[Senate Report 119-99]
[From the U.S. Government Publishing Office]
Calendar No. 304
119th Congress} { Report
SENATE
2nd Session } { 119-99
======================================================================
CHILDREN AND TEENS' ONLINE PRIVACY PROTECTION ACT
__________
R E P O R T
OF THE
COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION
ON
S. 836
January 27, 2026.--Ordered to be printed
SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION
one hundred nineteenth congress
second session
TED CRUZ, Texas, Chairman
JOHN THUNE, South Dakota MARIA CANTWELL, Washington
ROGER F.WICKER, Mississippi AMY KLOBUCHAR, Minnesota
DEB FISCHER, Nebraska BRIAN SCHATZ, Hawaii
JERRY MORAN, Kansas EDWARD J. MARKEY, Massachusetts
DAN SULLIVAN, Alaska GARY C. PETERS, Michigan
MARSHA BLACKBURN, Tennessee TAMMY BALDWIN, Wisconsin
TODD YOUNG, Indiana TAMMY DUCKWORTH, Illinois
TED BUDD, North Carolina JACKY ROSEN, Nevada
ERIC SCHMITT, Missouri BEN RAY LUJAN, New Mexico
JOHN CURTIS, Utah JOHN W. HICKENLOOPER, Colorado
BERNIE MORENO, Ohio JOHN FETTERMAN, Pennsylvania
TIM SHEEHY, Montana ANDY KIM, New Jersey
SHELLEY MOORE CAPITO, West Virginia LISA BLUNT ROCHESTER, Delaware
CYNTHIA M. LUMMIS, Wyoming
Brad Grantz, Majority Staff Director
Lila Harper Helms, Democratic Staff Director
Calendar No. 304
119th Congress} { Report
SENATE
2nd Session } { 119-99
======================================================================
CHILDREN AND TEENS' ONLINE PRIVACY PROTECTION ACT
_______
January 27, 2026.--Ordered to be printed
_______
Mr. Cruz, from the Committee on Commerce, Science, and Transportation,
submitted the following
R E P O R T
[To accompany S. 836]
[Including cost estimate of the Congressional Budget Office]
The Committee on Commerce, Science, and Transportation, to
which was referred the bill (S. 836) to amend the Children's
Online Privacy Protection Act of 1998 to strengthen protections
relating to the online collection, use, and disclosure of
personal information of children and teens, and for other
purposes, having considered the same, reports favorably thereon
with amendments and recommends that the bill, as amended, do
pass.
Purpose of the Bill
The purpose of S. 836 is to amend the Children's Online
Privacy Protection Act (COPPA) of 1998\1\ to strengthen and
expand protections relating to the online collection, use, and
disclosure of personal information of children and teens.
---------------------------------------------------------------------------
\1\Public Law 105-277; 112 Stat. 2681-728; 15 U.S.C. 6501-6506.
---------------------------------------------------------------------------
Background and Needs
When Congress was considering COPPA in 1998, the Committee
on Commerce, Science, and Transportation of the Senate received
written testimony regarding the need for children's online
information to be protected, including from pervasive tracking
and profiling for individualized marketing:
The Internet has an unprecedented ability to invade
individual privacy. The emerging model of E-commerce is
built on the concept of ``one-to-one marketing,'' which
involves creating detailed personal profiles that are
used to ``microtarget'' individual consumers. The
interactive nature of the online medium makes it
possible to obtain not only name, address, email and
other personally identifiable information voluntarily,
but also to track every move that an individual child
makes online, including his/her response to various
kinds of marketing and advertising appeals, or the
kinds of Web pages that person accesses. Elaborate
``psychographic'' and other profiles can be created by
merging the information obtained online with other
information gathered from offline sources. All of these
trends underscore the need for clear, enforceable
safeguards now to protect children and families.\2\
---------------------------------------------------------------------------
\2\Prepared Statement of Kathryn Montgomery, submitted to the U.S.
Senate Committee on Commerce, Science, and Transportation, Subcommittee
on Communications, for hearing on ``S. 2326, Children's Online Privacy
Protection Act of 1998,'' 105th Congress, S. Hrg. 105-1089, at p. 39,
September 23, 1998, https://catalog.hathitrust.org/Record/009798364.
The concern over the ability to track the online activities
of children and collect their personal information, among other
concerns regarding children's online privacy, led Congress to
enact COPPA in 1998. COPPA requires the Federal Trade
Commission (FTC) to issue and enforce regulations protecting
the personal information of children online.\3\ COPPA applies
to operators of websites and online services that are directed
to children or those operators that have actual knowledge that
they are collecting personal information from a child.
---------------------------------------------------------------------------
\3\Public Law 105-227; 112 Stat. 2681 (1998).
---------------------------------------------------------------------------
COPPA gives parents control over the online collection,
use, or disclosure of the personal information of a child under
the age of 13. The law requires operators to post online their
policies for collecting, using, and disclosing information they
collect about children. COPPA also requires operators to
provide parents with direct notice of their information
practices and obtain verifiable parental consent before
collecting personal information from children. It also requires
operators to establish and maintain reasonable procedures to
protect the confidentiality, security, and integrity of
personal information collected from children.
There are concerns that the ``actual knowledge'' standard
can create an incentive for operators to look the other way,
even where objective indicators demonstrate that they are
collecting personal information from a child.\4\ There have
been calls to eliminate or relax the knowledge standard to
strengthen COPPA's protections.
---------------------------------------------------------------------------
\4\Statement of Laura Moy, taken from transcript on ``The Future of
the COPPA Rule: An FTC Workshop,'' part 1, at p. 11, Federal Trade
Commission, October 7, 2019, https://www.ftc.gov/system/files/
documents/public_events/1535372/
transcript_of_coppa_workshop_part_1_1.pdf.
---------------------------------------------------------------------------
The internet has changed dramatically since COPPA's
enactment in 1998, and there is a strong argument for Congress
updating the law.\5\ Given the prevalence of internet connected
devices in our society, children are often introduced to social
media use at a young age. A May 2023 advisory by the U.S.
Surgeon General stated that up to 95 percent of youth between
ages 13-17 reported using social media, with over a third using
it ``almost constantly.''\6\ Numerous studies, as well as
hearings held in prior Congresses before the Subcommittee on
Consumer Protection, Product Safety, and Data Security of the
Committee on Commerce, Science, and Transportation of the
Senate, document the significant physical and mental health
harms to children from social media use as well as safety
concerns that arise when predators have access to children
through their online accounts and activities.
---------------------------------------------------------------------------
\5\ Rachel Lerman, ``New Bill Would Update Decades-Old Law
Governing Children's Privacy Online, Add Protection for Teens,'' The
Washington Post, July 29, 2021, https://www.washingtonpost.com/
technology/2021/07/29/coppa-update-teenagers-online/; Benjamin Din,
``Markey Renews Call to Update Children's Privacy Law,'' Politico, May
11, 2021, https://www.politico.com/newsletters/morning-tech/2021/05/11/
markey-renews-call-to-update-
childrens-privacy-law-795218; ``Diverse Coalition of Advocates Urges
Congress to Pass Legislation to Protect Kids and Teens Online,''
Fairplay, March 22, 2022, https://fairplayforkids.org/march-22-2022-
diverse-coalition-of-advocates-urges-congress-to-pass-legislation-to-
protect-kids-and-teens-online/.
\6\``Surgeon General Issues New Advisory About Effects Social Media
Use Has on Youth Mental Health,'' archived press release, Department of
Health and Human Services, May 23, 2023 (content is available at
https://ehtrust.org/surgeon-general-issues-new-advisory-about-effects-
social-media-use-has-on-youth-mental-health/.
---------------------------------------------------------------------------
During the 117th Congress, the Committee held a series of
hearings relating to digital safety for children and teens. On
May 18, 2021, the Subcommittee on Consumer Protection, Product
Safety, and Data Security held a hearing titled ``Protecting
Kids Online: Internet Privacy and Manipulative Marketing'' to
examine issues posed by websites, online platforms, and child-
oriented apps, and to explore updates to COPPA to address these
issues.\7\
---------------------------------------------------------------------------
\7\Hearing on ``Protecting Kids Online: Internet Privacy and
Manipulative Marketing,'' U.S. Senate Committee on Commerce, Science,
and Transportation, Subcommittee on Consumer Protection, Product
Safety, and Data Security, 117th Congress, May 18, 2021, https://
www.commerce.senate.gov/2021/5/protecting-kids-online-internet-privacy-
and-manipulative-marketing.
---------------------------------------------------------------------------
On October 2, 2021, the subcommittee heard from a
whistleblower and former Facebook (now Meta) employee who
testified that Meta prioritized user engagement, which fueled
growth and profit, over the wellbeing of young users. The
witness further testified that Meta's policies, practices, and
the extent of its internal research on harms to youth on its
platforms lack transparency, both to the public and independent
researchers.\8\
---------------------------------------------------------------------------
\8\Testimony of Frances Haugen, hearing on ``Protecting Kids
Online: Testimony from a Facebook Whistleblower,'' U.S. Senate
Committee on Commerce, Science, and Transportation, Subcommittee on
Consumer Protection, Product Safety, and Data Security, 117th Congress,
October 5, 2021, https://www.commerce.senate.gov/2021/10/
protecting%20kids%20online:%20
testimony%20from%20a%20facebook%20whistleblower.
---------------------------------------------------------------------------
The subcommittee held other hearings on September 30,
2021,\9\ October 26, 2021,\10\ and December 8, 2021,\11\ to
examine how online platforms--particularly social media
platforms--harm young users. These hearings highlighted
personal information used in algorithmic recommendation systems
and targeted advertisements that push age-inappropriate,
potentially life-threatening content on youth. They also
revealed how children and teens need protection online from
platforms and businesses seeking to profit from their personal
information by targeting them with advertisements. Finally, the
hearings revealed that external oversight and regulation,
including updating COPPA, is needed to ensure the safety of
minors online because the platforms have not demonstrated
success in doing so on their own.
---------------------------------------------------------------------------
\9\Hearing on ``Protecting Kids Online: Facebook, Instagram, and
Mental Health Harms,'' U.S. Senate Committee on Commerce, Science, and
Transportation, Subcommittee on Consumer Protection, Product Safety,
and Data Security, 117th Congress, September 30, 2021, https://
www.commerce.senate.gov/2021/9/protecting-kids-online-facebook-
instagram-and-mental-health-harms.
\10\Hearing on ``Protecting Kids Online: Snapchat, TikTok, and
YouTube,'' U.S. Senate Committee on Commerce, Science, and
Transportation, Subcommittee on Consumer Protection, Product Safety,
and Data Security, 117th Congress, October 26, 2021, https://
www.commerce.senate.gov/2021/10/protecting-kids-online-snapchat-tiktok-
and-youtube.
\11\Hearing on ``Protecting Kids Online: Instagram and Reforms for
Young Users,'' U.S. Senate Committee on Commerce, Science, and
Transportation, Subcommittee on Consumer Protection, Product Safety,
and Data Security, 117th Congress, December 8, 2021, https://
www.commerce.senate.gov/2021/12/protecting-kids-online-instagram-and-
reforms-for-young-users.
---------------------------------------------------------------------------
S. 836 would respond to the evidence that Congress must
update COPPA to better protect both children and teens online.
Summary of Provisions
S. 836 would do the following:
Expand the requirements under COPPA to individuals
aged 13 to 16.
Extend an operator's scope of liability beyond
actual knowledge that the operator is collecting
personal information from a child to also include
``knowledge fairly implied on the basis of objective
circumstances'' that they are collecting personal
information from a child or teen.
Update the definitions of the term ``operator'' and
``personal information''.
Prohibit individual-specific advertising that is
targeted to children and teens.
Prohibit transfer or storage of children's or teens'
personal information outside the United States without
disclosing such transfer or storage to the child or
teen.
Prohibit retention of personal information for
longer than reasonably necessary to fulfill a
transaction or provide a requested service except as
authorized by Federal or State law.
Direct the FTC to amend its regulations under COPPA
to:
Require notice and consent for data collection of
teens.
Require verifiable consent from the child or teen
before using or disclosing a child or teen's data
for a reason not previously disclosed.
Allow parents or teens to request descriptions of
the personal data collected by an operator and to
request deletion of such information.
Allow parents or teens to challenge and request
correction of inaccurate data from a child or teen.
Require reasonable security practices to protect
children and teens' personal information.
Require operators to delete personal information
about a teen at the request of the teen; and
prohibit the discontinuation of service to a child
or teen based on the parent's or teen's exercise of
the right to require deletion of personal
information.
Modify COPPA's preemption clause to preempt any
conflicting State laws or regulations while clarifying
that the title does not prohibit States from enacting
more protective laws or regulations.
Direct the FTC to submit annual reports to Congress
on actions brought, investigations or inquiries into
violations or potential violations of COPPA, complaints
received regarding alleged violations, and policy or
legislative recommendations to strengthen online
protections for children and teens.
Direct the U.S. Comptroller General to conduct a
study and submit a report to Congress on the privacy
and mental health of teens who use financial technology
products and include recommendations for legislation
and administrative action as deemed appropriate.
Legislative History
S. 836 was introduced on March 4, 2025, by Senator Markey
(for himself and Senators Cassidy, Cantwell, Schatz, Capito,
Klobuchar, Crapo, Wyden, Grassley, Lujan, Blumenthal, Merkley,
Welch, King, Kelly, Britt, and Heinrich) and was referred to
the Committee on Commerce, Science, and Transportation of the
Senate. Senators Ossoff, Schumer, Cornyn, Kim, and McCormick
are additional cosponsors. On June 25, 2025, the Committee met
in open Executive Session and, by voice vote, ordered S. 836
reported favorably with amendments.
118th Congress
S. 1418, the Children and Teens' Online Privacy Protection
Act, was introduced on May 3, 2023, by Senator Markey (for
himself and Senator Cassidy) and was referred to the Committee
on Commerce, Science, and Transportation of the Senate. On July
27, 2023, the Committee met in open Executive Session and, by
voice vote, ordered S. 1418 reported favorably with an
amendment (in the nature of a substitute). Senators Cantwell,
Cruz, Crapo, Blumenthal, Butler, Capito, King, Klobuchar,
Lujan, Manchin, Peters, Schatz, Welch, Wyden, Heinrich, Lee,
Britt, Cornyn, Ossoff, Merkley, and Grassley were later added
as cosponsors.
After S. 1418 was reported favorably with an amendment (in
the nature of a substitute), that bill was bundled with the
text of S. 1409, the Kids Online Safety Act, into a new
standalone bill: S. 2073, the Kids Online Safety and Privacy
Act. On July 30, 2024, the Senate passed S. 2073 by a vote of
91-3.
117th Congress
S. 1628, the Children and Teens' Online Privacy Protection
Act, was introduced on May 13, 2021, by Senator Markey (for
himself and Senator Cassidy) and was referred to the Committee
on Commerce, Science, and Transportation of the Senate.
Senators Blumenthal and Lummis were additional cosponsors. On
July 27, 2022, the Committee met in open Executive Session and,
by voice vote, ordered S. 1628 reported favorably with an
amendment (in the nature of a substitute).
Estimated Costs
In accordance with paragraph 11(a) of rule XXVI of the
Standing Rules of the Senate and section 403 of the
Congressional Budget Act of 1974, the Committee provides the
following cost estimate, prepared by the Congressional Budget
Office:
The bill would:
Establish or expand online protections for
some minors and require the Federal Trade Commission
(FTC) to supervise providers and enforce violations of
the bill's provisions
Direct the FTC and the Government
Accountability Office to study and report to the
Congress on the online privacy of some minors
Impose intergovernmental and private-sector
mandates
Estimated budgetary effects would mainly stem from:
Increases in revenues from additional
collections of civil monetary penalties
Spending subject to appropriation for the
FTC to supervise and enforce the bill's privacy
protections
Bill summary: S. 836 would amend provisions of the
Children's Online Privacy Protection Act (COPPA) to establish
new protections for children under the age of 13 and to extend
protections to teenagers under the age of 17. Operators of
websites, online services, and mobile applications that collect
or maintain user data, allow others to collect such data, or
allow users to publicly disclose personal information would be
subject to the bill's requirements.
The bill would prohibit operators from collecting, using,
maintaining, or disclosing to third parties the personal
information of any user under the age of 17 for the purpose of
direct advertising. S. 836 also would prohibit operators from
storing or transferring such information outside the United
States without notification and from retaining such information
for longer than reasonably necessary. Operators that fail to
meet those requirements could be subject to civil monetary
penalties.
Operators also would need to obtain verifiable consent from
a parent of any user under the age of 13, or the teenager under
the age of 17, before using or disclosing that information for
any purpose other than originally disclosed. Upon request,
operators would need to provide those parents or teenagers with
a means to access the information and an opportunity for the
information to be deleted.
S. 836 would direct the Federal Trade Commission (FTC) to
study and report on the feasibility of allowing a single
operator to obtain verifiable consent from a parent of users
under the age of 13, or teenagers under the age of 17, on
behalf of multiple operators that provide related services. If
the FTC determines that such common, verifiable consent is
viable, the commission would be required to issue regulations
permitting its use.
The bill would instruct the FTC to report to the Congress,
within three years of enactment, on how platforms directed at
children under the age of 13 comply with the bill and to report
annually on investigations or enforcement undertaken in the
prior year.
Finally, S. 836 would require the Government Accountability
Office to study and report to the Congress on the effects of
the use of financial technology products on the privacy and
mental health of teenagers under the age of 17.
Estimated Federal cost: The estimated budgetary effect of
S. 836 is shown in Table 1. The costs of the legislation fall
within budget function 370 (commerce and housing credit).
TABLE 1.--ESTIMATED BUDGETARY EFFECTS OF S. 836
--------------------------------------------------------------------------------------------------------------------------------------------------------
By fiscal year, millions of dollars--
-------------------------------------------------------------------------------------
2026- 2026-
2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2030 2035
--------------------------------------------------------------------------------------------------------------------------------------------------------
INCREASES IN REVENUES
Estimated Revenues................................................ 0 0 7 15 23 23 24 24 24 24 45 164
INCREASES IN SPENDING SUBJECT TO APPROPRIATION
Estimated Authorization........................................... * 3 4 5 4 n.e. n.e. n.e. n.e. n.e. 16 n.e.
Estimated Outlays................................................. * 3 4 5 4 n.e. n.e. n.e. n.e. n.e. 16 n.e.
--------------------------------------------------------------------------------------------------------------------------------------------------------
n.e. = not estimated; *= between zero and $500,000.
Basis of estimate: CBO assumes that S. 836 will be enacted
in fiscal year 2026.
Revenues: S. 836 would authorize the FTC to collect civil
monetary penalties from businesses found to violate the bill's
provisions, along with pursuing other remedies. Civil monetary
penalties are generally remitted to the Treasury and recorded
as revenues.
The bill would expand the scope of COPPA and nearly double
the covered population by adding teenagers under the age of 17,
who tend to use online services and applications more
intensively than do younger children. CBO estimates, based on a
review of past enforcement actions reported by the FTC, that
civil monetary penalties ordered for violations of COPPA
averaged $50 million per year over the last 10 years. On that
basis, and accounting for the estimated number of newly covered
online and application users and for anticipated inflation, CBO
estimates that the FTC would collect an additional $164 million
in revenues from penalties collected over the 2026-2035 period.
Spending subject to appropriation: Using information from
the FTC and based on the costs of similar activities, CBO
estimates that, in total, implementing S. 836 would cost $16
million over the 2026-2030 period. Any related spending would
be subject to the availability of appropriated funds. Those
costs, detailed below, are based on information from the FTC,
including the average cost of an employee in 2026 ($240,000),
and account for anticipated inflation.
CBO expects that the FTC would need seven
employees in 2026 and 2027 to issue the required rules
and guidance at a cost of $2 million.
CBO estimates that the FTC would need 15 new
employees to supervise the bill's implementation and
enforce its requirements starting in 2028, at a total
cost of $11 million over the 2026-2030 period.
CBO also estimates that it would cost the
FTC and the Government Accountability Office $3 million
over the 2026-2030 period to complete the required
studies and reports.
CBO cannot determine whether the FTC will consider common,
verifiable consent to be feasible, so the costs associated with
potential rulemaking for that activity are not reflected in
this estimate. If the FTC issues such regulations, CBO expects
that the amounts estimated for spending subject to
appropriation would be higher than shown here.
Pay-As-You-Go considerations: The Statutory Pay-As-You-Go
Act of 2010 establishes budget-reporting and enforcement
procedures for legislation affecting direct spending or
revenues. The net changes in revenues that are subject to those
pay-as-you-go procedures are shown in Table 1.
Increase in long-term net direct spending and deficits: CBO
estimates that enacting S. 836 would not increase net direct
spending or on-budget deficits in any of the four consecutive
10-year periods beginning in 2036.
Mandates: S. 836 would impose intergovernmental and
private-sector mandates, as defined in the Unfunded Mandates
Reform Act (UMRA), on operators of websites, online services,
and mobile applications. CBO estimates that the cost of the
intergovernmental mandates would not exceed the threshold
established in UMRA ($103 million in 2025, adjusted annually
for inflation). Because much of the data on users of online
services is proprietary, CBO cannot determine if the costs to
comply with the private-sector mandates would exceed the UMRA
threshold ($206 million in 2025, adjusted annually for
inflation).
Preemption of state laws: S. 836 would impose an
intergovernmental mandate by explicitly preempting state laws
that conflict with the bill's provisions unless those laws
provide greater protection to people under the age of 17 than
would be provided under the bill. Although it would limit the
application of state and local laws, CBO estimates that the
preemption would impose no costs.
Collection and storage of data: The bill would impose
private-sector mandates by regulating the collection and
storage of some minors' data by operators of websites, online
services, and mobile applications. The bill would expand
existing rules for children under the age of 13 to cover
teenagers under the age of 17. The bill also would prohibit
operators from collecting personal information from those users
for the purpose of direct advertising. CBO estimates that the
cost for operators to stop collecting the data would be small.
Under UMRA, the cost of lost advertising revenue is not
considered a direct cost of complying with a mandate.
S. 836 would require operators to implement reasonable
security practices to protect the personal information of
children and teenagers under the age of 17. Based on discussion
with industry experts, CBO expects that the cost for operators
to comply with that requirement would be small because the data
industry already follows various federal and state laws
governing collection and storage of some types of data (such as
Social Security numbers and health information). To be
competitive in the business of data storage and collection,
most operators already follow reasonable security practices.
Finally, the bill would prohibit operators from collecting,
storing, or transferring the personal information of children
and teenagers under the age of 17 to a site outside of the
United States, without notifying a parent of the child or the
teenager. More than 200 million websites and mobile
applications are available worldwide, but information about
where they store data is proprietary as is information about
the ages of users and the volume of their interactions with
those sites and applications. Because of the significant
uncertainty that surrounds the number of users, mobile
applications and websites that would be subject to the
requirement, CBO cannot determine whether the cost of the
required notifications would exceed the threshold established
for private-sector mandates.
Estimate prepared by: Federal costs: Sean Christensen;
Revenues: Jennifer Shand; Mandates: Rachel Austin.
Estimate reviewed by: Justin Humphrey, Chief, Finance,
Housing, and Education Cost Estimates Unit; Joshua Shakin,
Chief, Revenue Projections Unit; Kathleen FitzGerald, Chief,
Public and Private Mandates Unit; H. Samuel Papenfuss, Deputy
Director of Budget Analysis.
Estimate approved by: Phillip L. Swagel, Director,
Congressional Budget Office.
Regulatory Impact Statement
In accordance with paragraph 11(b) of rule XXVI of the
Standing Rules of the Senate, the Committee provides the
following evaluation of the regulatory impact of the
legislation, as reported:
NUMBER OF PERSONS COVERED
The number of persons covered by S. 836 would equal the sum
of the following individuals and entities and any employees
retained by them: (1) operators of internet websites, online
services, online applications, or mobile applications; (2) the
Federal Trade Commission; (3) State Attorneys General; and (4)
the U.S. Comptroller General.
ECONOMIC IMPACT
S. 836 is not expected to have significant economic impact
outside of any costs to or changes in revenue for operators
that result from: (1) expanding COPPA's requirements to teens
ages 13 to 16; (2) prohibiting individual-specific advertising
directed at children or teens; (3) allowing parents, children,
or teens to request information on, corrections to, or deletion
of a child or teen's personal information; or (4) complying
with the notice and disclosure requirements provided in the
bill.
PRIVACY
S. 836 is expected to strengthen the privacy of children
and teens online. It would do so by strengthening and expanding
protections relating to the online collection, use, and
disclosure of personal information of children and teens.
PAPERWORK
Operators of online systems would be required to provide
clear and conspicuous notice on their websites regarding the
rights and opportunities available to the parent of a child or
teen to ensure that personal information is collected in
accordance with the regulations promulgated under this Act.
The FTC would be required to submit two reports to Congress
on: (1) the processes of platforms that offer mobile and online
applications for ensuring that, of those applications that are
websites, online services, online applications, or mobile
applications directed to children, the applications operate in
accordance with COPPA, COPPA's rules, and any rules relating to
unfair or deceptive acts or practices in marketing; and (2) the
number of actions, investigations, and complaints brought under
COPPA as well as future policy or legislative recommendations
to strengthen online protections for children and teens.
Finally, the Comptroller General of the United States would
be required to conduct a study on the privacy and mental health
of teens who use financial technology products, including the
types of financial technology products used by teens, teen
privacy and mental health risks for such products, and consider
whether existing laws are sufficient to address such risks.
Congressionally Directed Spending
In compliance with paragraph 4(b) of rule XLIV of the
Standing Rules of the Senate, the Committee provides that no
provisions contained in the bill, as reported, meet the
definition of congressionally directed spending items under the
rule.
Section-by-Section Analysis
Section 1. Short title; table of contents.
This section would provide that the bill may be cited as
the ``Children and Teens' Online Privacy Protection Act''. It
would also provide a table of contents for the bill.
Section 2. Online collection, use, disclosure, and deletion of personal
information of children and teens.
This section would amend the Children's Online Privacy
Protection Act of 1998 (COPPA) by updating the current
statutory definitions for the terms ``operator'', ``personal
information'', and ``verifiable consent''. Notably, it would
update the definition of the term ``personal information'' to
expressly exclude an audio file that contains a child's or
teen's voice, which is consistent with the FTC's 2017 Policy
Enforcement Statement. Further, this section would update the
definition of website or online service directed to children
(renamed website, online service, online application, or mobile
application directed to children) to codify the totality of
circumstances test that is currently used by FTC when
determining whether an operator meets this definition.
This section would also add the following new definitions
to COPPA: the terms ``connected device'', ``online
application'', ``mobile application'', ``geolocation
information'', ``teen'', ``individual-specific advertising to
children or teens'', and ``educational agency or institution''.
Notably the term ``individual-specific advertising to children
or teens'' would exclude advertising or marketing based on an
individual's response to a specific request for information or
feedback, contextual advertising not based on personal
information, processing personal information solely for
measuring or reporting advertising or content performance, or
advertising or marketing directed to a connected device used by
both adult and child or teen members of a household where such
advertising or marketing is directed to the profile of the
adult. It would also provide that such term ``individual-
specific advertising to children or teens'' shall not be
construed to prohibit an operator from delivering advertising
or marketing that is age-appropriate and intended for a child
or teen audience, so long as the operator does not use any
personal information other than whether the user is under the
age of 17.
This section would also expand certain requirements under
COPPA (and those new requirements added by this Act) to also
apply to teens ages 13 to 16 (in addition to children under
13). Additionally, this section would amend the knowledge
standard to be actual knowledge or knowledge fairly implied on
the basis of objective circumstances. It would also make it
unlawful for an operator of an online system (website, service,
or online or mobile application) directed at a child or any
operator of an online system with actual knowledge or knowledge
fairly implied on the basis of objective circumstances that a
user is a child or teen to:
Collect personal information that violates this Act;
Collect, use, maintain or disclose personal
information of a child or teen for purposes of
individual-specific advertising to children or teens;
Collect personal information of a child or teen
except in specified circumstances;
Store or transfer the personal information of a
child or teen outside of the United States without
notice to the parent; or
Retain the personal information of a child or teen
for longer than reasonably necessary to fulfill a
transaction or provide a service as requested.
This section would also provide the requirements for how an
operator may comply with the verifiable consent requirements
under COPPA when acting under a written agreement with an
educational agency or institution.
This section would require that operators provide clear and
conspicuous notice on their websites regarding the rights and
opportunities available to the parent of a child or teen to
ensure that personal information is collected in accordance
with the regulations promulgated under this Act. This section
would further require that the operator provide a child,
parents of the child, or teen with the opportunity to delete,
or modify for accuracy, personal information collected from the
teen or child. Such deletion would not limit the authority of a
law enforcement agency or require an operator to delete
information of another user information required to be retained
by law.
This section would also expand COPPA's existing data
security requirement for operators to protect the
confidentiality, integrity, and accessibility of personal
information of children or teens collected by the operator and
to protect such information from unauthorized access.
This section would also require the FTC to assess the
feasibility of allowing operators the option to use a common
verifiable consent mechanism that fully meets the requirements
of this title.
This section would amend section 1304 of COPPA to expand
COPPA's safe harbor to include teens and to require the FTC to
publish any report or documentation required by regulation to
carry out this Act unless otherwise specified.
This section would also amend COPPA's existing preemption
provision to preempt any conflicting State laws or regulations,
while clarifying that the title does not prohibit States from
enacting more protective laws or regulations. It would also
amend section 1305 of COPPA to allow States to take the same
actions as the FTC related to the online collection, use,
disclosure, and deletion of personal information of children
and teens.
This section would amend section 1306 of COPPA to clarify
that an appropriate Federal banking agency has jurisdiction
over bank compliance with the Act and the updated sections.
This section would require the FTC to provide guidance
within 180 days on best practices and examples for operators to
understand the FTC determination of whether an operator has
knowledge fairly implied on the basis of objective
circumstances that a user is a child or teen. This standard
would require the FTC or respective State attorney general,
when making a determination, to rely on competent and reliable
empirical evidence taking into account the totality of
circumstances, including whether a reasonable and prudent
person under the circumstances would have known that the user
was a child or teen. Such a determination could not be
construed to require an operator to collect additional
information on a child or teen or to implement an age gating or
age verification functionality.
Finally, this section would restrict the ability of the FTC
or State attorneys general to use non-compliance with the
guidance as evidence that an act or practice violates this
title.
Section 3. Study and reports of mobile and online application oversight
and enforcement.
This section would direct the FTC to submit to Congress a
report within 3 years of the effective date on mobile app and
online app compliance with this Act and rules promulgated by
the FTC. It would further direct the FTC to submit annual
reports to Congress on the number of actions and open
investigations by the FTC brought under COPPA, the nature of
the complaints related to COPPA, and policy or legislative
recommendations to strengthen online protections for children
and teens.
Section 4. GAO study.
This section would require the Comptroller General of the
United States to conduct a study on the privacy and mental
health of teens who use financial technology products, noting
the types of financial technology products used by teens, teen
privacy and mental health risks from using such products, and
considering whether existing laws are sufficient to address
such risks. No later than 1 year after enactment, the
Comptroller General would be required to submit to Congress a
report of the results of the study along with recommendations
for legislative and administrative actions as appropriate.
Section 5. Severability.
This section would require that if any provision of this
Act is determined to be unenforceable or invalid, the remaining
provisions of this Act shall not be affected.
Changes in Existing Law
In compliance with paragraph 12 of rule XXVI of the
Standing Rules of the Senate, changes in existing law made by
the bill, as reported, are shown as follows (existing law
proposed to be omitted is enclosed in black brackets, new
material is printed in italic, existing law in which no change
is proposed is shown in roman):
CHILDREN'S ONLINE PRIVACY PROTECTION ACT OF 1998
* * * * * * *
DIVISION C--OTHER MATTERS
* * * * * * *
TITLE XIII--CHILDREN'S ONLINE PRIVACY PROTECTION
* * * * * * *
[15 U.S.C. 6501]
SEC. 1302. DEFINITIONS.
In this title:
(1) Child.--The term ``child'' means an individual
under the age of 13.
[(2) Operator.--The term ``operator''--
[(A) means any person who operates a
website located on the Internet or an online
service and who collects or maintains personal
information from or about the users of or
visitors to such website or online service, or
on whose behalf such information is collected
or maintained, where such website or online
service is operated for commercial purposes,
including any person offering products or
services for sale through that website or
online service, involving commerce--
[(i) among the several States or
with 1 or more foreign nations;
[(ii) in any territory of the
United States or in the District of
Columbia, or between any such territory
and--
[(I) another such
territory; or
[(II) any State or foreign
nation; or
[(iii) between the District
of Columbia and any State,
territory, or foreign nation;
but
[(B) does not include any nonprofit entity
that would otherwise be exempt from coverage
under section 5 of the Federal Trade Commission
Act (15 U.S.C. 45).]
(2) Operator.--The term ``operator''--
(A) means any person--
(i) who, for commercial purposes,
in interstate or foreign commerce
operates or provides a website on the
internet, an online service, an online
application, or a mobile application;
and
(ii) who--
(I) collects or maintains,
either directly or through a
service provider, personal
information from or about the
users of that website, service,
or application;
(II) allows another person
to collect personal information
directly from users of that
website, service, or
application (in which case, the
operator is deemed to have
collected the information); or
(III) allows users of that
website, service, or
application to publicly
disclose personal information
(in which case, the operator is
deemed to have collected the
information); and
(B) does not include any nonprofit entity
that would otherwise be exempt from coverage
under section 5 of the Federal Trade Commission
Act (15 U.S.C. 45).
(3) Commission.--The term ``Commission'' means the
Federal Trade Commission.
(4) Disclosure.--The term ``disclosure'' means,
with respect to personal information--
[(A) the release of personal information
collected from a child in identifiable form by
an operator for any purpose,except where such
information is provided to a person other than the operator who
provides support for the internal operations of the website and does
not disclose or use that information for any other purpose; and]
(A) the release of personal information
collected from a child or teen by an operator
for any purpose, except where the personal
information is provided to a person other than
an operator who--
(i) provides support for the
internal operations of the website,
online service, online application, or
mobile application of the operator,
excluding any activity relating to
individual-specific advertising to
children or teens; and
(ii) does not disclose or use that
personal information for any other
purpose; and
(B) making personal information collected
from a child or teen by a [website or online
service] website, online service, online
application, or mobile application directed to
children or with [actual knowledge] actual
knowledge or knowledge fairly implied on the
basis of objective circumstances that such
information was collected from a child or teen,
publicly available in identifiable form, by any
means including by a public posting, through
the Internet, or through--
(i) a home page of a website;
(ii) a pen pal service;
(iii) an electronic mail service;
(iv) a message board; or
(v) a chat room.
(5) Federal agency.--The term ``Federal agency''
means an agency, as that term is defined in section
551(1) of title 5, United States Code.
(6) Internet.--The term ``Internet'' means
collectively the myriad of computer and
telecommunications facilities, including equipment and
operating software, which comprise the interconnected
world-wide network of networks that employ the
Transmission Control Protocol/Internet Protocol, or any
predecessor or successor protocols to such protocol, to
communicate information of all kinds by wire or radio.
(7) Parent.--The term ``parent'' includes a legal
guardian.
[(8) Personal information.--The term ``personal
information'' means individually identifiable
information about an individual collected online,
including--
[(A) a first and last name;
[(B) a home or other physical address
including street name and name of a city or
town;
[(C) an e-mail address;
[(D) a telephone number;
[(E) a Social Security number;
[(F) any other identifier that the
Commission determines permits the physical or
online contacting of a specific individual; or
[(G) information concerning the child or
the parents of that child that the website
collects online from the child and combines
with an identifier described in this
paragraph.]
(8) Personal information.--
(A) In general.--The term ``personal
information'' means individually identifiable
information about an individual collected
online, including--
(i) a first and last name;
(ii) a home or other physical
address including street name and name
of a city or town;
(iii) an e-mail address;
(iv) a telephone number;
(v) a Social Security number;
(vi) any other identifier that the
Commission determines permits the
physical or online contacting of a
specific individual;
(vii) a persistent identifier that
can be used to recognize a specific
child or teen over time and across
different websites, online services,
online applications, or mobile
applications, including but not limited
to a customer number held in a cookie,
an Internet Protocol (IP) address, a
processor or device serial number, or
unique device identifier, but excluding
an identifier that is used by an
operator solely for providing support
for the internal operations of the
website, online service, online
application, or mobile application;
(viii) a photograph, video, or
audio file where such file contains a
specific child's or teen's image or
voice;
(ix) geolocation information;
(x) information generated from the
measurement or technological processing
of an individual's biological,
physical, or physiological
characteristics that is used to
identify an individual, including--
(I) fingerprints;
(II) voice prints;
(III) iris or retina
imagery scans;
(IV) facial templates;
(V) deoxyribonucleic acid
(DNA) information; or
(VI) gait; or
(xi) information linked or
reasonably linkable to a child or teen
or the parents of that child or teen
(including any unique identifier) that
an operator collects online from the
child or teen and combines with an
identifier described in this
subparagraph.
(B) Exclusion.--The term ``personal
information'' shall not include an audio file
that contains a child's or teen's voice so long
as the operator--
(i) does not request information
via voice that would otherwise be
considered personal information under
this paragraph;
(ii) provides clear notice of its
collection and use of the audio file
and its deletion policy in its privacy
policy;
(iii) only uses the voice within
the audio file solely as a replacement
for written words, to perform a task,
or engage with a website, online
service, online application, or mobile
application, such as to perform a
search or fulfill a verbal instruction
or request; and
(iv) only maintains the audio file
long enough to complete the stated
purpose and then immediately deletes
the audio file and does not make any
other use of the audio file prior to
deletion.
(C) Support for the internal operations of
a website, online service, online application,
or mobile application.--
(i) In general.--For purposes of
subparagraph (A)(vii), the term
``support for the internal operations
of a website, online service, online
application, or mobile application''
means those activities necessary to--
(I) maintain or analyze the
functioning of the website,
online service, online
application, or mobile
application;
(II) perform network
communications;
(III) authenticate users
of, or personalize the content
on, the website, online
service, online application, or
mobile application;
(IV) serve contextual
advertising, provided that any
persistent identifier is only
used as necessary for technical
purposes to serve the
contextual advertisement, or
cap the frequency of
advertising;
(V) protect the security or
integrity of the user, website,
online service, online
application, or mobile
application;
(VI) ensure legal or
regulatory compliance, or
(VII) fulfill a request of
a child or teen as permitted by
subparagraphs (A) through (C)
of section 1303(b)(2).
(ii) Condition.--Except as
specifically permitted under clause
(i), information collected for the
activities listed in clause (i) cannot
be used or disclosed to contact a
specific individual, including through
individual-specific advertising to
children or teens, to amass a profile
on a specific individual, in connection
with processes that encourage or prompt
use of a website or online service, or
for any other purpose.
[(9) Verifiable parental consent.--The term
``verifiable parental consent'' means any reasonable
effort (taking into consideration available
technology), including a request for authorization for
future collection, use, and disclosure described in the
notice, to ensure that a parent of a child receives
notice of the operator's personal information
collection, use, and disclosure practices, and
authorizes the collection, use, and disclosure, as
applicable, of personal information and the subsequent
use of that information before that information is
collected from that child.]
(9) Verifiable consent.--The term ``verifiable
consent'' means any reasonable effort (taking into
consideration available technology), including a
request for authorization for future collection, use,
and disclosure described in the notice, to ensure that,
in the case of a child, a parent of the child, or, in
the case of a teen, the teen--
(A) receives direct notice of the personal
information collection, use, and disclosure
practices of the operator; and
(B) before the personal information of the
child or teen is collected, freely and
unambiguously authorizes--
(i) the collection, use, and
disclosure, as applicable, of that
personal information; and
(ii) any subsequent use of that
personal information.
(10) [Website or online service directed to
children] Website, online service, online application,
or mobile application directed to children.--
(A) In general.--The term ``website, online
service, online application, or mobile
application [``website or online service]
directed to children'' means--]
(i) a commercial [website or online
service] website, online service,
online application, or mobile
application that is targeted to
children; or
(ii) that portion of a commercial
[website or online service] website,
online service, online application, or
mobile application that is targeted to
children.
(B) Limitation.--A commercial [website or
online service] website, online service, online
application, or mobile application, or a
portion of a commercial [website or online
service] website, online service, online
application, or mobile application, shall not
be deemed directed to children solely for
referring or linking to a commercial [website
or online service] website, online service,
online application, or mobile application
directed to children by using information
location tools, including a directory, index,
reference, pointer, or hypertext link.
(C) Rule of construction.--In considering
whether a website, online service, online
application, or mobile application, or portion
thereof, is directed to children, the
Commission shall apply a totality of
circumstances test and will also consider
competent and reliable empirical evidence
regarding audience composition and evidence
regarding the intended audience of the website,
online service, online application, or mobile
application.
(11) Person.--The term ``person'' means any
individual, partnership, corporation, trust, estate,
cooperative, association, or other entity.
(12) Online contact information.--The term ``online
contact information'' means an e-mail address or
another substantially similar identifier that permits
direct contact with a person online.
(13) Connected device.--The term ``connected
device'' means a device that is capable of connecting
to the internet, directly or indirectly, or to another
connected device.
(14) Online application.--The term ``online
application''--
(A) means an internet-connected software
program; and
(B) includes a service or application
offered via a connected device.
(15) Mobile application.--The term ``mobile
application''--
(A) means a software program that runs on
the operating system of--
(i) a cellular telephone;
(ii) a tablet computer; or
(iii) a similar portable computing
device that transmits data over a
wireless connection; and
(B) includes a service or application
offered via a connected device.
(16) Geolocation information.--The term
``geolocation information'' means information
sufficient to identify a street name and name of a city
or town.
(17) Teen.--The term ``teen'' means an individual
who has attained age 13 and is under the age of 17.
(18) Individual-specific advertising to children or
teens.--
(A) In general.--The term ``individual-
specific advertising to children or teens''
means advertising or any other effort to market
a product or service that is directed to a
specific child or teen or a connected device
that is linked or reasonably linkable to a
child or teen based on--
(i) the personal information from--
(I) the child or teen; or
(II) a group of children or
teens who are similar in sex,
age, household income level,
race, or ethnicity to the
specific child or teen to whom
the product or service is
marketed;
(ii) profiling of a child or teen
or group of children or teens; or
(iii) a unique identifier of the
connected device.
(B) Exclusions.--The term ``individual-
specific advertising to children or teens''
shall not include--
(i) advertising or marketing to an
individual or the device of an
individual in response to the
individual's specific request for
information or feedback, such as a
child's or teen's current search query;
(ii) contextual advertising, such
as when an advertisement is displayed
based on the content of the website,
online service, online application,
mobile application, or connected device
in which the advertisement appears and
does not vary based on personal
information related to the viewer; or
(iii) processing personal
information solely for measuring or
reporting advertising or content
performance, reach, or frequency,
including independent measurement; or
(iv) advertising or marketing
directed to a connected device used by
both adult and child or teen members of
a household where such advertising or
marketing is directed to the profile of
the adult user.
(C) Rule of construction.--Nothing in
subparagraph (A) shall be construed to prohibit
an operator with actual knowledge or knowledge
fairly implied on the basis of objective
circumstances that a user is under the age of
17 from delivering advertising or marketing
that is age-appropriate and intended for a
child or teen audience, so long as the operator
does not use any personal information other
than whether the user is under the age of 17.
(19) Educational agency or institution.--The term
``educational agency or institution'' means--
(A) a State educational agency or local
educational agency, as such terms are defined
in section 8101 of the Elementary and Secondary
Education Act of 1965 (20 U.S.C. 7801); or
(B) an institutional day or residential
school, including a public school (including a
charter school) or private school, that
provides elementary or secondary education, as
determined under State law.
[15 U.S.C. 6502]
SEC. 1303. [REGULATION OF UNFAIR AND DECEPTIVE ACTS AND PRACTICES IN
CONNECTION WITH THE COLLECTION AND USE OF PERSONAL
INFORMATION FROM AND ABOUT CHILDREN ON THE
INTERNET.] ONLINE COLLECTION, USE, DISCLOSURE, AND
DELETION OF PERSONAL INFORMATION OF CHILDREN AND
TEENS.
(a) Acts Prohibited.--
[(1) In general.--It is unlawful for an operator of
a website or online service directed to children, or
any operator that has actual knowledge that it is
collecting personal information from a child, to
collect personal information from a child in a manner
that violates the regulations prescribed under
subsection (b).]
(1) In general.--It is unlawful for an operator of
a website, online service, online application, or
mobile application directed to children or for any
operator of a website, online service, online
application, or mobile application with actual
knowledge or knowledge fairly implied on the basis of
objective circumstances that a user is a child or
teen--
(A) to collect personal information from a
child or teen in a manner that violates the
regulations prescribed under subsection (b);
(B) except as provided in subparagraphs (B)
and (C) of section 1302(18), to collect, use,
disclose to third parties, or maintain personal
information of a child or teen for purposes of
individual-specific advertising to children or
teens (or to allow another person to collect,
use, disclose, or maintain such information for
such purpose);
(C) to collect the personal information of
a child or teen except when the collection of
the personal information is--
(i) consistent with the context of
a particular transaction or service or
the relationship of the child or teen
with the operator, including collection
necessary to fulfill a transaction or
provide a product or service requested
by the child or teen; or
(ii) required or specifically
authorized by Federal or State law; or
(D) to store or transfer the personal
information of a child or teen outside of the
United States unless the operator provides
direct notice to the parent of the child, in
thecase of a child, or to the teen, in the case
of a teen, that the child's or teen's personal information is being
stored or transferred outside of the United States; or
(E) to retain the personal information of a
child or teen for longer than is reasonably
necessary to fulfill a transaction or provide a
service requested by the child or teen except
as required or specifically authorized by
Federal or State law.
(2) Disclosure to [parent] parent or teen
protected.--[Notwithstanding paragraph (1)]
Notwithstanding paragraph (1)(A), neither an operator
[of such a website or online service] nor the
operator's agent shall be held to be liable under any
Federal or State law for any disclosure made in good
faith and following reasonable procedures in responding
to a request for disclosure of personal information
under [subsection (b)(1)(B)(iii) to the parent of a
child] subsection (b)(1)(B)(iv) to the parent of a
child or under subsection (b)(1)(C)(iv) to a teen.
(b) Regulations.--
(1) In general.--Not later than 1 year after the
date of the enactment of this Act, the Commission shall
promulgate under section 553 of title 5, United States
Code, regulations that--
(A) require the [operator of any website or
online service directed to children that
collects personal information from children or
the operator of a website or online service
that has actual knowledge that it is collecting
personal information from a child] operator of
a website, online service, online application,
or mobile application directed to children or
that has actual knowledge or knowledge fairly
implied on the basis of objective circumstances
that a user is a child or teen--
(i) to provide [notice on the
website] clear and conspicuous notice
on the website of what information is
collected from children or teens by the
operator, how the operator uses such
information[, and the operator's], the
operator's disclosure practices for
such information[; and], the rights and
opportunities available to the parent
of the child or teen under
subparagraphs (B) and (C), and the
procedures or mechanisms the operator
uses to ensure that personal
information is not collected from
children or teens except in accordance
with the regulations promulgated under
this paragraph;
(ii) to obtain verifiable
[parental] consent for the collection,
use, or disclosure of personal
information from children or teens[;];
and
(iii) to obtain verifiable consent
from a parent of a child or from a teen
before using or disclosing personal
information of the child or teen for
any purpose that is a material change
from the original purposes and
disclosure practices specified to the
parent of the child or the teen under
clause (i);
(B) require the operator to provide, upon
request of a parent under this subparagraph
whose child has provided personal information
to that [website or online service] operator,
upon proper identification of that parent, to
such parent--
(i) a description of the specific
types of personal information collected
from the child by that operator and the
method by which the operator obtained
the personal information, and the
purposes for which the operator
collects, uses, discloses, and retains
the personal information;
(ii) the opportunity at any time to
delete personal information collected
from the child or content or
information submitted by the child to a
website, online service, online
application, or mobile application and
to refuse to permit the operator's
further use or maintenance in
retrievable form, or future online
collection, of personal information
from that child[; and];
(iii) the opportunity to challenge
the accuracy of the personal
information and, if the parent of the
child establishes the inaccuracy of the
personal information, to have the
inaccurate personal information
corrected;
[(iii)] (iv) notwithstanding any
other provision of law, a means that is
reasonable under the circumstances for
the parent to obtain any personal
information collected from that child,
if such information is available to the
operator at the time the parent makes
the request;
(C) require the operator to provide, upon
the request of a teen under this subparagraph
who has provided personal information to the
operator, upon proper identification of that
teen--
(i) a description of the specific
types of personal information collected
from the teen by the operator, the
method by which the operator obtained
the personal information, and the
purposes for which the operator
collects, uses, discloses, and retains
the personal information;
(ii) the opportunity at any time to
delete personal information collected
from the teen or content or information
submitted by the teen to a website,
online service, online application, or
mobile application and to refuse to
permit the operator's further use or
maintenance in retrievable form, or
online collection, of personal
information from the teen;
(iii) the opportunity to challenge
the accuracy of the personal
information and, if the teen
establishes the inaccuracy of the
personal information, to have the
inaccurate personal information
corrected; and
(iv) a means that is reasonable
under the circumstances for the teen to
obtain any personal information
collected from the teen, if such
information is available to the
operator at the time the teen makes the
request;
[(C)] (D) prohibit conditioning [a child's]
a child's or teen's participation in a game,
the offering of a prize, or another activity on
the child or teen disclosing more personal
information than is reasonably necessary to
participate in such activity; and
[(D)] (E) [require the operator of such a
website or online service to establish and
maintain reasonable procedures to protect the
confidentiality, security, and integrity of
personal information collected from children.]
require the operator to establish, implement,
and maintain reasonable security practices to
protect the confidentiality, integrity, and
accessibility of personal information of
children or teens collected by the operator,
and to protect such personal information
against unauthorized access.
(2) When consent not required.--The regulations
shall provide that [verifiable parental consent]
verifiable consent under paragraph (1)(A)(ii) is not
required in the case of--
(A) online contact information collected
from a child or teen that is used only to
respond directly on a one-time basis to a
specific request from the child or teen and is
not used to recontact the child or teen or to
contact another child or teen and is not
maintained in retrievable form by the operator;
(B) a request for the name or online
contact information of a [parent or child]
parent or teen that is used for the sole
purpose of obtaining [parental consent]
verifiable consent or providing notice under
this section and where such information is not
maintained in retrievable form by the operator
if [parental consent] verifiable consent is not
obtained after a reasonable time;
(C) online contact information collected
from a child or teen that is used only to
respond more than once directly to a specific
request from the child or teen and is not used
to recontact the child or teen beyond the scope
of that request--
(i) if, before any additional
response after the initial response to
the child or teen, the operator uses
reasonable efforts to provide a parent
or teen, as applicable, notice of the
online contact information collected
from the child or teen, the purposes
for which it is to be used, and an
opportunity for the parent or teen, as
applicable, to request that the
operator make no further use of the
information and that it not be
maintained in retrievable form; or
(ii) [without notice to the parent]
without notice to the parent or teen,
as applicable, in such circumstances as
the Commission may determine are
appropriate, taking into consideration
the benefits to the child or teen of
access to information and services, and
risks to the security and privacy of
the child or teen, in regulations
promulgated under this subsection;
(D) the name of the child or teen and
online contact information (to the extent
reasonably necessary to protect the safety of a
child or teen participant on the site)--
(i) used only for the purpose of
protecting such safety;
(ii) not used to recontact the
child or teen or for any other purpose;
and
(iii) not disclosed on the site,if
the operator uses reasonable efforts to
provide a parent or teen, as
applicable, notice of the name and
online contact information collected
from the child or teen, the purposes
for which it is to be used, and an
opportunity for the parent or teen, as
applicable, to request that the
operator make no further use of the
information and that it not be
maintained in retrievable form; or
(E) the collection, use, or dissemination
of such information by the operator of such a
website or online service necessary--
(i) to protect the security or
integrity of its website;
(ii) to take precautions against
liability;
(iii) to respond to judicial
process; or
(iv) to the extent permitted under
other provisions of law, to provide
information to law enforcement agencies
or for an investigation on a matter
related to public safety.
(3) Application to operators acting under
agreements with educational agencies or institutions.--
The regulations may provide that verifiable consent
under paragraph (1)(A)(ii) is not required for an
operator that is acting under a written agreement with
an educational agency or institution that, at a
minimum, requires the--
(A) operator to--
(i) limit its collection, use, and
disclosure of the personal information
from a child or teen to solely
educational purposes and for no other
commercial purposes;
(ii) provide the educational agency
or institution with a notice of the
specific types of personal information
the operator will collect from the
child or teen, the method by which the
operator will obtain the personal
information, and the purposes for which
the operator will collect, use,
disclose, and retain the personal
information;
(iii) provide the educational
agency or institution with a link to
the operator's online notice of
information practices as required under
subsection (b)(1)(A)(i); and
(iv) provide the educational agency
or institution, upon request, with a
means to review the personal
information collected from a child or
teen, to prevent further use or
maintenance or future collection of
personal information from a child or
teen, and to delete personal
information collected from a child or
teen or content or information
submitted by a child or teen to the
operator's website, online service,
online application, or mobile
application;
(B) representative of the educational
agency or institution to acknowledge and agree
that they have authority to authorize the
collection, use, and disclosure of personal
information from children or teens on behalf of
the educational agency or institution, along
with such authorization, their name, and title
at the educational agency or institution; and
(C) educational agency or institution to--
(i) provide on its website a notice
that identifies the operator with which
it has entered into a written agreement
under this subsection and provides a
link to the operator's online notice of
information practices as required under
paragraph (1)(A)(i);
(ii) provide the operator's notice
regarding its information practices, as
required under subparagraph (A)(ii),
upon request, to a parent, in the case
of a child, or a parent or teen, in the
case of a teen; and
(iii) upon the request of a parent,
in the case of a child, or a parent or
teen, in the case of a teen, request
the operator provide a means to review
the personal information from the child
or teen and provide the parent, in the
case of a child, or parent or teen, in
the case of the teen, a means to review
the personal information.
[(3)] (4) [Termination of service.--The regulations
shall permit the operator of a website or an online
service to terminate service provided to a child whose
parent has refused, under the regulations prescribed
under paragraph (1)(B)(ii), to permit the operator's
further use or maintenance in retrievable form, or
future online collection, of personal information from
that child.] Termination of service.--The regulations
shall permit the operator of a website, online service,
online application, or mobile application to terminate
service provided to a child whose parent has refused,
or a teen who has refused, under the regulations
prescribed under paragraphs (1)(B)(ii) and (1)(C)(ii),
to permit the operator's further use or maintenance in
retrievable form, or future online collection of,
personal information from that child or teen.
(5) Continuation of service.--The regulations shall
prohibit an operator from discontinuing service
provided to a child or teen on the basis of a request
by the parent of the child or by the teen, under the
regulations prescribed under subparagraph (B) or (C) of
paragraph (1), respectively, to delete personal
information collected from the child or teen, to the
extent that the operator is capable of providing such
service without such information.
(6) Rule of construction.--A request made pursuant
to subparagraph (B) or (C) of paragraph (1) to delete
or correct personal information of a child or teen
shall not be construed--
(A) to limit the authority of a law
enforcement agency to obtain any content or
information from an operator pursuant to a
lawfully executed warrant or an order of a
court of competent jurisdiction;
(B) to require an operator or third party
delete or correct information that--
(i) any other provision of Federal
or State law requires the operator or
third party to maintain; or
(ii) was submitted to the website,
online service, online application, or
mobile application of the operator by
any person other than the user who is
attempting to erase or otherwise
eliminate the content or information,
including content or information
submitted by the user that was
republished or resubmitted by another
person; or
(C) to prohibit an operator from--
(i) retaining a record of the
deletion request and the minimum
information necessary for the purposes
of ensuring compliance with a request
made pursuant to subparagraph (B) or
(C);
(ii) preventing, detecting,
protecting against, or responding to
security incidents, identity theft, or
fraud, or reporting those responsible
for such actions;
(iii) protecting the integrity or
security of a website, online service,
online application or mobile
application; or
(iv) ensuring that the child's or
teen's information remains deleted.
(7) Common verifiable consent mechanism.--
(A) In general.--
(i) Feasibility of mechanism.--The
Commission shall assess the
feasibility, with notice and public
comment, of allowing operators the
option to use a common verifiable
consent mechanism that fully meets the
requirements of this title.
(ii) Requirements.--The feasibility
assessment described in clause (i)
shall consider whether a single
operator could use a common verifiable
consent mechanism to obtain verifiable
consent, as required under this title,
from a parent of a child or from a teen
on behalf of multiple, listed operators
that provide a joint or related
service.
(B) Report.--Not later than 1 year after
the date of enactment of this paragraph, the
Commission shall submit a report to the
Committee on Commerce, Science, and
Transportation of the Senate and the Committee
on Energy and Commerce of the House of
Representatives with the findings of the
assessment required by subparagraph (A).
(C) Regulations.--If the Commission finds
that the use of a common verifiable consent
mechanism is feasible and would meet the
requirements of this title, the Commission
shall issue regulations to permit the use of a
common verifiable consent mechanism in
accordance with the findings outlined in such
report.
(c) Enforcement.--Subject to sections 1304 and 1306, a
violation of [a regulation prescribed under subsection (a)]
subparagraph (B), (C), (D), or (E) of subsection (a)(1), or of
a regulation prescribed under subsection (b), shall be treated
as a violation of a rule defining an unfair or deceptive act or
practice prescribed under section 18(a)(1)(B) of the Federal
Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
[(d) Inconsistent State Law.--No State or local government
may impose any liability for commercial activities or actions
by operators in interstate or foreign commerce in connection
with an activity or action described in this title that is
inconsistent with the treatment of those activities or actions
under this section.]
(d) Relationship to State Law.--The provisions of this
title shall preempt any State law, rule, or regulation only to
the extent that such State law, rule, or regulation conflicts
with a provision of this title. Nothing in this title shall be
construed to prohibit any State from enacting a law, rule, or
regulation that provides greater protection to children or
teens than the provisions of this title.
[15 U.S.C. 6503]
SEC. 1304. SAFE HARBORS.
(a) Guidelines.--An operator may satisfy the requirements
of regulations issued under section 1303(b) by following a set
of self-regulatory guidelines, issued by representatives of the
marketing or online industries, or by other persons, approved
under subsection (b).
(b) Incentives.--
(1) Self-regulatory incentives.--In prescribing
regulations under section 1303, the Commission shall
provide incentives for self-regulation by operators to
implement the protections afforded children and teens
under the regulatory requirements described in
subsection (b) of that section.
(2) Deemed compliance.--Such incentives shall
include provisions for ensuring that a person will be
deemed to be in compliance with the requirements of the
regulations under section 1303 if that person complies
with guidelines that, after notice and comment, are
approved by the Commission upon making a determination
that the guidelines meet the requirements of the
regulations issued under section 1303.
(3) Expedited response to requests.--The Commission
shall act upon requests for safe harbor treatment
within 180 days of the filing of the request, and shall
set forth in writing its conclusions with regard to
such requests.
(c) Appeals.--Final action by the Commission on a request
for approval of guidelines, or the failure to act within 180
days on a request for approval of guidelines, submitted under
subsection (b) may be appealed to a district court of the
United States of appropriate jurisdiction as provided for in
section 706 of title 5, United States Code.
(d) Publication.--
(1) In general.--Subject to the restrictions
described in paragraph (2), the Commission shall
publish on the internet website of the Commission any
report or documentation required by regulation to be
submitted to the Commission to carry out this section.
(2) Restrictions on publication.--The restrictions
described in section 6(f) and section 21 of the Federal
Trade Commission Act (15 U.S.C. 46(f), 57b-2)
applicable to the disclosure of information obtained by
the Commission shall apply in same manner to the
disclosure under this subsection of information
obtained by the Commission from a report or
documentation described in paragraph (1).
[15 U.S.C. 6504]
SEC. 1305. ACTIONS BY STATES.
(a) In General.--
(1) Civil actions.--In any case in which the
attorney general of a State has reason to believe that
an interest of theresidents of that State has been or
is threatened or adversely affected by the engagement of any person in
a practice that violates section 1303(a)(1) or any regulation of the
Commission prescribed under section 1303(b), the State, as parens
patriae, may bring a civil action on behalf of the residents of the
State in a district court of the United States of appropriate
jurisdiction to--
(A) enjoin that practice;
(B) enforce compliance with section
1303(a)(1) or the regulation;
(C) obtain damage, restitution, or other
compensation on behalf of residents of the
State; or
(D) obtain such other relief as the court
may consider to be appropriate.
(2) Notice.--
(A) In general.--Before filing an action
under paragraph (1), the attorney general of
the State involved shall provide to the
Commission--
(i) written notice of that action;
and
(ii) a copy of the complaint for
that action.
(B) Exemption.--
(i) In general.--Subparagraph (A)
shall not apply with respect to the
filing of an action by an attorney
general of a State under this
subsection, if the attorney general
determines that it is not feasible to
provide the notice described in that
subparagraph before the filing of the
action.
(ii) Notification.--In an action
described in clause (i), the attorney
general of a State shall provide notice
and a copy of the complaint to the
Commission at the same time as the
attorney general files the action.
(b) Intervention.--
(1) In general.--On receiving notice under
subsection (a)(2), the Commission shall have the right
to intervene in the action that is the subject of the
notice.
(2) Effect of intervention.--If the Commission
intervenes in an action under subsection (a), it shall
have the right--
(A) to be heard with respect to any matter
that arises in that action; and
(B) to file a petition for appeal.
(3) Amicus curiae.--Upon application to the court,
a person whose self-regulatory guidelines have been
approved by the Commission and are relied upon as a
defense by any defendant to a proceeding under this
section may file amicus curiae in that proceeding.
(c) Construction.--For purposes of bringing any civil
action under subsection (a), nothing in this title shall be
construed to prevent an attorney general of a State from
exercising the powers conferred on the attorney general by the
laws of that State to--
(1) conduct investigations;
(2) administer oaths or affirmations; or
(3) compel the attendance of witnesses or the
production of documentary and other evidence.
(d) Actions by the Commission.--In any case in which an
action is instituted by or on behalf of the Commission for
violation of section 1303(a)(1) or any regulation prescribed
under section 1303, no State may, during the pendency of that
action, institute an action under subsection (a) against any
defendant named in the complaint in that action for violation
of section 1303(a)(1) or that regulation.
(e) Venue; Service of Process.--
(1) Venue.--Any action brought under subsection (a)
may be brought in the district court of the United
States that meets applicable requirements relating to
venue under section 1391 of title 28, United States
Code.
(2) Service of process.--In an action brought under
subsection (a), process may be served in any district
in which the defendant--
(A) is an inhabitant; or
(B) may be found.
[15 U.S.C. 6505]
SEC. 1306. ADMINISTRATION AND APPLICABILITY OF ACT.
(a) In General.--Except as otherwise provided, this title
shall be enforced by the Commission under the Federal Trade
Commission Act (15 U.S.C. 41 et seq.).
(b) Provisions.--Compliance with the requirements imposed
under this title shall be enforced under--
(1) section 8 of the Federal Deposit Insurance Act
(12 U.S.C. 1818)[, in the case of--] by the appropriate
Federal banking agency, with respect to any insured
depository institution (as those terms are defined in
section 3 of that Act (12 U.S.C. 1813));
[(A) national banks, and Federal branches
and Federal agencies of foreign banks, by the
Office of the Comptroller of the Currency;
[(B) member banks of the Federal Reserve
System (other than national banks), branches
and agencies of foreign banks (other than
Federal branches, Federal agencies, and insured
State branches of foreign banks), commercial
lending companies owned or controlled by
foreign banks, and organizations operating
under section 25 or 25(a) of the Federal
Reserve Act (12 U.S.C. 601 et seq. and 611 et
seq.), by the Board; and
[(C) banks insured by the Federal Deposit
Insurance Corporation (other than members of
the Federal Reserve System) and insured State
branches of foreign banks, by the Board of
Directors of the Federal Deposit Insurance
Corporation;
[(2) section 8 of the Federal Deposit Insurance Act
(12 U.S.C. 1818), by the Director of the Office of
Thrift Supervision, in the case of a savings
association the deposits of which are insured by the
Federal Deposit Insurance Corporation;]
[(3)] (2) the Federal Credit Union Act (12 U.S.C.
1751 et seq.) by the National Credit Union
Administration Board with respect to any Federal credit
union;
[(4)] (3) part A of subtitle VII of title 49,
United States Code, by the Secretary of Transportation
with respect to any air carrier or foreign air carrier
subject to that part;
[(5)] (4) the Packers and Stockyards Act, 1921 (7
U.S.C. 181 et seq.) (except as provided in section 406
of that Act (7 U.S.C. 226, 227)), by the Secretary of
Agriculture with respect to any activities subject to
that Act; and
[(6)] (5) the Farm Credit Act of 1971 (12 U.S.C.
2001 et seq.) by the Farm Credit Administration with
respect to any Federal land bank, Federal land bank
association, Federal intermediate credit bank, or
production credit association.
(c) Exercise of Certain Powers.--For the purpose of the
exercise by any agency referred to in subsection (a) of its
powers under any Act referred to in that subsection, a
violation of any requirement imposed under this title shall be
deemed to be a violation of a requirement imposed under that
Act. In addition to its powers under any provision of law
specifically referred to in subsection (a), each of the
agencies referred to in that subsection may exercise, for the
purpose of enforcing compliance with any requirement imposed
under this title, any other authority conferred on it by law.
(d) Actions by the Commission.--The Commission shall
prevent any person from violating section 1303(a)(1) or a rule
of the Commission under section 1303 in the same manner, by the
same means, and with the same jurisdiction, powers, and duties
as though all applicable terms and provisions of the Federal
Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated
into and made a part of this title. Any entity that violates
[such rule] section 1303(a)(1) or a rule of the Commission
under section 1303 shall be subject to the penalties and
entitled to the privileges and immunities provided in the
Federal Trade Commission Act in the same manner, by the same
means, and with the same jurisdiction, power, and duties as
though all applicable terms and provisions of the Federal Trade
Commission Act were incorporated into and made a part of this
title.
(e) Effect on Other Laws.--Nothing contained in the Act
shall be construed to limit the authority of the Commission
under any other provisions of law.
(f) Determination of Whether an Operator Has Knowledge
Fairly Implied on the Basis of Objective Circumstances.--
(1) Rule of construction.--For purposes of
enforcing this title or a regulation promulgated under
this title, in making a determination as to whether an
operator has knowledge fairly implied on the basis of
objective circumstances that a specific user is a child
or teen, the Commission or State attorneys general
shall rely on competent and reliable evidence, taking
into account the totality of the circumstances,
including whether a reasonable and prudent person under
the circumstances would have known that the user is a
child or teen. Nothing in this title, including a
determination described in the preceding sentence,
shall be construed to require an operator to--
(A) affirmatively collect any personal
information with respect to the age of a child
or teen that an operator is not already
collecting in the normal course of business; or
(B) implement an age gating or age
verification functionality.
(2) Commission guidance.--
(A) In general.--Within 180 days of
enactment, the Commission shall issue guidance
to provide information, including best
practices and examples for operators to
understand the Commission's determination of
whether an operator has knowledge fairly
implied on the basis of objective circumstances
that a user is a child or teen.
(B) Limitation.--No guidance issued by the
Commission with respect to this title shall
confer any rights on any person, State, or
locality, nor shall operate to bind the
Commission or any person to the approach
recommended in such guidance. In any
enforcement action brought pursuant to this
title, the Commission or State attorney
general, as applicable, shall allege a specific
violation of a provision of this title. The
Commission or State attorney general, as
applicable, may not base an enforcement action
on, or execute a consent order based on,
practices that are alleged to be inconsistent
with any such guidance, unless the practices
allegedly violate this title. For purposes of
enforcing this title or a regulation
promulgated under this title, State attorneys
general shall take into account any guidance
issued by the Commission under subparagraph
(A).
(g) Additional Requirement.--Any regulations issued under
this title shall include a description and analysis of the
impact of proposed and final Rules on small entities per the
Regulatory Flexibility Act of 1980 (5 U.S.C. 601 et seq.).
* * * * * * *
[all]