SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Children's Online Privacy Protection 
Act of 1998''.

SEC. 2. DEFINITIONS.

    In this Act:
            (1) Child.--The term ``child'' means an individual under 
        the age of 16.
            (2) Children.--The term ``children'' means more than 1 
        child.
            (3) Commercial website operator.--The term ``commercial 
        website operator'' means any person operating a website on the 
        World Wide Webs for commercial purposes, including any person 
        offering products or services for sale though that website, 
        involving commerce--
                    (A) among the several States or with 1 or more 
                foreign nations;
                    (B) in any territory of the United States or in the 
                District of Columbia, or between any such territory--
                            (i) and another such territory; or
                            (ii) and any State or foreign nation; or
                    (C) between the District of Columbia and any State, 
                territory, or foreign nation.
            (4) Commission.--The term ``Commission'' means the Federal 
        Trade Commission.
            (5) Disclosure.--The term ``disclosure'' means, with 
        respect to personal information--
                    (A) the release of information in identifiable form 
                by a person to any other person for any purpose; or
                    (B) making publicly available information in 
                identifiable form by any means including by a public 
                posting, through the use of a computer on or through--
                            (i) a home page of a website;
                            (ii) a pen pal service;
                            (iii) an electronic mail service;
                            (iv) a message board; or
                            (v) a chat room.
            (6) Federal agency.--The term ``Federal agency'' means an 
        agency, as that term is defined in section 551(1) of title 5, 
        United States Code.
            (7) Internet.--The term ``Internet'' means the 
        international computer network of both Federal and non-Federal 
        interoperable packet switched data networks.
            (8) Parent.--The term ``parent'' means a legal guardian, 
        including a biological or adoptive parent.
            (9) Personal information.--The term ``personal 
        information'' means individually, identifiable information 
        about an individual, including--
                    (A) a first and last name;
                    (B) a home or other physical address;
                    (C) an e-mail address;
                    (D) a telephone number;
                    (E) a Social Security number; or
                    (F) any other information that would facilitate or 
                enable the physical or online locating and contacting 
                of a specific individual, including information that is 
                associated with an identifier described in this 
                paragraph in such manner as to become identifiable to a 
                specific individual.
            (10) Verifiable parental consent.--The term ``verifiable 
        parental consent'' means any reasonable effort (taking into 
        consideration available technology) to ensure that a parent of 
        a child authorizes the disclosure of personal information and 
        subsequent use of that information before that information is 
        collected from that child.
            (11) Website directed to children.--The term ``website 
        directed to children''--
                    (A) means a commercial website that is--
                            (i) targeted to children;
                            (ii) directed to children by reason of the 
                        subject matter, visual content, age of models, 
                        language, characters, tone, message, or any 
                        other similar characteristic of the website; or
                            (iii) used by a commercial website operator 
                        to knowingly collect information from children; 
                        and
                    (B) includes any commercial website any portion of 
                which is directed to children, as specified in 
                subparagraph (A).
            (12) Person.--The term ``person'' means any individual, 
        partnership, corporation, trust, estate, cooperative, 
        association, or other entity.

SEC. 3. REGULATION OF UNFAIR AND DECEPTIVE ACTS AND PRACTICES IN 
              CONNECTION WITH THE COLLECTION AND USE OF PERSONAL 
              INFORMATION FROM AND ABOUT CHILDREN ON THE INTERNET.

    (a) Regulations.--
            (1) In general.--Not later than 1 year after the date of 
        enactment of this Act, the Commission shall, in a manner 
        consistent with section 553 of title 5, United States Code, 
        prescribe regulations requiring commercial website operators to 
        follow fair information practices in connection with the 
        collection and use of personal information from children.
            (2) Contents.--The regulations issued under this subsection 
        shall--
                    (A) require that any website directed to children 
                that collects personal information from children--
                            (i) provide clear, prominent, 
                        understandable notice of the information 
                        collection and use practices of the website 
                        operator through the website;
                            (ii) obtain verifiable parental consent for 
                        the collection, use, or disclosure of personal 
                        information from children who are under the age 
                        of 13;
                            (iii) use reasonable efforts to provide the 
                        parents with notice and an opportunity to 
                        prevent or curtail the collection or use of 
                        personal information collected from children 
                        over the age of 12 and under the age of 17;
                            (iv) provide a parent--
                                    (I) access to the personal 
                                information of the child of that parent 
                                collected by that website; and
                                    (II) the opportunity to refuse to 
                                permit any further use or future 
                                collection of personal information 
                                referred to in subclause (I) and notice 
                                of that opportunity; and
                    (B) require that the commercial website operator 
                concerned establish and maintain reasonable procedures 
                to ensure the confidentiality, security, accuracy, and 
                integrity of personal information collected from 
                children through the website.
    (b) Enforcement.--
            (1) Treatment of regulations.--A regulation prescribed 
        under subsection (a) shall be treated as a rule defining an 
        unfair or deceptive act or practice under section 18(a)(1)(B) 
        of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
            (2) Enforcement.--Subject to section 6, a violation of a 
        regulation prescribed under subsection (a) shall be treated as 
        a violation of a rule defining an unfair or deceptive act or 
        practice prescribed under section 18(a)(1)(B) of the Federal 
        Trade Commission Act.

SEC. 4. SAFE HARBORS.

    (a) In General.--In prescribing regulations under section 3, the 
Commission shall provide incentives for efforts of self-regulation by 
commercial website operators to implement the protections described in 
subsection (a) of that section.
    (b) Safe Harbors.--The incentives referred to in subsection (a) 
shall include provisions for ensuring that a person will be deemed to 
be in compliance with the requirements of the regulations under section 
3 if that person applies guidelines that--
            (1) are issued by appropriate representatives of the 
        computer industry; and
            (2) are approved by the Commission upon making a 
        determination that the guidelines meet the requirements of the 
        regulations issued under section 3.

SEC. 5. ACTIONS BY STATES.

    (a) In General.--
            (1) Civil actions.--In any case in which the attorney 
        general of a State has reason to believe that an interest of 
        the residents of that State has been or is threatened or 
        adversely affected by the engagement of any person in a 
        practice that violates any regulation of the Commission 
        prescribed under section 3, the State, as parens patriae, may 
        bring a civil action on behalf of the residents of the State in 
        a district court of the United States of appropriate 
        jurisdiction to--
                    (A) enjoin that practice;
                    (B) enforce compliance with the regulation;
                    (C) obtain damage, restitution, or other 
                compensation on behalf of residents of the State; or
                    (D) obtain such other relief as the court may 
                consider to be appropriate.
            (2) Notice.--
                    (A) In general.--Before filing an action under 
                paragraph (1), the attorney general of the State 
                involved shall provide to the Commission--
                            (i) written notice of that action; and
                            (ii) a copy of the complaint for that 
                        action.
                    (B) Exemption.--
                            (i) In general.--Subparagraph (A) shall not 
                        apply with respect to the filing of an action 
                        by an attorney general of a State under this 
                        subsection, if the attorney general determines 
                        that it is not feasible to provide the notice 
                        described in that subparagraph before the 
                        filing of the action.
                            (ii) Notification.--In an action described 
                        in clause (i), the attorney general of a State 
                        shall provide notice and a copy of the 
                        complaint to the Commission at the same time as 
                        the attorney general files the action.
    (b) Intervention.--
            (1) In general.--On receiving notice under paragraph (2), 
        the Commission shall have the right to intervene in the action 
        that is the subject of the notice.
            (2) Effect of intervention.--If the Commission intervenes 
        in an action under subparagraph (A), the Commission shall have 
        the right--
                    (A) to be heard with respect to any matter that 
                arises in that action; and
                    (B) to file a petition for appeal.
    (c) Construction.--For purposes of bringing any civil action under 
subsection (a), nothing in this Act shall be construed to prevent an 
attorney general of a State from exercising the powers conferred on the 
attorney general by the laws of that State to--
            (1) conduct investigations;
            (2) administer oaths or affirmations; or
            (3) compel the attendance of witnesses or the production of 
        documentary and other evidence.
    (d) Actions by the Commission.--In any case in which an action is 
instituted by or on behalf of the Commission for violation of any 
regulation prescribed under section 3, no State may, during the 
pendency of that action, institute an action under subsection (a) 
against any defendant named in the complaint in that action for 
violation of that regulation.
    (e) Venue; Service of Process.--
            (1) Venue.--Any action brought under subsection (a) may be 
        brought in the district court of the United States--
                    (A) in which the defendant--
                            (i) is found;
                            (ii) is an inhabitant; or
                            (iii) transacts business; or
                    (B) that otherwise meets applicable requirements 
                relating to venue under section 1391 of title 28, 
                United States Code.
            (2) Service of process.--In an action brought under 
        subsection (a), process may be served in any district in which 
        the defendant--
                    (A) is an inhabitant; or
                    (B) may be found.
    (f) Actions by Other State Officials.--
            (1) In general.--Nothing in this section may be construed 
        to prohibit a State official from proceeding a court of the 
        State in accordance with the laws of that State on the basis of 
an alleged violation of any civil or criminal law of that State.
            (2) Certain actions in state courts.--In addition to any 
        actions brought by an attorney general of a State under 
        subsection (a), an action described in paragraph (1) may be 
        brought by any other officer of that State who is authorized by 
        the State to bring such an action in that State on behalf of 
        the residents of the State.

SEC. 6. ADMINISTRATION AND APPLICABILITY OF ACT.

    (a) In General.--Except as otherwise provided, this Act shall be 
enforced by the Commission under the Federal Trade Commission Act (15 
U.S.C. 41 et seq.).
    (b) Provisions.--Compliance with the requirements imposed under 
this subchapter shall be enforced under--
            (1) section 8 of the Federal Deposit Insurance Act (12 
        U.S.C. 1818), in the case of--
                    (A) national banks, and Federal branches and 
                Federal agencies of foreign banks, by the Office of the 
                Comptroller of the Currency;
                    (B) member banks of the Federal Reserve System 
                (other than national banks), branches and agencies of 
                foreign banks (other than Federal branches, Federal 
                agencies, and insured State branches of foreign banks), 
                commercial lending companies owned or controlled by 
                foreign banks, and organizations operating under 
                section 25 or 25(a) of the Federal Reserve Act (12 
                U.S.C. 601 et seq. and 611 et seq.), by the Board; and
                    (C) banks insured by the Federal Deposit Insurance 
                Corporation (other than members of the Federal Reserve 
                System) and insured State branches of foreign banks, by 
                the Board of Directors of the Federal Deposit Insurance 
                Corporation;
            (2) section 8 of the Federal Deposit Insurance Act (12 
        U.S.C. 1818), by the Director of the Office of Thrift 
        Supervision, in the case of a savings association the deposits 
        of which are insured by the Federal Deposit Insurance 
        Corporation;
            (3) the Federal Credit Union Act (12 U.S.C. 1751 et seq.), 
        by the National Credit Union Administration Board with respect 
        to any Federal credit union;
            (4) part A of subtitle VII of title 49, by the Secretary of 
        Transportation with respect to any air carrier or foreign air 
        carrier subject to that part;
            (5) the Packers and Stockyards Act, 1921 (7 U.S.C. 181 et 
        seq.) (except as provided in section 406 of that Act (7 U.S.C. 
        226, 227)), by the Secretary of Agriculture with respect to any 
        activities subject to that Act; and
            (6) the Farm Credit Act of 1971 (12 U.S.C. 2001 et seq.) by 
        the Farm Credit Administration with respect to any Federal land 
        bank, Federal land bank association, Federal intermediate 
        credit bank, or production credit association.
    (c) Exercise of Certain Powers.--For the purpose of the exercise by 
any agency referred to in subsection (a) of its powers under any Act 
referred to in that subsection, a violation of any requirement imposed 
under this Act shall be deemed to be a violation of a requirement 
imposed under that Act. In addition to its powers under any provision 
of law specifically referred to in subsection (a), each of the agencies 
referred to in that subsection may exercise, for the purpose of 
enforcing compliance with any requirement imposed under this Act, any 
other authority conferred on it by law.
    (d) Actions by the Commission.--The Commission shall prevent any 
person from violating a rule of the Commission under section 3 in the 
same manner, by the same means, and with the same jurisdiction, powers, 
and duties as though all applicable terms and provisions of the Federal 
Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and 
made a part of this Act. Any entity that violates such rule shall be 
subject to the penalties and entitled to the privileges and immunities 
provided in the Federal Trade Commission Act in the same manner, by the 
same means, and with the same jurisdiction, power, and duties as though 
all applicable terms and provisions of the Federal Trade Commission Act 
were incorporated into and made a part of this Act.
    (e) Effect on Other Laws.--Nothing contained in the Act shall be 
construed to limit the authority of the Commission under any other 
provisions of law.

SEC. 7. REVIEW.

    (a) In General.--Not later than 5 years after the effective date of 
the regulations initially issued under section 3, the Commission 
shall--
            (1) review the implementation of this Act, including the 
        effect of the implementation of this Act on practices relating 
        to the disclosure of information relating to children; and
            (2) prepare and submit to Congress a report the results of 
        the review under paragraph (1).
Children's Online Privacy Protection Act of 1998 - Directs the Federal Trade Commission (FTC) to prescribe regulations requiring commercial website operators to follow fair information practices in connection with the collection and use of personal information from children under age 16, including by obtaining verifiable parental consent for the collection, use, or disclosure of personal information from children under the age of 13. 
Directs the FTC to provide incentives for efforts of self-regulation by operators to implement appropriate protections for such information. 
Authorizes the States to enforce such regulations by bringing actions on behalf of residents, requiring the appropriate attorney general to first notify the FTC of such action.  Authorizes the FTC to intervene in any such action. 
Provides for enforcement of this Act through the Federal Trade Commission Act. 
Directs the FTC to review and report to the Congress on the implementation of this Act.
Children's Online Privacy Protection Act of 1998