A bill to enhance the protection of privacy of children who use school or library computers employing Internet content management services, and for other purposes.

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Children's Electronic Access Safety 
Enhancement (CEASE) Act''.

SEC. 2. DISCLOSURE BY INTERNET CONTENT MANAGEMENT SERVICES OF 
              COLLECTION, USE, AND DISCLOSURE OF INFORMATION UNDER 
              CONTRACTS FOR SCHOOLS AND LIBRARIES.

    (a) Initial Disclosure of Policies.--
            (1) In general.--A provider of Internet content management 
        services shall, before entering into a contract or other 
        agreement to provide such services to or for an elementary or 
        secondary school or library, notify the local educational 
        agency or other authority with responsibility for the school, 
        or library, as the case may be, of the policies of the provider 
        regarding the collection, use, and disclosure of information 
        from or about children whose Internet use will be covered by 
        such services.
            (2) Elements of notice.--Notice on policies regarding the 
        collection, use, disclosure of information under paragraph (1) 
        shall include information on the following:
                    (A) Whether any information will be collected from 
                or about children whose Internet use will be covered by 
                the services in question.
                    (B) Whether any information so collected will be 
                stored or otherwise retained by the provider of 
                Internet content management services, and, if so, under 
                what terms and conditions, including a description of 
                how the information will be secured.
                    (C) Whether any information so collected will be 
                sold, distributed, or otherwise transferred, and, if 
                so, under what terms and conditions.
            (3) Form of notice.--Any notice under this subsection shall 
        be clear, conspicuous, and designed to be readily 
        understandable by its intended audience.
    (b) Modification of Policies.--
            (1) In general.--A provider of Internet content management 
        services shall, before implementing any material modification 
        of the policies described in subsection (a)(1) under a contract 
        or other agreement with respect to an elementary or secondary 
        school or library, notify the local educational agency or other 
        authority with responsibility for the school, or library, as 
        the case may be, of the proposed modification of the policies.
            (2) Timeliness.--Notice under paragraph (1) shall be 
        provided in sufficient time in advance of the modification 
        covered by the notice to permit the local educational agency or 
        other authority concerned, or library concerned, as the case 
        may be, to evaluate the effects of the modification.
    (c) Regulations.--The Commission shall prescribe regulations for 
purposes of the administration of this section. The regulations shall 
include provisions regarding the elements of notice required under 
subsection (a)(2) and the timeliness of notice under subsection (b)(2).
    (d) Administration.--
            (1) In general.--This section shall be enforced by the 
        Commission under the Federal Trade Commission Act (15 U.S.C. 41 
        et seq.).
            (2) Effect on other laws.--Nothing in this section shall be 
        construed to limit the authority of the Commission under any 
        other provision of law.
    (e) Noncompliance.--
            (1) In general.--The violation of any provision of this 
        section, including the regulations prescribed by the Commission 
        under subsection (c), shall be treated as a violation of a rule 
        defining an unfair or deceptive act or practice prescribed 
        under section 18(a)(1)(B) of the Federal Trade Commission Act 
        (15 U.S.C. 57a(a)(1)(B)).
            (2) Termination of contract or agreement.--
                    (A) Authority to terminate.--Notwithstanding any 
                provision of a contract or agreement to the contrary, 
                if a provider of Internet content management services 
                for a school or library fails to comply with a policy 
                in a notice under subsection (a), or fails to submit 
                notice of a modification of a policy under subsection 
                (b) in a timely manner, the local educational agency or 
                other authority concerned, or library concerned, may 
                terminate the contract or other agreement with the 
                provider to provide Internet content management 
                services to the school or library, as the case may be.
                    (B) Resolution of disputes.--Any dispute under 
                subparagraph (A) regarding the failure of a provider of 
                Internet content management services as described in 
                that subparagraph shall be resolved by the Commission.
                    (C) Relationship to other relief.--The authority 
                under this paragraph with respect to noncompliance of a 
                provider of Internet content management services is in 
                addition to the power of the Commission to treat the 
                noncompliance as a violation under paragraph (1).
    (f) Notice to Parents.--A school or library shall provide 
reasonable notice of the policies of an Internet content management 
service provider used by that school or library to parents of students, 
or patrons of the library, as the case may be.

SEC. 3. COLLECTION OF PERSONAL INFORMATION ABOUT CERTAIN OLDER CHILDREN 
              BY PROVIDERS OF INTERNET CONTENT MANAGEMENT SERVICES TO 
              SCHOOLS AND LIBRARIES.

    (a) Prohibition.--A provider of Internet content management 
services to or for an elementary or secondary school or library may not 
collect through such services personal information from or about a 
child who is a student at that school or a user of that library.
    (b) Responsibilities Upon Collection.--
            (1) In general.--If a provider of Internet content 
        management services to or for an elementary or secondary school 
        or library collects through such services personal information 
        from or about a child who is a student at that school or a user 
        of that library, the provider shall--
                    (A) provide prompt notice of such collection--
                            (i) to either--
                                    (I) the local educational agency or 
                                other authority with responsibility for 
                                the school and appropriate officials of 
                                the State in which the school is 
                                located; or
                                    (II) the library; and
                            (ii) to the Federal Trade Commission; and
                    (B) take appropriate actions to treat the personal 
                information--
                            (i) in a manner consistent with the 
                        provisions of the Children's Online Privacy 
                        Protection Act of 1998 (15 U.S.C. 6501 et seq.) 
                        if the personal information was collected from 
                        a child as defined in section 1302(1) of that 
                        Act; or
                            (ii) in a similar manner, under regulations 
                        prescribed by the Commission, if the personal 
                        information was collected from a child over the 
                        age of 12.
            (2) Elements of notice.--Notice of the collection of 
        personal information by a provider of Internet content 
        management services under paragraph (1)(A) shall include the 
        following:
                    (A) A description of the personal information so 
                collected.
                    (B) A description of the actions taken by the 
                provider with respect to such personal information 
                under paragraph (1)(B).
    (c) Response to Notice.--A local educational agency or other 
authority, or library, receiving notice under subsection (b) with 
respect to a covered child shall take appropriate actions to notify a 
parent or guardian of the child of receipt of such notice.

SEC. 4. APPLICATION OF COPPA.

    Section 1302 of the Children's Online Privacy Protection Act of 
1998 (15 U.S.C. 6501) is amended by adding at the end the following:
            ``(13) Provider of internet content management services 
        treated as operator.--The term `operator' includes a provider 
        of Internet content management services (as defined in section 
        5(4) of the Children's Electronic Access Safety Enhancement 
        Act) who collects or maintains personal information from or 
        about the users of those services, or on whose behalf such 
        information is collected or maintained, if those services are 
        provided for commercial purposes involving commerce described 
        in paragraph (2)(A)(i), (ii), or (iii).''.

SEC. 5. DEFINITIONS.

    In this Act:
            (1) Commission.--The term ``Commission'' means the Federal 
        Trade Commission.
            (2) Child.--Except as provided in section 3(b)(1)(B), the 
        term ``child'' means an individual who is less than 19 years of 
        age.
            (3) Personal information.--The term ``personal 
        information'' has the meaning given that term in section 
        1301(8) of the Children's Online Privacy Protection Act of 1998 
        (15 U.S.C. 6501(8)).
            (4) Provider of internet content management services.--The 
        term ``provider of Internet content management services'' 
        includes a provider of Internet content management software if 
        such software operates, in whole or in part, by or through an 
        Internet connection or otherwise provides information on users 
        of such software to the provider by the Internet or other 
        means.

Summary: Children's Electronic Access Safety Enhancement (CEASE) Act - Requires providers of Internet content management services (providers) to notify local educational agencies or other authorities responsible for schools (LEAs), or libraries, of the providers' policies regarding collection, use, and disclosure of information from or about children under age 19 whose Internet use will be covered by such services, before entering into a contract or other agreement to provide such services to or for an elementary or secondary school or a library, and before implementing any later material modifications of such policies. Directs the Federal Trade Commission (FTC) to treat noncompliance with these requirements as a violation of a rule defining an unfair or deceptive act or practice under the Federal Trade Commission Act. Allows LEAs or libraries to terminate such contracts or agreements with providers who fail to comply with these requirements. Requires a school or library to provide reasonable notice of its provider's policy to students' parents or library patrons. Prohibits providers from collecting personal information from or about a child who is a school student or library patron. Requires providers, if they do collect such information, to: (1) promptly notify the LEA and appropriate State officials, or the library, and the FTC. And (2) treat the information in accordance with the Children's Online Privacy Protection Act of 1998 (COPPA) if the child is under 12, and in accordance with FTC regulations if the child is over 12. Requires the LEA or library to notify a parent or guardian of the child of receipt of such notice. Amends COPPA to treat providers as operators.