No official summary available for this bill.
[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 836 Introduced in Senate (IS)]
<DOC>
119th CONGRESS
1st Session
S. 836
To amend the Children's Online Privacy Protection Act of 1998 to
strengthen protections relating to the online collection, use, and
disclosure of personal information of children and teens, and for other
purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
March 4, 2025
Mr. Markey (for himself, Mr. Cassidy, Ms. Cantwell, Mr. Schatz, Mrs.
Capito, Ms. Klobuchar, Mr. Crapo, Mr. Wyden, Mr. Grassley, Mr. Lujan,
Mr. Blumenthal, Mr. Merkley, Mr. Welch, Mr. King, Mr. Kelly, Mrs.
Britt, and Mr. Heinrich) introduced the following bill; which was read
twice and referred to the Committee on Commerce, Science, and
Transportation
_______________________________________________________________________
A BILL
To amend the Children's Online Privacy Protection Act of 1998 to
strengthen protections relating to the online collection, use, and
disclosure of personal information of children and teens, and for other
purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) Short Title.--This Act may be cited as the ``Children and
Teens' Online Privacy Protection Act''.
(b) Table of Contents.--The table of contents for this Act is as
follows:
Sec. 1. Short title; table of contents.
Sec. 2. Online collection, use, disclosure, and deletion of personal
information of children and teens.
Sec. 3. Study and reports of mobile and online application oversight
and enforcement.
Sec. 4. GAO study.
Sec. 5. Severability.
SEC. 2. ONLINE COLLECTION, USE, DISCLOSURE, AND DELETION OF PERSONAL
INFORMATION OF CHILDREN AND TEENS.
(a) Definitions.--Section 1302 of the Children's Online Privacy
Protection Act of 1998 (15 U.S.C. 6501) is amended--
(1) by amending paragraph (2) to read as follows:
``(2) Operator.--The term `operator'--
``(A) means any person--
``(i) who, for commercial purposes, in
interstate or foreign commerce operates or
provides a website on the internet, an online
service, an online application, or a mobile
application; and
``(ii) who--
``(I) collects or maintains, either
directly or through a service provider,
personal information from or about the
users of that website, service, or
application;
``(II) allows another person to
collect personal information directly
from users of that website, service, or
application (in which case, the
operator is deemed to have collected
the information); or
``(III) allows users of that
website, service, or application to
publicly disclose personal information
(in which case, the operator is deemed
to have collected the information); and
``(B) does not include any nonprofit entity that
would otherwise be exempt from coverage under section 5
of the Federal Trade Commission Act (15 U.S.C. 45).'';
(2) in paragraph (4)--
(A) by amending subparagraph (A) to read as
follows:
``(A) the release of personal information collected
from a child or teen by an operator for any purpose,
except where the personal information is provided to a
person other than an operator who--
``(i) provides support for the internal
operations of the website, online service,
online application, or mobile application of
the operator, excluding any activity relating
to individual-specific advertising to children
or teens; and
``(ii) does not disclose or use that
personal information for any other purpose;
and''; and
(B) in subparagraph (B)--
(i) by inserting ``or teen'' after
``child'' each place the term appears;
(ii) by striking ``website or online
service'' and inserting ``website, online
service, online application, or mobile
application''; and
(iii) by striking ``actual knowledge'' and
inserting ``actual knowledge or knowledge
fairly implied on the basis of objective
circumstances'';
(3) by striking paragraph (8) and inserting the following:
``(8) Personal information.--
``(A) In general.--The term `personal information'
means individually identifiable information about an
individual collected online, including--
``(i) a first and last name;
``(ii) a home or other physical address
including street name and name of a city or
town;
``(iii) an e-mail address;
``(iv) a telephone number;
``(v) a Social Security number;
``(vi) any other identifier that the
Commission determines permits the physical or
online contacting of a specific individual;
``(vii) a persistent identifier that can be
used to recognize a specific child or teen over
time and across different websites, online
services, online applications, or mobile
applications, including but not limited to a
customer number held in a cookie, an Internet
Protocol (IP) address, a processor or device
serial number, or unique device identifier, but
excluding an identifier that is used by an
operator solely for providing support for the
internal operations of the website, online
service, online application, or mobile
application;
``(viii) a photograph, video, or audio file
where such file contains a specific child's or
teen's image or voice;
``(ix) geolocation information;
``(x) information generated from the
measurement or technological processing of an
individual's biological, physical, or
physiological characteristics that is used to
identify an individual, including--
``(I) fingerprints;
``(II) voice prints;
``(III) iris or retina imagery
scans;
``(IV) facial templates;
``(V) deoxyribonucleic acid (DNA)
information; or
``(VI) gait; or
``(xi) information linked or reasonably
linkable to a child or teen or the parents of
that child or teen (including any unique
identifier) that an operator collects online
from the child or teen and combines with an
identifier described in this subparagraph.
``(B) Exclusion.--The term `personal information'
shall not include an audio file that contains a child's
or teen's voice so long as the operator--
``(i) does not request information via
voice that would otherwise be considered
personal information under this paragraph;
``(ii) provides clear notice of its
collection and use of the audio file and its
deletion policy in its privacy policy;
``(iii) only uses the voice within the
audio file solely as a replacement for written
words, to perform a task, or engage with a
website, online service, online application, or
mobile application, such as to perform a search
or fulfill a verbal instruction or request; and
``(iv) only maintains the audio file long
enough to complete the stated purpose and then
immediately deletes the audio file and does not
make any other use of the audio file prior to
deletion.
``(C) Support for the internal operations of a
website, online service, online application, or mobile
application.--
``(i) In general.--For purposes of
subparagraph (A)(vii), the term `support for
the internal operations of a website, online
service, online application, or mobile
application' means those activities necessary
to--
``(I) maintain or analyze the
functioning of the website, online
service, online application, or mobile
application;
``(II) perform network
communications;
``(III) authenticate users of, or
personalize the content on, the
website, online service, online
application, or mobile application;
``(IV) serve contextual
advertising, provided that any
persistent identifier is only used as
necessary for technical purposes to
serve the contextual advertisement, or
cap the frequency of advertising;
``(V) protect the security or
integrity of the user, website, online
service, online application, or mobile
application;
``(VI) ensure legal or regulatory
compliance, or
``(VII) fulfill a request of a
child or teen as permitted by
subparagraphs (A) through (C) of
section 1303(b)(2).
``(ii) Condition.--Except as specifically
permitted under clause (i), information
collected for the activities listed in clause
(i) cannot be used or disclosed to contact a
specific individual, including through
individual-specific advertising to children or
teens, to amass a profile on a specific
individual, in connection with processes that
encourage or prompt use of a website or online
service, or for any other purpose.'';
(4) by amending paragraph (9) to read as follows:
``(9) Verifiable consent.--The term `verifiable consent'
means any reasonable effort (taking into consideration
available technology), including a request for authorization
for future collection, use, and disclosure described in the
notice, to ensure that, in the case of a child, a parent of the
child, or, in the case of a teen, the teen--
``(A) receives direct notice of the personal
information collection, use, and disclosure practices
of the operator; and
``(B) before the personal information of the child
or teen is collected, freely and unambiguously
authorizes--
``(i) the collection, use, and disclosure,
as applicable, of that personal information;
and
``(ii) any subsequent use of that personal
information.'';
(5) in paragraph (10)--
(A) in the paragraph header, by striking ``Website
or online service directed to children'' and inserting
``Website, online service, online application, or
mobile application directed to children'';
(B) by striking ``website or online service'' each
place it appears and inserting ``website, online
service, online application, or mobile application'';
and
(C) by adding at the end the following new
subparagraph:
``(C) Rule of construction.--In considering whether
a website, online service, online application, or
mobile application, or portion thereof, is directed to
children, the Commission shall apply a totality of
circumstances test and will also consider competent and
reliable empirical evidence regarding audience
composition and evidence regarding the intended
audience of the website, online service, online
application, or mobile application.''; and
(6) by adding at the end the following:
``(13) Connected device.--The term `connected device' means
a device that is capable of connecting to the internet,
directly or indirectly, or to another connected device.
``(14) Online application.--The term `online application'--
``(A) means an internet-connected software program;
and
``(B) includes a service or application offered via
a connected device.
``(15) Mobile application.--The term `mobile application'--
``(A) means a software program that runs on the
operating system of--
``(i) a cellular telephone;
``(ii) a tablet computer; or
``(iii) a similar portable computing device
that transmits data over a wireless connection;
and
``(B) includes a service or application offered via
a connected device.
``(16) Geolocation information.--The term `geolocation
information' means information sufficient to identify a street
name and name of a city or town.
``(17) Teen.--The term `teen' means an individual who has
attained age 13 and is under the age of 17.
``(18) Individual-specific advertising to children or
teens.--
``(A) In general.--The term `individual-specific
advertising to children or teens' means advertising or
any other effort to market a product or service that is
directed to a specific child or teen or a connected
device that is linked or reasonably linkable to a child
or teen based on--
``(i) the personal information from--
``(I) the child or teen; or
``(II) a group of children or teens
who are similar in sex, age, household
income level, race, or ethnicity to the
specific child or teen to whom the
product or service is marketed;
``(ii) profiling of a child or teen or
group of children or teens; or
``(iii) a unique identifier of the
connected device.
``(B) Exclusions.--The term `individual-specific
advertising to children or teens' shall not include--
``(i) advertising or marketing to an
individual or the device of an individual in
response to the individual's specific request
for information or feedback, such as a child's
or teen's current search query;
``(ii) contextual advertising, such as when
an advertisement is displayed based on the
content of the website, online service, online
application, mobile application, or connected
device in which the advertisement appears and
does not vary based on personal information
related to the viewer; or
``(iii) processing personal information
solely for measuring or reporting advertising
or content performance, reach, or frequency,
including independent measurement.
``(C) Rule of construction.--Nothing in
subparagraph (A) shall be construed to prohibit an
operator with actual knowledge or knowledge fairly
implied on the basis of objective circumstances that a
user is under the age of 17 from delivering advertising
or marketing that is age-appropriate and intended for a
child or teen audience, so long as the operator does
not use any personal information other than whether the
user is under the age of 17.
``(19) Educational agency or institution.--The term
`educational agency or institution' means--
``(A) a State educational agency or local
educational agency, as such terms are defined in
section 8101 of the Elementary and Secondary Education
Act of 1965 (20 U.S.C. 7801); or
``(B) an institutional day or residential school,
including a public school (including a charter school)
or private school, that provides elementary or
secondary education, as determined under State law.''.
(b) Online Collection, Use, Disclosure, and Deletion of Personal
Information of Children and Teens.--Section 1303 of the Children's
Online Privacy Protection Act of 1998 (15 U.S.C. 6502) is amended--
(1) by striking the heading and inserting the following:
``online collection, use, disclosure, and deletion of personal
information of children and teens.'';
(2) in subsection (a)--
(A) by amending paragraph (1) to read as follows:
``(1) In general.--It is unlawful for an operator of a
website, online service, online application, or mobile
application directed to children or for any operator of a
website, online service, online application, or mobile
application with actual knowledge or knowledge fairly implied
on the basis of objective circumstances that a user is a child
or teen--
``(A) to collect personal information from a child
or teen in a manner that violates the regulations
prescribed under subsection (b);
``(B) except as provided in subparagraphs (B) and
(C) of section 1302(18), to collect, use, disclose to
third parties, or maintain personal information of a
child or teen for purposes of individual-specific
advertising to children or teens (or to allow another
person to collect, use, disclose, or maintain such
information for such purpose);
``(C) to collect the personal information of a
child or teen except when the collection of the
personal information is--
``(i) consistent with the context of a
particular transaction or service or the
relationship of the child or teen with the
operator, including collection necessary to
fulfill a transaction or provide a product or
service requested by the child or teen; or
``(ii) required or specifically authorized
by Federal or State law; or
``(D) to store or transfer the personal information
of a child or teen outside of the United States unless
the operator provides direct notice to the parent of
the child, in the case of a child, or to the teen, in
the case of a teen, that the child's or teen's personal
information is being stored or transferred outside of
the United States; or
``(E) to retain the personal information of a child
or teen for longer than is reasonably necessary to
fulfill a transaction or provide a service requested by
the child or teen except as required or specifically
authorized by Federal or State law.''; and
(B) in paragraph (2)--
(i) in the header, by striking ``parent''
and inserting ```parent or teen''';
(ii) by striking ``Notwithstanding
paragraph (1)'' and inserting ``Notwithstanding
paragraph (1)(A)'';
(iii) by striking ``of such a website or
online service''; and
(iv) by striking ``subsection
(b)(1)(B)(iii) to the parent of a child'' and
inserting ``subsection (b)(1)(B)(iv) to the
parent of a child or under subsection
(b)(1)(C)(iv) to a teen'';
(3) in subsection (b)--
(A) in paragraph (1)--
(i) in subparagraph (A)--
(I) by striking ``operator of any
website'' and all that follows through
``from a child'' and inserting
``operator of a website, online
service, online application, or mobile
application directed to children or
that has actual knowledge or knowledge
fairly implied on the basis of
objective circumstances that a user is
a child or teen'';
(II) in clause (i)--
(aa) by striking ``notice
on the website'' and inserting
``clear and conspicuous notice
on the website'';
(bb) by inserting ``or
teens'' after ``children'';
(cc) by striking ``, and
the operator's'' and inserting
``, the operator's''; and
(dd) by striking ``; and''
and inserting ``, the rights
and opportunities available to
the parent of the child or teen
under subparagraphs (B) and
(C), and the procedures or
mechanisms the operator uses to
ensure that personal
information is not collected
from children or teens except
in accordance with the
regulations promulgated under
this paragraph;'';
(III) in clause (ii)--
(aa) by striking
``parental'';
(bb) by inserting ``or
teens'' after ``children'';
(cc) by striking the
semicolon at the end and
inserting ``; and''; and
(IV) by inserting after clause (ii)
the following new clause:
``(iii) to obtain verifiable consent from a
parent of a child or from a teen before using
or disclosing personal information of the child
or teen for any purpose that is a material
change from the original purposes and
disclosure practices specified to the parent of
the child or the teen under clause (i);'';
(ii) in subparagraph (B)--
(I) in the matter preceding clause
(i), by striking ``website or online
service'' and inserting ``operator'';
(II) in clause (i), by inserting
``and the method by which the operator
obtained the personal information, and
the purposes for which the operator
collects, uses, discloses, and retains
the personal information'' before the
semicolon;
(III) in clause (ii)--
(aa) by inserting ``to
delete personal information
collected from the child or
content or information
submitted by the child to a
website, online service, online
application, or mobile
application and'' after ``the
opportunity at any time''; and
(bb) by striking ``; and''
and inserting a semicolon;
(IV) by redesignating clause (iii)
as clause (iv) and inserting after
clause (ii) the following new clause:
``(iii) the opportunity to challenge the
accuracy of the personal information and, if
the parent of the child establishes the
inaccuracy of the personal information, to have
the inaccurate personal information
corrected;''; and
(V) in clause (iv), as so
redesignated, by inserting ``, if such
information is available to the
operator at the time the parent makes
the request'' before the semicolon;
(iii) by redesignating subparagraphs (C)
and (D) as subparagraphs (D) and (E),
respectively;
(iv) by inserting after subparagraph (B)
the following new subparagraph:
``(C) require the operator to provide, upon the
request of a teen under this subparagraph who has
provided personal information to the operator, upon
proper identification of that teen--
``(i) a description of the specific types
of personal information collected from the teen
by the operator, the method by which the
operator obtained the personal information, and
the purposes for which the operator collects,
uses, discloses, and retains the personal
information;
``(ii) the opportunity at any time to
delete personal information collected from the
teen or content or information submitted by the
teen to a website, online service, online
application, or mobile application and to
refuse to permit the operator's further use or
maintenance in retrievable form, or online
collection, of personal information from the
teen;
``(iii) the opportunity to challenge the
accuracy of the personal information and, if
the teen establishes the inaccuracy of the
personal information, to have the inaccurate
personal information corrected; and
``(iv) a means that is reasonable under the
circumstances for the teen to obtain any
personal information collected from the teen,
if such information is available to the
operator at the time the teen makes the
request;'';
(v) in subparagraph (D), as so
redesignated--
(I) by striking ``a child's'' and
inserting ``a child's or teen's''; and
(II) by inserting ``or teen'' after
``the child''; and
(vi) by amending subparagraph (E), as so
redesignated, to read as follows:
``(E) require the operator to establish, implement,
and maintain reasonable security practices to protect
the confidentiality, integrity, and accessibility of
personal information of children or teens collected by
the operator, and to protect such personal information
against unauthorized access.'';
(B) in paragraph (2)--
(i) in the matter preceding subparagraph
(A), by striking ``verifiable parental
consent'' and inserting ``verifiable consent'';
(ii) in subparagraph (A)--
(I) by inserting ``or teen'' after
``collected from a child'';
(II) by inserting ``or teen'' after
``request from the child''; and
(III) by inserting ``or teen or to
contact another child or teen'' after
``to recontact the child'';
(iii) in subparagraph (B)--
(I) by striking ``parent or child''
and inserting ``parent or teen''; and
(II) by striking ``parental
consent'' each place the term appears
and inserting ``verifiable consent'';
(iv) in subparagraph (C)--
(I) in the matter preceding clause
(i), by inserting ``or teen'' after
``child'' each place the term appears;
(II) in clause (i)--
(aa) by inserting ``or
teen'' after ``child'' each
place the term appears; and
(bb) by inserting ``or
teen, as applicable,'' after
``parent'' each place the term
appears; and
(III) in clause (ii)--
(aa) by striking ``without
notice to the parent'' and
inserting ``without notice to
the parent or teen, as
applicable,''; and
(bb) by inserting ``or
teen'' after ``child'' each
place the term appears; and
(v) in subparagraph (D)--
(I) in the matter preceding clause
(i), by inserting ``or teen'' after
``child'' each place the term appears;
(II) in clause (ii), by inserting
``or teen'' after ``child''; and
(III) in the flush text following
clause (iii)--
(aa) by inserting ``or
teen, as applicable,'' after
``parent'' each place the term
appears; and
(bb) by inserting ``or
teen'' after ``child'';
(C) by redesignating paragraph (3) as paragraph (4)
and inserting after paragraph (2) the following new
paragraph:
``(3) Application to operators acting under agreements with
educational agencies or institutions.--The regulations may
provide that verifiable consent under paragraph (1)(A)(ii) is
not required for an operator that is acting under a written
agreement with an educational agency or institution that, at a
minimum, requires the--
``(A) operator to--
``(i) limit its collection, use, and
disclosure of the personal information from a
child or teen to solely educational purposes
and for no other commercial purposes;
``(ii) provide the educational agency or
institution with a notice of the specific types
of personal information the operator will
collect from the child or teen, the method by
which the operator will obtain the personal
information, and the purposes for which the
operator will collect, use, disclose, and
retain the personal information;
``(iii) provide the educational agency or
institution with a link to the operator's
online notice of information practices as
required under subsection (b)(1)(A)(i); and
``(iv) provide the educational agency or
institution, upon request, with a means to
review the personal information collected from
a child or teen, to prevent further use or
maintenance or future collection of personal
information from a child or teen, and to delete
personal information collected from a child or
teen or content or information submitted by a
child or teen to the operator's website, online
service, online application, or mobile
application;
``(B) representative of the educational agency or
institution to acknowledge and agree that they have
authority to authorize the collection, use, and
disclosure of personal information from children or
teens on behalf of the educational agency or
institution, along with such authorization, their name,
and title at the educational agency or institution; and
``(C) educational agency or institution to--
``(i) provide on its website a notice that
identifies the operator with which it has
entered into a written agreement under this
subsection and provides a link to the
operator's online notice of information
practices as required under paragraph
(1)(A)(i);
``(ii) provide the operator's notice
regarding its information practices, as
required under subparagraph (A)(ii), upon
request, to a parent, in the case of a child,
or a parent or teen, in the case of a teen; and
``(iii) upon the request of a parent, in
the case of a child, or a parent or teen, in
the case of a teen, request the operator
provide a means to review the personal
information from the child or teen and provide
the parent, in the case of a child, or parent
or teen, in the case of the teen, a means to
review the personal information.'';
(D) by amending paragraph (4), as so redesignated,
to read as follows:
``(4) Termination of service.--The regulations shall permit
the operator of a website, online service, online application,
or mobile application to terminate service provided to a child
whose parent has refused, or a teen who has refused, under the
regulations prescribed under paragraphs (1)(B)(ii) and
(1)(C)(ii), to permit the operator's further use or maintenance
in retrievable form, or future online collection of, personal
information from that child or teen.''; and
(E) by adding at the end the following new
paragraphs:
``(5) Continuation of service.--The regulations shall
prohibit an operator from discontinuing service provided to a
child or teen on the basis of a request by the parent of the
child or by the teen, under the regulations prescribed under
subparagraph (B) or (C) of paragraph (1), respectively, to
delete personal information collected from the child or teen,
to the extent that the operator is capable of providing such
service without such information.
``(6) Rule of construction.--A request made pursuant to
subparagraph (B) or (C) of paragraph (1) to delete or correct
personal information of a child or teen shall not be
construed--
``(A) to limit the authority of a law enforcement
agency to obtain any content or information from an
operator pursuant to a lawfully executed warrant or an
order of a court of competent jurisdiction;
``(B) to require an operator or third party delete
or correct information that--
``(i) any other provision of Federal or
State law requires the operator or third party
to maintain; or
``(ii) was submitted to the website, online
service, online application, or mobile
application of the operator by any person other
than the user who is attempting to erase or
otherwise eliminate the content or information,
including content or information submitted by
the user that was republished or resubmitted by
another person; or
``(C) to prohibit an operator from--
``(i) retaining a record of the deletion
request and the minimum information necessary
for the purposes of ensuring compliance with a
request made pursuant to subparagraph (B) or
(C);
``(ii) preventing, detecting, protecting
against, or responding to security incidents,
identity theft, or fraud, or reporting those
responsible for such actions;
``(iii) protecting the integrity or
security of a website, online service, online
application or mobile application; or
``(iv) ensuring that the child's or teen's
information remains deleted.
``(7) Common verifiable consent mechanism.--
``(A) In general.--
``(i) Feasibility of mechanism.--The
Commission shall assess the feasibility, with
notice and public comment, of allowing
operators the option to use a common verifiable
consent mechanism that fully meets the
requirements of this title.
``(ii) Requirements.--The feasibility
assessment described in clause (i) shall
consider whether a single operator could use a
common verifiable consent mechanism to obtain
verifiable consent, as required under this
title, from a parent of a child or from a teen
on behalf of multiple, listed operators that
provide a joint or related service.
``(B) Report.--Not later than 1 year after the date
of enactment of this paragraph, the Commission shall
submit a report to the Committee on Commerce, Science,
and Transportation of the Senate and the Committee on
Energy and Commerce of the House of Representatives
with the findings of the assessment required by
subparagraph (A).
``(C) Regulations.--If the Commission finds that
the use of a common verifiable consent mechanism is
feasible and would meet the requirements of this title,
the Commission shall issue regulations to permit the
use of a common verifiable consent mechanism in
accordance with the findings outlined in such
report.'';
(4) in subsection (c), by striking ``a regulation
prescribed under subsection (a)'' and inserting ``subparagraph
(B), (C), (D), or (E) of subsection (a)(1), or of a regulation
prescribed under subsection (b),''; and
(5) by striking subsection (d) and inserting the following:
``(d) Relationship to State Law.--The provisions of this title
shall preempt any State law, rule, or regulation only to the extent
that such State law, rule, or regulation conflicts with a provision of
this title. Nothing in this title shall be construed to prohibit any
State from enacting a law, rule, or regulation that provides greater
protection to children or teens than the provisions of this title.''.
(c) Safe Harbors.--Section 1304 of the Children's Online Privacy
Protection Act of 1998 (15 U.S.C. 6503) is amended--
(1) in subsection (b)(1), by inserting ``and teens'' after
``children''; and
(2) by adding at the end the following:
``(d) Publication.--
``(1) In general.--Subject to the restrictions described in
paragraph (2), the Commission shall publish on the internet
website of the Commission any report or documentation required
by regulation to be submitted to the Commission to carry out
this section.
``(2) Restrictions on publication.--The restrictions
described in section 6(f) and section 21 of the Federal Trade
Commission Act (15 U.S.C. 46(f), 57b-2) applicable to the
disclosure of information obtained by the Commission shall
apply in same manner to the disclosure under this subsection of
information obtained by the Commission from a report or
documentation described in paragraph (1).''.
(d) Actions by States.--Section 1305 of the Children's Online
Privacy Protection Act of 1998 (15 U.S.C. 6504) is amended--
(1) in subsection (a)(1)--
(A) in the matter preceding subparagraph (A), by
inserting ``section 1303(a)(1) or'' before ``any
regulation''; and
(B) in subparagraph (B), by inserting ``section
1303(a)(1) or'' before ``the regulation''; and
(2) in subsection (d)--
(A) by inserting ``section 1303(a)(1) or'' before
``any regulation''; and
(B) by inserting ``section 1303(a)(1) or'' before
``that regulation''.
(e) Administration and Applicability of Act.--Section 1306 of the
Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6505) is
amended--
(1) in subsection (b)--
(A) in paragraph (1), by striking ``, in the case
of'' and all that follows through ``the Board of
Directors of the Federal Deposit Insurance
Corporation;'' and inserting the following: ``by the
appropriate Federal banking agency, with respect to any
insured depository institution (as those terms are
defined in section 3 of that Act (12 U.S.C. 1813));'';
and
(B) by striking paragraph (2) and redesignating
paragraphs (3) through (6) as paragraphs (2) through
(5), respectively;
(2) in subsection (d)--
(A) by inserting ``section 1303(a)(1) or'' before
``a rule''; and
(B) by striking ``such rule'' and inserting
``section 1303(a)(1) or a rule of the Commission under
section 1303''; and
(3) by adding at the end the following new subsections:
``(f) Determination of Whether an Operator Has Knowledge Fairly
Implied on the Basis of Objective Circumstances.--
``(1) Rule of construction.--For purposes of enforcing this
title or a regulation promulgated under this title, in making a
determination as to whether an operator has knowledge fairly
implied on the basis of objective circumstances that a specific
user is a child or teen, the Commission or State attorneys
general shall rely on competent and reliable evidence, taking
into account the totality of the circumstances, including
whether a reasonable and prudent person under the circumstances
would have known that the user is a child or teen. Nothing in
this title, including a determination described in the
preceding sentence, shall be construed to require an operator
to--
``(A) affirmatively collect any personal
information with respect to the age of a child or teen
that an operator is not already collecting in the
normal course of business; or
``(B) implement an age gating or age verification
functionality.
``(2) Commission guidance.--
``(A) In general.--Within 180 days of enactment,
the Commission shall issue guidance to provide
information, including best practices and examples for
operators to understand the Commission's determination
of whether an operator has knowledge fairly implied on
the basis of objective circumstances that a user is a
child or teen.
``(B) Limitation.--No guidance issued by the
Commission with respect to this title shall confer any
rights on any person, State, or locality, nor shall
operate to bind the Commission or any person to the
approach recommended in such guidance. In any
enforcement action brought pursuant to this title, the
Commission or State attorney general, as applicable,
shall allege a specific violation of a provision of
this title. The Commission or State attorney general,
as applicable, may not base an enforcement action on,
or execute a consent order based on, practices that are
alleged to be inconsistent with any such guidance,
unless the practices allegedly violate this title. For
purposes of enforcing this title or a regulation
promulgated under this title, State attorneys general
shall take into account any guidance issued by the
Commission under subparagraph (A).
``(g) Additional Requirement.--Any regulations issued under this
title shall include a description and analysis of the impact of
proposed and final Rules on small entities per the Regulatory
Flexibility Act of 1980 (5 U.S.C. 601 et seq.).''.
SEC. 3. STUDY AND REPORTS OF MOBILE AND ONLINE APPLICATION OVERSIGHT
AND ENFORCEMENT.
(a) Oversight Report.--Not later than 3 years after the date of
enactment of this Act, the Federal Trade Commission shall submit to the
Committee on Commerce, Science, and Transportation of the Senate and
the Committee on Energy and Commerce of the House of Representatives a
report on the processes of platforms that offer mobile and online
applications for ensuring that, of those applications that are
websites, online services, online applications, or mobile applications
directed to children, the applications operate in accordance with--
(1) this Act, the amendments made by this Act, and rules
promulgated under this Act; and
(2) rules promulgated by the Commission under section 18 of
the Federal Trade Commission Act (15 U.S.C. 57a) relating to
unfair or deceptive acts or practices in marketing.
(b) Enforcement Report.--Not later than 1 year after the date of
enactment of this Act, and each year thereafter, the Federal Trade
Commission shall submit to the Committee on Commerce, Science, and
Transportation of the Senate and the Committee on Energy and Commerce
of the House of Representatives a report that addresses, at a minimum--
(1) the number of actions brought by the Commission during
the reporting year to enforce the Children's Online Privacy
Protection Act of 1998 (15 U.S.C. 6501) (referred to in this
subsection as the ``Act'') and the outcome of each such action;
(2) the total number of investigations or inquiries into
potential violations of the Act; during the reporting year;
(3) the total number of open investigations or inquiries
into potential violations of the Act as of the time the report
is submitted;
(4) the number and nature of complaints received by the
Commission relating to an allegation of a violation of the Act
during the reporting year; and
(5) policy or legislative recommendations to strengthen
online protections for children and teens.
SEC. 4. GAO STUDY.
(a) Study.--The Comptroller General of the United States (in this
section referred to as the ``Comptroller General'') shall conduct a
study on the privacy of teens who use financial technology products.
Such study shall--
(1) identify the type of financial technology products that
teens are using;
(2) identify the potential risks to teens' privacy from
using such financial technology products; and
(3) determine whether existing laws are sufficient to
address such risks to teens' privacy.
(b) Report.--Not later than 1 year after the date of enactment of
this section, the Comptroller General shall submit to Congress a report
containing the results of the study conducted under subsection (a),
together with recommendations for such legislation and administrative
action as the Comptroller General determines appropriate.
SEC. 5. SEVERABILITY.
If any provision of this Act, or an amendment made by this Act, is
determined to be unenforceable or invalid, the remaining provisions of
this Act and the amendments made by this Act shall not be affected.
<all>
Introduced in Senate
Read twice and referred to the Committee on Commerce, Science, and Transportation.
Committee on Commerce, Science, and Transportation. Ordered to be reported with amendments favorably.
Committee on Commerce, Science, and Transportation. Reported by Senator Cruz with amendments. With written report No. 119-99.
Committee on Commerce, Science, and Transportation. Reported by Senator Cruz with amendments. With written report No. 119-99.
Placed on Senate Legislative Calendar under General Orders. Calendar No. 304.
Llama 3.2 · runs locally in your browser
Ask anything about this bill. The AI reads the full text to answer.
Enter to send · Shift+Enter for new line