[Congressional Record Volume 172, Number 42 (Thursday, March 5, 2026)]
[Senate]
[Pages S860-S869]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]
CHILDREN AND TEENS' ONLINE PRIVACY PROTECTION ACT
Mr. MARKEY. Mr. President, in a moment, I will ask unanimous consent
that the Senate pass the Children and Teens' Online Privacy Protection
Act, or COPPA 2.0, bipartisan legislation that would finally update our
children's online privacy law for the modern internet age.
More than 25 years ago, I passed the original Children's Online
Privacy Protection Act. At that time, the internet looked very
different than it does today. Only birds tweeted 25 years ago. TikTok
was the sound that a clock made. But one thing that has not changed,
children and teens deserve privacy, they deserve safety, and they
deserve protection online.
Unfortunately, Big Tech's business model has evolved far faster than
our laws. Today, the largest online platforms collect enormous amounts
of personal data from the users, including from children and from
teenagers. That data fuels an advertising machine designed to keep
young people clicking, swiping, and scrolling for as long as possible.
These ads are big business for Big Tech. In 2022, the major Big Tech
platforms earned nearly $11 billion from U.S. users 17 and under. This
model has real consequences for the well-being of our young people--$11
billion.
And we are facing a youth mental health crisis in this country,
driven in part by social media platforms.
I have said these statistics on the floor before, but they bear
repeating. According to the Centers for Disease Control, one in four
teenage high school girls in the United States seriously considered
suicide in 2023.
At least one in eight high school girls in the United States in 2023
attempted suicide. Among LGBTQ+ youth, the number is more than one in
five who attempted suicide in 2023.
Congress has a responsibility to respond. COPPA 2.0 does exactly
that. It brings our children's privacy law into the 21st century and
gives young people and their families meaningful control over their
personal information.
First, COPPA 2.0 bans targeted advertising to children and teenagers.
The days of building detailed behavioral profiles on young people in
order to serve them manipulative, hyperpersonalized ads--that era must
come to an end. That is what we are talking about in this legislation
here today--ending that era in our country.
Second, the legislation creates an ``eraser'' button, allowing
children and teens and their parents to delete the personal data that
platforms have collected about them.
Third, COPPA 2.0, the Children's Online Privacy Protection Act 2.0,
establishes strong limits on the collection of personal information
from minors. If a platform, for example, does not need a child's or a
teen's data to provide the service, it should not be collecting that
data in the first place.
These are simple, commonsense protections, and they have broad
bipartisan support.
I am very, very proud to have worked over the last 3 years with my
friend Senator Cassidy from Louisiana on constructing this legislation
and moving it to the floor here today. He is a physician, and he is
someone who believes in preventive care. That is what this bill is
today. It just avoids much of the harm that otherwise will be imposed
upon teenagers and children in our country.
I also want to thank Chairman Cruz, Ranking Member Cantwell, and many
other Members in this body who have helped move this legislation
forward.
This effort has also been driven by parents, by advocates, by young
people themselves--families who have experienced firsthand the harms
that can result when online platforms prioritize profit over the safety
of children.
Passing COPPA 2.0 today would represent the single most significant
update to children's online privacy protections in a quarter of a
century. It is long overdue. We know there is a crisis, and it would
send a clear message that Congress is prepared to stand up to Big Tech
and put the interests of kids and families first.
I would be remiss if I did not note what is happening across the
Capitol
[[Page S861]]
today. Even as the Senate works in a bipartisan manner to strengthen
protections for children and teens online, the House Energy and
Commerce Committee is marking up a weaker partisan version of this
legislation. That proposal strips away key protections and undermines
the strong bipartisan compromise that Members of this Chamber have
worked for years to develop. The children in our country deserve better
than a watered-down privacy bill in this online era. For kids in our
country right now, online access is like oxygen for them. It is all
day. It is every day. Yet we haven't updated the safety protections in
25 years.
I urge my colleagues in the House to set aside partisan differences
and take up the Senate's bipartisan bill so that we can finally deliver
meaningful online privacy protections for children and teenagers across
our country. Young people and their families have waited long enough.
That is what we will be voting on right now.
With that, I yield to my partner and my friend in this effort, the
Senator from Louisiana, Senator Cassidy.
The PRESIDING OFFICER. The Senator from Louisiana.
Mr. CASSIDY. Mr. President, I thank Senator Markey.
Let me just point out that this continues Senator Markey's decades-
long work on protecting children in this sort of environment, work
which I have been privileged to join for the last couple of years.
Every parent should know that their child can go online without being
tracked, targeted, or taken advantage of.
Now every child, it seems, is using the internet for school, for
connections, and just to look things up, but they shouldn't have to pay
for that access with their personal information, particularly when the
child doesn't understand the value of their personal information. They
should not have their data collected, shared, or sold without their
knowledge and consent and without the knowledge and consent of their
parents.
That is why the Children and Teens' Online Privacy Protection Act,
COPPA 2.0, matters. It updates the rules for today's digital world and
places protections where they belong--around our children. This bill
gives families the confidence that their child can learn and connect
and explore online safely.
Again, I thank Senator Markey for his collaboration on this.
Mr. MARKEY. I thank my friend for his consistent support in
protecting teenagers and children in our country.
With that, Mr. President, I ask unanimous consent that the Senate
proceed to the immediate consideration of Calendar No. 304, S. 836.
The PRESIDING OFFICER. The clerk will report the bill by title.
The senior assistant legislative clerk read as follows:
A bill (S. 836) to amend the Children's Online Privacy
Protection Act of 1998 to strengthen protections relating to
the online collection, use, and disclosure of personal
information of children and teens, and for other purposes.
There being no objection, the Senate proceeded to consider the bill,
which had been reported from the Committee on Commerce, Science, and
Transportation, with amendments, as follows:
(The parts of the bill intended to be stricken are in boldfaced
brackets, and the parts of the bill intended to be inserted are in
italic.)
S. 836
Be it enacted by the Senate and House of Representatives of
the United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) Short Title.--This Act may be cited as the ``Children
and Teens' Online Privacy Protection Act''.
(b) Table of Contents.--The table of contents for this Act
is as follows:
Sec. 1. Short title; table of contents.
Sec. 2. Online collection, use, disclosure, and deletion of personal
information of children and teens.
Sec. 3. Study and reports of mobile and online application oversight
and enforcement.
Sec. 4. GAO study.
Sec. 5. Severability.
SEC. 2. ONLINE COLLECTION, USE, DISCLOSURE, AND DELETION OF
PERSONAL INFORMATION OF CHILDREN AND TEENS.
(a) Definitions.--Section 1302 of the Children's Online
Privacy Protection Act of 1998 (15 U.S.C. 6501) is amended--
(1) by amending paragraph (2) to read as follows:
``(2) Operator.--The term `operator'--
``(A) means any person--
``(i) who, for commercial purposes, in interstate or
foreign commerce operates or provides a website on the
internet, an online service, an online application, or a
mobile application; and
``(ii) who--
``(I) collects or maintains, either directly or through a
service provider, personal information from or about the
users of that website, service, or application;
``(II) allows another person to collect personal
information directly from users of that website, service, or
application (in which case, the operator is deemed to have
collected the information); or
``(III) allows users of that website, service, or
application to publicly disclose personal information (in
which case, the operator is deemed to have collected the
information); and
``(B) does not include any nonprofit entity that would
otherwise be exempt from coverage under section 5 of the
Federal Trade Commission Act (15 U.S.C. 45).'';
(2) in paragraph (4)--
(A) by amending subparagraph (A) to read as follows:
``(A) the release of personal information collected from a
child or teen by an operator for any purpose, except where
the personal information is provided to a person other than
an operator who--
``(i) provides support for the internal operations of the
website, online service, online application, or mobile
application of the operator, excluding any activity relating
to individual-specific advertising to children or teens; and
``(ii) does not disclose or use that personal information
for any other purpose; and''; and
(B) in subparagraph (B)--
(i) by inserting ``or teen'' after ``child'' each place the
term appears;
(ii) by striking ``website or online service'' and
inserting ``website, online service, online application, or
mobile application''; and
(iii) by striking ``actual knowledge'' and inserting
``actual knowledge or knowledge fairly implied on the basis
of objective circumstances'';
(3) by striking paragraph (8) and inserting the following:
``(8) Personal information.--
``(A) In general.--The term `personal information' means
individually identifiable information about an individual
collected online, including--
``(i) a first and last name;
``(ii) a home or other physical address including street
name and name of a city or town;
``(iii) an e-mail address;
``(iv) a telephone number;
``(v) a Social Security number;
``(vi) any other identifier that the Commission determines
permits the physical or online contacting of a specific
individual;
``(vii) a persistent identifier that can be used to
recognize a specific child or teen over time and across
different websites, online services, online applications, or
mobile applications, including but not limited to a customer
number held in a cookie, an Internet Protocol (IP) address, a
processor or device serial number, or unique device
identifier, but excluding an identifier that is used by an
operator solely for providing support for the internal
operations of the website, online service, online
application, or mobile application;
``(viii) a photograph, video, or audio file where such file
contains a specific child's or teen's image or voice;
``(ix) geolocation information;
``(x) information generated from the measurement or
technological processing of an individual's biological,
physical, or physiological characteristics that is used to
identify an individual, including--
``(I) fingerprints;
``(II) voice prints;
``(III) iris or retina imagery scans;
``(IV) facial templates;
``(V) deoxyribonucleic acid (DNA) information; or
``(VI) gait; or
``(xi) information linked or reasonably linkable to a child
or teen or the parents of that child or teen (including any
unique identifier) that an operator collects online from the
child or teen and combines with an identifier described in
this subparagraph.
``(B) Exclusion.--The term `personal information' shall not
include an audio file that contains a child's or teen's voice
so long as the operator--
``(i) does not request information via voice that would
otherwise be considered personal information under this
paragraph;
``(ii) provides clear notice of its collection and use of
the audio file and its deletion policy in its privacy policy;
``(iii) only uses the voice within the audio file solely as
a replacement for written words, to perform a task, or engage
with a website, online service, online application, or mobile
application, such as to perform a search or fulfill a verbal
instruction or request; and
``(iv) only maintains the audio file long enough to
complete the stated purpose and then immediately deletes the
audio file and does not make any other use of the audio file
prior to deletion.
``(C) Support for the internal operations of a website,
online service, online application, or mobile application.--
[[Page S862]]
``(i) In general.--For purposes of subparagraph (A)(vii),
the term `support for the internal operations of a website,
online service, online application, or mobile application'
means those activities necessary to--
``(I) maintain or analyze the functioning of the website,
online service, online application, or mobile application;
``(II) perform network communications;
``(III) authenticate users of, or personalize the content
on, the website, online service, online application, or
mobile application;
``(IV) serve contextual advertising, provided that any
persistent identifier is only used as necessary for technical
purposes to serve the contextual advertisement, or cap the
frequency of advertising;
``(V) protect the security or integrity of the user,
website, online service, online application, or mobile
application;
``(VI) ensure legal or regulatory compliance, or
``(VII) fulfill a request of a child or teen as permitted
by subparagraphs (A) through (C) of section 1303(b)(2).
``(ii) Condition.--Except as specifically permitted under
clause (i), information collected for the activities listed
in clause (i) cannot be used or disclosed to contact a
specific individual, including through individual-specific
advertising to children or teens, to amass a profile on a
specific individual, in connection with processes that
encourage or prompt use of a website or online service, or
for any other purpose.'';
(4) by amending paragraph (9) to read as follows:
``(9) Verifiable consent.--The term `verifiable consent'
means any reasonable effort (taking into consideration
available technology), including a request for authorization
for future collection, use, and disclosure described in the
notice, to ensure that, in the case of a child, a parent of
the child, or, in the case of a teen, the teen--
``(A) receives direct notice of the personal information
collection, use, and disclosure practices of the operator;
and
``(B) before the personal information of the child or teen
is collected, freely and unambiguously authorizes--
``(i) the collection, use, and disclosure, as applicable,
of that personal information; and
``(ii) any subsequent use of that personal information.'';
(5) in paragraph (10)--
(A) in the paragraph header, by striking ``Website or
online service directed to children'' and inserting
``Website, online service, online application, or mobile
application directed to children'';
(B) by striking ``website or online service'' each place it
appears and inserting ``website, online service, online
application, or mobile application''; and
(C) by adding at the end the following new subparagraph:
``(C) Rule of construction.--In considering whether a
website, online service, online application, or mobile
application, or portion thereof, is directed to children, the
Commission shall apply a totality of circumstances test and
will also consider competent and reliable empirical evidence
regarding audience composition and evidence regarding the
intended audience of the website, online service, online
application, or mobile application.''; and
(6) by adding at the end the following:
``(13) Connected device.--The term `connected device' means
a device that is capable of connecting to the internet,
directly or indirectly, or to another connected device.
``(14) Online application.--The term `online application'--
``(A) means an internet-connected software program; and
``(B) includes a service or application offered via a
connected device.
``(15) Mobile application.--The term `mobile application'--
``(A) means a software program that runs on the operating
system of--
``(i) a cellular telephone;
``(ii) a tablet computer; or
``(iii) a similar portable computing device that transmits
data over a wireless connection; and
``(B) includes a service or application offered via a
connected device.
``(16) Geolocation information.--The term `geolocation
information' means information sufficient to identify a
street name and name of a city or town.
``(17) Teen.--The term `teen' means an individual who has
attained age 13 and is under the age of 17.
``(18) Individual-specific advertising to children or
teens.--
``(A) In general.--The term `individual-specific
advertising to children or teens' means advertising or any
other effort to market a product or service that is directed
to a specific child or teen or a connected device that is
linked or reasonably linkable to a child or teen based on--
``(i) the personal information from--
``(I) the child or teen; or
``(II) a group of children or teens who are similar in sex,
age, household income level, race, or ethnicity to the
specific child or teen to whom the product or service is
marketed;
``(ii) profiling of a child or teen or group of children or
teens; or
``(iii) a unique identifier of the connected device.
``(B) Exclusions.--The term `individual-specific
advertising to children or teens' shall not include--
``(i) advertising or marketing to an individual or the
device of an individual in response to the individual's
specific request for information or feedback, such as a
child's or teen's current search query;
``(ii) contextual advertising, such as when an
advertisement is displayed based on the content of the
website, online service, online application, mobile
application, or connected device in which the advertisement
appears and does not vary based on personal information
related to the viewer; [or
``(iii) processing personal information solely for
measuring or reporting advertising or content performance,
reach, or frequency, including independent measurement.]
``(iii) processing personal information solely for
measuring or reporting advertising or content performance,
reach, or frequency, including independent measurement; or
``(iv) advertising or marketing directed to a connected
device used by both adult and child or teen members of a
household where such advertising or marketing is directed to
the profile of the adult user.
``(C) Rule of construction.--Nothing in subparagraph (A)
shall be construed to prohibit an operator with actual
knowledge or knowledge fairly implied on the basis of
objective circumstances that a user is under the age of 17
from delivering advertising or marketing that is age-
appropriate and intended for a child or teen audience, so
long as the operator does not use any personal information
other than whether the user is under the age of 17.
``(19) Educational agency or institution.--The term
`educational agency or institution' means--
``(A) a State educational agency or local educational
agency, as such terms are defined in section 8101 of the
Elementary and Secondary Education Act of 1965 (20 U.S.C.
7801); or
``(B) an institutional day or residential school, including
a public school (including a charter school) or private
school, that provides elementary or secondary education, as
determined under State law.''.
(b) Online Collection, Use, Disclosure, and Deletion of
Personal Information of Children and Teens.--Section 1303 of
the Children's Online Privacy Protection Act of 1998 (15
U.S.C. 6502) is amended--
(1) by striking the heading and inserting the following:
``online collection, use, disclosure, and deletion of
personal information of children and teens.'';
(2) in subsection (a)--
(A) by amending paragraph (1) to read as follows:
``(1) In general.--It is unlawful for an operator of a
website, online service, online application, or mobile
application directed to children or for any operator of a
website, online service, online application, or mobile
application with actual knowledge or knowledge fairly implied
on the basis of objective circumstances that a user is a
child or teen--
``(A) to collect personal information from a child or teen
in a manner that violates the regulations prescribed under
subsection (b);
``(B) except as provided in subparagraphs (B) and (C) of
section 1302(18), to collect, use, disclose to third parties,
or maintain personal information of a child or teen for
purposes of individual-specific advertising to children or
teens (or to allow another person to collect, use, disclose,
or maintain such information for such purpose);
``(C) to collect the personal information of a child or
teen except when the collection of the personal information
is--
``(i) consistent with the context of a particular
transaction or service or the relationship of the child or
teen with the operator, including collection necessary to
fulfill a transaction or provide a product or service
requested by the child or teen; or
``(ii) required or specifically authorized by Federal or
State law; or
``(D) to store or transfer the personal information of a
child or teen outside of the United States unless the
operator provides direct notice to the parent of the child,
in the case of a child, or to the teen, in the case of a
teen, that the child's or teen's personal information is
being stored or transferred outside of the United States; or
``(E) to retain the personal information of a child or teen
for longer than is reasonably necessary to fulfill a
transaction or provide a service requested by the child or
teen except as required or specifically authorized by Federal
or State law.''; and
(B) in paragraph (2)--
(i) in the header, by striking ``parent'' and inserting [``
`parent or teen' ''] ``parent or teen'';
(ii) by striking ``Notwithstanding paragraph (1)'' and
inserting ``Notwithstanding paragraph (1)(A)'';
(iii) by striking ``of such a website or online service'';
and
(iv) by striking ``subsection (b)(1)(B)(iii) to the parent
of a child'' and inserting ``subsection (b)(1)(B)(iv) to the
parent of a child or under subsection (b)(1)(C)(iv) to a
teen'';
(3) in subsection (b)--
(A) in paragraph (1)--
(i) in subparagraph (A)--
(I) by striking ``operator of any website'' and all that
follows through ``from a child'' and inserting ``operator of
a website, online service, online application, or mobile
application directed to children or that has actual knowledge
or knowledge fairly implied on the basis of objective
circumstances that a user is a child or teen'';
(II) in clause (i)--
[[Page S863]]
(aa) by striking ``notice on the website'' and inserting
``clear and conspicuous notice on the website'';
(bb) by inserting ``or teens'' after ``children'';
(cc) by striking ``, and the operator's'' and inserting ``,
the operator's''; and
(dd) by striking ``; and'' and inserting ``, the rights and
opportunities available to the parent of the child or teen
under subparagraphs (B) and (C), and the procedures or
mechanisms the operator uses to ensure that personal
information is not collected from children or teens except in
accordance with the regulations promulgated under this
paragraph;'';
(III) in clause (ii)--
(aa) by striking ``parental'';
(bb) by inserting ``or teens'' after ``children'';
(cc) by striking the semicolon at the end and inserting ``;
and''; and
(IV) by inserting after clause (ii) the following new
clause:
``(iii) to obtain verifiable consent from a parent of a
child or from a teen before using or disclosing personal
information of the child or teen for any purpose that is a
material change from the original purposes and disclosure
practices specified to the parent of the child or the teen
under clause (i);'';
(ii) in subparagraph (B)--
(I) in the matter preceding clause (i), by striking
``website or online service'' and inserting ``operator'';
(II) in clause (i), by inserting ``and the method by which
the operator obtained the personal information, and the
purposes for which the operator collects, uses, discloses,
and retains the personal information'' before the semicolon;
(III) in clause (ii)--
(aa) by inserting ``to delete personal information
collected from the child or content or information submitted
by the child to a website, online service, online
application, or mobile application and'' after ``the
opportunity at any time''; and
(bb) by striking ``; and'' and inserting a semicolon;
(IV) by redesignating clause (iii) as clause (iv) and
inserting after clause (ii) the following new clause:
``(iii) the opportunity to challenge the accuracy of the
personal information and, if the parent of the child
establishes the inaccuracy of the personal information, to
have the inaccurate personal information corrected;''; and
(V) in clause (iv), as so redesignated, by inserting ``, if
such information is available to the operator at the time the
parent makes the request'' before the semicolon;
(iii) by redesignating subparagraphs (C) and (D) as
subparagraphs (D) and (E), respectively;
(iv) by inserting after subparagraph (B) the following new
subparagraph:
``(C) require the operator to provide, upon the request of
a teen under this subparagraph who has provided personal
information to the operator, upon proper identification of
that teen--
``(i) a description of the specific types of personal
information collected from the teen by the operator, the
method by which the operator obtained the personal
information, and the purposes for which the operator
collects, uses, discloses, and retains the personal
information;
``(ii) the opportunity at any time to delete personal
information collected from the teen or content or information
submitted by the teen to a website, online service, online
application, or mobile application and to refuse to permit
the operator's further use or maintenance in retrievable
form, or online collection, of personal information from the
teen;
``(iii) the opportunity to challenge the accuracy of the
personal information and, if the teen establishes the
inaccuracy of the personal information, to have the
inaccurate personal information corrected; and
``(iv) a means that is reasonable under the circumstances
for the teen to obtain any personal information collected
from the teen, if such information is available to the
operator at the time the teen makes the request;'';
(v) in subparagraph (D), as so redesignated--
(I) by striking ``a child's'' and inserting ``a child's or
teen's''; and
(II) by inserting ``or teen'' after ``the child''; and
(vi) by amending subparagraph (E), as so redesignated, to
read as follows:
``(E) require the operator to establish, implement, and
maintain reasonable security practices to protect the
confidentiality, integrity, and accessibility of personal
information of children or teens collected by the operator,
and to protect such personal information against unauthorized
access.'';
(B) in paragraph (2)--
(i) in the matter preceding subparagraph (A), by striking
``verifiable parental consent'' and inserting ``verifiable
consent'';
(ii) in subparagraph (A)--
(I) by inserting ``or teen'' after ``collected from a
child'';
(II) by inserting ``or teen'' after ``request from the
child''; and
(III) by inserting ``or teen or to contact another child or
teen'' after ``to recontact the child'';
(iii) in subparagraph (B)--
(I) by striking ``parent or child'' and inserting ``parent
or teen''; and
(II) by striking ``parental consent'' each place the term
appears and inserting ``verifiable consent'';
(iv) in subparagraph (C)--
(I) in the matter preceding clause (i), by inserting ``or
teen'' after ``child'' each place the term appears;
(II) in clause (i)--
(aa) by inserting ``or teen'' after ``child'' each place
the term appears; and
(bb) by inserting ``or teen, as applicable,'' after
``parent'' each place the term appears; and
(III) in clause (ii)--
(aa) by striking ``without notice to the parent'' and
inserting ``without notice to the parent or teen, as
applicable,''; and
(bb) by inserting ``or teen'' after ``child'' each place
the term appears; and
(v) in subparagraph (D)--
(I) in the matter preceding clause (i), by inserting ``or
teen'' after ``child'' each place the term appears;
(II) in clause (ii), by inserting ``or teen'' after
``child''; and
(III) in the flush text following clause (iii)--
(aa) by inserting ``or teen, as applicable,'' after
``parent'' each place the term appears; and
(bb) by inserting ``or teen'' after ``child'';
(C) by redesignating paragraph (3) as paragraph (4) and
inserting after paragraph (2) the following new paragraph:
``(3) Application to operators acting under agreements with
educational agencies or institutions.--The regulations may
provide that verifiable consent under paragraph (1)(A)(ii) is
not required for an operator that is acting under a written
agreement with an educational agency or institution that, at
a minimum, requires the--
``(A) operator to--
``(i) limit its collection, use, and disclosure of the
personal information from a child or teen to solely
educational purposes and for no other commercial purposes;
``(ii) provide the educational agency or institution with a
notice of the specific types of personal information the
operator will collect from the child or teen, the method by
which the operator will obtain the personal information, and
the purposes for which the operator will collect, use,
disclose, and retain the personal information;
``(iii) provide the educational agency or institution with
a link to the operator's online notice of information
practices as required under subsection (b)(1)(A)(i); and
``(iv) provide the educational agency or institution, upon
request, with a means to review the personal information
collected from a child or teen, to prevent further use or
maintenance or future collection of personal information from
a child or teen, and to delete personal information collected
from a child or teen or content or information submitted by a
child or teen to the operator's website, online service,
online application, or mobile application;
``(B) representative of the educational agency or
institution to acknowledge and agree that they have authority
to authorize the collection, use, and disclosure of personal
information from children or teens on behalf of the
educational agency or institution, along with such
authorization, their name, and title at the educational
agency or institution; and
``(C) educational agency or institution to--
``(i) provide on its website a notice that identifies the
operator with which it has entered into a written agreement
under this subsection and provides a link to the operator's
online notice of information practices as required under
paragraph (1)(A)(i);
``(ii) provide the operator's notice regarding its
information practices, as required under subparagraph
(A)(ii), upon request, to a parent, in the case of a child,
or a parent or teen, in the case of a teen; and
``(iii) upon the request of a parent, in the case of a
child, or a parent or teen, in the case of a teen, request
the operator provide a means to review the personal
information from the child or teen and provide the parent, in
the case of a child, or parent or teen, in the case of the
teen, a means to review the personal information.'';
(D) by amending paragraph (4), as so redesignated, to read
as follows:
``(4) Termination of service.--The regulations shall permit
the operator of a website, online service, online
application, or mobile application to terminate service
provided to a child whose parent has refused, or a teen who
has refused, under the regulations prescribed under
paragraphs (1)(B)(ii) and (1)(C)(ii), to permit the
operator's further use or maintenance in retrievable form, or
future online collection of, personal information from that
child or teen.''; and
(E) by adding at the end the following new paragraphs:
``(5) Continuation of service.--The regulations shall
prohibit an operator from discontinuing service provided to a
child or teen on the basis of a request by the parent of the
child or by the teen, under the regulations prescribed under
subparagraph (B) or (C) of paragraph (1), respectively, to
delete personal information collected from the child or teen,
to the extent that the operator is capable of providing such
service without such information.
``(6) Rule of construction.--A request made pursuant to
subparagraph (B) or (C) of paragraph (1) to delete or correct
personal information of a child or teen shall not be
construed--
``(A) to limit the authority of a law enforcement agency to
obtain any content or information from an operator pursuant
to a lawfully executed warrant or an order of a court of
competent jurisdiction;
[[Page S864]]
``(B) to require an operator or third party delete or
correct information that--
``(i) any other provision of Federal or State law requires
the operator or third party to maintain; or
``(ii) was submitted to the website, online service, online
application, or mobile application of the operator by any
person other than the user who is attempting to erase or
otherwise eliminate the content or information, including
content or information submitted by the user that was
republished or resubmitted by another person; or
``(C) to prohibit an operator from--
``(i) retaining a record of the deletion request and the
minimum information necessary for the purposes of ensuring
compliance with a request made pursuant to subparagraph (B)
or (C);
``(ii) preventing, detecting, protecting against, or
responding to security incidents, identity theft, or fraud,
or reporting those responsible for such actions;
``(iii) protecting the integrity or security of a website,
online service, online application or mobile application; or
``(iv) ensuring that the child's or teen's information
remains deleted.
``(7) Common verifiable consent mechanism.--
``(A) In general.--
``(i) Feasibility of mechanism.--The Commission shall
assess the feasibility, with notice and public comment, of
allowing operators the option to use a common verifiable
consent mechanism that fully meets the requirements of this
title.
``(ii) Requirements.--The feasibility assessment described
in clause (i) shall consider whether a single operator could
use a common verifiable consent mechanism to obtain
verifiable consent, as required under this title, from a
parent of a child or from a teen on behalf of multiple,
listed operators that provide a joint or related service.
``(B) Report.--Not later than 1 year after the date of
enactment of this paragraph, the Commission shall submit a
report to the Committee on Commerce, Science, and
Transportation of the Senate and the Committee on Energy and
Commerce of the House of Representatives with the findings of
the assessment required by subparagraph (A).
``(C) Regulations.--If the Commission finds that the use of
a common verifiable consent mechanism is feasible and would
meet the requirements of this title, the Commission shall
issue regulations to permit the use of a common verifiable
consent mechanism in accordance with the findings outlined in
such report.'';
(4) in subsection (c), by striking ``a regulation
prescribed under subsection (a)'' and inserting
``subparagraph (B), (C), (D), or (E) of subsection (a)(1), or
of a regulation prescribed under subsection (b),''; and
(5) by striking subsection (d) and inserting the following:
``(d) Relationship to State Law.--The provisions of this
title shall preempt any State law, rule, or regulation only
to the extent that such State law, rule, or regulation
conflicts with a provision of this title. Nothing in this
title shall be construed to prohibit any State from enacting
a law, rule, or regulation that provides greater protection
to children or teens than the provisions of this title.''.
(c) Safe Harbors.--Section 1304 of the Children's Online
Privacy Protection Act of 1998 (15 U.S.C. 6503) is amended--
(1) in subsection (b)(1), by inserting ``and teens'' after
``children''; and
(2) by adding at the end the following:
``(d) Publication.--
``(1) In general.--Subject to the restrictions described in
paragraph (2), the Commission shall publish on the internet
website of the Commission any report or documentation
required by regulation to be submitted to the Commission to
carry out this section.
``(2) Restrictions on publication.--The restrictions
described in section 6(f) and section 21 of the Federal Trade
Commission Act (15 U.S.C. 46(f), 57b-2) applicable to the
disclosure of information obtained by the Commission shall
apply in same manner to the disclosure under this subsection
of information obtained by the Commission from a report or
documentation described in paragraph (1).''.
(d) Actions by States.--Section 1305 of the Children's
Online Privacy Protection Act of 1998 (15 U.S.C. 6504) is
amended--
(1) in subsection (a)(1)--
(A) in the matter preceding subparagraph (A), by inserting
``section 1303(a)(1) or'' before ``any regulation''; and
(B) in subparagraph (B), by inserting ``section 1303(a)(1)
or'' before ``the regulation''; and
(2) in subsection (d)--
(A) by inserting ``section 1303(a)(1) or'' before ``any
regulation''; and
(B) by inserting ``section 1303(a)(1) or'' before ``that
regulation''.
(e) Administration and Applicability of Act.--Section 1306
of the Children's Online Privacy Protection Act of 1998 (15
U.S.C. 6505) is amended--
(1) in subsection (b)--
(A) in paragraph (1), by striking ``, in the case of'' and
all that follows through ``the Board of Directors of the
Federal Deposit Insurance Corporation;'' and inserting the
following: ``by the appropriate Federal banking agency, with
respect to any insured depository institution (as those terms
are defined in section 3 of that Act (12 U.S.C. 1813));'';
and
(B) by striking paragraph (2) and redesignating paragraphs
(3) through (6) as paragraphs (2) through (5), respectively;
(2) in subsection (d)--
(A) by inserting ``section 1303(a)(1) or'' before ``a
rule''; and
(B) by striking ``such rule'' and inserting ``section
1303(a)(1) or a rule of the Commission under section 1303'';
and
(3) by adding at the end the following new subsections:
``(f) Determination of Whether an Operator Has Knowledge
Fairly Implied on the Basis of Objective Circumstances.--
``(1) Rule of construction.--For purposes of enforcing this
title or a regulation promulgated under this title, in making
a determination as to whether an operator has knowledge
fairly implied on the basis of objective circumstances that a
specific user is a child or teen, the Commission or State
attorneys general shall rely on competent and reliable
evidence, taking into account the totality of the
circumstances, including whether a reasonable and prudent
person under the circumstances would have known that the user
is a child or teen. Nothing in this title, including a
determination described in the preceding sentence, shall be
construed to require an operator to--
``(A) affirmatively collect any personal information with
respect to the age of a child or teen that an operator is not
already collecting in the normal course of business; or
``(B) implement an age gating or age verification
functionality.
``(2) Commission guidance.--
``(A) In general.--Within 180 days of enactment, the
Commission shall issue guidance to provide information,
including best practices and examples for operators to
understand the Commission's determination of whether an
operator has knowledge fairly implied on the basis of
objective circumstances that a user is a child or teen.
``(B) Limitation.--No guidance issued by the Commission
with respect to this title shall confer any rights on any
person, State, or locality, nor shall operate to bind the
Commission or any person to the approach recommended in such
guidance. In any enforcement action brought pursuant to this
title, the Commission or State attorney general, as
applicable, shall allege a specific violation of a provision
of this title. The Commission or State attorney general, as
applicable, may not base an enforcement action on, or execute
a consent order based on, practices that are alleged to be
inconsistent with any such guidance, unless the practices
allegedly violate this title. For purposes of enforcing this
title or a regulation promulgated under this title, State
attorneys general shall take into account any guidance issued
by the Commission under subparagraph (A).
``(g) Additional Requirement.--Any regulations issued under
this title shall include a description and analysis of the
impact of proposed and final Rules on small entities per the
Regulatory Flexibility Act of 1980 (5 U.S.C. 601 et seq.).''.
SEC. 3. STUDY AND REPORTS OF MOBILE AND ONLINE APPLICATION
OVERSIGHT AND ENFORCEMENT.
(a) Oversight Report.--Not later than 3 years after the
date of enactment of this Act, the Federal Trade Commission
shall submit to the Committee on Commerce, Science, and
Transportation of the Senate and the Committee on Energy and
Commerce of the House of Representatives a report on the
processes of platforms that offer mobile and online
applications for ensuring that, of those applications that
are websites, online services, online applications, or mobile
applications directed to children, the applications operate
in accordance with--
(1) this Act, the amendments made by this Act, and rules
promulgated under this Act; and
(2) rules promulgated by the Commission under section 18 of
the Federal Trade Commission Act (15 U.S.C. 57a) relating to
unfair or deceptive acts or practices in marketing.
(b) Enforcement Report.--Not later than 1 year after the
date of enactment of this Act, and each year thereafter, the
Federal Trade Commission shall submit to the Committee on
Commerce, Science, and Transportation of the Senate and the
Committee on Energy and Commerce of the House of
Representatives a report that addresses, at a minimum--
(1) the number of actions brought by the Commission during
the reporting year to enforce the Children's Online Privacy
Protection Act of 1998 (15 U.S.C. 6501) (referred to in this
subsection as the ``Act'') and the outcome of each such
action;
(2) the total number of investigations or inquiries into
potential violations of the Act; during the reporting year;
(3) the total number of open investigations or inquiries
into potential violations of the Act as of the time the
report is submitted;
(4) the number and nature of complaints received by the
Commission relating to an allegation of a violation of the
Act during the reporting year; and
(5) policy or legislative recommendations to strengthen
online protections for children and teens.
SEC. 4. GAO STUDY.
[(a) Study.--The Comptroller General of the United States
(in this section referred to as the ``Comptroller General'')
shall conduct a study on the privacy of teens who use
financial technology products. Such study shall--
(1) identify the type of financial technology products that
teens are using;
(2) identify the potential risks to teens' privacy from
using such financial technology products; and
[[Page S865]]
(3) determine whether existing laws are sufficient to
address such risks to teens' privacy.]
(a) Study.--The Comptroller General of the United States
(in this section referred to as the ``Comptroller General'')
shall conduct a study on the privacy and mental health of
teens who use financial technology products. Such study
shall--
(1) identify the type of financial technology products that
teens are using;
(2) identify the potential risks to teens' privacy and
mental health from using such financial technology products;
and
(3) determine whether existing laws are sufficient to
address such risks to teens' privacy and mental health.
(b) Report.--Not later than 1 year after the date of
enactment of this section, the Comptroller General shall
submit to Congress a report containing the results of the
study conducted under subsection (a), together with
recommendations for such legislation and administrative
action as the Comptroller General determines appropriate.
SEC. 5. SEVERABILITY.
If any provision of this Act, or an amendment made by this
Act, is determined to be unenforceable or invalid, the
remaining provisions of this Act and the amendments made by
this Act shall not be affected.
Mr. MARKEY. Mr. President, I ask unanimous consent that the
committee-reported amendments be agreed to; that the bill, as amended,
be considered read a third time and passed; and that the motion to
reconsider be considered made and laid upon the table with no
intervening action or debate.
The PRESIDING OFFICER. Without objection, it is so ordered.
The committee-reported amendments were agreed to.
The bill (S. 836), as amended, was ordered to be engrossed for a
third reading, was read the third time, and passed, as follows:
S. 836
Be it enacted by the Senate and House of Representatives of
the United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) Short Title.--This Act may be cited as the ``Children
and Teens' Online Privacy Protection Act''.
(b) Table of Contents.--The table of contents for this Act
is as follows:
Sec. 1. Short title; table of contents.
Sec. 2. Online collection, use, disclosure, and deletion of personal
information of children and teens.
Sec. 3. Study and reports of mobile and online application oversight
and enforcement.
Sec. 4. GAO study.
Sec. 5. Severability.
SEC. 2. ONLINE COLLECTION, USE, DISCLOSURE, AND DELETION OF
PERSONAL INFORMATION OF CHILDREN AND TEENS.
(a) Definitions.--Section 1302 of the Children's Online
Privacy Protection Act of 1998 (15 U.S.C. 6501) is amended--
(1) by amending paragraph (2) to read as follows:
``(2) Operator.--The term `operator'--
``(A) means any person--
``(i) who, for commercial purposes, in interstate or
foreign commerce operates or provides a website on the
internet, an online service, an online application, or a
mobile application; and
``(ii) who--
``(I) collects or maintains, either directly or through a
service provider, personal information from or about the
users of that website, service, or application;
``(II) allows another person to collect personal
information directly from users of that website, service, or
application (in which case, the operator is deemed to have
collected the information); or
``(III) allows users of that website, service, or
application to publicly disclose personal information (in
which case, the operator is deemed to have collected the
information); and
``(B) does not include any nonprofit entity that would
otherwise be exempt from coverage under section 5 of the
Federal Trade Commission Act (15 U.S.C. 45).'';
(2) in paragraph (4)--
(A) by amending subparagraph (A) to read as follows:
``(A) the release of personal information collected from a
child or teen by an operator for any purpose, except where
the personal information is provided to a person other than
an operator who--
``(i) provides support for the internal operations of the
website, online service, online application, or mobile
application of the operator, excluding any activity relating
to individual-specific advertising to children or teens; and
``(ii) does not disclose or use that personal information
for any other purpose; and''; and
(B) in subparagraph (B)--
(i) by inserting ``or teen'' after ``child'' each place the
term appears;
(ii) by striking ``website or online service'' and
inserting ``website, online service, online application, or
mobile application''; and
(iii) by striking ``actual knowledge'' and inserting
``actual knowledge or knowledge fairly implied on the basis
of objective circumstances'';
(3) by striking paragraph (8) and inserting the following:
``(8) Personal information.--
``(A) In general.--The term `personal information' means
individually identifiable information about an individual
collected online, including--
``(i) a first and last name;
``(ii) a home or other physical address including street
name and name of a city or town;
``(iii) an e-mail address;
``(iv) a telephone number;
``(v) a Social Security number;
``(vi) any other identifier that the Commission determines
permits the physical or online contacting of a specific
individual;
``(vii) a persistent identifier that can be used to
recognize a specific child or teen over time and across
different websites, online services, online applications, or
mobile applications, including but not limited to a customer
number held in a cookie, an Internet Protocol (IP) address, a
processor or device serial number, or unique device
identifier, but excluding an identifier that is used by an
operator solely for providing support for the internal
operations of the website, online service, online
application, or mobile application;
``(viii) a photograph, video, or audio file where such file
contains a specific child's or teen's image or voice;
``(ix) geolocation information;
``(x) information generated from the measurement or
technological processing of an individual's biological,
physical, or physiological characteristics that is used to
identify an individual, including--
``(I) fingerprints;
``(II) voice prints;
``(III) iris or retina imagery scans;
``(IV) facial templates;
``(V) deoxyribonucleic acid (DNA) information; or
``(VI) gait; or
``(xi) information linked or reasonably linkable to a child
or teen or the parents of that child or teen (including any
unique identifier) that an operator collects online from the
child or teen and combines with an identifier described in
this subparagraph.
``(B) Exclusion.--The term `personal information' shall not
include an audio file that contains a child's or teen's voice
so long as the operator--
``(i) does not request information via voice that would
otherwise be considered personal information under this
paragraph;
``(ii) provides clear notice of its collection and use of
the audio file and its deletion policy in its privacy policy;
``(iii) only uses the voice within the audio file solely as
a replacement for written words, to perform a task, or engage
with a website, online service, online application, or mobile
application, such as to perform a search or fulfill a verbal
instruction or request; and
``(iv) only maintains the audio file long enough to
complete the stated purpose and then immediately deletes the
audio file and does not make any other use of the audio file
prior to deletion.
``(C) Support for the internal operations of a website,
online service, online application, or mobile application.--
``(i) In general.--For purposes of subparagraph (A)(vii),
the term `support for the internal operations of a website,
online service, online application, or mobile application'
means those activities necessary to--
``(I) maintain or analyze the functioning of the website,
online service, online application, or mobile application;
``(II) perform network communications;
``(III) authenticate users of, or personalize the content
on, the website, online service, online application, or
mobile application;
``(IV) serve contextual advertising, provided that any
persistent identifier is only used as necessary for technical
purposes to serve the contextual advertisement, or cap the
frequency of advertising;
``(V) protect the security or integrity of the user,
website, online service, online application, or mobile
application;
``(VI) ensure legal or regulatory compliance, or
``(VII) fulfill a request of a child or teen as permitted
by subparagraphs (A) through (C) of section 1303(b)(2).
``(ii) Condition.--Except as specifically permitted under
clause (i), information collected for the activities listed
in clause (i) cannot be used or disclosed to contact a
specific individual, including through individual-specific
advertising to children or teens, to amass a profile on a
specific individual, in connection with processes that
encourage or prompt use of a website or online service, or
for any other purpose.'';
(4) by amending paragraph (9) to read as follows:
``(9) Verifiable consent.--The term `verifiable consent'
means any reasonable effort (taking into consideration
available technology), including a request for authorization
for future collection, use, and disclosure described in the
notice, to ensure that, in the case of a child, a parent of
the child, or, in the case of a teen, the teen--
``(A) receives direct notice of the personal information
collection, use, and disclosure practices of the operator;
and
``(B) before the personal information of the child or teen
is collected, freely and unambiguously authorizes--
``(i) the collection, use, and disclosure, as applicable,
of that personal information; and
``(ii) any subsequent use of that personal information.'';
(5) in paragraph (10)--
(A) in the paragraph header, by striking ``Website or
online service directed to children'' and inserting
``Website, online
[[Page S866]]
service, online application, or mobile application directed
to children'';
(B) by striking ``website or online service'' each place it
appears and inserting ``website, online service, online
application, or mobile application''; and
(C) by adding at the end the following new subparagraph:
``(C) Rule of construction.--In considering whether a
website, online service, online application, or mobile
application, or portion thereof, is directed to children, the
Commission shall apply a totality of circumstances test and
will also consider competent and reliable empirical evidence
regarding audience composition and evidence regarding the
intended audience of the website, online service, online
application, or mobile application.''; and
(6) by adding at the end the following:
``(13) Connected device.--The term `connected device' means
a device that is capable of connecting to the internet,
directly or indirectly, or to another connected device.
``(14) Online application.--The term `online application'--
``(A) means an internet-connected software program; and
``(B) includes a service or application offered via a
connected device.
``(15) Mobile application.--The term `mobile application'--
``(A) means a software program that runs on the operating
system of--
``(i) a cellular telephone;
``(ii) a tablet computer; or
``(iii) a similar portable computing device that transmits
data over a wireless connection; and
``(B) includes a service or application offered via a
connected device.
``(16) Geolocation information.--The term `geolocation
information' means information sufficient to identify a
street name and name of a city or town.
``(17) Teen.--The term `teen' means an individual who has
attained age 13 and is under the age of 17.
``(18) Individual-specific advertising to children or
teens.--
``(A) In general.--The term `individual-specific
advertising to children or teens' means advertising or any
other effort to market a product or service that is directed
to a specific child or teen or a connected device that is
linked or reasonably linkable to a child or teen based on--
``(i) the personal information from--
``(I) the child or teen; or
``(II) a group of children or teens who are similar in sex,
age, household income level, race, or ethnicity to the
specific child or teen to whom the product or service is
marketed;
``(ii) profiling of a child or teen or group of children or
teens; or
``(iii) a unique identifier of the connected device.
``(B) Exclusions.--The term `individual-specific
advertising to children or teens' shall not include--
``(i) advertising or marketing to an individual or the
device of an individual in response to the individual's
specific request for information or feedback, such as a
child's or teen's current search query;
``(ii) contextual advertising, such as when an
advertisement is displayed based on the content of the
website, online service, online application, mobile
application, or connected device in which the advertisement
appears and does not vary based on personal information
related to the viewer;
``(iii) processing personal information solely for
measuring or reporting advertising or content performance,
reach, or frequency, including independent measurement; or
``(iv) advertising or marketing directed to a connected
device used by both adult and child or teen members of a
household where such advertising or marketing is directed to
the profile of the adult user.
``(C) Rule of construction.--Nothing in subparagraph (A)
shall be construed to prohibit an operator with actual
knowledge or knowledge fairly implied on the basis of
objective circumstances that a user is under the age of 17
from delivering advertising or marketing that is age-
appropriate and intended for a child or teen audience, so
long as the operator does not use any personal information
other than whether the user is under the age of 17.
``(19) Educational agency or institution.--The term
`educational agency or institution' means--
``(A) a State educational agency or local educational
agency, as such terms are defined in section 8101 of the
Elementary and Secondary Education Act of 1965 (20 U.S.C.
7801); or
``(B) an institutional day or residential school, including
a public school (including a charter school) or private
school, that provides elementary or secondary education, as
determined under State law.''.
(b) Online Collection, Use, Disclosure, and Deletion of
Personal Information of Children and Teens.--Section 1303 of
the Children's Online Privacy Protection Act of 1998 (15
U.S.C. 6502) is amended--
(1) by striking the heading and inserting the following:
``online collection, use, disclosure, and deletion of
personal information of children and teens.'';
(2) in subsection (a)--
(A) by amending paragraph (1) to read as follows:
``(1) In general.--It is unlawful for an operator of a
website, online service, online application, or mobile
application directed to children or for any operator of a
website, online service, online application, or mobile
application with actual knowledge or knowledge fairly implied
on the basis of objective circumstances that a user is a
child or teen--
``(A) to collect personal information from a child or teen
in a manner that violates the regulations prescribed under
subsection (b);
``(B) except as provided in subparagraphs (B) and (C) of
section 1302(18), to collect, use, disclose to third parties,
or maintain personal information of a child or teen for
purposes of individual-specific advertising to children or
teens (or to allow another person to collect, use, disclose,
or maintain such information for such purpose);
``(C) to collect the personal information of a child or
teen except when the collection of the personal information
is--
``(i) consistent with the context of a particular
transaction or service or the relationship of the child or
teen with the operator, including collection necessary to
fulfill a transaction or provide a product or service
requested by the child or teen; or
``(ii) required or specifically authorized by Federal or
State law; or
``(D) to store or transfer the personal information of a
child or teen outside of the United States unless the
operator provides direct notice to the parent of the child,
in the case of a child, or to the teen, in the case of a
teen, that the child's or teen's personal information is
being stored or transferred outside of the United States; or
``(E) to retain the personal information of a child or teen
for longer than is reasonably necessary to fulfill a
transaction or provide a service requested by the child or
teen except as required or specifically authorized by Federal
or State law.''; and
(B) in paragraph (2)--
(i) in the header, by striking ``parent'' and inserting
``parent or teen'';
(ii) by striking ``Notwithstanding paragraph (1)'' and
inserting ``Notwithstanding paragraph (1)(A)'';
(iii) by striking ``of such a website or online service'';
and
(iv) by striking ``subsection (b)(1)(B)(iii) to the parent
of a child'' and inserting ``subsection (b)(1)(B)(iv) to the
parent of a child or under subsection (b)(1)(C)(iv) to a
teen'';
(3) in subsection (b)--
(A) in paragraph (1)--
(i) in subparagraph (A)--
(I) by striking ``operator of any website'' and all that
follows through ``from a child'' and inserting ``operator of
a website, online service, online application, or mobile
application directed to children or that has actual knowledge
or knowledge fairly implied on the basis of objective
circumstances that a user is a child or teen'';
(II) in clause (i)--
(aa) by striking ``notice on the website'' and inserting
``clear and conspicuous notice on the website'';
(bb) by inserting ``or teens'' after ``children'';
(cc) by striking ``, and the operator's'' and inserting ``,
the operator's''; and
(dd) by striking ``; and'' and inserting ``, the rights and
opportunities available to the parent of the child or teen
under subparagraphs (B) and (C), and the procedures or
mechanisms the operator uses to ensure that personal
information is not collected from children or teens except in
accordance with the regulations promulgated under this
paragraph;'';
(III) in clause (ii)--
(aa) by striking ``parental'';
(bb) by inserting ``or teens'' after ``children'';
(cc) by striking the semicolon at the end and inserting ``;
and''; and
(IV) by inserting after clause (ii) the following new
clause:
``(iii) to obtain verifiable consent from a parent of a
child or from a teen before using or disclosing personal
information of the child or teen for any purpose that is a
material change from the original purposes and disclosure
practices specified to the parent of the child or the teen
under clause (i);'';
(ii) in subparagraph (B)--
(I) in the matter preceding clause (i), by striking
``website or online service'' and inserting ``operator'';
(II) in clause (i), by inserting ``and the method by which
the operator obtained the personal information, and the
purposes for which the operator collects, uses, discloses,
and retains the personal information'' before the semicolon;
(III) in clause (ii)--
(aa) by inserting ``to delete personal information
collected from the child or content or information submitted
by the child to a website, online service, online
application, or mobile application and'' after ``the
opportunity at any time''; and
(bb) by striking ``; and'' and inserting a semicolon;
(IV) by redesignating clause (iii) as clause (iv) and
inserting after clause (ii) the following new clause:
``(iii) the opportunity to challenge the accuracy of the
personal information and, if the parent of the child
establishes the inaccuracy of the personal information, to
have the inaccurate personal information corrected;''; and
(V) in clause (iv), as so redesignated, by inserting ``, if
such information is available to the operator at the time the
parent makes the request'' before the semicolon;
(iii) by redesignating subparagraphs (C) and (D) as
subparagraphs (D) and (E), respectively;
[[Page S867]]
(iv) by inserting after subparagraph (B) the following new
subparagraph:
``(C) require the operator to provide, upon the request of
a teen under this subparagraph who has provided personal
information to the operator, upon proper identification of
that teen--
``(i) a description of the specific types of personal
information collected from the teen by the operator, the
method by which the operator obtained the personal
information, and the purposes for which the operator
collects, uses, discloses, and retains the personal
information;
``(ii) the opportunity at any time to delete personal
information collected from the teen or content or information
submitted by the teen to a website, online service, online
application, or mobile application and to refuse to permit
the operator's further use or maintenance in retrievable
form, or online collection, of personal information from the
teen;
``(iii) the opportunity to challenge the accuracy of the
personal information and, if the teen establishes the
inaccuracy of the personal information, to have the
inaccurate personal information corrected; and
``(iv) a means that is reasonable under the circumstances
for the teen to obtain any personal information collected
from the teen, if such information is available to the
operator at the time the teen makes the request;'';
(v) in subparagraph (D), as so redesignated--
(I) by striking ``a child's'' and inserting ``a child's or
teen's''; and
(II) by inserting ``or teen'' after ``the child''; and
(vi) by amending subparagraph (E), as so redesignated, to
read as follows:
``(E) require the operator to establish, implement, and
maintain reasonable security practices to protect the
confidentiality, integrity, and accessibility of personal
information of children or teens collected by the operator,
and to protect such personal information against unauthorized
access.'';
(B) in paragraph (2)--
(i) in the matter preceding subparagraph (A), by striking
``verifiable parental consent'' and inserting ``verifiable
consent'';
(ii) in subparagraph (A)--
(I) by inserting ``or teen'' after ``collected from a
child'';
(II) by inserting ``or teen'' after ``request from the
child''; and
(III) by inserting ``or teen or to contact another child or
teen'' after ``to recontact the child'';
(iii) in subparagraph (B)--
(I) by striking ``parent or child'' and inserting ``parent
or teen''; and
(II) by striking ``parental consent'' each place the term
appears and inserting ``verifiable consent'';
(iv) in subparagraph (C)--
(I) in the matter preceding clause (i), by inserting ``or
teen'' after ``child'' each place the term appears;
(II) in clause (i)--
(aa) by inserting ``or teen'' after ``child'' each place
the term appears; and
(bb) by inserting ``or teen, as applicable,'' after
``parent'' each place the term appears; and
(III) in clause (ii)--
(aa) by striking ``without notice to the parent'' and
inserting ``without notice to the parent or teen, as
applicable,''; and
(bb) by inserting ``or teen'' after ``child'' each place
the term appears; and
(v) in subparagraph (D)--
(I) in the matter preceding clause (i), by inserting ``or
teen'' after ``child'' each place the term appears;
(II) in clause (ii), by inserting ``or teen'' after
``child''; and
(III) in the flush text following clause (iii)--
(aa) by inserting ``or teen, as applicable,'' after
``parent'' each place the term appears; and
(bb) by inserting ``or teen'' after ``child'';
(C) by redesignating paragraph (3) as paragraph (4) and
inserting after paragraph (2) the following new paragraph:
``(3) Application to operators acting under agreements with
educational agencies or institutions.--The regulations may
provide that verifiable consent under paragraph (1)(A)(ii) is
not required for an operator that is acting under a written
agreement with an educational agency or institution that, at
a minimum, requires the--
``(A) operator to--
``(i) limit its collection, use, and disclosure of the
personal information from a child or teen to solely
educational purposes and for no other commercial purposes;
``(ii) provide the educational agency or institution with a
notice of the specific types of personal information the
operator will collect from the child or teen, the method by
which the operator will obtain the personal information, and
the purposes for which the operator will collect, use,
disclose, and retain the personal information;
``(iii) provide the educational agency or institution with
a link to the operator's online notice of information
practices as required under subsection (b)(1)(A)(i); and
``(iv) provide the educational agency or institution, upon
request, with a means to review the personal information
collected from a child or teen, to prevent further use or
maintenance or future collection of personal information from
a child or teen, and to delete personal information collected
from a child or teen or content or information submitted by a
child or teen to the operator's website, online service,
online application, or mobile application;
``(B) representative of the educational agency or
institution to acknowledge and agree that they have authority
to authorize the collection, use, and disclosure of personal
information from children or teens on behalf of the
educational agency or institution, along with such
authorization, their name, and title at the educational
agency or institution; and
``(C) educational agency or institution to--
``(i) provide on its website a notice that identifies the
operator with which it has entered into a written agreement
under this subsection and provides a link to the operator's
online notice of information practices as required under
paragraph (1)(A)(i);
``(ii) provide the operator's notice regarding its
information practices, as required under subparagraph
(A)(ii), upon request, to a parent, in the case of a child,
or a parent or teen, in the case of a teen; and
``(iii) upon the request of a parent, in the case of a
child, or a parent or teen, in the case of a teen, request
the operator provide a means to review the personal
information from the child or teen and provide the parent, in
the case of a child, or parent or teen, in the case of the
teen, a means to review the personal information.'';
(D) by amending paragraph (4), as so redesignated, to read
as follows:
``(4) Termination of service.--The regulations shall permit
the operator of a website, online service, online
application, or mobile application to terminate service
provided to a child whose parent has refused, or a teen who
has refused, under the regulations prescribed under
paragraphs (1)(B)(ii) and (1)(C)(ii), to permit the
operator's further use or maintenance in retrievable form, or
future online collection of, personal information from that
child or teen.''; and
(E) by adding at the end the following new paragraphs:
``(5) Continuation of service.--The regulations shall
prohibit an operator from discontinuing service provided to a
child or teen on the basis of a request by the parent of the
child or by the teen, under the regulations prescribed under
subparagraph (B) or (C) of paragraph (1), respectively, to
delete personal information collected from the child or teen,
to the extent that the operator is capable of providing such
service without such information.
``(6) Rule of construction.--A request made pursuant to
subparagraph (B) or (C) of paragraph (1) to delete or correct
personal information of a child or teen shall not be
construed--
``(A) to limit the authority of a law enforcement agency to
obtain any content or information from an operator pursuant
to a lawfully executed warrant or an order of a court of
competent jurisdiction;
``(B) to require an operator or third party delete or
correct information that--
``(i) any other provision of Federal or State law requires
the operator or third party to maintain; or
``(ii) was submitted to the website, online service, online
application, or mobile application of the operator by any
person other than the user who is attempting to erase or
otherwise eliminate the content or information, including
content or information submitted by the user that was
republished or resubmitted by another person; or
``(C) to prohibit an operator from--
``(i) retaining a record of the deletion request and the
minimum information necessary for the purposes of ensuring
compliance with a request made pursuant to subparagraph (B)
or (C);
``(ii) preventing, detecting, protecting against, or
responding to security incidents, identity theft, or fraud,
or reporting those responsible for such actions;
``(iii) protecting the integrity or security of a website,
online service, online application or mobile application; or
``(iv) ensuring that the child's or teen's information
remains deleted.
``(7) Common verifiable consent mechanism.--
``(A) In general.--
``(i) Feasibility of mechanism.--The Commission shall
assess the feasibility, with notice and public comment, of
allowing operators the option to use a common verifiable
consent mechanism that fully meets the requirements of this
title.
``(ii) Requirements.--The feasibility assessment described
in clause (i) shall consider whether a single operator could
use a common verifiable consent mechanism to obtain
verifiable consent, as required under this title, from a
parent of a child or from a teen on behalf of multiple,
listed operators that provide a joint or related service.
``(B) Report.--Not later than 1 year after the date of
enactment of this paragraph, the Commission shall submit a
report to the Committee on Commerce, Science, and
Transportation of the Senate and the Committee on Energy and
Commerce of the House of Representatives with the findings of
the assessment required by subparagraph (A).
``(C) Regulations.--If the Commission finds that the use of
a common verifiable consent mechanism is feasible and would
meet the requirements of this title, the Commission shall
issue regulations to permit the use of a common verifiable
consent mechanism in accordance with the findings outlined in
such report.'';
(4) in subsection (c), by striking ``a regulation
prescribed under subsection (a)'' and inserting
``subparagraph (B), (C), (D), or (E) of
[[Page S868]]
subsection (a)(1), or of a regulation prescribed under
subsection (b),''; and
(5) by striking subsection (d) and inserting the following:
``(d) Relationship to State Law.--The provisions of this
title shall preempt any State law, rule, or regulation only
to the extent that such State law, rule, or regulation
conflicts with a provision of this title. Nothing in this
title shall be construed to prohibit any State from enacting
a law, rule, or regulation that provides greater protection
to children or teens than the provisions of this title.''.
(c) Safe Harbors.--Section 1304 of the Children's Online
Privacy Protection Act of 1998 (15 U.S.C. 6503) is amended--
(1) in subsection (b)(1), by inserting ``and teens'' after
``children''; and
(2) by adding at the end the following:
``(d) Publication.--
``(1) In general.--Subject to the restrictions described in
paragraph (2), the Commission shall publish on the internet
website of the Commission any report or documentation
required by regulation to be submitted to the Commission to
carry out this section.
``(2) Restrictions on publication.--The restrictions
described in section 6(f) and section 21 of the Federal Trade
Commission Act (15 U.S.C. 46(f), 57b-2) applicable to the
disclosure of information obtained by the Commission shall
apply in same manner to the disclosure under this subsection
of information obtained by the Commission from a report or
documentation described in paragraph (1).''.
(d) Actions by States.--Section 1305 of the Children's
Online Privacy Protection Act of 1998 (15 U.S.C. 6504) is
amended--
(1) in subsection (a)(1)--
(A) in the matter preceding subparagraph (A), by inserting
``section 1303(a)(1) or'' before ``any regulation''; and
(B) in subparagraph (B), by inserting ``section 1303(a)(1)
or'' before ``the regulation''; and
(2) in subsection (d)--
(A) by inserting ``section 1303(a)(1) or'' before ``any
regulation''; and
(B) by inserting ``section 1303(a)(1) or'' before ``that
regulation''.
(e) Administration and Applicability of Act.--Section 1306
of the Children's Online Privacy Protection Act of 1998 (15
U.S.C. 6505) is amended--
(1) in subsection (b)--
(A) in paragraph (1), by striking ``, in the case of'' and
all that follows through ``the Board of Directors of the
Federal Deposit Insurance Corporation;'' and inserting the
following: ``by the appropriate Federal banking agency, with
respect to any insured depository institution (as those terms
are defined in section 3 of that Act (12 U.S.C. 1813));'';
and
(B) by striking paragraph (2) and redesignating paragraphs
(3) through (6) as paragraphs (2) through (5), respectively;
(2) in subsection (d)--
(A) by inserting ``section 1303(a)(1) or'' before ``a
rule''; and
(B) by striking ``such rule'' and inserting ``section
1303(a)(1) or a rule of the Commission under section 1303'';
and
(3) by adding at the end the following new subsections:
``(f) Determination of Whether an Operator Has Knowledge
Fairly Implied on the Basis of Objective Circumstances.--
``(1) Rule of construction.--For purposes of enforcing this
title or a regulation promulgated under this title, in making
a determination as to whether an operator has knowledge
fairly implied on the basis of objective circumstances that a
specific user is a child or teen, the Commission or State
attorneys general shall rely on competent and reliable
evidence, taking into account the totality of the
circumstances, including whether a reasonable and prudent
person under the circumstances would have known that the user
is a child or teen. Nothing in this title, including a
determination described in the preceding sentence, shall be
construed to require an operator to--
``(A) affirmatively collect any personal information with
respect to the age of a child or teen that an operator is not
already collecting in the normal course of business; or
``(B) implement an age gating or age verification
functionality.
``(2) Commission guidance.--
``(A) In general.--Within 180 days of enactment, the
Commission shall issue guidance to provide information,
including best practices and examples for operators to
understand the Commission's determination of whether an
operator has knowledge fairly implied on the basis of
objective circumstances that a user is a child or teen.
``(B) Limitation.--No guidance issued by the Commission
with respect to this title shall confer any rights on any
person, State, or locality, nor shall operate to bind the
Commission or any person to the approach recommended in such
guidance. In any enforcement action brought pursuant to this
title, the Commission or State attorney general, as
applicable, shall allege a specific violation of a provision
of this title. The Commission or State attorney general, as
applicable, may not base an enforcement action on, or execute
a consent order based on, practices that are alleged to be
inconsistent with any such guidance, unless the practices
allegedly violate this title. For purposes of enforcing this
title or a regulation promulgated under this title, State
attorneys general shall take into account any guidance issued
by the Commission under subparagraph (A).
``(g) Additional Requirement.--Any regulations issued under
this title shall include a description and analysis of the
impact of proposed and final Rules on small entities per the
Regulatory Flexibility Act of 1980 (5 U.S.C. 601 et seq.).''.
SEC. 3. STUDY AND REPORTS OF MOBILE AND ONLINE APPLICATION
OVERSIGHT AND ENFORCEMENT.
(a) Oversight Report.--Not later than 3 years after the
date of enactment of this Act, the Federal Trade Commission
shall submit to the Committee on Commerce, Science, and
Transportation of the Senate and the Committee on Energy and
Commerce of the House of Representatives a report on the
processes of platforms that offer mobile and online
applications for ensuring that, of those applications that
are websites, online services, online applications, or mobile
applications directed to children, the applications operate
in accordance with--
(1) this Act, the amendments made by this Act, and rules
promulgated under this Act; and
(2) rules promulgated by the Commission under section 18 of
the Federal Trade Commission Act (15 U.S.C. 57a) relating to
unfair or deceptive acts or practices in marketing.
(b) Enforcement Report.--Not later than 1 year after the
date of enactment of this Act, and each year thereafter, the
Federal Trade Commission shall submit to the Committee on
Commerce, Science, and Transportation of the Senate and the
Committee on Energy and Commerce of the House of
Representatives a report that addresses, at a minimum--
(1) the number of actions brought by the Commission during
the reporting year to enforce the Children's Online Privacy
Protection Act of 1998 (15 U.S.C. 6501) (referred to in this
subsection as the ``Act'') and the outcome of each such
action;
(2) the total number of investigations or inquiries into
potential violations of the Act; during the reporting year;
(3) the total number of open investigations or inquiries
into potential violations of the Act as of the time the
report is submitted;
(4) the number and nature of complaints received by the
Commission relating to an allegation of a violation of the
Act during the reporting year; and
(5) policy or legislative recommendations to strengthen
online protections for children and teens.
SEC. 4. GAO STUDY.
(a) Study.--The Comptroller General of the United States
(in this section referred to as the ``Comptroller General'')
shall conduct a study on the privacy and mental health of
teens who use financial technology products. Such study
shall--
(1) identify the type of financial technology products that
teens are using;
(2) identify the potential risks to teens' privacy and
mental health from using such financial technology products;
and
(3) determine whether existing laws are sufficient to
address such risks to teens' privacy and mental health.
(b) Report.--Not later than 1 year after the date of
enactment of this section, the Comptroller General shall
submit to Congress a report containing the results of the
study conducted under subsection (a), together with
recommendations for such legislation and administrative
action as the Comptroller General determines appropriate.
SEC. 5. SEVERABILITY.
If any provision of this Act, or an amendment made by this
Act, is determined to be unenforceable or invalid, the
remaining provisions of this Act and the amendments made by
this Act shall not be affected.
Mr. MARKEY. With that again, Mr. President, I thank Senator Cassidy.
It is a historic day. We have begun this process on the Senate floor
today with protections in place, which has been long overdue for
teenagers and children in our country. Again, it is the ongoing assault
against their privacy and undermining their mental health. So I thank
everyone who participated in this, especially my friend Senator
Cassidy.
I yield the floor.
The PRESIDING OFFICER. The Senator from Oregon.
Remembering Kurt Paul Pfotenhauer
Mr. WYDEN. Mr. President, today, I want to recognize and honor the
life of Kurt Paul Pfotenhauer, an extraordinary public servant and
three-decade friend who passed away on January 21.
Kurt was, first and foremost, a man of deep Christian faith. He was
guided in his public service not only by his conservative political
beliefs but by that faith, his integrity, his humility, and his sense
of responsibility for others.
When I first met Kurt, he had been named Senator Gordon Smith's chief
of staff. Gordon and I were brand new Senators, and we had a Mount
Hood-sized mountain to climb. That is because we were to fill the giant
shoes of two retiring, very powerful U.S. Senators from Oregon.
Kurt and my chief of staff executed an agreement between Gordon and I
to set aside our political differences whenever possible and go to bat
for the
[[Page S869]]
State of Oregon. That included making sure that our respective
congressional and political staffs abided by that agreement. That last
bit, as Senators know, sometimes can be easier said than done.
We quickly learned that Kurt's word really meant something. Trust can
be awfully difficult to make happen in politics, even with those in
your own political party, but we came to see that Kurt's word, in fact,
was his bond. Our staffs learned to work together--occasionally through
gritted teeth--and Kurt and Gordon always upheld their end of the
agreement.
Those years of the Oregon bipartisan partnership with Gordon and Kurt
were extraordinarily, extraordinarily important to me. I believe they
were fruitful years, and we owe so much of that credit for all the
collaboration to the leadership and decency of Kurt.
After Kurt left the Congress and Gordon's office, he went on to a
very successful career in the financial services sector. He culminated
his years there as executive vice president and vice chairman of First
American Title Insurance. I know his colleagues there feel an enormous
loss, too, because Kurt was the kind of individual who conducted
himself professionally and lived his life daily in a way that served as
an example, particularly to young people around him.
Kurt was generous with his time, his financial resources, and
especially with his heart. He believed in the communities that he was a
part of and he was beloved by the communities that he touched. His
commitment to service was reflected in a lifelong dedication to always
trying to help others. For decades, Kurt and his wonderful wife, Nancy,
were sole supporters of The Children's Light Home orphanage in India.
He served on the board of directors for the Opens Doors Foundation, and
he helped provide mortgage and rental assistance to the many families
that had disabled kids.
His support for those in need continued even in his final days. He
extended help at that time to a chemo patient from out of town who
lived out of the cab of his truck on his chemo days at the Mayo Clinic.
Kurt helped his fellow patient with lodging. That, Mr. President--and I
say this on behalf of all Oregonians who got to know Kurt--tells you
what Kurt Pfotenhauer was always about, the Kurt we knew and the Kurt
we loved.
He fought an incredibly courageous 18-month-long battle against
cancer. Kurt used that time creating special memories with his beloved
wife Nancy and their five kids and grandchildren. Family was everything
to Kurt.
I want to extend a special thank-you to all of them for sharing Kurt
with all of us here in the Senate, and I want to extend a heartfelt
thank-you to Kurt's family on behalf of Oregonians and our Nation for
all that he did to make our country and the great State of Oregon a
better place.
Kurt's many wise and kind deeds on Earth are going to continue to
create opportunity, and opportunity is what our country is all about.
Opportunity is when we are at our best, and, my God, Kurt Pfotenhauer
created a lot of opportunity for generations, in Oregon and in our
country, to have a better life in the days ahead.
Kurt served as a trusted adviser and confidant to me, and that will
be something I will always miss. My former chief of staff and I are
always going to remember and love our friend Kurt Pfotenhauer. May his
memory be a blessing to all who knew him and to all who have studied
what he has done to make a difference. May people reflect on that in
the days ahead and may it be a comfort.
I yield the floor.
The PRESIDING OFFICER. The Democrat leader.
S. 836
Mr. SCHUMER. Mr. President, I am very glad that today the Senate is
taking a major step forward to protect our kids online. Today, the
Senate is passing unanimously COPPA, the Children Online Privacy and
Protection Act.
The bill expands the current law protecting our kids online to ensure
companies cannot collect personal information from anyone under the age
of 17. This is a big step forward for protecting our kids. We hope the
House can join us. They haven't thus far. But this is really important
to protect kids online. To ban targeting advertising to children and
teens makes imminent sense. To establish data minimization rules to
prohibit the excessive collection of children and teens' data makes
sense.
So this is a very good day for kids throughout America. This is a
very good day for their parents as well, who can breathe a sigh of
relief that some real protections for kids online are finally passing
the Senate once again.
I yield the floor.
____________________