Clean Slate for Kids Online Act of 2018

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Clean Slate for Kids Online Act of 
2018''.

SEC. 2. ENHANCING THE CHILDREN'S ONLINE PRIVACY PROTECTION ACT OF 1998.

    (a) Definitions.--Section 1302 of the Children's Online Privacy 
Protection Act of 1998 (15 U.S.C. 6501) is amended by adding at the end 
the following:
            ``(13) Delete.--The term `delete' means to remove personal 
        information such that the information is not maintained in 
        retrievable form and cannot be retrieved in the normal course 
        of business.''.
    (b) Regulation of Unfair and Deceptive Acts and Practices in 
Connection With the Collection and Use of Personal Information From and 
About Children on the Internet.--Section 1303 of the Children's Online 
Privacy Protection Act of 1998 (15 U.S.C. 6502) is amended--
            (1) in subsection (a), by adding at the end the following:
            ``(3) Failure to delete.--It is unlawful for an operator of 
        a website or online service directed to children, or any 
        operator that has actual knowledge that it is collecting 
        personal information from a child, to fail to delete personal 
        information collected from or about a child if a request for 
        deletion is made pursuant to regulations prescribed under 
        subsection (e).''; and
            (2) by adding at the end the following:
    ``(e) Right of an Individual To Delete Personal Information 
Collected When the Person Was a Child.--
            ``(1) In general.--Not later than 1 year after the date of 
        enactment of this subsection, the Commission shall promulgate 
        under section 553 of title 5, United States Code, regulations 
        that require the operator of any website or online service 
        directed to children, or any operator that has actual knowledge 
        that it has collected personal information from a child or 
        maintains such personal information--
                    ``(A) to provide notice on the website of how an 
                individual over the age of 13, or a legal guardian of 
                an individual over the age of 13 acting with the 
                knowledge and consent of the individual, can request 
                that the operator delete all personal information in 
                the possession of the operator that was collected from 
                or about the individual when the individual was a child 
                notwithstanding any parental consent that may have been 
                provided when the individual was a child;
                    ``(B) to promptly delete all personal information 
                in the possession of the operator that was collected 
                from or about an individual when the individual was a 
                child when such deletion is requested by an individual 
                over the age of 13 or by the legal guardian of such 
                individual acting with the knowledge and consent of the 
                individual, notwithstanding any parental consent that 
                may have been provided when the individual was a child;
                    ``(C) to provide written confirmation of deletion, 
                after the deletion has occurred, to an individual or 
                legal guardian of such individual who has requested 
                such deletion pursuant to this subsection; and
                    ``(D) to except from deletion personal information 
                collected from or about a child--
                            ``(i) only to the extent that the personal 
                        information is necessary--
                                    ``(I) to respond to judicial 
                                process; or
                                    ``(II) to the extent permitted 
                                under any other provision of law, to 
                                provide information to law enforcement 
                                agencies or for an investigation on a 
                                matter related to public safety; and
                            ``(ii) if the operator retain such excepted 
                        personal information for only as long as 
                        reasonably necessary to fulfill the purpose for 
                        which the information has been excepted and 
                        that the excepted information not be used, 
                        disseminated or maintained in a form 
                        retrievable to anyone except for the purposes 
                        specified in this subparagraph.''.
    (c) Safe Harbors.--Section 1304 of the Children's Online Privacy 
Protection Act of 1998 (15 U.S.C. 6503) is amended--
            (1) in subsection (a), by striking ``section 1303(b)'' and 
        inserting ``subsections (b) and (e) of section 1303''; and
            (2) in subsection (b)(1), by striking ``subsection (b)'' 
        and inserting ``subsections (b) and (e)''.
    (d) Actions by States.--Section 1305(a)(1) of the Children's Online 
Privacy Protection Act of 1998 (15 U.S.C. 6504(a)(1)) is amended by 
striking ``1303(b)'' and inserting ``subsection (b) or (e) of section 
1303''.

Summary: Clean Slate for Kids Online Act of 2018 This bill amends the Children's Online Privacy Protection Act of 1998 to require the operator of any website or online service directed to children: to provide notice on the website about how an individual over age 13, or the guardian of an individual over 13, can request the deletion of all personal information in the operator's possession collected when the individual was a child, to promptly delete, upon request, all personalnbsp, information in thenbsp. Operator's possession that was collected from or about the individual when the individual was a child, and tonbsp. Provide written confirmation of deletion. Delete means to remove personal information such that the information is not maintained in retrievable form and cannot be retrieved in the normal course of business. The bill allows a limited exception to the deletion requirement if the personal information collected from or about a child is necessary to respond to judicial process or to provide information to law enforcement agencies.