I 

116TH CONGRESS 

2D SESSION H. R. 5703 

To amend the Children’s Online Privacy Protection Act of 1998 to update 

and expand the coverage of such Act, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JANUARY 29, 2020 

Ms. CASTOR of Florida introduced the following bill; which was referred to the 

Committee on Energy and Commerce 

A BILL 

To amend the Children’s Online Privacy Protection Act of 

1998 to update and expand the coverage of such Act, 

and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

4 This Act may be cited as the ‘‘Protecting the Infor5 mation of our Vulnerable Children and Youth Act’’ or the 

6 ‘‘PRIVCY ACT’’. 

7 SEC. 2. DEFINITIONS. 

8 Section 1302 of the Children’s Online Privacy Protec9 tion Act of 1998 (15 U.S.C. 6501) is amended— 

10 (1) in paragraph (1)— 


pamtmann on DSKBC07HB2PROD with BILLS
2 

•HR 5703 IH

1 (A) by inserting ‘‘or ‘children’ ’’ after 

2 ‘‘child’’; and 

3 (B) by inserting ‘‘or individuals, respec4 tively,’’ after ‘‘individual’’; 

5 (2) by striking paragraph (10); 

6 (3) by redesignating paragraphs (2) through 

7 (9) as paragraphs (3) through (10), respectively; 

8 (4) inserting after paragraph (1) the following: 

9 ‘‘(2) YOUNG CONSUMER.—The term ‘young 

10 consumer’ means an individual over the age of 12 

11 and under the age of 18.’’; 

12 (5) by amending paragraph (3) (as so redesig13 nated) to read as follows: 

14 ‘‘(3) COVERED ENTITY.—The term ‘covered en15 tity’ means— 

16 ‘‘(A) any organization, corporation, trust, 

17 partnership, sole proprietorship, unincorporated 

18 association, or venture over which the Commis19 sion has authority pursuant to section 5(a)(2) 

20 of the Federal Trade Commission Act (15 

21 U.S.C. 45(a)(2)); 

22 ‘‘(B) notwithstanding section 5(a)(2) of 

23 the Federal Trade Commission Act (15 U.S.C. 

24 45(a)(2)), common carriers; and 


pamtmann on DSKBC07HB2PROD with BILLS
3 

•HR 5703 IH

1 ‘‘(C) notwithstanding sections 4 and 

2 5(a)(2) of the Federal Trade Commission Act 

3 (15 U.S.C. 44 and 45(a)(2)), any nonprofit or4 ganization, including any organization described 

5 in section 501(c) of the Internal Revenue Code 

6 of 1986 that is exempt from taxation under sec7 tion 501(a) of the Internal Revenue Code of 

8 1986.’’; 

9 (6) by amending paragraph (5) (as so redesig10 nated) to read as follows: 

11 ‘‘(5) DISCLOSE.—The term ‘disclose’ means to 

12 intentionally or unintentionally release, transfer, sell, 

13 disseminate, share, publish, lease, license, make 

14 available, allow access to, fail to restrict access to, 

15 or otherwise communicate covered information.’’; 

16 (7) by amending paragraph (9) (as so redesig17 nated) to read as follows: 

18 ‘‘(9) COVERED INFORMATION.—The term ‘cov19 ered information’— 

20 ‘‘(A) means any information, linked or rea21 sonably linkable to a specific young consumer 

22 or child, or consumer device of a young con23 sumer or child; 

24 ‘‘(B) may include— 


pamtmann on DSKBC07HB2PROD with BILLS
4 

•HR 5703 IH

1 ‘‘(i) a name, alias, home or other 

2 physical address, online identifier, Internet 

3 Protocol address, email address, account 

4 name, Social Security number, physical 

5 characteristics or description, telephone 

6 number, State identification card number, 

7 driver’s license number, where applicable, 

8 passport number, or other similar identi9 fier; 

10 ‘‘(ii) race, religion, sex, sexual orienta11 tion, sexual behavior, familial status, gen12 der identity, disability, age, political affili13 ation, or national origin; 

14 ‘‘(iii) commercial information, includ15 ing records relating to personal property, 

16 products or services purchased, obtained, 

17 or considered, or other purchasing or con18 suming histories or tendencies; 

19 ‘‘(iv) biometric information; 

20 ‘‘(v) Internet or other electronic net21 work activity information, including brows22 ing history, search history, and informa23 tion regarding a young consumer’s or 

24 child’s interaction with an Internet 

25 website, application, or advertisement; 


pamtmann on DSKBC07HB2PROD with BILLS
5 

•HR 5703 IH

1 ‘‘(vi) geolocation information; 

2 ‘‘(vii) audio, electronic, visual, ther3 mal, olfactory, or similar information; 

4 ‘‘(viii) education information; 

5 ‘‘(ix) health information; 

6 ‘‘(x) facial recognition information; 

7 ‘‘(xi) contents of and parties to infor8 mation, including with respect to electronic 

9 mail, text messages, picture messages, 

10 voicemails, audio conversations, and video 

11 conversations; 

12 ‘‘(xii) financial information, including 

13 bank account numbers, credit card num14 bers, debit card numbers, or insurance pol15 icy numbers, where applicable; 

16 ‘‘(xiii) inferences drawn from any of 

17 the information described in this para18 graph to create a profile about a young 

19 consumer or child reflecting the young con20 sumer’s or child’s preferences, characteris21 tics, psychological trends, predispositions, 

22 behavior, attitudes, intelligence, abilities, 

23 and aptitudes; and 

24 ‘‘(C) does not include— 


pamtmann on DSKBC07HB2PROD with BILLS
6 

•HR 5703 IH

1 ‘‘(i) information that is processed 

2 solely for the purpose of employment of a 

3 young consumer; 

4 ‘‘(ii) de-identified information.’’; 

5 (8) by amending paragraph (10) (as so redesig6 nated) to read as follows: 

7 ‘‘(10) VERIFIABLE CONSENT.—The term 

8 ‘verifiable consent’ means express, affirmative con9 sent freely given by a young consumer, or by the 

10 parent of a child, to the processing of covered infor11 mation of that young consumer or child, respec12 tively— 

13 ‘‘(A) that is specific, informed, and unam14 biguous; 

15 ‘‘(B) that is given separately for each proc16 ess of specific types of covered information; 

17 ‘‘(C) where the young consumer or parent 

18 of a child, as applicable, has not received any 

19 financial or other incentive in exchange for such 

20 consent; and 

21 ‘‘(D) that is given before any processing 

22 occurs, at a time and in a context in which the 

23 young consumer or parent of a child, as appli24 cable, would reasonably expect to make choices 

25 concerning such processing.’’; 


pamtmann on DSKBC07HB2PROD with BILLS
7 

•HR 5703 IH

1 (9) by redesignating paragraphs (11) and (12) 

2 as paragraphs (12) and (13), respectively; and 

3 (10) by adding at the end the following: 

4 ‘‘(14) PROCESS.—The term ‘process’ means 

5 any operation or set of operations which is per6 formed on covered information, whether or not by 

7 automated means, including collecting, creating, ac8 quiring, disclosing, recording, deriving, inferring, ob9 taining, assembling, organizing, structuring, storing, 

10 retaining, adapting or altering, using, or retrieving 

11 covered information. 

12 ‘‘(15) DE-IDENTIFIED INFORMATION AND RE13 LATED TERMS.— 

14 ‘‘(A) The term ‘de-identified information’ 

15 means information that has been de-identified 

16 by a covered entity, where the covered entity 

17 publicly discloses the methods it uses to de18 identify information. 

19 ‘‘(B) The term ‘de-identify’ means the re20 moval of identifying information from informa21 tion such that the information is not reasonably 

22 linkable to a specific young consumer or child 

23 or consumer device of a young consumer or 

24 child. 


pamtmann on DSKBC07HB2PROD with BILLS
8 

•HR 5703 IH

1 ‘‘(C) The term ‘re-identify’ means to link 

2 information that has been de-identified to a 

3 specific young consumer or child or consumer 

4 device of a young consumer or child. 

5 ‘‘(16) STATE.—The term ‘State’ means each of 

6 the several States, the District of Columbia, each 

7 territory of the United States, and each federally 

8 recognized Indian Tribe. 

9 ‘‘(17) SERVICE PROVIDER.—The term ‘service 

10 provider’ means a covered entity that processes cov11 ered information at the direction of, and for the sole 

12 benefit of, another covered entity, and— 

13 ‘‘(A) is contractually or legally prohibited 

14 from processing such covered information for 

15 any other purpose; and 

16 ‘‘(B) complies with all of the requirements 

17 of this Act.’’. 

18 SEC. 3. UNFAIR OR DECEPTIVE ACTS OR PRACTICES. 

19 Section 1303 of the Children’s Online Privacy Protec20 tion Act of 1998 (15 U.S.C. 6502) is amended— 

21 (1) in the section heading, by striking ‘‘COL22 LECTION AND USE OF PERSONAL INFORMA23 TION FROM AND ABOUT CHILDREN ON THE

24 INTERNET’’ and inserting ‘‘PROCESSING OF COVVerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703

pamtmann on DSKBC07HB2PROD with BILLS
9 

•HR 5703 IH

1 ERED INFORMATION FROM AND ABOUT YOUNG

2 CONSUMERS OR CHILDREN’’; 

3 (2) by amending subsection (a) to read as fol4 lows: 

5 ‘‘(a) ACTS PROHIBITED.—It is unlawful for a covered 

6 entity that has actual or constructive knowledge that such 

7 covered entity is processing covered information about a 

8 young consumer or child to process such information in 

9 a manner that violates the regulations prescribed under 

10 subsection (b).’’; 

11 (3) by amending subsection (b) to read as fol12 lows: 

13 ‘‘(b) IN GENERAL.—Not later than 1 year after the 

14 date of enactment of the Protecting the Information of 

15 our Vulnerable Children and Youth Act, the Commission 

16 shall, under section 553 of title 5, United States Code, 

17 revise regulations issued under this Act prior to such date 

18 of enactment and issue additional regulations as necessary 

19 that implement the requirements and prohibitions set 

20 forth in paragraphs (1) through (7). The Commission 

21 shall have the authority to revise such regulations every 

22 7 years or as it determines necessary due to changes in 

23 or emerging technology. 

24 ‘‘(1) TRANSPARENCY.—Such regulations shall 

25 require a covered entity to develop and make pubVerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703

pamtmann on DSKBC07HB2PROD with BILLS
10 

•HR 5703 IH

1 licly available at all times and in a machine-readable 

2 format, a privacy policy, in a manner that is clear, 

3 easily understood, and written in plain and concise 

4 language, that includes— 

5 ‘‘(A) the categories of covered information 

6 that the covered entity processes about young 

7 consumers and children; 

8 ‘‘(B) how and under what circumstances 

9 covered information is collected directly from a 

10 young consumer or child; 

11 ‘‘(C) the categories and the sources of any 

12 covered information processed by a covered en13 tity that is not collected directly from a young 

14 consumer or child; 

15 ‘‘(D) a description of the purposes for 

16 which the covered entity processes covered in17 formation, including— 

18 ‘‘(i) a description of whether and how 

19 the covered entity customizes products or 

20 services, or adjusts the prices of products 

21 or services for young consumers or chil22 dren or based in any part on processing of 

23 covered information; 

24 ‘‘(ii) a description of whether and how 

25 the covered entity, or the covered entity’s 


pamtmann on DSKBC07HB2PROD with BILLS
11 

•HR 5703 IH

1 affiliates or service providers, de-identifies 

2 information, including the methods used to 

3 de-identify such information; and 

4 ‘‘(iii) a description of whether and 

5 how the covered entity, or the covered enti6 ty’s affiliates or service providers, gen7 erates or uses any consumer score to make 

8 decisions concerning a young consumer or 

9 child, and the source or sources of any 

10 such consumer score; 

11 ‘‘(E) a description of how long and the cir12 cumstances under which the covered entity re13 tains covered information; 

14 ‘‘(F) a description of all of the purposes 

15 for which the covered entity discloses covered 

16 information with service providers and, on a bi17 ennial basis, the categories of service providers; 

18 ‘‘(G) a description of whether and for what 

19 purposes the covered entity discloses informa20 tion to third parties; 

21 ‘‘(H) whether a covered entity sells or oth22 erwise shares covered information with data 

23 brokers or processes covered information for 

24 targeted advertising; 


pamtmann on DSKBC07HB2PROD with BILLS
12 

•HR 5703 IH

1 ‘‘(I) whether a covered entity collects cov2 ered information about young consumers or 

3 children over time and across different websites 

4 or mobile applications when a young consumer 

5 or child uses the covered entity’s website or mo6 bile application; 

7 ‘‘(J) how a young consumer or a parent of 

8 a child can exercise their rights to access, cor9 rect, and delete such young consumer’s or 

10 child’s covered information as set forth under 

11 paragraph (5); 

12 ‘‘(K) how a young consumer or a parent of 

13 a child can grant, withhold, or withdraw the 

14 consent required under paragraph (2), including 

15 how to modify consent for the processing of 

16 covered information, and the consequences of 

17 withholding, withdrawing, or modifying such 

18 consent; 

19 ‘‘(L) the effective date of the notice; and 

20 ‘‘(M) how the covered entity will commu21 nicate material changes of the privacy policy to 

22 the young consumer or the parent of a child. 

23 ‘‘(2) CONSENT REQUIRED.— 

24 ‘‘(A) IN GENERAL.—Such regulations shall 

25 require a covered entity that has actual or conVerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703

pamtmann on DSKBC07HB2PROD with BILLS
13 

•HR 5703 IH

1 structive knowledge that such covered entity is 

2 processing covered information about a young 

3 consumer or child— 

4 ‘‘(i) to provide clear and concise no5 tice to a young consumer or the parent of 

6 a child of the items of covered information 

7 about such young consumer or child, re8 spectively, that is processed by such cov9 ered entity and how such covered entity 

10 processes such covered information and ob11 tain verifiable consent for such processing; 

12 and 

13 ‘‘(ii) if such covered entity determines, 

14 including through constructive knowledge, 

15 that such covered entity has not obtained 

16 verifiable consent for the processing of cov17 ered information about a young consumer 

18 or child, to, not later than 48 hours after 

19 such determination— 

20 ‘‘(I) obtain verifiable consent; or 

21 ‘‘(II) delete all covered informa22 tion about such young consumer or 

23 child. 

24 ‘‘(B) WHEN CONSENT NOT REQUIRED.— 

25 Such regulations shall provide that verifiable 


pamtmann on DSKBC07HB2PROD with BILLS
14 

•HR 5703 IH

1 consent under this paragraph is not required in 

2 the case of— 

3 ‘‘(i) online contact information col4 lected from a young consumer or child 

5 that— 

6 ‘‘(I) is used only to respond di7 rectly on a one-time basis to a specific 

8 request from the young consumer or 

9 child; 

10 ‘‘(II) is not used to re-contact the 

11 young consumer or child; and 

12 ‘‘(III) is not retained by the cov13 ered entity after responding as de14 scribed in subclause (I); 

15 ‘‘(ii) a request for the name or online 

16 contact information of a young consumer 

17 or the parent of a child that is used for the 

18 sole purpose of obtaining verifiable consent 

19 or providing notice under subparagraph 

20 (A)(i) and where such information is not 

21 retained by the covered entity if verifiable 

22 consent is not obtained within 48 hours; or 

23 ‘‘(iii) the processing of such informa24 tion by the covered entity is necessary— 


pamtmann on DSKBC07HB2PROD with BILLS
15 

•HR 5703 IH

1 ‘‘(I) to respond to judicial proc2 ess; or 

3 ‘‘(II) to the extent permitted 

4 under other provisions of law, to pro5 vide information to law enforcement 

6 agencies or for an investigation on a 

7 matter related to public safety. 

8 ‘‘(C) WITHDRAWAL OF CONSENT.—Such 

9 regulations shall further provide a young con10 sumer or the parent of a child, as applicable, a 

11 mechanism to withdraw his or her consent at 

12 any time in a manner that is as easy as the 

13 mechanism to give consent. Such withdrawal of 

14 consent shall not be construed to affect the law15 fulness of any processing based on verifiable 

16 consent before such withdrawal. 

17 ‘‘(D) PROHIBITION ON LIMITING OR DIS18 CONTINUING SERVICE.—Such regulations shall 

19 prohibit a covered entity from refusing to pro20 vide a service, or discontinuing a service pro21 vided, to a young consumer or child, if the 

22 young consumer or parent of the child, as appli23 cable, refuses to consent, or withdraws consent, 

24 to the processing of any covered information 


pamtmann on DSKBC07HB2PROD with BILLS
16 

•HR 5703 IH

1 not essential to the covered entity to provide 

2 such service. 

3 ‘‘(3) RETENTION OF DATA.— 

4 ‘‘(A) RETENTION LIMITATIONS.—Subject 

5 to the exceptions provided in subparagraph (B), 

6 such regulations shall prohibit a covered entity 

7 from keeping, retaining, or otherwise storing 

8 covered information for longer than is reason9 ably necessary for the purposes for which the 

10 covered information is processed. 

11 ‘‘(B) EXCEPTIONS.—Further retention of 

12 covered information shall not be considered to 

13 be incompatible with the purposes of processing 

14 described in subparagraph (A) if such proc15 essing is necessary and done solely for the pur16 poses of— 

17 ‘‘(i) compliance with laws, regulations, 

18 or other legal obligations; 

19 ‘‘(ii) preventing risks to the health or 

20 safety of a child or young adults or groups 

21 of children or young adults; or 

22 ‘‘(iii) repairing errors that impair ex23 isting functionality. 

24 ‘‘(4) LIMITATION ON DISCLOSING COVERED IN25 FORMATION TO THIRD PARTIES.— 


pamtmann on DSKBC07HB2PROD with BILLS
17 

•HR 5703 IH

1 ‘‘(A) DISCLOSURES.—Such regulations 

2 shall prohibit a covered entity from disclosing 

3 covered information to a third party unless the 

4 covered entity has a written agreement with 

5 such third party that— 

6 ‘‘(i) specifies all of the purposes for 

7 which the third party may process the cov8 ered information for which the covered en9 tity has verifiable consent; 

10 ‘‘(ii) prohibits the third party from 

11 processing covered information for any 

12 purpose other than the purposes specified 

13 under clause (i); and 

14 ‘‘(iii) requires the third party to pro15 vide at least the same privacy and security 

16 protections as the covered entity; or 

17 ‘‘(B) RESPONSIBILITIES OF COVERED EN18 TITIES REGARDING THIRD PARTIES.—Such reg19 ulations shall require a covered entity— 

20 ‘‘(i) to perform reasonable due dili21 gence in selecting any third party to enter 

22 into an agreement under subparagraph (A) 

23 and to exercise reasonable oversight over 

24 all such third parties to assure compliance 

25 with the requirements of this Act; and 


pamtmann on DSKBC07HB2PROD with BILLS
18 

•HR 5703 IH

1 ‘‘(ii) if the covered entity has actual 

2 or constructive knowledge that a third 

3 party has violated the agreement described 

4 in subparagraph (A) to— 

5 ‘‘(I) to the extent practicable, 

6 promptly take steps to ensure compli7 ance with such agreement; and 

8 ‘‘(II) promptly report to the 

9 Commission that such a violation oc10 curred. 

11 ‘‘(5) RIGHT TO ACCESS, CORRECT, AND DELETE

12 COVERED INFORMATION.— 

13 ‘‘(A) ACCESS.—Such regulations shall re14 quire a covered entity, upon request of a young 

15 consumer or the parent of a child and after 

16 proper identification of such young consumer or 

17 parent, to promptly provide to such young con18 sumer or parent, as applicable— 

19 ‘‘(i) access to all covered information 

20 pertaining to such young consumer or child 

21 including a description of— 

22 ‘‘(I) each type of covered infor23 mation processed by the covered enti24 ty pertaining to the young consumer 

25 or child, as applicable; 


pamtmann on DSKBC07HB2PROD with BILLS
19 

•HR 5703 IH

1 ‘‘(II) each purpose for which the 

2 covered entity processes each category 

3 of covered information pertaining to 

4 the young consumer or child, as appli5 cable; 

6 ‘‘(III) the names of each third 

7 party to which the covered entity dis8 closed the covered information; 

9 ‘‘(IV) each source other than the 

10 young consumer or child, as applica11 ble, from which the covered entity ob12 tained covered information pertaining 

13 to that young consumer or child, as 

14 applicable; 

15 ‘‘(V) how long the covered infor16 mation will be retained or stored by 

17 the covered entity and, if not known, 

18 the criteria the covered entity uses to 

19 determine how long the covered infor20 mation will be retained or stored by 

21 the covered entity; and 

22 ‘‘(VI) with respect to any con23 sumer score of the young consumer or 

24 child, as applicable, processed by the 

25 covered entity, of— 


pamtmann on DSKBC07HB2PROD with BILLS
20 

•HR 5703 IH

1 ‘‘(aa) how such consumer 

2 score is used by the covered enti3 ty to make decisions with respect 

4 to that young consumer or child, 

5 as applicable; and 

6 ‘‘(bb) the source that cre7 ated the consumer score if not 

8 created by the covered entity; 

9 and 

10 ‘‘(ii) a simple and reasonable mecha11 nism by which a young consumer or parent 

12 of a child may request access to the infor13 mation described under clause (i), as appli14 cable. 

15 ‘‘(B) DELETION.—Such regulations shall 

16 require a covered entity, subject to the excep17 tions established under subparagraph (D)— 

18 ‘‘(i) to establish a simple and reason19 able mechanism by which a young con20 sumer or parent of a child with respect to 

21 whom the covered entity processes covered 

22 information may request the covered entity 

23 to delete any covered information (or any 

24 component thereof); and 


pamtmann on DSKBC07HB2PROD with BILLS
21 

•HR 5703 IH

1 ‘‘(ii) to delete such covered informa2 tion not later than 45 days after receiving 

3 such request. 

4 ‘‘(C) CORRECTION.—Such regulations shall 

5 require a covered entity, subject to the excep6 tions established under subparagraph (D)— 

7 ‘‘(i) to provide each young consumer 

8 or parent of a child with respect to whom 

9 the covered entity processes covered infor10 mation, as applicable, a simple and reason11 able mechanism by which that young con12 sumer or parent may submit a request to 

13 the entity— 

14 ‘‘(I) to dispute the accuracy or 

15 completeness of that covered informa16 tion, or part or component thereof; 

17 and 

18 ‘‘(II) to request that such cov19 ered information, or part or compo20 nent thereof, be corrected for accuracy 

21 or completeness; and 

22 ‘‘(ii) not later than 45 days after re23 ceiving a request under clause (i)— 

24 ‘‘(I) to determine whether the 

25 covered information disputed or reVerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00021 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703

pamtmann on DSKBC07HB2PROD with BILLS
22 

•HR 5703 IH

1 quested to be corrected is inaccurate 

2 or incomplete; and 

3 ‘‘(II) to correct the accuracy or 

4 completeness of any covered informa5 tion determined by the covered entity 

6 to be inaccurate or incomplete. 

7 ‘‘(D) EXCEPTIONS.—Such regulations 

8 shall permit a covered entity to deny a request 

9 made under subparagraphs (A), (B), or (C) if— 

10 ‘‘(i) the covered entity is unable to 

11 verify the identity of the young consumer 

12 or parent of a child making the request 

13 after making a reasonable effort to verify 

14 the identity of such young consumer or 

15 parent; or 

16 ‘‘(ii) with respect to the request made, 

17 the covered entity determines that— 

18 ‘‘(I) the entity is limited from 

19 doing so by law, legally recognized 

20 privilege, or other legal obligation; or 

21 ‘‘(II) fulfilling the request would 

22 create a legitimate risk to the privacy, 

23 security, or safety of someone other 

24 than the young consumer or child, as 

25 applicable; or 


pamtmann on DSKBC07HB2PROD with BILLS
23 

•HR 5703 IH

1 ‘‘(iii) with respect to a request to cor2 rect covered information made under sub3 paragraph (C) or a request to delete cov4 ered information made under subpara5 graph (D), the covered entity determines 

6 that the retention of the covered informa7 tion is necessary to— 

8 ‘‘(I) complete the transaction 

9 with the young consumer or child, as 

10 applicable, for which the covered in11 formation was collected; 

12 ‘‘(II) provide a product or service 

13 affirmatively requested by the young 

14 consumer or parent of a child, as ap15 plicable; 

16 ‘‘(III) perform a contract with 

17 the young consumer or a parent of a 

18 child, as applicable, including a con19 tract for billing, financial reporting, or 

20 accounting; 

21 ‘‘(IV) to keep a record of the cov22 ered information for law enforcement 

23 purposes; or 


pamtmann on DSKBC07HB2PROD with BILLS
24 

•HR 5703 IH

1 ‘‘(V) identify and repair errors 

2 that impair the functionality of the 

3 Internet website or online service; or 

4 ‘‘(iv) the covered information is used 

5 in public or peer-reviewed scientific, med6 ical, or statistical research in the public in7 terest that adheres to commonly accepted 

8 ethical standards or laws, with informed 

9 consent consistent with section 50.20 of 

10 title 21, Code of Federal Regulations, pro11 vided that the research must already be in 

12 progress at the time of request to access, 

13 correct, or delete is made under subpara14 graphs (A), (B), or (C). 

15 ‘‘(E) PROHIBITION ON LIMITING OR DIS16 CONTINUING SERVICE.—Such regulations shall 

17 prohibit a covered entity from refusing to pro18 vide a service, or discontinuing a service pro19 vided, to a young consumer or child, if the 

20 young consumer or parent of the child, as appli21 cable, exercises any of the rights set forth in 

22 regulations under this paragraph. 

23 ‘‘(6) ADDITIONAL PROHIBITED PRACTICES

24 WITH RESPECT TO YOUNG CONSUMERS AND CHIL25 DREN.— 


pamtmann on DSKBC07HB2PROD with BILLS
25 

•HR 5703 IH

1 ‘‘(A) IN GENERAL.—Such regulations shall 

2 prohibit a covered entity from— 

3 ‘‘(i) processing any covered informa4 tion in a manner that is inconsistent with 

5 what a reasonable young consumer or par6 ent of a child would expect in the context 

7 of a particular transaction or the young 

8 consumer’s or parent’s relationship with 

9 such covered entity or seeking to obtain 

10 verifiable consent for such processing; 

11 ‘‘(ii) providing targeting advertise12 ments or engaging in other marketing to a 

13 specific child, based on that child’s covered 

14 information or behavior, or based on the 

15 covered information or behavior of children 

16 who are similar to that child in gender, in17 come level, age, race, or ethnicity; and 

18 ‘‘(iii) conditioning the participation of 

19 a child in a game, sweepstakes, or other 

20 contest on consenting to the processing of 

21 more covered information than is necessary 

22 for such child to participate. 

23 ‘‘(B) EXCEPTIONS.—Nothing in subpara24 graph (A) shall prohibit a covered entity from 


pamtmann on DSKBC07HB2PROD with BILLS
26 

•HR 5703 IH

1 processing covered information if necessary 

2 solely for purposes of— 

3 ‘‘(i) detecting and preventing security 

4 incidents; 

5 ‘‘(ii) preventing imminent danger to 

6 the personal safety of an individual or 

7 group of individuals; 

8 ‘‘(iii) identifying and repairing errors 

9 that impair the functionality of the Inter10 net website or online service; or 

11 ‘‘(iv) complying with any Federal, 

12 State, or local law, rule, regulation, or 

13 other legal obligation, including civil, crimi14 nal, or regulatory inquiries, investigations, 

15 subpoenas, disclosures of information re16 quired by a court order or other properly 

17 executed compulsory process. 

18 ‘‘(C) DE-IDENTIFIED INFORMATION.— 

19 Such regulations shall prohibit a covered entity 

20 that de-identifies information, and any third 

21 party with which the covered entity discloses 

22 such de-identified information, from re-identi23 fying, or attempting to re-identify, any informa24 tion that the covered entity has de-identified. 

25 Such regulations shall also require a covered 


pamtmann on DSKBC07HB2PROD with BILLS
27 

•HR 5703 IH

1 entity to contractually prohibit any third party 

2 with which the covered entity discloses such de3 identified information from re-identifying or at4 tempting to re-identify such information. 

5 ‘‘(7) SECURITY REQUIREMENTS.— 

6 ‘‘(A) IN GENERAL.—Such regulations shall 

7 require a covered entity to establish and imple8 ment reasonable security policies, practices, and 

9 procedures for the treatment and protection of 

10 covered information, taking into consider11 ation— 

12 ‘‘(i) the size, nature, scope, and com13 plexity of the activities engaged in by such 

14 covered entity; 

15 ‘‘(ii) the sensitivity of any covered in16 formation at issue; 

17 ‘‘(iii) the state of the art in adminis18 trative, technical, and physical safeguards 

19 for protecting such information; and 

20 ‘‘(iv) the cost of implementing such 

21 policies, practices, and procedures. 

22 ‘‘(B) SPECIFIC REQUIREMENTS.—Such 

23 regulations shall require the policies, practices, 

24 and procedures established pursuant to regulaVerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00027 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703

pamtmann on DSKBC07HB2PROD with BILLS
28 

•HR 5703 IH

1 tions issued under subparagraph (A) to include 

2 the following: 

3 ‘‘(i) A written security policy with re4 spect to the processing of such covered in5 formation. 

6 ‘‘(ii) The identification of an officer or 

7 other individual as the point of contact 

8 with responsibility for the management of 

9 information security. 

10 ‘‘(iii) A process for identifying and as11 sessing any reasonably foreseeable 

12 vulnerabilities in the system or systems 

13 maintained by such covered entity that 

14 contains such covered information, includ15 ing regular monitoring for a breach of se16 curity of such system or systems. 

17 ‘‘(iv) A process for taking preventive 

18 and corrective action to mitigate against 

19 any vulnerabilities identified in the process 

20 required by clause (iii), which may in21 clude— 

22 ‘‘(I) implementing any changes to 

23 the security practices, architecture, in24 stallation, or implementation of net25 work or operating software; and 


pamtmann on DSKBC07HB2PROD with BILLS
29 

•HR 5703 IH

1 ‘‘(II) regular testing or otherwise 

2 monitoring the effectiveness of the 

3 safeguards. 

4 ‘‘(v) A process for determining if the 

5 covered information is no longer needed 

6 and deleting such covered information by 

7 shredding, permanently erasing, or other8 wise modifying the covered information 

9 contained in such data to make such cov10 ered information permanently unreadable 

11 or indecipherable. 

12 ‘‘(vi) A process for overseeing persons 

13 who have access to covered information, in14 cluding through Internet-connected devices, 

15 by— 

16 ‘‘(I) taking reasonable steps to 

17 select and retain persons that are ca18 pable of maintaining appropriate safe19 guards for the covered information or 

20 Internet-connected devices at issue; 

21 and 

22 ‘‘(II) requiring all such persons 

23 to implement and maintain such secu24 rity measures. 


pamtmann on DSKBC07HB2PROD with BILLS
30 

•HR 5703 IH

1 ‘‘(vii) A process for employee training 

2 and supervision for implementation of the 

3 policies, practices, and procedures required 

4 by this subsection. 

5 ‘‘(viii) A written plan or protocol for 

6 internal and public response in the event of 

7 a breach of security. 

8 ‘‘(C) PERIODIC ASSESSMENT AND CON9 SUME PRIVACY AND DATA SECURITY MOD10 ERNIZATION.—Such regulations shall require a 

11 covered entity, not less frequently than every 12 

12 months, to monitor, evaluate, and adjust, as ap13 propriate, the policies, practices, and procedures 

14 of such covered entity in light of any relevant 

15 changes in— 

16 ‘‘(i) technology; 

17 ‘‘(ii) internal or external threats and 

18 vulnerabilities to covered information; and 

19 ‘‘(iii) the changing business arrange20 ments of the covered entity. 

21 ‘‘(D) SUBMISSION OF POLICIES TO THE

22 FTC.—Such regulations shall require a covered 

23 entity to submit the policies, practices, and pro24 cedures of the covered entity to the Commission 

25 in conjunction with a notification of a breach of 


pamtmann on DSKBC07HB2PROD with BILLS
31 

•HR 5703 IH

1 security required by any Federal or State stat2 ute or regulation or upon request of the Com3 mission.’’; and 

4 (4) in subsection (c)— 

5 (A) by inserting ‘‘subsection (a)(2) or’’ 

6 after ‘‘violation of’’; and 

7 (B) by striking ‘‘under subsection (a)’’ and 

8 inserting ‘‘under subsection (b)’’. 

9 SEC. 4. REPEAL OF SAFE HARBORS PROVISION AND CON10 FORMING AMENDMENTS. 

11 (a) IN GENERAL.—Section 1304 of the Children’s 

12 Online Privacy Protection Act of 1998 (15 U.S.C. 6503) 

13 is repealed. 

14 (b) CONFORMING AMENDMENTS.—The Children’s 

15 Online Privacy Protection Act of 1998 (15 U.S.C. 6501 

16 et seq.) is amended— 

17 (1) by striking ‘‘operator’’ each place it appears 

18 and inserting ‘‘covered entity’’; 

19 (2) in section 1303(c), by striking ‘‘sections 

20 1304 and 1306’’ and inserting ‘‘section 1306’’; and 

21 (3) in section 1305(b), by striking paragraph 

22 (3). 


pamtmann on DSKBC07HB2PROD with BILLS
32 

•HR 5703 IH

1 SEC. 5. ADMINISTRATION AND APPLICABILITY OF ACT. 

2 (a) ENFORCEMENT BY FEDERAL TRADE COMMIS3 SION.—Section 1306(d) of the Children’s Online Privacy 

4 Protection Act of 1998 (15 U.S.C. 6505(d)) is amended— 

5 (1) in the first sentence, by striking ‘‘this title. 

6 Any entity’’ and inserting ‘‘this title, and any enti7 ty’’; 

8 (2) by striking ‘‘The Commission shall prevent’’ 

9 and inserting the following: 

10 ‘‘(1) IN GENERAL.—Except as provided in para11 graphs (2) through (4), the Commission shall pre12 vent’’; and 

13 (3) by adding at the end the following: 

14 ‘‘(2) INCREASED CIVIL PENALTY AMOUNT.—In 

15 the case of a civil penalty under subsection (l) or 

16 (m) of section 5 of the Federal Trade Commission 

17 Act (15 U.S.C. 45) relating to acts or practices in 

18 violation of any provision of this title or a regulation 

19 prescribed under this title, the maximum dollar 

20 amount per violation shall be $63,795. 

21 ‘‘(3) NATURE OF RELIEF AVAILABLE.—In any 

22 action commenced by the Commission under section 

23 19(a) of the Federal Trade Commission Act (15 

24 U.S.C. 57a(a)) to enforce this title, the Commission 

25 shall seek all appropriate relief described in sub26 section (b) of such section, and may, notwithVerDate Sep 11 2014 02:06 Jan 30, 2020 Jkt 099200 PO 00000 Frm 00032 Fmt 6652 Sfmt 6201 E:\BILLS\H5703.IH H5703

pamtmann on DSKBC07HB2PROD with BILLS
33 

•HR 5703 IH

1 standing such subsection, seek any exemplary or pu2 nitive damages.’’. 

3 (b) ENFORCEMENT BY CERTAIN OTHER AGEN4 CIES.—Section 1306 of the Children’s Online Privacy Pro5 tection Act of 1998 (15 U.S.C. 6505) is further amend6 ed— 

7 (1) in subsection (b)— 

8 (A) in paragraph (1), by striking ‘‘, in the 

9 case of’’ and all that follows and inserting the 

10 following: ‘‘by the appropriate Federal banking 

11 agency, with respect to any insured depository 

12 institution (as those terms are defined in sec13 tion 3 of that Act (12 U.S.C. 1813));’’; 

14 (B) in paragraph (6), by striking ‘‘Federal 

15 land bank, Federal land bank association, Fed16 eral intermediate credit bank, or production 

17 credit association’’ and inserting ‘‘Farm Credit 

18 Bank, Agricultural Credit Bank (to the extent 

19 exercising the authorities of a Farm Credit 

20 Bank), Federal Land Credit Association, or ag21 ricultural credit association’’; and 

22 (C) by striking paragraph (2) and redesig23 nating paragraphs (3) through (6) as para24 graphs (2) through (5), respectively; and 


pamtmann on DSKBC07HB2PROD with BILLS
34 

•HR 5703 IH

1 (2) in subsection (c), by striking ‘‘subsection 

2 (a)’’ each place it appears and inserting ‘‘subsection 

3 (b)’’. 

4 SEC. 6. REVIEW. 

5 Section 1307 of the Children’s Online Privacy Protec6 tion Act of 1998 (15 U.S.C. 6506) is amended— 

7 (1) in the matter preceding paragraph (1), by 

8 striking ‘‘the regulations initially issued under sec9 tion 1303’’ and inserting ‘‘the regulations issued 

10 under section 1303 for the initial implementation of 

11 the amendments made by the Protecting the Infor12 mation of our Vulnerable Children and Youth Act’’; 

13 and 

14 (2) by amending paragraph (1) to read as fol15 lows: 

16 ‘‘(1) review the implementation of this title, in17 cluding the effect of the implementation of this title 

18 on practices relating to the processing of covered in19 formation about young consumers or children and 

20 young consumer’s and children’s ability to obtain ac21 cess to information of their choice online; and’’. 

22 SEC. 7. PRIVATE RIGHT OF ACTION. 

23 The Children’s Online Privacy Protection Act of 1998 

24 (15 U.S.C. 6501 et seq.) is amended— 


pamtmann on DSKBC07HB2PROD with BILLS
35 

•HR 5703 IH

1 (1) by redesignating sections 1307 and 1308 as 

2 sections 1308 and 1309, respectively; and 

3 (2) by inserting after section 1306 the fol4 lowing: 

5 ‘‘SEC. 1307. PRIVATE RIGHT OF ACTION. 

6 ‘‘(a) RIGHT OF ACTION.—Any parent of a young con7 sumer or parent of a child alleging a violation of this title 

8 or a regulation prescribed under this title with respect to 

9 the covered information of such young consumer or child 

10 may bring a civil action in any court of competent jurisdic11 tion. 

12 ‘‘(b) INJURY IN FACT.—A violation of this Act or a 

13 regulation promulgated under this Act with respect to the 

14 covered information of a young consumer or child con15 stitutes an injury in fact to that young consumer or child. 

16 ‘‘(c) RELIEF.—In a civil action brought under sub17 section (a) in which the plaintiff prevails, the court may 

18 award— 

19 ‘‘(1) injunctive relief; 

20 ‘‘(2) actual damages; 

21 ‘‘(3) punitive damages; 

22 ‘‘(4) reasonable attorney’s fees and costs; and 

23 ‘‘(5) any other relief that the court determines 

24 appropriate. 

25 ‘‘(d) PRE-DISPUTE ARBITRATION AGREEMENTS.— 


pamtmann on DSKBC07HB2PROD with BILLS
36 

•HR 5703 IH

1 ‘‘(1) IN GENERAL.—No pre-dispute arbitration 

2 agreement or pre-dispute joint-action waiver shall be 

3 valid or enforceable with respect to any claim arising 

4 out of this Act or the regulations issued under this 

5 Act. 

6 ‘‘(2) DETERMINATION.—A determination as to 

7 whether and how this Act applies to an arbitration 

8 agreement shall be determined under Federal law by 

9 the court, rather than the arbitrator, irrespective of 

10 whether the party opposing arbitration challenges 

11 such agreement specifically or in conjunction with 

12 any other term of the contract containing such 

13 agreement. 

14 ‘‘(3) DEFINITIONS.—As used in this sub15 section— 

16 ‘‘(A) the term ‘pre-dispute arbitration 

17 agreement’ means any agreement to arbitrate a 

18 dispute that has not arisen at the time of the 

19 making of the agreement; and 

20 ‘‘(B) the term ‘pre-dispute joint-action 

21 waiver’ means an agreement, whether or not 

22 part of a pre-dispute arbitration agreement, 

23 that would prohibit, or waive the right of, one 

24 of the parties to the agreement to participate in 

25 a joint, class, or collective action in a judicial, 


pamtmann on DSKBC07HB2PROD with BILLS
37 

•HR 5703 IH

1 arbitral, administrative, or other forum, con2 cerning a dispute that has not yet arisen at the 

3 time of the making of the agreement. 

4 ‘‘(e) NON-WAIVEABILITY.—The rights and remedies 

5 provided under this Act may not be waived or limited by 

6 contract or otherwise.’’. 

7 SEC. 8. RELATIONSHIP TO OTHER LAW. 

8 Section 1306 of the Children’s Online Privacy Protec9 tion Act of 1998 (15 U.S.C. 6505) is further amended 

10 by adding at the end the following: 

11 ‘‘(f) RELATIONSHIP TO OTHER LAW.—Nothing in 

12 this Act may be construed to modify, limit, or supersede 

13 the operation of any privacy or security provision in any 

14 other Federal statute or regulation.’’. 

15 SEC. 9. ADDITIONAL CONFORMING AMENDMENT. 

16 The heading of title XIII of division C of the Omni17 bus Consolidated and Emergency Supplemental Appro18 priations Act, 1999 (Public Law 105–277; 112 Stat. 

19 2681–728) is amended by inserting ‘‘AND YOUNG 

20 CONSUMER’S’’ after ‘‘CHILDREN’S’’. 

Æ 


pamtmann on DSKBC07HB2PROD with BILLS