SCREEN Act''.
SEC. 402. FINDINGS; SENSE OF CONGRESS.
(a) Findings.--Congress finds the following:
(1) Over the 3 decades preceding the date of enactment of
this Act, Congress has passed several bills to protect minors
from access to online pornographic content, including title V
of the Telecommunications Act of 1996 (Public Law 104-104)
(commonly known as the ``Communications Decency Act''),
section 231 of the Communications Act of 1934 (47 U.S.C. 231)
(commonly known as the ``Child Online Protection Act''), and
the Children's Internet Protection Act (title XVII of
division B of Public Law 106-554).
(2) With the exception of the Children's Internet
Protection Act (title XVII of division B of Public Law 106-
554), the Supreme Court of the United States has struck down
the previous efforts of Congress to shield children from
pornographic content, finding that such legislation
constituted a ``compelling government interest'' but that it
was not the least restrictive means to achieve such interest.
In Ashcroft v. ACLU, 542 U.S. 656 (2004), the Court even
suggested at the time that ``blocking and filtering
software'' could conceivably be a ``primary alternative'' to
the requirements passed by Congress.
(3) In the nearly 2 decades since the Supreme Court of the
United States suggested the use of ``blocking and filtering
software'', such technology has proven to be ineffective in
protecting minors from accessing online pornographic content.
The Kaiser Family Foundation has found that filters do not
work on 1 in 10 pornography sites accessed intentionally and
1 in 3 pornography sites that are accessed unintentionally.
Further, it has been proven that children are able to bypass
``blocking and filtering'' software by employing strategic
searches or measures to bypass the software completely.
(4) Additionally, Pew Research has revealed studies showing
that only 39 percent of parents use blocking or filtering
software for their minor's online activities, meaning that 61
percent of children only have restrictions on their internet
access when they are at school or at a library.
(5) 17 States have now recognized pornography as a public
health hazard that leads to a broad range of individual
harms, societal harms, and public health impacts.
(6) It is estimated that 80 percent of minors between the
ages of 12 to 17 have been exposed to pornography, with 54
percent of teenagers seeking it out. The internet is the most
common source for minors to access pornography with
pornographic websites receiving more web traffic in the
United States than Twitter, Netflix, Pinterest, and LinkedIn
combined.
(7) Exposure to online pornography has created unique
psychological effects for minors, including anxiety,
addiction, low self-esteem, body image disorders, an increase
in problematic sexual activity at younger ages, and an
increased desire among minors to engage in risky sexual
behavior.
(8) The Supreme Court of the United States has recognized
on multiple occasions that Congress has a ``compelling
government interest'' to protect the physical and
psychological well-being of minors, which includes shielding
them from ``indecent'' content that may not necessarily be
considered ``obscene'' by adult standards.
(9) Because ``blocking and filtering software'' has not
produced the results envisioned nearly 2 decades ago, it is
necessary for Congress to pursue alternative policies to
enable the protection of the physical and psychological well-
being of minors.
(10) The evolution of our technology has now enabled the
use of age verification technology that is cost efficient,
not unduly burdensome, and can be operated narrowly in a
manner that ensures only adults have access to a website's
online pornographic content.
(b) Sense of Congress.--It is the sense of Congress that--
(1) shielding minors from access to online pornographic
content is a compelling government interest that protects the
physical and psychological well-being of minors; and
(2) requiring interactive computer services that are in the
business of creating, hosting, or making available
pornographic content to enact technological measures that
shield minors from accessing pornographic content on their
platforms is the least restrictive means for Congress to
achieve its compelling government interest.
SEC. 403. DEFINITIONS.
In this title:
(1) Child pornography; minor.--The terms ``child
pornography'' and ``minor'' have the meanings given those
terms in section 2256 of title 18, United States Code.
(2) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(3) Covered platform.--The term ``covered platform''--
(A) means an entity--
(i) that is an interactive computer service;
(ii) that--
(I) is engaged in interstate or foreign commerce; or
(II) purposefully avails itself of the United States market
or a portion thereof; and
(iii) for which it is in the regular course of the trade or
business of the entity to create, host, or make available
content that meets the definition of harmful to minors under
paragraph (4) and that is provided by the entity, a user, or
other information content provider, with the objective of
earning a profit; and
(B) includes an entity described in subparagraph (A)
regardless of whether--
(i) the entity earns a profit on the activities described
in subparagraph (A)(iii); or
(ii) creating, hosting, or making available content that
meets the definition of harmful to minors under paragraph (4)
is the sole source of income or principal business of the
entity.
(4) Harmful to minors.--The term ``harmful to minors'',
with respect to a picture, image, graphic image file, film,
videotape, or other visual depiction, means that the picture,
image, graphic image file, film, videotape, or other
depiction--
(A)(i) taken as a whole and with respect to minors, appeals
to the prurient interest in nudity, sex, or excretion;
(ii) depicts, describes, or represents, in a patently
offensive way with respect to what is suitable for minors, an
actual or simulated sexual act or sexual contact, actual or
simulated normal or perverted sexual acts, or lewd exhibition
of the genitals; and
(iii) taken as a whole, lacks serious, literary, artistic,
political, or scientific value as to minors;
(B) is obscene; or
(C) is child pornography.
(5) Information content provider; interactive computer
service.--The terms ``information content provider'' and
``interactive computer service'' have the meanings given
those terms in section 230(f) of the Communications Act of
1934 (47 U.S.C. 230(f)).
(6) Sexual act; sexual contact.--The terms ``sexual act''
and ``sexual contact'' have the meanings given those terms in
section 2246 of title 18, United States Code.
(7) Technology verification measure.--The term ``technology
verification measure'' means technology that--
(A) employs a system or process to determine whether it is
more likely than not that a user of a covered platform is a
minor; and
(B) prevents access by minors to any content on a covered
platform.
(8) Technology verification measure data.--The term
``technology verification measure data'' means information
that--
(A) identifies, is linked to, or is reasonably linkable to
an individual or a device that identifies, is linked to, or
is reasonably linkable to an individual;
(B) is collected or processed for the purpose of fulfilling
a request by an individual to access any content on a covered
platform; and
(C) is collected and processed solely for the purpose of
utilizing a technology verification measure and meeting the
obligations imposed under this title.
SEC. 404. TECHNOLOGY VERIFICATION MEASURES.
(a) Covered Platform Requirements.--Beginning on the date
that is 1 year after the date of enactment of this Act, a
covered platform shall adopt and utilize technology
verification measures on the platform to ensure that--
(1) users of the covered platform are not minors; and
(2) minors are prevented from accessing any content on the
covered platform that is harmful to minors.
(b) Requirements for Age Verification Measures.--In order
to comply with the requirement of subsection (a), the
technology
[[Page S5386]]
verification measures adopted and utilized by a covered
platform shall do the following:
(1) Use a technology verification measure in order to
verify a user's age.
(2) Provide that requiring a user to confirm that the user
is not a minor shall not be sufficient to satisfy the
requirement of subsection (a).
(3) Make publicly available the verification process that
the covered platform is employing to comply with the
requirements under this title.
(4) Subject the Internet Protocol (IP) addresses, including
known virtual proxy network IP addresses, of all users of a
covered platform to the technology verification measure
described in paragraph (1) unless the covered platform
determines based on available technology that a user is not
located within the United States.
(c) Choice of Verification Measures.--A covered platform
may choose the specific technology verification measures to
employ for purposes of complying with subsection (a),
provided that the technology verification measure employed by
the covered platform meets the requirements of subsection (b)
and prohibits a minor from accessing the platform or any
information on the platform that is obscene, child
pornography, or harmful to minors.
(d) Use of Third Parties.--A covered platform may contract
with a third party to employ technology verification measures
for purposes of complying with subsection (a) but the use of
such a third party shall not relieve the covered platform of
its obligations under this title or from liability under this
title.
(e) Rule of Construction.--Nothing in this section shall be
construed to require a covered platform to submit to the
Commission any information that identifies, is linked to, or
is reasonably linkable to a user of the covered platform or a
device that identifies, is linked to, or is reasonably
linkable to a user of the covered platform.
(f) Technology Verification Measure Data Security.--A
covered platform shall--
(1) establish, implement, and maintain reasonable data
security to--
(A) protect the confidentiality, integrity, and
accessibility of technology verification measure data
collected by the covered platform or a third party employed
by the covered platform; and
(B) protect such technology verification measure data
against unauthorized access; and
(2) retain the technology verification measure data for no
longer than is reasonably necessary to utilize a technology
verification measure or what is minimally necessary to
demonstrate compliance with the obligations under this title.
SEC. 405. CONSULTATION REQUIREMENTS.
In enforcing the requirements under section 404, the
Commission shall consult with the following individuals,
including with respect to the applicable standards and
metrics for making a determination on whether a user of a
covered platform is not a minor:
(1) Individuals with experience in computer science and
software engineering.
(2) Individuals with experience in--
(A) advocating for online child safety; or
(B) providing services to minors who have been victimized
by online child exploitation.
(3) Individuals with experience in consumer protection and
online privacy.
(4) Individuals who supply technology verification measure
products or have expertise in technology verification measure
solutions.
(5) Individuals with experience in data security and
cryptography.
SEC. 406. COMMISSION REQUIREMENTS.
(a) In General.--The Commission shall--
(1) conduct regular audits of covered platforms to ensure
compliance with the requirements of section 404;
(2) make public the terms and processes for the audits
conducted under paragraph (1), including the processes for
any third party conducting an audit on behalf of the
Commission;
(3) establish a process for each covered platform to submit
only such documents or other materials as are necessary for
the Commission to ensure full compliance with the
requirements of section 404 when conducting audits under this
section; and
(4) prescribe the appropriate documents, materials, or
other measures required to demonstrate full compliance with
the requirements of section 404.
(b) Guidance.--
(1) In general.--Not later than 180 days after the date of
enactment of this Act, the Commission shall issue guidance to
assist covered platforms in complying with the requirements
of section 404.
(2) Limitations on guidance.--No guidance issued by the
Commission with respect to this title shall confer any rights
on any person, State, or locality, nor shall operate to bind
the Commission or any person to the approach recommended in
such guidance. In any enforcement action brought pursuant to
this title, the Commission shall allege a specific violation
of a provision of this title. The Commission may not base an
enforcement action on, or execute a consent order based on,
practices that are alleged to be inconsistent with any such
guidelines, unless the practices allegedly violate a
provision of this title.
SEC. 407. ENFORCEMENT.
(a) Unfair or Deceptive Act or Practice.--A violation of
section 404 shall be treated as a violation of a rule
defining an unfair or deceptive act or practice under section
18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C.
57a(a)(1)(B)).
(b) Powers of the Commission.--
(1) In general.--The Commission shall enforce section 404
in the same manner, by the same means, and with the same
jurisdiction, powers, and duties as though all applicable
terms and provisions of the Federal Trade Commission Act (15
U.S.C. 41 et seq.) were incorporated into and made a part of
this title.
(2) Privileges and immunities.--Any person who violates
section 404 shall be subject to the penalties and entitled to
the privileges and immunities provided in the Federal Trade
Commission Act (15 U.S.C. 41 et seq.).
(3) Authority preserved.--Nothing in this title shall be
construed to limit the authority of the Commission under any
other provision of law.
SEC. 408. GAO REPORT.
Not later than 2 years after the date on which covered
platforms are required to comply with the requirement of
section 404(a), the Comptroller General of the United States
shall submit to Congress a report that includes--
(1) an analysis of the effectiveness of the technology
verification measures required under such section;
(2) an analysis of rates of compliance with such section
among covered platforms;
(3) an analysis of the data security measures used by
covered platforms in the age verification process;
(4) an analysis of the behavioral, economic, psychological,
and societal effects of implementing technology verification
measures;
(5) recommendations to the Commission on improving
enforcement of section 404(a), if any; and
(6) recommendations to Congress on potential legislative
improvements to this title, if any.
SEC. 409. SEVERABILITY CLAUSE.
If any provision of this Act, or the application of such a
provision to any person or circumstance, is held to be
unconstitutional, the remaining provisions of this Act, and
the application of such provisions to any other person or
circumstance, shall not be affected thereby.
______