```

[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[H.R. 8818 Introduced in House (IH)]

<DOC>

118th CONGRESS
  2d Session
                                H. R. 8818

  To provide Americans with foundational data privacy rights, create 
strong oversight mechanisms, and establish meaningful enforcement, and 
                          for other purposes.

_______________________________________________________________________

                    IN THE HOUSE OF REPRESENTATIVES

                             June 25, 2024

 Mrs. Rodgers of Washington (for herself, Mr. Pallone, Mr. Bilirakis, 
 and Ms. Schakowsky) introduced the following bill; which was referred 
                to the Committee on Energy and Commerce

_______________________________________________________________________

                                 A BILL

 
  To provide Americans with foundational data privacy rights, create 
strong oversight mechanisms, and establish meaningful enforcement, and 
                          for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

    (a) Short Title.--This Act may be cited as the ``American Privacy 
Rights Act of 2024''.
    (b) Table of Contents.--The table of contents for this Act is as 
follows:

Sec. 1. Short title; table of contents.
                    TITLE I--AMERICAN PRIVACY RIGHTS

Sec. 101. Definitions.
Sec. 102. Data minimization.
Sec. 103. Privacy by design.
Sec. 104. Transparency.
Sec. 105. Individual control over covered data.
Sec. 106. Opt-out rights and universal mechanisms.
Sec. 107. Interference with consumer rights.
Sec. 108. Prohibition on denial of service and waiver of rights.
Sec. 109. Data security and protection of covered data.
Sec. 110. Executive responsibility.
Sec. 111. Service providers and third parties.
Sec. 112. Data brokers.
Sec. 113. Commission-approved compliance guidelines.
Sec. 114. Privacy-enhancing technology pilot program.
Sec. 115. Enforcement by Federal Trade Commission.
Sec. 116. Enforcement by States.
Sec. 117. Enforcement by persons.
Sec. 118. Relation to other laws.
Sec. 119. Children's Online Privacy Protection Act of 1998.
Sec. 120. Data protections for covered minors.
Sec. 121. Termination of FTC rulemaking on commercial surveillance and 
                            data security.
Sec. 122. Severability.
Sec. 123. Innovation rulemakings.
Sec. 124. Effective date.
         TITLE II--CHILDREN'S ONLINE PRIVACY PROTECTION ACT 2.0

Sec. 201. Short title.
Sec. 202. Online collection, use, disclosure, and deletion of personal 
                            information of children.
Sec. 203. Study and reports on mobile and online application oversight 
                            and enforcement.
Sec. 204. Severability.

                    TITLE I--AMERICAN PRIVACY RIGHTS

SEC. 101. DEFINITIONS.

    In this title:
            (1) Affirmative express consent.--
                    (A) In general.--The term ``affirmative express 
                consent'' means an affirmative act by an individual 
                that--
                            (i) clearly communicates the authorization 
                        of the individual for an act or practice; and
                            (ii) is provided in response to a specific 
                        request from a covered entity, or a service 
                        provider on behalf of a covered entity, that 
                        meets the requirements of subparagraph (B).
                    (B) Request requirements.--The requirements of this 
                subparagraph with respect to a request are the 
                following:
                            (i) The request is provided to the 
                        individual in a clear and conspicuous 
                        standalone disclosure.
                            (ii) The request includes a description of 
                        each act or practice for which the consent of 
                        the individual is sought and--
                                    (I) clearly distinguishes between 
                                an act or practice that is necessary, 
                                proportionate, and limited to fulfill a 
                                request of the individual and an act or 
                                practice that is for another purpose;
                                    (II) clearly states the specific 
                                categories of covered data that the 
                                covered entity shall collect, process, 
                                retain, or transfer under each such act 
                                or practice; and
                                    (III) is written in easy-to-
                                understand language and includes a 
                                prominent heading that would enable a 
                                reasonable individual to identify and 
                                understand each such act or practice.
                            (iii) The request clearly explains the 
                        applicable rights of the individual related to 
                        consent.
                            (iv) The request is made in a manner 
                        reasonably accessible to and usable by 
                        individuals living with disabilities.
                            (v) The request is made available to the 
                        individual in the language in which the covered 
                        entity provides a product or service for which 
                        authorization is sought.
                            (vi) The option to refuse consent is at 
                        least as prominent as the option to provide 
                        consent, and the option to refuse consent takes 
                        no more than 1 additional step as compared to 
                        the number of steps necessary to provide 
                        consent.
                            (vii) With respect to affirmative express 
                        consent sought for the collection, processing, 
                        retention, or transfer of biometric information 
                        or genetic information, the request includes 
                        the length of time the covered entity or 
                        service provider intends to retain the 
                        biometric information or genetic information 
                        or, if it is not possible to identify the 
                        length of time, the criteria used to determine 
                        the length of time the covered entity or 
                        service provider intends to retain the 
                        biometric information or genetic information.
                    (C) Express consent required.--Affirmative express 
                consent to an act or practice may not be inferred from 
                the inaction of an individual or the continued use by 
                an individual of a service or product provided by an 
                entity.
                    (D) Withdrawal of affirmative express consent.--
                            (i) In general.--A covered entity shall 
                        provide an individual with a means to withdraw 
                        affirmative express consent previously provided 
                        by the individual.
                            (ii) Requirements.--The means to withdraw 
                        affirmative express consent described in clause 
                        (i) shall be--
                                    (I) clear and conspicuous; and
                                    (II) as easy for a reasonable 
                                individual to use as the mechanism by 
                                which the individual provided 
                                affirmative express consent.
                    (E) Children and teens.--If a covered entity has 
                knowledge that--
                            (i) an individual is a child, only a parent 
                        of the child may provide affirmative express 
                        consent on behalf of the child; or
                            (ii) an individual is a teen, a parent or 
                        the teen may provide affirmative express 
                        consent on behalf of the teen.
            (2) Biometric information.--
                    (A) In general.--The term ``biometric information'' 
                means any covered data that allows or confirms the 
                unique identification or verification of an individual 
                and is generated from the measurement or processing of 
                unique biological, physical, or physiological 
                characteristics, including--
                            (i) fingerprints;
                            (ii) voice prints;
                            (iii) iris or retina imagery scans;
                            (iv) facial or hand mapping, geometry, or 
                        templates; and
                            (v) gait.
                    (B) Exclusion.--The term ``biometric information'' 
                does not include--
                            (i) a digital or physical photograph;
                            (ii) an audio or video recording; or
                            (iii) data derived from a digital or 
                        physical photograph or an audio or video 
                        recording that cannot be used to identify or 
                        authenticate a specific individual.
            (3) Child.--The term ``child'' means an individual under 
        the age of 13.
            (4) Clear and conspicuous.--The term ``clear and 
        conspicuous'' means, with respect to a disclosure, that the 
        disclosure is difficult to miss and easily understandable by 
        ordinary consumers.
            (5) Coarse geolocation information.--The term ``coarse 
        geolocation information'' means information that reveals the 
        present physical location of an individual or device identified 
        by a unique persistent identifier at the ZIP Code attribution 
        level (except, if a geographic area attributed to a ZIP Code is 
        equal to or less than the area of a circle with a radius of 
        1,850 feet or less, at a level greater than a geographic area 
        equal to the area of a circle with a radius of 1,850 feet).
            (6) Collect.--The term ``collect'' means, with respect to 
        covered data, to buy, rent, gather, obtain, receive, access, or 
        otherwise acquire the covered data by any means.
            (7) Commission.--The term ``Commission'' means the Federal 
        Trade Commission.
            (8) Common branding.--The term ``common branding'' means a 
        name, service mark, or trademark that is shared by 2 or more 
        entities.
            (9) Connected device.--The term ``connected device'' means 
        a device that is capable of connecting to the internet.
            (10) Contextual advertising.--The term ``contextual 
        advertising'' means displaying or presenting an advertisement 
        that--
                    (A) does not vary based on the identity of the 
                individual recipient; and
                    (B) is based solely on--
                            (i) the content of a webpage or online 
                        service;
                            (ii) a specific request of the individual 
                        for information or feedback; or
                            (iii) coarse geolocation information.
            (11) Control.--The term ``control'' means, with respect to 
        an entity--
                    (A) ownership of, or the power to vote, more than 
                50 percent of the outstanding shares of any class of 
                voting security of the entity;
                    (B) control over the election of a majority of the 
                directors of the entity (or of individuals exercising 
                similar functions); or
                    (C) the power to exercise a controlling influence 
                over the management of the entity.
            (12) Covered data.--
                    (A) In general.--The term ``covered data'' means 
                information that identifies or is linked or reasonably 
                linkable, alone or in combination with other 
                information, to an individual or a device that 
                identifies or is linked or reasonably linkable to 1 or 
                more individuals.
                    (B) Exclusions.--The term ``covered data'' does not 
                include--
                            (i) de-identified data;
                            (ii) employee information;
                            (iii) publicly available information;
                            (iv) inferences made exclusively from 
                        multiple independent sources of publicly 
                        available information, if such inferences--
                                    (I) do not reveal information about 
                                an individual that meets the definition 
                                of the term ``sensitive covered data'' 
                                with respect to the individual; and
                                    (II) are not combined with covered 
                                data;
                            (v) information in the collection of a 
                        library, archive, or museum, if--
                                    (I) the collection is--
                                            (aa) open to the public or 
                                        routinely made available to 
                                        researchers who are not 
                                        affiliated with the library, 
                                        archive, or museum; and
                                            (bb) composed of lawfully 
                                        acquired materials with respect 
                                        to which all licensing 
                                        conditions are met; and
                                    (II) the library, archive, or 
                                museum has--
                                            (aa) a public service 
                                        mission; and
                                            (bb) trained staff or 
                                        volunteers to provide 
                                        professional services normally 
                                        associated with libraries, 
                                        archives, or museums; or
                            (vi) on-device data.
            (13) Covered entity.--
                    (A) In general.--The term ``covered entity'' means 
                any entity that, alone or jointly with others, 
                determines the purposes and means of collecting, 
                processing, retaining, or transferring covered data 
                and--
                            (i) is subject to the Federal Trade 
                        Commission Act (15 U.S.C. 41 et seq.);
                            (ii) is a common carrier subject to title 
                        II of the Communications Act of 1934 (47 U.S.C. 
                        201 et seq.); or
                            (iii) is an organization not organized to 
                        carry on business for its own profit or that of 
                        its members.
                    (B) Inclusion.--The term ``covered entity'' 
                includes any entity that controls, is controlled by, or 
                is under common control with another covered entity.
                    (C) Exclusions.--The term ``covered entity'' does 
                not include--
                            (i) a Federal, State, Tribal, or local 
                        government entity, such as a body, authority, 
                        board, bureau, commission, district, agency, or 
                        other political subdivision of the Federal 
                        Government or a State, Tribal, or local 
                        government;
                            (ii) an entity that is collecting, 
                        processing, retaining, or transferring covered 
                        data on behalf of a Federal, State, Tribal, or 
                        local government entity, to the extent that 
                        such entity is acting as a service provider to 
                        the government entity;
                            (iii) a small business;
                            (iv) an individual acting at their own 
                        direction and in a non-commercial context;
                            (v) the National Center for Missing and 
                        Exploited Children; or
                            (vi) except with respect to requirements 
                        under section 109, a nonprofit organization 
                        whose primary mission is to prevent, 
                        investigate, or deter fraud, to train anti-
                        fraud professionals, or to educate the public 
                        about fraud, including insurance fraud, 
                        securities fraud, and financial fraud, to the 
                        extent the organization collects, processes, 
                        retains, or transfers covered data in 
                        furtherance of such primary mission.
                    (D) Nonapplication to service providers.--An entity 
                may not be considered to be a ``covered entity'' for 
                the purposes of this title, insofar as the entity is 
                acting as a service provider.
            (14) Covered high-impact social media company.--
                    (A) In general.--The term ``covered high-impact 
                social media company'' means a covered entity that 
                provides any internet-accessible platform that--
                            (i) generates $3,000,000,000 or more in 
                        global annual revenue, including the revenue 
                        generated by any affiliate of such covered 
                        entity;
                            (ii) has 300,000,000 or more global monthly 
                        active users for not fewer than 3 of the 
                        preceding 12 months; and
                            (iii) constitutes an online product or 
                        service that is primarily used by users to 
                        access or share user-generated content.
                    (B) Treatment of certain services and 
                applications.--A service or application may not be 
                considered to constitute an online product or service 
                described in subparagraph (A)(iii) solely on the basis 
                of providing any of the following:
                            (i) Email.
                            (ii) Career or professional development 
                        networking opportunities.
                            (iii) Reviews of products, services, 
                        events, or destinations.
                            (iv) A platform for use in a public or 
                        private school under the direction of the 
                        school.
                            (v) File collaboration.
                            (vi) Cloud storage.
                            (vii) Closed video or audio communications 
                        services.
                            (viii) A wireless messaging service, 
                        including such a service provided through short 
                        messaging service or multimedia messaging 
                        service protocols, that is not a component of, 
                        or linked to, a platform of a covered high-
                        impact social media company, if the predominant 
                        or exclusive function is direct messaging 
                        consisting of the transmission of text, photos, 
                        or videos that are sent by electronic means, 
                        and if messages are transmitted from the sender 
                        to a recipient and are not posted within a 
                        platform of a covered high-impact social media 
                        company or publicly.
            (15) Covered minor.--The term ``covered minor'' means an 
        individual under the age of 17.
            (16) Dark patterns.--The term ``dark patterns'' means a 
        user interface designed or manipulated with the substantial 
        effect of subverting or impairing user autonomy, decision-
        making, or choice.
            (17) Data broker.--
                    (A) In general.--The term ``data broker'' means a 
                covered entity whose principal source of revenue is 
                derived from processing or transferring covered data 
                that the covered entity did not collect directly from 
                the individuals linked or linkable to the covered data.
                    (B) Principal source of revenue.--For purposes of 
                this paragraph, the term ``principal source of 
                revenue'' means, for the prior 12-month period--
                            (i) revenue that constitutes greater than 
                        50 percent of all revenue of the covered entity 
                        during such period; or
                            (ii) revenue obtained from processing and 
                        transferring the covered data of more than 
                        5,000,000 individuals that the covered entity 
                        did not collect directly from the individuals 
                        linked or linkable to the covered data.
                    (C) Non-application to service providers.--The term 
                ``data broker'' does not include an entity to the 
                extent that such entity is acting as a service 
                provider.
            (18) De-identified data.--
                    (A) In general.--The term ``de-identified data'' 
                means information that cannot reasonably be used to 
                infer or derive the identity of an individual, and does 
                not identify and is not linked or reasonably linkable 
                to an individual or a device that identifies or is 
                linked or reasonably linkable to an individual, 
                regardless of whether the information is aggregated, if 
                the relevant covered entity or service provider--
                            (i) takes reasonable physical, 
                        administrative, and technical measures to 
                        ensure that the information cannot, at any 
                        point, be used to re-identify any individual or 
                        device that identifies or is linked or 
                        reasonably linkable to an individual;
                            (ii) publicly commits in a clear and 
                        conspicuous manner to--
                                    (I) process, retain, or transfer 
                                the information solely in a de-
                                identified form without any reasonable 
                                means for re-identification; and
                                    (II) not attempt to re-identify the 
                                information with any individual or 
                                device that identifies or is linked or 
                                reasonably linkable to an individual, 
                                except as necessary, limited, and 
                                proportionate to test the effectiveness 
                                of the measures described in clause 
                                (i); and
                            (iii) contractually obligates any entity 
                        that receives the information from the covered 
                        entity or service provider to--
                                    (I) comply with clauses (i) and 
                                (ii) with respect to the information; 
                                and
                                    (II) require that such contractual 
                                obligations be included contractually 
                                in all subsequent instances in which 
                                the information may be received.
                    (B) Health information.--The term ``de-identified 
                data'' includes health information (as defined in 
                section 1171 of the Social Security Act (42 U.S.C. 
                1320d)) that has been de-identified in accordance with 
                section 164.514(b) of title 45, Code of Federal 
                Regulations, except that if such information is 
                subsequently provided to an entity that is not an 
                entity subject to parts 160 and 164 of such title 45, 
                such entity shall comply with clauses (ii) and (iii) of 
                subparagraph (A) for the information to be considered 
                de-identified under this title.
            (19) Derived data.--The term ``derived data'' means covered 
        data that is created by the derivation of information, data, 
        assumptions, correlations, inferences, predictions, or 
        conclusions from facts, evidence, or another source of 
        information.
            (20) Device.--The term ``device'' means any electronic 
        equipment capable of collecting, processing, retaining, or 
        transferring covered data that is used by 1 or more 
        individuals, including a connected device or a portable 
        connected device.
            (21) Direct mail targeted advertising.--The term ``direct 
        mail targeted advertising'' means advertising or marketing 
        using third-party data through a direct communication with an 
        individual via direct mail.
            (22) Disability.--The term ``disability'' has the meaning 
        given such term in section 3 of the Americans with Disabilities 
        Act of 1990 (42 U.S.C. 12102).
            (23) Email targeted advertising.--The term ``email targeted 
        advertising'' means advertising or marketing using third-party 
        data through a direct communication with an individual via 
        email.
            (24) Employee.--The term ``employee'' means an individual 
        who is an employee, director, officer, staff member, paid 
        intern, individual working as an independent contractor (who is 
        not a service provider), volunteer, or unpaid intern of an 
        employer, regardless of whether such individual is paid, 
        unpaid, or engaged on a temporary basis.
            (25) Employee information.--The term ``employee 
        information'' means information, including biometric 
        information or genetic information--
                    (A) about an individual related to the course of 
                employment or application for employment of the 
                individual (including on a contract or temporary 
                basis), if such information is collected, retained, 
                processed, or transferred by the employer or the 
                service provider of the employer solely for purposes 
                necessary for the employment or application of the 
                individual;
                    (B) that is emergency contact information for an 
                individual who is an employee or job applicant of an 
                employer, if such information is collected, retained, 
                processed, or transferred by the employer or the 
                service provider of the employer solely for the purpose 
                of having an emergency contact for such individual on 
                file; or
                    (C) about an individual who is an employee or 
                former employee of an employer, or a relative, 
                dependent, or beneficiary of the employee or former 
                employee, and collected, retained, processed, or 
                transferred for the purpose of administering benefits, 
                including enrollment and disenrollment for benefits, to 
                which the employee, former employee, relative, 
                dependent, or beneficiary is entitled on the basis of 
                the employment of the employee or former employee with 
                the employer, if such information is collected, 
                retained, processed, or transferred by the employer or 
                the service provider of the employer solely for the 
                purpose of administering such benefits.
            (26) Entity.--The term ``entity'' means an individual, a 
        trust, a partnership, an association, an organization, a 
        company, and a corporation.
            (27) Executive agency.--The term ``Executive agency'' has 
        the meaning given such term in section 105 of title 5, United 
        States Code.
            (28) Federated nonprofit organization.--The term 
        ``federated nonprofit organization'' means a network or system 
        of 2 or more entities, described in section 501(c)(3) of the 
        Internal Revenue Code of 1986 and exempt from taxation under 
        section 501(a) of such Code, that share common branding.
            (29) First party.--The term ``first party''--
                    (A) means a consumer-facing covered entity with 
                which a consumer intends and expects to interact; and
                    (B) includes any entities with which the covered 
                entity shares common branding.
            (30) First-party advertising.--
                    (A) In general.--The term ``first-party 
                advertising'' means advertising or marketing by a first 
                party using the first-party data of the first party and 
                not other forms of covered data and carried out--
                            (i) through direct communications with an 
                        individual, such as direct mail, email (subject 
                        to the CAN-SPAM Act of 2003 (15 U.S.C. 7701 et 
                        seq.) and the regulations promulgated under 
                        such Act), or text message communications 
                        (subject to section 227 of the Communications 
                        Act of 1934 (47 U.S.C. 227) and the regulations 
                        promulgated under such section); or
                            (ii) entirely--
                                    (I) in a physical location operated 
                                by the first party;
                                    (II) in the case of a first party 
                                that is not a covered high-impact 
                                social media company, on a website, 
                                online service, online application, or 
                                mobile application operated by the 
                                first party, through display or 
                                presentation of an online advertisement 
                                that promotes a product or service 
                                (whether offered by the first party or 
                                not offered by the first party) to an 
                                individual or device identified by a 
                                unique persistent identifier, or group 
                                of individuals or devices identified by 
                                unique persistent identifiers; or
                                    (III) in the case of a first party 
                                that is a covered high-impact social 
                                media company, on a website, online 
                                service, online application, or mobile 
                                application operated by the first 
                                party, through display or presentation 
                                of an online advertisement that 
                                promotes a product or service offered 
                                by the first party to an individual or 
                                device identified by a unique 
                                persistent identifier, or group of 
                                individuals or devices identified by 
                                unique persistent identifiers.
                    (B) Exclusion.--The term ``first-party 
                advertising'' does not include contextual advertising.
            (31) First-party data.--The term ``first-party data'' means 
        covered data collected directly from an individual by a first 
        party, including based on a visit by the individual to or use 
        by the individual of a physical location, website, online 
        service, online application, or mobile application operated by 
        the first party.
            (32) Genetic information.--The term ``genetic information'' 
        means any covered data, regardless of format, that concerns the 
        genetic characteristics of an identified or identifiable 
        individual, including--
                    (A) raw sequence data that results from the 
                sequencing of the complete, or a portion of, extracted 
                deoxyribonucleic acid (DNA) of an individual; or
                    (B) genotypic and phenotypic information that 
                results from analyzing raw sequence data described in 
                subparagraph (A).
            (33) Health information.--The term ``health information'' 
        means information that describes or reveals the past, present, 
        or future physical health, mental health, disability, 
        diagnosis, or health condition, status, or treatment of an 
        individual, including the precise geolocation information of 
        such treatment.
            (34) Individual.--The term ``individual'' means a natural 
        person residing in the United States.
            (35) Knowledge.--
                    (A) In general.--The term ``knowledge'' means, with 
                respect to whether an individual is a child, teen, or 
                covered minor, actual knowledge or knowledge fairly 
                implied on the basis of objective circumstances.
                    (B) Rule of construction.--For purposes of 
                enforcing this title or a regulation promulgated under 
                this title, a determination as to whether a covered 
                entity has knowledge fairly implied on the basis of 
                objective circumstances that an individual is a child, 
                teen, or covered minor shall rely on competent and 
                reliable evidence, taking into account the totality of 
                the circumstances, including whether a reasonable and 
                prudent person under the circumstances would have known 
                that the individual is a child, teen, or covered minor. 
                Nothing in this title, including a determination 
                described in the preceding sentence, may be construed 
                to require a covered entity to--
                            (i) affirmatively collect any covered data 
                        with respect to the age of a child, teen, or 
                        covered minor that the covered entity is not 
                        already collecting in the normal course of 
                        business; or
                            (ii) implement an age gating or age 
                        verification functionality.
                    (C) Commission guidance.--
                            (i) In general.--Not later than 180 days 
                        after the date of the enactment of this Act, 
                        the Commission shall issue guidance to provide 
                        information, including best practices and 
                        examples, for covered entities to use in 
                        understanding whether a covered entity has 
                        knowledge fairly implied on the basis of 
                        objective circumstances that an individual is a 
                        child, teen, or covered minor.
                            (ii) Limitation.--No guidance issued by the 
                        Commission under clause (i) confers any rights 
                        on any person, State, or locality, or operates 
                        to bind the Commission or any person, State, or 
                        locality to the approach recommended in such 
                        guidance. Any enforcement action brought 
                        pursuant to this title by the Commission, or by 
                        the attorney general of a State, the chief 
                        consumer protection officer of a State, or an 
                        officer or office of a State authorized to 
                        enforce privacy or data security laws 
                        applicable to covered entities or service 
                        providers, shall allege a specific violation of 
                        a provision of this title, and the Commission 
                        or the attorney general, chief consumer 
                        protection officer, or other authorized officer 
                        or office of the State, as applicable, may not 
                        base an enforcement action on, or as applicable 
                        execute a consent order based on, practices 
                        that are alleged to be inconsistent with any 
                        such guidance, unless the practices allegedly 
                        violate this title.
            (36) Large data holder.--
                    (A) In general.--The term ``large data holder'' 
                means a covered entity or service provider that, in the 
                most recent calendar year, had an annual gross revenue 
                of not less than $250,000,000 and, subject to 
                subparagraph (B), collected, processed, retained, or 
                transferred--
                            (i) the covered data of--
                                    (I) more than 5,000,000 
                                individuals;
                                    (II) more than 15,000,000 portable 
                                connected devices that identify or are 
                                linked or reasonably linkable to 1 or 
                                more individuals; or
                                    (III) more than 35,000,000 
                                connected devices that identify or are 
                                linked or reasonable linkable to 1 or 
                                more individuals; or
                            (ii) the sensitive covered data of--
                                    (I) more than 200,000 individuals;
                                    (II) more than 300,000 portable 
                                connected devices that identify or are 
                                linked or reasonable linkable to 1 or 
                                more individuals; or
                                    (III) more than 700,000 connected 
                                devices that identify or are linked or 
                                reasonably linkable to 1 or more 
                                individuals.
                    (B) Exclusions.--For the purposes of subparagraph 
                (A), a covered entity or service provider may not be 
                considered a large data holder solely on the basis of 
                collecting, processing, retaining, or transferring to a 
                service provider--
                            (i) personal mailing or email addresses;
                            (ii) personal telephone numbers;
                            (iii) log-in information of an individual 
                        or device to allow the individual or device to 
                        log in to an account administered by the 
                        covered entity; or
                            (iv) in the case of a covered entity that 
                        is a seller of goods or services (other than an 
                        entity that facilitates payment, such as a 
                        bank, credit card processor, mobile payment 
                        system, or payment platform), credit, debit, or 
                        mobile payment information necessary and used 
                        to initiate, render, bill for, finalize, 
                        complete, or otherwise facilitate payments for 
                        such goods or services.
                    (C) Definition of annual gross revenue.--For the 
                purposes of subparagraph (A), the term ``annual gross 
                revenue'', with respect to a covered entity or service 
                provider--
                            (i) means the gross receipts the covered 
                        entity or service provider received, in 
                        whatever form from all sources, without 
                        subtracting any costs or expenses; and
                            (ii) includes contributions, gifts, grants, 
                        dues or other assessments, income from 
                        investments, and proceeds from the sale of real 
                        or personal property.
            (37) Market research.--The term ``market research'' means 
        the collection, processing, retention, or transfer of covered 
        data, with affirmative express consent, that is necessary, 
        proportionate, and limited to measure and analyze the market or 
        market trends of products, services, advertising, or ideas, if 
        the covered data is not--
                    (A) integrated into any product or service;
                    (B) otherwise used to contact any individual or 
                device of an individual; or
                    (C) used for targeted advertising or to otherwise 
                market to any individual or device of an individual.
            (38) Material change.--The term ``material change'' means, 
        with respect to treatment of covered data, a change by an 
        entity that would likely affect the decision of an individual 
        to engage with and provide covered data to the entity, 
        including providing affirmative express consent for, or opting 
        out of, the collection, processing, retention, or transfer of 
        covered data pertaining to such individual.
            (39) Mobile application.--The term ``mobile application''--
                    (A) means a software program that runs on the 
                operating system of--
                            (i) a cellular telephone;
                            (ii) a tablet computer; or
                            (iii) a similar portable computing device 
                        that transmits data over a wireless connection; 
                        and
                    (B) includes a service or application offered via a 
                connected device.
            (40) On-device data.--
                    (A) In general.--The term ``on-device data'' means 
                data collected, retained, and processed solely on the 
                device of an individual.
                    (B) Limitation.--Data collected, retained, and 
                processed solely on the device of an individual may be 
                considered ``on-device data'' only if--
                            (i) such data is not transferred by a 
                        covered entity or service provider;
                            (ii) the relevant covered entity clearly 
                        and conspicuously provides the device owner 
                        with controls that allow the owner to access, 
                        correct, delete, and export such data 
                        consistent with the rights provided with 
                        respect to covered data pursuant to section 
                        105;
                            (iii) the relevant covered entity provides 
                        easy-to-understand instructions on how the 
                        device owner can access such controls; and
                            (iv) the relevant covered entity 
                        establishes, implements, and maintains 
                        reasonable data security practices, consistent 
                        with section 109, to protect--
                                    (I) the confidentiality, integrity, 
                                and availability of the on-device data; 
                                and
                                    (II) on device data against 
                                unauthorized access.
            (41) Online activity profile.--The term ``online activity 
        profile'' means covered data that identifies the online 
        activities of an individual (or a device linked or reasonably 
        linkable to an individual) over time and across third-party 
        websites, online services, online applications, or mobile 
        applications that do not share common branding and that is 
        collected, processed, retained, or transferred for the purpose 
        of evaluating, analyzing, or predicting the behaviors or 
        characteristics of an individual.
            (42) Online application.--The term ``online application''--
                    (A) means an internet-connected software program; 
                and
                    (B) includes a service or application offered via a 
                connected device.
            (43) Parent.--The term ``parent'' means a legal guardian.
            (44) Portable connected device.--The term ``portable 
        connected device'' means a portable device that is capable of 
        connecting to the internet over a wireless connection, 
        including a smartphone, tablet computer, laptop computer, 
        smartwatch, or similar portable device.
            (45) Precise geolocation information.--
                    (A) In general.--The term ``precise geolocation 
                information'' means information that reveals the past 
                or present physical location of an individual or device 
                with sufficient precision to identify the location of 
                such individual or device within a geographic area that 
                is equal to or less than the area of a circle with a 
                radius of 1,850 feet or less.
                    (B) Exclusions.--The term ``precise geolocation 
                information'' does not include information derived 
                solely from--
                            (i) a digital or physical photograph;
                            (ii) an audio or visual recording; or
                            (iii) metadata associated with a digital or 
                        physical photograph or an audio or visual 
                        recording that cannot be linked to an 
                        individual.
            (46) Process.--The term ``process'' means, with respect to 
        covered data, any operation or set of operations performed on 
        the covered data, including analyzing, organizing, structuring, 
        using, modifying, or otherwise handling the covered data.
            (47) Publicly available information.--
                    (A) In general.--The term ``publicly available 
                information'' means any information that a covered 
                entity has a reasonable basis to believe has been 
                lawfully made available to the general public by--
                            (i) Federal, State, or local government 
                        records, if the covered entity collects, 
                        processes, retains, and transfers such 
                        information in accordance with any restrictions 
                        or terms of use placed on the information by 
                        the relevant government entity;
                            (ii) widely distributed media;
                            (iii) a website or online service made 
                        available to all members of the public, for 
                        free or for a fee, including where all members 
                        of the public can log in to the website or 
                        online service; or
                            (iv) a disclosure to the general public 
                        that is required to be made by Federal, State, 
                        or local law.
                    (B) Clarifications; limitations.--
                            (i) Available to all members of the 
                        public.--For purposes of this paragraph, 
                        information from a website or online service is 
                        not available to all members of the public if 
                        the individual to whom the information pertains 
                        has restricted the information to a specific 
                        audience or maintained a default setting that 
                        restricts the information to a specific 
                        audience.
                            (ii) Business contact information.--The 
                        term ``publicly available information'' 
                        includes business contact information of an 
                        individual acting in a business or professional 
                        context that is made available on a website or 
                        online service made available to all members of 
                        the public, including the name, position or 
                        title, business telephone number, business 
                        email address, or business address of the 
                        individual.
                            (iii) Other limitations.--The term 
                        ``publicly available information'' does not 
                        include--
                                    (I) any obscene visual depiction 
                                (as such term is used in section 1460 
                                of title 18, United States Code);
                                    (II) derived data from publicly 
                                available information that reveals 
                                information about an individual that 
                                meets the definition of the term 
                                ``sensitive covered data'';
                                    (III) biometric information;
                                    (IV) genetic information, unless 
                                made publicly available by the 
                                individual to whom the information 
                                pertains by a means described in clause 
                                (ii) or (iii) of subparagraph (A);
                                    (V) covered data that is created 
                                through the combination of covered data 
                                with publicly available information;
                                    (VI) intimate images, authentic or 
                                computer-generated, known to be 
                                nonconsensual; or
                                    (VII) sensitive covered data made 
                                available by a data broker.
            (48) Retain.--The term ``retain'' means, with respect to 
        covered data, to store, maintain, save, or otherwise keep such 
        data, regardless of format.
            (49) Sensitive covered data.--
                    (A) In general.--The term ``sensitive covered 
                data'' means the following forms of covered data:
                            (i) A government-issued identifier, 
                        including a Social Security number, passport 
                        number, or driver's license number, that is not 
                        required by law to be displayed in public.
                            (ii) Any information that describes or 
                        reveals the past, present, or future physical 
                        health, mental health, disability, diagnosis, 
                        or health condition, status, or treatment of an 
                        individual.
                            (iii) Genetic information.
                            (iv) A financial account number, debit card 
                        number, credit card number, or any required 
                        security or access code, password, or 
                        credentials allowing access to any such account 
                        or card, except that the last four digits of an 
                        account number, debit card number, or credit 
                        card number may not be considered sensitive 
                        covered data.
                            (v) Biometric information.
                            (vi) Precise geolocation information.
                            (vii) The private communications of an 
                        individual (such as voicemails, or other voice 
                        or video communications, emails, texts, direct 
                        messages, or mail) or information identifying 
                        the parties to such communications, information 
                        contained in telephone bills, and any 
                        information that pertains to the transmission 
                        of private voice or video communications, 
                        including numbers called, numbers from which 
                        calls were placed, the time calls were made, 
                        call duration, and location information of the 
                        parties to the call, unless the relevant 
                        covered entity or service provider is an 
                        intended recipient of the communication.
                            (viii) Unencrypted or unredacted account or 
                        device log-in credentials.
                            (ix) Information revealing the sexual 
                        behavior of an individual in a manner 
                        inconsistent with the reasonable expectation of 
                        the individual regarding disclosure of such 
                        information.
                            (x) Calendar information, address book 
                        information, phone, text, or electronic logs, 
                        photographs, audio recordings, or videos 
                        intended for private use.
                            (xi) A photograph, film, video recording, 
                        or other similar medium that shows the naked or 
                        undergarment-clad private area of an 
                        individual.
                            (xii) Information revealing the extent or 
                        content of the access, viewing, or other use by 
                        an individual of any video programming (as 
                        defined in section 713(h)(2) of the 
                        Communications Act of 1934 (47 U.S.C. 
                        613(h)(2))), including programming provided by 
                        a provider of broadcast television service, 
                        cable service, satellite service, or streaming 
                        media service, but only with regard to the 
                        transfer of such information to a third party 
                        (excluding any such information used solely for 
                        transfers for independent video measurement).
                            (xiii) Information collected by a covered 
                        entity that is not a provider of a service 
                        described in clause (xii) that reveals the 
                        video content requested or selected by an 
                        individual (excluding any such information used 
                        solely for transfers for independent video 
                        measurement).
                            (xiv) Information revealing the race, 
                        ethnicity, national origin, religion, or sex of 
                        an individual in a manner inconsistent with the 
                        reasonable expectation of the individual 
                        regarding disclosure of such information.
                            (xv) An online activity profile.
                            (xvi) Information about a covered minor.
                            (xvii) Information that reveals the status 
                        of an individual as a member of the Armed 
                        Forces.
                            (xviii) Neural data.
                            (xix) Any other covered data collected, 
                        processed, retained, or transferred for the 
                        purpose of identifying a type of information 
                        described in any of clauses (i) through 
                        (xviii).
                    (B) Third party.--For the purposes of subparagraph 
                (A)(xii), the term ``third party'' does not include an 
                entity that--
                            (i) is related by common ownership or 
                        corporate control to the provider of broadcast 
                        television service or streaming media service; 
                        and
                            (ii) provides video programming as 
                        described in such subparagraph.
            (50) Service provider.--
                    (A) In general.--The term ``service provider'' 
                means an entity that collects, processes, retains, or 
                transfers covered data for the purpose of performing 1 
                or more services or functions on behalf of, and at the 
                direction of--
                            (i) a covered entity or another service 
                        provider; or
                            (ii) a Federal, State, Tribal, or local 
                        government entity.
                    (B) Rule of construction.--
                            (i) In general.--An entity is a covered 
                        entity and not a service provider with respect 
                        to a specific collecting, processing, 
                        retaining, or transferring of covered data, if 
                        the entity, alone or jointly with others, 
                        determines the purposes and means of the 
                        specific collecting, processing, retaining, or 
                        transferring of data.
                            (ii) Instructions.--An entity that is not 
                        limited in its collecting, processing, 
                        retaining, or transferring of covered data 
                        pursuant to the instructions of a covered 
                        entity, another service provider, or a Federal, 
                        State, Tribal, or local government entity, or 
                        that fails to adhere to such instructions, is a 
                        covered entity and not a service provider with 
                        respect to a specific collecting, processing, 
                        retaining, or transferring of such data. If a 
                        service provider begins, alone or jointly with 
                        others, determining the purposes and means of 
                        collecting, processing, retaining, or 
                        transferring covered data, the entity is a 
                        covered entity with respect to such data.
                            (iii) Context required.--Whether an entity 
                        is a covered entity or a service provider 
                        depends on the facts surrounding how, and the 
                        context in which, data is collected, processed, 
                        retained, or transferred.
            (51) Small business.--
                    (A) In general.--The term ``small business'' means 
                an entity (including any affiliate of the entity)--
                            (i) that has average annual gross revenues 
                        for the period of the 3 preceding calendar 
                        years (or for the period during which the 
                        entity has been in existence, if such period is 
                        less than 3 calendar years) not exceeding 
                        $40,000,000, indexed to the Producer Price 
                        Index reported by the Bureau of Labor 
                        Statistics;
                            (ii) that, on average for the period 
                        described in clause (i), did not annually 
                        collect, process, retain, or transfer the 
                        covered data of more than 200,000 individuals 
                        for any purpose other than initiating, 
                        rendering, billing for, finalizing, completing, 
                        or otherwise collecting payment for a requested 
                        service or product; and
                            (iii) that did not, during the period 
                        described in clause (i), transfer covered data 
                        to a third party in exchange for revenue or 
                        anything of value, except for purposes of 
                        initiating, rendering, billing for, finalizing, 
                        completing, or otherwise collecting payment for 
                        a requested service or product or facilitating 
                        web analytics that are not used to create an 
                        online activity profile.
                    (B) Nonprofit revenue.--For purposes of 
                subparagraph (A)(i), the term ``revenue'', as such term 
                relates to any entity that is not organized to carry on 
                business for its own profit or that of its members, 
                means the gross receipts the entity received, in 
                whatever form from all sources, without subtracting any 
                costs or expenses, and includes contributions, gifts, 
                grants (except for grants from the Federal Government), 
                dues or other assessments, income from investments, or 
                proceeds from the sale of real or personal property.
            (52) State.--The term ``State'' means each of the 50 
        States, the District of Columbia, the Commonwealth of Puerto 
        Rico, the Virgin Islands of the United States, Guam, American 
        Samoa, and the Commonwealth of the Northern Mariana Islands.
            (53) Substantial privacy harm.--The term ``substantial 
        privacy harm'' means--
                    (A) any alleged financial harm of not less than 
                $10,000; or
                    (B) any alleged physical or mental harm to an 
                individual that involves--
                            (i) treatment by a licensed, credentialed, 
                        or otherwise bona fide health care provider, 
                        hospital, community health center, clinic, 
                        hospice, or residential or outpatient facility 
                        for medical, mental health, or addiction care; 
                        or
                            (ii) physical injury, highly offensive 
                        intrusion into the privacy expectations of a 
                        reasonable individual under the circumstances, 
                        or discrimination on the basis of race, color, 
                        religion, national origin, sex, or disability.
            (54) Targeted advertising.--The term ``targeted 
        advertising''--
                    (A) means displaying or presenting an online 
                advertisement to an individual or to a device 
                identified by a unique persistent identifier (or to a 
                group of individuals or devices identified by unique 
                persistent identifiers), if the advertisement is 
                selected based, in whole or in part, on known or 
                predicted preferences or interests associated with the 
                individual or device;
                    (B) includes--
                            (i) an online advertisement by a covered 
                        high-impact social media company for a product 
                        or service that is not a product or service 
                        offered by the covered high-impact social media 
                        company; and
                            (ii) an online advertisement for a product 
                        or service based on the previous interaction of 
                        an individual or a device identified by a 
                        unique persistent identifier with such product 
                        or service on a website or online service that 
                        does not share common branding or affiliation 
                        with the website or online service displaying 
                        or presenting the advertisement; and
                    (C) excludes contextual advertising and first-party 
                advertising.
            (55) Teen.--The term ``teen'' means an individual 13 years 
        of age or older, but under the age of 17.
            (56) Third party.--The term ``third party''--
                    (A) means any entity that--
                            (i) receives covered data from another 
                        entity that is not the individual to whom the 
                        data pertains; and
                            (ii) is not a service provider with respect 
                        to such data; and
                    (B) does not include an entity that collects 
                covered data from another entity if the 2 entities 
                are--
                            (i) related by common ownership or 
                        corporate control; or
                            (ii) nonprofit entities that are part of 
                        the same federated nonprofit organization.
            (57) Third-party data.--The term ``third-party data'' means 
        covered data that has been transferred to a third party.
            (58) Transfer.--The term ``transfer'' means, with respect 
        to covered data, to disclose, release, share, disseminate, make 
        available, sell, rent, or license the covered data (orally, in 
        writing, electronically, or by any other means) for 
        consideration of any kind or for a commercial purpose.
            (59) Unique persistent identifier.--
                    (A) In general.--The term ``unique persistent 
                identifier'' means a technologically created identifier 
                to the extent that such identifier is reasonably 
                linkable to an individual or a device that identifies 
                or is linked or reasonably linkable to 1 or more 
                individuals, including device identifiers, Internet 
                Protocol addresses, cookies, beacons, pixel tags, 
                mobile ad identifiers or similar technology customer 
                numbers, unique pseudonyms, user aliases, telephone 
                numbers, or other forms of persistent or probabilistic 
                identifiers that are linked or reasonably linkable to 1 
                or more individuals or devices.
                    (B) Exclusion.--The term ``unique persistent 
                identifier'' does not include an identifier assigned by 
                a covered entity for the sole purpose of giving effect 
                to the exercise of affirmative express consent or opt 
                out by an individual with respect to the collecting, 
                processing, retaining, and transfer of covered data or 
                otherwise limiting the collecting, processing, 
                retaining, or transfer of covered data.
            (60) Widely distributed media.--
                    (A) In general.--The term ``widely distributed 
                media'' means information that is available to the 
                general public, including information from a telephone 
                book or online directory, a television, internet, or 
                radio program, the news media, or an internet site that 
                is available to the general public on an unrestricted 
                basis.
                    (B) Exclusion.--The term ``widely distributed 
                media'' does not include an obscene visual depiction 
                (as such term is used in section 1460 of title 18, 
                United States Code).

SEC. 102. DATA MINIMIZATION.

    (a) In General.--A covered entity may not collect, process, retain, 
or transfer covered data of an individual or direct a service provider 
to collect, process, retain, or transfer covered data of an individual 
beyond what is necessary, proportionate, and limited--
            (1) to provide or maintain--
                    (A) a specific product or service requested by the 
                individual to whom the data pertains, including any 
                associated routine administrative, operational, or 
                account-servicing activity, such as billing, shipping, 
                delivery, storage, or accounting; or
                    (B) a communication, that is not an advertisement, 
                by the covered entity to the individual reasonably 
                anticipated within the context of the relationship; or
            (2) for a purpose expressly permitted under subsection (d).
    (b) Additional Protections for Sensitive Covered Data.--Subject to 
subsection (a), a covered entity may not transfer sensitive covered 
data to a third party or direct a service provider to transfer 
sensitive covered data to a third party without the affirmative express 
consent of the individual to whom such data pertains, unless for a 
purpose permitted by paragraph (2), (3), (4), (5), (6), (8), (9), (11), 
(12), or (13) of subsection (d).
    (c) Additional Protections for Biometric Information and Genetic 
Information.--
            (1) Collection.--Subject to subsection (a), a covered 
        entity may not collect biometric information or genetic 
        information or direct a service provider to collect biometric 
        information or genetic information without the affirmative 
        express consent of the individual to whom such information 
        pertains.
            (2) Processing.--Subject to subsection (a), a covered 
        entity may not process biometric information or genetic 
        information or direct a service provider to process biometric 
        information or genetic information without the affirmative 
        express consent of the individual to whom such information 
        pertains, unless for a purpose permitted by paragraph (2), (3), 
        or (4) of subsection (d).
            (3) Retention.--Subject to subsection (a), a covered entity 
        may not retain biometric information or direct a service 
        provider to retain biometric information beyond the point at 
        which the purpose for which an individual provided affirmative 
        express consent under paragraph (1) has been satisfied or 
        beyond the date that is 3 years after the date of the last 
        interaction of the individual with the covered entity or 
        service provider, whichever occurs first, unless for a purpose 
        permitted under paragraph (2), (3), or (4) of subsection (d).
            (4) Transfer.--
                    (A) Affirmative express consent required.--Subject 
                to subsection (a), a covered entity may not transfer 
                biometric information or genetic information to a third 
                party or direct a service provider to transfer 
                biometric information or genetic information to a third 
                party without the affirmative express consent of the 
                individual to whom such information pertains, unless 
                for a purpose permitted by paragraph (2), (3), or (4) 
                of subsection (d).
                    (B) No transfer for payment or other valuable 
                consideration.--A covered entity may not transfer 
                biometric information or genetic information to a third 
                party, or direct a service provider to transfer 
                biometric information or genetic information to a third 
                party, for payment or other valuable consideration 
                (regardless of the purpose of the transfer, including a 
                purpose described in subparagraph (A)).
    (d) Permitted Purposes.--Subject to the requirements in subsections 
(b) and (c), a covered entity may collect, process, retain, or transfer 
or direct a service provider to collect, process, retain, or transfer 
covered data for the following purposes, if the covered entity or 
service provider can demonstrate that the collection, processing, 
retention, or transfer is necessary, proportionate, and limited to such 
purpose:
            (1) To protect data security as described in section 109, 
        protect against spam, or protect and maintain networks and 
        systems, including through diagnostics, debugging, and repairs.
            (2) To comply with a legal obligation imposed by a Federal, 
        State, Tribal, or local law that is not preempted by this 
        title.
            (3) To investigate, establish, prepare for, exercise, or 
        defend cognizable legal claims of the covered entity or service 
        provider.
            (4) To transfer covered data to a Federal, State, Tribal, 
        or local law enforcement agency pursuant to a lawful warrant, 
        administrative subpoena, or other form of lawful process.
            (5) To effectuate a product recall pursuant to Federal or 
        State law, or to fulfill a warranty.
            (6) To conduct market research.
            (7) With respect to covered data previously collected in 
        accordance with this title, to process the covered data such 
        that the covered data becomes de-identified data, including in 
        order to--
                    (A) develop or enhance a product or service of the 
                covered entity or service provider;
                    (B) conduct research or analytics to improve a 
                product or service of the covered entity or service 
                provider;
                    (C) conduct research to investigate, establish, or 
                improve the effectiveness or safety of medical 
                products, including drugs, biologics, and medical 
                devices;
                    (D) enable the effective delivery and 
                administration of health care products and treatments 
                to patients, in compliance with Federal regulations; or
                    (E) monitor the safety and efficacy of health care 
                products and services administered to patients, in 
                compliance with Federal regulations.
            (8) To transfer assets to a third party in the context of a 
        merger, acquisition, bankruptcy, or similar transaction, with 
        respect to which the third party assumes control, in whole or 
        in part, of the assets of the covered entity, but only if the 
        covered entity, in a reasonable time prior to such transfer, 
        provides each affected individual with--
                    (A) a notice describing such transfer, including 
                the name of the entity or entities receiving the 
                covered data of the individual and the privacy policies 
                of such entity or entities as described in section 104; 
                and
                    (B) a reasonable opportunity to--
                            (i) withdraw any previously provided 
                        consent in accordance with the requirements of 
                        affirmative express consent under this title 
                        related to the covered data of the individual; 
                        and
                            (ii) request the deletion of the covered 
                        data of the individual, as described in section 
                        105.
            (9) With respect to a covered entity or service provider 
        that is a telecommunications carrier or a provider of a mobile 
        service, interconnected VoIP service, or non-interconnected 
        VoIP service (as such terms are defined in section 3 of the 
        Communications Act of 1934 (47 U.S.C. 153)), to provide call 
        location information in a manner described in subparagraph (A) 
        or (C) of section 222(d)(4) of such Act (47 U.S.C. 222(d)(4)).
            (10) To prevent, detect, protect against, investigate, or 
        respond to fraud, excluding the transfer of covered data for 
        payment or other valuable consideration to a government entity.
            (11) To prevent, detect, protect against, investigate, or 
        respond to an ongoing or imminent security incident relating to 
        network security or physical security, including an intrusion 
        or trespass, medical alert or request for a medical response, 
        fire alarm or request for a fire response, or access control.
            (12) To prevent, detect, protect against, investigate, or 
        respond to an imminent or ongoing public safety incident (such 
        as a mass casualty event, natural disaster, or national 
        security incident), excluding the transfer of covered data for 
        payment or other valuable consideration to a government entity.
            (13) Except with respect to health information, to prevent, 
        detect, protect against, investigate, or respond to criminal 
        activity or harassment, excluding the transfer of covered data 
        for payment or other valuable consideration to a government 
        entity.
            (14) Except with respect to sensitive covered data, and 
        only with respect to covered data previously collected in 
        accordance with this title, to process or transfer such data to 
        provide first-party advertising or contextual advertising or to 
        measure and report on marketing performance or media 
        performance by the covered entity, including processing or 
        transferring covered data for measurement and reporting of 
        frequency, attribution, and performance, including by 
        independent entities, except that this paragraph does not 
        permit the processing or transfer of covered data for first-
        party advertising to a covered minor as prohibited by section 
        120.
            (15) Except with respect to sensitive covered data, and 
        only with respect to covered data previously collected in 
        accordance with this title, to process or transfer such data to 
        provide targeted advertising, direct mail targeted advertising, 
        or email targeted advertising (subject to the CAN-SPAM Act of 
        2003 (15 U.S.C. 7701 et seq.) and the regulations promulgated 
        under such Act) or to measure and report on marketing 
        performance or media performance, including processing or 
        transferring covered data for measurement and reporting of 
        frequency, attribution, and performance, including by 
        independent entities, except that this paragraph does not 
        permit the processing or transfer of covered data for targeted 
        advertising to an individual who has opted out of targeted 
        advertising pursuant to section 106 or to a covered minor as 
        prohibited by section 120.
            (16) To conduct a public or peer-reviewed scientific, 
        historical, or statistical research project that--
                    (A) is in the public interest;
                    (B) adheres to all relevant laws and regulations 
                governing such research, including regulations for the 
                protection of human subjects, if applicable;
                    (C) limits transfers to third parties of sensitive 
                covered data to only those transfers necessary, 
                proportionate, and limited to carry out the research; 
                and
                    (D) prohibits the transfer of covered data to a 
                data broker.
            (17) To conduct medical research in compliance with part 46 
        of title 45, Code of Federal Regulations, or parts 50 and 56 of 
        title 21, Code of Federal Regulations.
    (e) Guidance.--Not later than 180 days after the date of the 
enactment of this Act, the Commission shall issue guidance regarding 
what is necessary, proportionate, and limited to comply with this 
section.
    (f) Journalism.--Nothing in this title may be construed to limit or 
diminish journalism, including gathering, preparing, collecting, 
photographing, recording, writing, editing, reporting, or investigating 
news or information that concerns local, national, or international 
events or other matters of public interest for dissemination to the 
public.

SEC. 103. PRIVACY BY DESIGN.

    (a) In General.--Each covered entity and service provider shall 
establish, implement, and maintain reasonable policies, practices, and 
procedures that reflect the role of the covered entity or service 
provider in the collection, processing, retention, and transferring of 
covered data.
    (b) Requirements.--The policies, practices, and procedures required 
by subsection (a) shall--
            (1) identify, assess, and mitigate privacy risks related to 
        covered minors (including, if applicable, in a manner that 
        considers the developmental needs of different age ranges of 
        covered minors), individuals living with disabilities, and 
        individuals over the age of 65;
            (2) mitigate privacy risks related to the products and 
        services of the covered entity or service provider, including 
        in the design, development, and implementation of such products 
        and services, taking into account the role of the covered 
        entity or service provider and the information available to the 
        covered entity or service provider; and
            (3) implement reasonable internal training and safeguards 
        to promote compliance with this title and to mitigate privacy 
        risks, taking into account the role of the covered entity or 
        service provider and the information available to the covered 
        entity or service provider.
    (c) Factors to Consider.--The policies, practices, and procedures 
established by a covered entity or service provider under subsection 
(a) shall align with, as applicable--
            (1) the nature, scope, and complexity of the activities 
        engaged in by the covered entity or service provider, including 
        whether the covered entity or service provider is a large data 
        holder, nonprofit organization, or data broker, taking into 
        account the role of the covered entity or service provider and 
        the information available to the covered entity or service 
        provider;
            (2) the sensitivity of the covered data collected, 
        processed, retained, or transferred by the covered entity or 
        service provider;
            (3) the volume of covered data collected, processed, 
        retained, or transferred by the covered entity or service 
        provider;
            (4) the number of individuals and devices to which the 
        covered data collected, processed, retained, or transferred by 
        the covered entity or service provider relates;
            (5) state-of-the-art administrative, technological, and 
        organizational measures that, by default, serve the purpose of 
        protecting the privacy and security of covered data as required 
        by this title; and
            (6) the cost of implementing such policies, practices, and 
        procedures in relation to the risks and nature of the covered 
        data involved.
    (d) Commission Guidance.--Not later than 1 year after the date of 
the enactment of this Act, the Commission shall issue guidance with 
respect to what constitutes reasonable policies, practices, and 
procedures as required by subsection (a). In issuing such guidance, the 
Commission shall consider unique circumstances applicable to nonprofit 
organizations, service providers, and data brokers.

SEC. 104. TRANSPARENCY.

    (a) In General.--Each covered entity and service provider shall 
make publicly available a clear and conspicuous, not misleading, and 
easy-to-read privacy policy that provides a detailed and accurate 
representation of the data collection, processing, retention, and 
transfer activities of the covered entity or service provider.
    (b) Content of Privacy Policy.--The privacy policy required under 
subsection (a) shall include, at a minimum, the following:
            (1) The identity and the contact information of--
                    (A) the covered entity or service provider to which 
                the privacy policy applies, including a point of 
                contact and a monitored email address or other 
                monitored online contact mechanism, as applicable, 
                specific to data privacy and data security inquiries; 
                and
                    (B) any affiliate within the same corporate 
                structure as the covered entity or service provider, to 
                which the covered entity or service provider may 
                transfer data, that--
                            (i) is not under common branding with the 
                        covered entity or service provider; or
                            (ii) has different contact information than 
                        the covered entity or service provider.
            (2) With respect to the collection, processing, and 
        retention of covered data--
                    (A) the categories of covered data the covered 
                entity or service provider collects, processes, or 
                retains; and
                    (B) the processing purposes for each such category 
                of covered data.
            (3) Whether the covered entity or service provider 
        transfers covered data and, if so--
                    (A) each category of service provider or third 
                party to which the covered entity or service provider 
                transfers covered data;
                    (B) the name of each data broker to which the 
                covered entity or service provider transfers covered 
                data; and
                    (C) the purposes for which such data is 
                transferred.
            (4) The length of time the covered entity or service 
        provider intends to retain each category of covered data or, if 
        it is not possible to identify the length of time, the criteria 
        used to determine the length of time the covered entity or 
        service provider intends to retain each category of covered 
        data.
            (5) A prominent description of how an individual may 
        exercise the rights, as applicable, of the individual under 
        this title.
            (6) A description of how the covered entity treats data 
        collected from covered minors differently than data collected 
        from other individuals, if the covered entity has knowledge 
        that the covered entity has collected data from covered minors.
            (7) A general description of the data security practices of 
        the covered entity or service provider.
            (8) The effective date of the privacy policy.
            (9) Whether any covered data collected by the covered 
        entity or service provider is transferred to, processed in, 
        retained in, or otherwise accessible to a foreign adversary (as 
        determined by the Secretary of Commerce and specified in 
        section 7.4 of title 15, Code of Federal Regulations (or any 
        successor regulation)).
    (c) Languages.--A privacy policy required under subsection (a) 
shall be made available to the public--
            (1) in the 10 most-used languages in which a covered entity 
        or service provider provides products or services or carries 
        out activities related to such products or services; or
            (2) if the covered entity or service provider provides 
        products or services in fewer than 10 languages, in the 
        languages in which the covered entity or service provider 
        provides products or services or carries out activities related 
        to such products or services.
    (d) Accessibility.--A covered entity or service provider shall 
provide the disclosures required under this section in a manner that is 
reasonably accessible to and usable by individuals living with 
disabilities.
    (e) Material Changes.--
            (1) Notice and opt out.--A covered entity that makes a 
        material change to the privacy policy or practices of the 
        covered entity shall--
                    (A) provide to each affected individual, in a clear 
                and conspicuous manner--
                            (i) advance notice of such material change; 
                        and
                            (ii) a means to opt out of the collection, 
                        processing, retention, or transfer of any 
                        covered data of such individual pursuant to 
                        such material change; and
                    (B) with respect to the covered data of any 
                individual who opts out using the means described in 
                subparagraph (A)(ii), discontinue the collection, 
                processing, retention, or transfer of such covered 
                data, unless such collection, processing, retention, or 
                transfer is necessary, proportionate, and limited to 
                provide or maintain a product or service specifically 
                requested by the individual.
            (2) Direct notification.--A covered entity shall take all 
        reasonable electronic measures to provide direct notification, 
        if possible, to each affected individual regarding material 
        changes to the privacy policy of the covered entity, and such 
        notification shall be provided in each language in which the 
        privacy policy is made available, taking into account available 
        technology and the nature of the relationship between the 
        covered entity and the individual.
            (3) Clarification.--Except as provided in paragraph (1)(B), 
        nothing in this subsection may be construed to affect the 
        requirements for covered entities under sections 102, 105, and 
        106.
    (f) Transparency Requirements for Large Data Holders.--
            (1) Retention of privacy policies; log of material 
        changes.--
                    (A) In general.--Beginning on the date that is 180 
                days after the date of the enactment of this Act, each 
                large data holder shall--
                            (i) retain and publish on the website of 
                        the large data holder a copy of each version of 
                        the privacy policy of the large data holder 
                        required under subsection (a) for not less than 
                        10 years; and
                            (ii) make publicly available on the website 
                        of the large data holder, in a clear and 
                        conspicuous manner, a log that describes the 
                        date and nature of each material change to the 
                        privacy policy of the large data holder during 
                        the preceding 10-year period in a manner that 
                        is sufficient for a reasonable individual to 
                        understand the effect of each material change.
                    (B) Exclusion.--This paragraph does not apply to 
                material changes to previous versions of the privacy 
                policy of a large data holder that precede the date 
                that is 180 days after the date of the enactment of 
                this Act.
            (2) Short form notice to consumers.--
                    (A) In general.--In addition to the privacy policy 
                required under subsection (a), a large data holder 
                shall provide a short-form notice of the covered data 
                practices of the large data holder in a manner that--
                            (i) is concise;
                            (ii) is clear and conspicuous;
                            (iii) is readily accessible to an 
                        individual, based on the manner in which the 
                        individual interacts with the large data holder 
                        and the products or services of the large data 
                        holder and what is reasonably anticipated 
                        within the context of the relationship between 
                        the individual and the large data holder;
                            (iv) includes an overview of individual 
                        rights and disclosures to reasonably draw 
                        attention to data practices that may be 
                        unexpected or that involve sensitive covered 
                        data; and
                            (v) is not more than 500 words in length in 
                        the English language or, if in a language other 
                        than English, not more than 550 words in 
                        length.
                    (B) Guidance.--Not later than 180 days after the 
                date of the enactment of this Act, the Commission shall 
                issue guidance establishing the minimum disclosures 
                necessary for the short-form notice described in this 
                paragraph and shall include templates or models for 
                such notice.

SEC. 105. INDIVIDUAL CONTROL OVER COVERED DATA.

    (a) Access to, and Correction, Deletion, and Portability of, 
Covered Data.--After receiving a verified request from an individual, 
including a parent acting on behalf of a child of the parent, a covered 
entity shall provide the individual with the right to--
            (1) access--
                    (A) in a format that can be naturally read by a 
                human, the covered data of the individual or child (as 
                applicable) (or an accurate representation of the 
                covered data of the individual or child (as 
                applicable), if the covered data is no longer in the 
                possession of the covered entity or a service provider 
                acting on behalf of the covered entity) that is 
                collected, processed, or retained by the covered entity 
                or any service provider of the covered entity;
                    (B) the name of any third party or service provider 
                to whom the covered entity has transferred the covered 
                data, as well as the categories of sources from which 
                the covered data was collected; and
                    (C) a description of the purpose for which the 
                covered entity transferred any covered data of the 
                individual or child (as applicable) to a third party or 
                service provider;
            (2) correct any inaccuracy or incomplete information with 
        respect to the covered data of the individual or child (as 
        applicable) that is collected, processed, or retained by the 
        covered entity and, for covered data that has been transferred, 
        request the covered entity to notify any third party or service 
        provider to which the covered entity transferred such covered 
        data of the corrected information, including so that service 
        providers may provide the assistance required by section 
        111(a)(1)(C);
            (3) delete covered data of the individual or child (as 
        applicable) that is retained by the covered entity and, for 
        covered data that has been transferred, request that the 
        covered entity notify any third party or service provider to 
        which the covered entity transferred such covered data of the 
        deletion request, including so that service providers may 
        provide the assistance required by section 111(a)(1)(C);
            (4) to the extent technically feasible, have exported 
        covered data of the individual or child (as applicable) that is 
        collected, processed, or retained by the covered entity, 
        without licensing restrictions that unreasonably limit such 
        transfers, in--
                    (A) a format that can be naturally read by a human; 
                and
                    (B) a format that is portable, structured, 
                interoperable, and machine-readable; and
            (5) delete any content or information submitted to the 
        covered entity by the individual when a covered minor and, for 
        any such content or information that has been transferred, 
        request that the covered entity notify any third party or 
        service provider to which the covered entity transferred such 
        content or information of the deletion request, including so 
        that service providers may provide the assistance required by 
        section 111(a)(1)(C).
    (b) Frequency and Cost.--A covered entity--
            (1) shall provide an individual with the opportunity to 
        exercise each of the rights described in subsection (a); and
            (2) with respect to--
                    (A) the first 3 instances that an individual 
                exercises any right described in subsection (a) during 
                any 12-month period, shall allow the individual to 
                exercise such right free of charge; and
                    (B) any instance beyond the first 3 instances 
                described in subparagraph (A), may charge a reasonable 
                fee for each additional request to exercise any such 
                right during such 12-month period.
    (c) Timing.--
            (1) In general.--Subject to subsections (b), (d), and (e), 
        each request under subsection (a) shall be completed--
                    (A) by any covered entity that is a large data 
                holder or data broker, not later than 30 calendar days 
                after receiving such request from an individual, unless 
                it is impossible or demonstrably impracticable to 
                verify the individual; or
                    (B) by a covered entity that is not a large data 
                holder or data broker, not later than 45 calendar days 
                after receiving such request from an individual, unless 
                it is impossible or demonstrably impracticable to 
                verify the individual.
            (2) Extension.--A response period required under paragraph 
        (1) may be extended once, by not more than the applicable time 
        period described in such paragraph, when reasonably necessary, 
        considering the complexity and number of requests from the 
        individual, if the covered entity informs the individual of any 
        such extension, and the reason for the extension, within the 
        initial response period.
    (d) Verification.--
            (1) In general.--A covered entity shall reasonably verify 
        that an individual making a request to exercise a right 
        described in subsection (a) is--
                    (A) the individual whose covered data is the 
                subject of the request;
                    (B) the parent of the child whose covered data (or, 
                with respect to a request under subsection (a)(5), 
                whose content or other information) is the subject of 
                the request; or
                    (C) another individual who is a natural person who 
                is authorized to make such a request on behalf of the 
                individual whose covered data is the subject of the 
                request.
            (2) Additional information.--If a covered entity cannot 
        make the verification described in paragraph (1), the covered 
        entity may request that the individual making the request 
        provide any additional information necessary for the sole 
        purpose of making such verification, except that--
                    (A) the request of the covered entity may not be 
                burdensome on the individual; and
                    (B) the covered entity may not process, retain, or 
                transfer such additional information for any other 
                purpose.
    (e) Exceptions.--
            (1) Required exceptions.--A covered entity may not permit 
        an individual to exercise a right described in subsection (a), 
        in whole or in part, if the covered entity--
                    (A) cannot reasonably make the verification 
                described in subsection (d)(1);
                    (B) determines that exercise of the right would 
                require access to, or the correction or deletion of, 
                the sensitive covered data of an individual other than 
                the individual whose covered data is the subject of the 
                request;
                    (C) determines that exercise of the right would 
                require correction or deletion of covered data subject 
                to a warrant, lawfully executed subpoena, or litigation 
                hold notice or equivalent preservation notice in 
                connection with such warrant or subpoena or issued in a 
                matter in which the covered entity is a named party;
                    (D) determines that exercise of the right would 
                violate a Federal, State, Tribal, or local law that is 
                not preempted by this title;
                    (E) determines that exercise of the right would 
                violate the professional ethical obligations of the 
                covered entity;
                    (F) reasonably believes that the request is made to 
                further fraud;
                    (G) except with respect to health information, 
                reasonably believes that the request is made in 
                furtherance of criminal activity; or
                    (H) reasonably believes that complying with the 
                request would threaten data security or network 
                security.
            (2) Permissive exceptions.--A covered entity may decline, 
        in whole or in part, to comply with a request to exercise a 
        right described in subsection (a), with adequate explanation to 
        the individual making the request, if compliance with the 
        request would--
                    (A) be demonstrably impracticable due to 
                technological limitations or prohibitive cost, and if 
                the covered entity provides a detailed description to 
                the individual regarding the inability to comply with 
                the request due to technological limitations or 
                prohibitive cost;
                    (B) delete covered data necessary to perform a 
                contract between the covered entity and the individual;
                    (C) with respect to a right described in paragraph 
                (1) or (4) of subsection (a), require the covered 
                entity to release trade secrets or other privileged, 
                proprietary, or confidential business information;
                    (D) prevent a covered entity from being able to 
                maintain a confidential record of opt-out requests 
                pursuant to this title that is maintained solely for 
                the purpose of preventing covered data of an individual 
                from being collected, processed, retained, or 
                transferred after the individual submits an opt-out 
                request;
                    (E) with respect to a deletion request, require a 
                private elementary or secondary school (as determined 
                under State law) or a private institution of higher 
                education (as defined in title I of the Higher 
                Education Act of 1965 (20 U.S.C. 1001 et seq.)) to 
                delete covered data, if the deletion would unreasonably 
                interfere with the provision of education services by, 
                or the ordinary operation of, the school or 
                institution;
                    (F) delete covered data that relates to a public 
                figure regarding a matter of legitimate public interest 
                and for which the requesting individual has no 
                reasonable expectation of privacy; or
                    (G) delete covered data that the covered entity 
                reasonably believes may be evidence of an abuse of the 
                products or services of the covered entity, including a 
                violation of terms of service.
            (3) Rule of construction.--This section may not be 
        construed to require a covered entity or service provider 
        acting on behalf of a covered entity to--
                    (A) retain covered data collected for a 1-time 
                transaction, if such covered data is not processed or 
                transferred by the covered entity for any purpose other 
                than completing such transaction;
                    (B) re-identify, or attempt to re-identify, de-
                identified data; or
                    (C) collect or retain any data in order to be 
                capable of associating a request with the covered data 
                that is the subject of the request.
            (4) Partial compliance.--In the event a covered entity 
        declines a request under paragraph (2), the covered entity 
        shall comply with the remainder of the request if partial 
        compliance is possible and not unduly burdensome.
            (5) Number of requests.--For purposes of paragraph (2)(A), 
        the receipt of a large number of verified requests, on its own, 
        may not be considered to render compliance with a request 
        demonstrably impracticable.
            (6) Additional exceptions.--
                    (A) In general.--The Commission may promulgate 
                regulations, in accordance with section 553 of title 5, 
                United States Code, to establish additional permissive 
                exceptions to subsection (a) necessary to protect the 
                rights of individuals, to alleviate undue burdens on 
                covered entities, to prevent unjust or unreasonable 
                outcomes from the exercise of access, correction, 
                deletion, or portability rights, or to otherwise 
                fulfill the purposes of this section.
                    (B) Considerations.--In establishing any exceptions 
                under subparagraph (A), the Commission shall consider 
                any relevant changes in technology, means for 
                protecting privacy and other rights, and beneficial 
                uses of covered data by covered entities.
                    (C) Clarification.--A covered entity may decline to 
                comply with a request of an individual to exercise a 
                right under this section pursuant to an exception the 
                Commission establishes under this paragraph.
    (f) Large Data Holder Metrics Reporting.--With respect to each 
calendar year for which an entity is a large data holder, such entity 
shall comply with the following requirements:
            (1) Required metrics.--Compile the following information 
        for such calendar year:
                    (A) The number of verified access requests under 
                subsection (a)(1).
                    (B) The number of verified deletion requests under 
                subsection (a)(3).
                    (C) The number of verified deletion requests under 
                subsection (a)(5).
                    (D) The number of verified requests to opt out of 
                covered data transfers under section 106(a)(1).
                    (E) The number of verified requests to opt out of 
                targeted advertising under section 106(a)(2).
                    (F) For each category of request described in 
                subparagraphs (A) through (E), the number of such 
                requests that the large data holder complied with in 
                whole or in part.
                    (G) For each category of request described in 
                subparagraphs (A) through (E), the average number of 
                days within which the large data holder substantively 
                responded to the requests.
            (2) Public disclosure.--Not later than July 1 of each 
        calendar year, disclose the information compiled under 
        paragraph (1) for the previous calendar year--
                    (A) in the privacy policy of the large data holder; 
                or
                    (B) on a publicly available website of the large 
                data holder that is accessible from a hyperlink 
                included in the privacy policy.
    (g) Guidance.--Not later than 1 year after the date of the 
enactment of this Act, the Commission shall issue guidance to clarify 
or explain the provisions of this section and establish practices by 
which a covered entity may verify a request to exercise a right 
described in subsection (a).
    (h) Accessibility.--
            (1) Language.--A covered entity shall facilitate the 
        ability of individuals to make requests to exercise rights 
        described in subsection (a) in any language in which the 
        covered entity provides a product or service.
            (2) Individuals living with disabilities.--The mechanisms 
        by which a covered entity enables individuals to make a request 
        to exercise a right described in subsection (a) shall be 
        readily accessible and usable by individuals living with 
        disabilities.

SEC. 106. OPT-OUT RIGHTS AND UNIVERSAL MECHANISMS.

    (a) In General.--A covered entity shall provide to an individual 
the following opt-out rights with respect to the covered data of the 
individual:
            (1) Right to opt out of covered data transfers to third 
        parties.--A covered entity--
                    (A) shall provide an individual with a clear and 
                conspicuous means to opt out of the transfer of the 
                covered data of the individual to a third party;
                    (B) upon establishment of an opt out mechanism that 
                meets the requirements and technical specifications 
                promulgated under subsection (b), shall allow an 
                individual to make an opt-out designation pursuant to 
                subparagraph (A) through the opt out mechanism;
                    (C) shall abide by an opt-out designation made 
                pursuant to subparagraph (A) and communicate such 
                designation to all relevant service providers and third 
                parties; and
                    (D) except as provided in subsection (b) or (c)(4) 
                of section 102, paragraph (3) or (4) of section 112(c), 
                or section 120(b), need not allow an individual to opt 
                out of a transfer of covered data made pursuant to a 
                permissible purpose described in paragraph (1), (2), 
                (3), (4), (5), (6), (7), (8), (9), (10), (11), (12), 
                (13), or (14) of section 102(d).
            (2) Right to opt out of targeted advertising.--A covered 
        entity that engages in targeted advertising shall--
                    (A) provide an individual with a clear and 
                conspicuous means to opt out of the processing and 
                transfer of covered data of the individual in 
                furtherance of targeted advertising;
                    (B) upon establishment of an opt out mechanism that 
                meets the requirements and technical specifications 
                promulgated under subsection (b), allow an individual 
                to make an opt-out designation with respect to targeted 
                advertising through the opt-out mechanism; and
                    (C) abide by any such opt-out designation made by 
                an individual and communicate such designation to all 
                relevant service providers and third parties.
    (b) Universal Opt-out Mechanisms.--
            (1) In general.--Not later than 2 years after the date of 
        the enactment of this Act, the Commission shall, in 
        consultation with the Secretary of Commerce, promulgate 
        regulations, in accordance with section 553 of title 5, United 
        States Code, to establish requirements and technical 
        specifications for 1 or more opt-out mechanisms (including 
        global privacy signals, such as browser or device privacy 
        settings) for individuals to exercise the opt-out rights 
        established under this title through a single interface that--
                    (A) ensures that the opt-out preference signal--
                            (i) is clearly described, and easy-to-use 
                        by a reasonable individual;
                            (ii) does not require that an individual 
                        provide additional information beyond what is 
                        necessary to indicate such preference;
                            (iii) clearly represents the preference of 
                        an individual;
                            (iv) is provided--
                                    (I) in the 10 most-used languages 
                                in which a covered entity provides 
                                products or services subject to the 
                                opt-out; or
                                    (II) if the covered entity provides 
                                products or services subject to the 
                                opt-out in fewer than 10 languages, in 
                                the languages in which the covered 
                                entity provides such products or 
                                services; and
                            (v) is provided in a manner that is 
                        reasonably accessible to and usable by 
                        individuals living with disabilities;
                    (B) provides a mechanism for an individual to 
                selectively opt out of the collection, processing, 
                retention, or transfer of covered data by a covered 
                entity, without affecting the preferences of the 
                individual with respect to other entities or disabling 
                the opt-out preference signal globally;
                    (C) states that, in the case of a page or setting 
                view that the individual accesses to set the opt-out 
                preference signal, the individual should see up to 2 
                choices, corresponding to the rights established under 
                subsection (a); and
                    (D) ensures that the opt-out preference signal will 
                be registered and set only by the individual or by 
                another individual who is a natural person on behalf of 
                the individual.
            (2) Effect of designations.--A covered entity shall abide 
        by any designation made by an individual through any mechanism 
        that meets the requirements and technical specifications 
        promulgated under paragraph (1).

SEC. 107. INTERFERENCE WITH CONSUMER RIGHTS.

    (a) Dark Patterns Prohibited.--
            (1) In general.--A covered entity may not use dark patterns 
        to--
                    (A) divert the attention of an individual from any 
                notice required under this title;
                    (B) impair the ability of an individual to exercise 
                any right under this title; or
                    (C) obtain, infer, or facilitate the consent of an 
                individual for any action that requires the consent of 
                an individual under this title.
            (2) Clarification.--Any agreement by an individual that is 
        obtained, inferred, or facilitated through dark patterns does 
        not constitute consent for any purpose under this title.
    (b) Individual Autonomy.--A covered entity may not condition, 
effectively condition, attempt to condition, or attempt to effectively 
condition the exercise of a right described in this title through the 
use of any false, fictitious, fraudulent, or materially misleading 
statement or representation.

SEC. 108. PROHIBITION ON DENIAL OF SERVICE AND WAIVER OF RIGHTS.

    (a) Retaliation Through Service or Pricing Prohibited.--A covered 
entity may not retaliate against an individual for exercising any of 
the rights established under this title, or any regulations promulgated 
under this title, including by denying goods or services, charging 
different prices or rates for goods or services, or providing a 
different level of quality of goods or services.
    (b) Rules of Construction.--
            (1) Bona fide loyalty programs.--
                    (A) In general.--Nothing in subsection (a) may be 
                construed to prohibit a covered entity from offering--
                            (i) to an individual different prices, 
                        rates, levels, qualities, or selections of 
                        goods or services, or functionalities with 
                        respect to a product or service, including 
                        offering goods or services for no fee, if the 
                        offering is in connection with the voluntary 
                        participation of the individual in a bona fide 
                        loyalty program, and if--
                                    (I) the individual provided 
                                affirmative express consent to 
                                participate in such bona fide loyalty 
                                program;
                                    (II) the covered entity abides by 
                                the exercise by the individual of any 
                                right provided by subsection (b) or (c) 
                                of section 102, section 105, or section 
                                106; and
                                    (III) the sale of covered data is 
                                not a condition of participation in the 
                                bona fide loyalty program; or
                            (ii) to an individual different prices, 
                        rates, levels, qualities, or selections of 
                        goods or services, or functionalities with 
                        respect to a product or service, based on the 
                        decision of the individual to terminate 
                        membership in a bona fide loyalty program or to 
                        exercise a right under section 105(a)(3) to 
                        delete covered data that is necessary for 
                        participation in the bona fide loyalty program.
                    (B) Bona fide loyalty program defined.--For 
                purposes of this section, the term ``bona fide loyalty 
                program''--
                            (i) includes rewards, premium features, 
                        discounts, and club card programs offered by a 
                        covered entity; and
                            (ii) excludes such programs offered by a 
                        covered high-impact social media company or 
                        data broker.
            (2) Market research.--Nothing in subsection (a) may be 
        construed to prohibit a covered entity from offering a 
        financial incentive or other consideration to an individual for 
        participation in market research.
            (3) Declining a product or service.--Nothing in subsection 
        (a) may be construed to prohibit a covered entity from 
        declining to provide a product or service or a bona fide 
        loyalty program to an individual, if any collection, 
        processing, retention, or transfer affected by the individual 
        exercising a right established under this title is necessary, 
        proportionate, and limited to providing such product or 
        service.

SEC. 109. DATA SECURITY AND PROTECTION OF COVERED DATA.

    (a) Establishment of Data Security Practices.--
            (1) In general.--Each covered entity or service provider 
        shall establish, implement, and maintain reasonable data 
        security practices to protect--
                    (A) the confidentiality, integrity, and 
                availability of covered data; and
                    (B) covered data against unauthorized access.
            (2) Considerations.--The data security practices required 
        under paragraph (1) shall be appropriate to--
                    (A) the size and complexity of the covered entity 
                or service provider;
                    (B) the nature and scope of the relevant 
                collecting, processing, retaining, or transferring of 
                covered data, taking into account changing business 
                operations with respect to covered data;
                    (C) the volume, nature, and sensitivity of the 
                covered data; and
                    (D) the state-of-the-art (and limitations thereof) 
                in administrative, technical, and physical safeguards 
                for protecting covered data.
    (b) Specific Requirements.--The data security practices required 
under subsection (a) shall include, at a minimum, the following:
            (1) Assess vulnerabilities.--Routinely identifying and 
        assessing any reasonably foreseeable internal or external risk 
        to, or vulnerability in, each system maintained by the covered 
        entity or service provider that collects, processes, retains, 
        or transfers covered data, including unauthorized access to or 
        corruption of such covered data, human vulnerabilities, access 
        rights, and the use of service providers. Such activities shall 
        include developing and implementing a plan for receiving and 
        considering unsolicited reports of vulnerability by any entity 
        and, if such a report is reasonably credible, performing a 
        reasonable and timely investigation of such report and taking 
        appropriate action to protect covered data against the 
        vulnerability.
            (2) Preventive and corrective action.--
                    (A) In general.--Taking preventive and corrective 
                action to mitigate any reasonably foreseeable internal 
                or external risk to, or vulnerability of, covered data 
                identified by the covered entity or service provider, 
                consistent with the nature of such risk or 
                vulnerability and the role of the covered entity or 
                service provider in collecting, processing, retaining, 
                or transferring the data, which may include 
                implementing administrative, technical, or physical 
                safeguards or changes to data security practices or the 
                architecture, installation, or implementation of 
                network or operating software.
                    (B) Evaluation of preventative and corrective 
                action.--Evaluating and making reasonable adjustments 
                to the action described in subparagraph (A) in light of 
                any material changes in state-of-the-art technology, 
                internal or external threats to covered data, and 
                changing business operations with respect to covered 
                data.
            (3) Information retention and disposal.--Disposing of 
        covered data (either by or at the direction of the covered 
        entity) that is required to be deleted by law or is no longer 
        necessary for the purpose for which the data was collected, 
        processed, retained, or transferred, unless a permitted purpose 
        under section 102(d) applies, except that retention and 
        disposal of biometric information shall be governed by section 
        102(c)(3). Such disposal shall include destroying, permanently 
        erasing, or otherwise modifying the covered data to make such 
        data permanently unreadable or indecipherable and unrecoverable 
        to ensure ongoing compliance with this section.
            (4) Retention schedule.--Developing, maintaining, and 
        adhering to a retention schedule for covered data consistent 
        with paragraph (3).
            (5) Training.--Training each employee with access to 
        covered data on how to safeguard covered data, and updating 
        such training as necessary.
            (6) Incident response.--Implementing procedures to detect, 
        respond to, and recover from data security incidents, including 
        breaches.
    (c) Regulations.--The Commission may, in consultation with the 
Secretary of Commerce, promulgate, in accordance with section 553 of 
title 5, United States Code, technology-neutral, process-based 
regulations to carry out this section.

SEC. 110. EXECUTIVE RESPONSIBILITY.

    (a) Designation of Privacy and Data Security Officers.--
            (1) In general.--A covered entity or service provider 
        (except for a large data holder) shall designate 1 or more 
        qualified employees to serve as privacy and data security 
        officers.
            (2) Requirements for officers.--An employee who is 
        designated by a covered entity or service provider as a privacy 
        and data security officer shall, at a minimum--
                    (A) implement a data privacy program and a data 
                security program to safeguard the privacy and security 
                of covered data in compliance with the requirements of 
                this title; and
                    (B) facilitate the ongoing compliance of the 
                covered entity or service provider with this title.
    (b) Requirements for Large Data Holders.--
            (1) Designation.--A covered entity or service provider that 
        is a large data holder shall designate 1 qualified employee to 
        serve as a privacy officer and 1 qualified employee to serve as 
        a data security officer.
            (2) Annual certification.--
                    (A) In general.--Beginning on the date that is 1 
                year after the date of the enactment of this Act, the 
                chief executive officer of a large data holder (or, if 
                the large data holder does not have a chief executive 
                officer, the highest ranking officer of the large data 
                holder) and each privacy officer and data security 
                officer of such large data holder designated under 
                paragraph (1), shall annually certify to the 
                Commission, in a manner specified by the Commission, 
                that the large data holder implements and maintains--
                            (i) internal controls reasonably designed, 
                        implemented, maintained, and monitored to 
                        comply with this title; and
                            (ii) internal reporting structures (as 
                        described in paragraph (3)) to ensure that such 
                        certifying officers are involved in, and 
                        responsible for, decisions that impact 
                        compliance by the large data holder with this 
                        title.
                    (B) Requirements.--A certification submitted under 
                subparagraph (A) shall be based on a review of the 
                effectiveness of the internal controls and reporting 
                structures of the large data holder that is conducted 
                by the certifying officers not more than 90 days before 
                the submission of the certification.
            (3) Internal reporting structure requirements.--At least 1 
        of the officers designated under paragraph (1) shall, either 
        directly or through a supervised designee--
                    (A) establish practices to periodically review and 
                update, as necessary, the privacy and security 
                policies, practices, and procedures of the large data 
                holder;
                    (B) conduct biennial and comprehensive audits to 
                ensure the policies, practices, and procedures of the 
                large data holder comply with this title and, upon 
                request, make such audits available to the Commission;
                    (C) develop a program to educate and train 
                employees about the requirements of this title;
                    (D) maintain updated, accurate, clear, and 
                understandable records of all significant privacy and 
                data security practices of the large data holder; and
                    (E) serve as the point of contact between the large 
                data holder and enforcement authorities.
            (4) Privacy impact assessments.--
                    (A) In general.--Not later than 1 year after the 
                date of the enactment of this Act or 1 year after the 
                date on which an entity first meets the definition of 
                the term ``large data holder'', whichever is earlier, 
                and biennially thereafter, each large data holder shall 
                conduct a privacy impact assessment that weighs the 
                benefits of the covered data collection, processing, 
                retention, and transfer practices of the entity against 
                the potential adverse consequences of such practices to 
                individual privacy.
                    (B) Assessment requirements.--A privacy impact 
                assessment required under subparagraph (A) shall be--
                            (i) reasonable and appropriate in scope 
                        given--
                                    (I) the nature and volume of the 
                                covered data collected, processed, 
                                retained, or transferred by the large 
                                data holder; and
                                    (II) the potential risks posed to 
                                the privacy of individuals by the 
                                collection, processing, retention, and 
                                transfer of covered data by the large 
                                data holder;
                            (ii) documented in written form and 
                        maintained by the large data holder for as long 
                        as the relevant privacy policy is required to 
                        be retained under section 104(f)(1); and
                            (iii) approved by the privacy officer of 
                        the large data holder.
                    (C) Additional factors to include in assessment.--
                In assessing privacy risks for purposes of an 
                assessment conducted under subparagraph (A), including 
                significant risks of harm to the privacy of an 
                individual or the security of covered data, the large 
                data holder shall include reviews of the means by which 
                technologies, including blockchain and distributed 
                ledger technologies and other emerging technologies, 
                including privacy enhancing technologies, are used to 
                secure covered data.

SEC. 111. SERVICE PROVIDERS AND THIRD PARTIES.

    (a) Service Providers.--
            (1) In general.--A service provider that collects, 
        processes, retains, or transfers covered data on behalf of or 
        at the direction of a covered entity or another service 
        provider--
                    (A) shall adhere to the instructions of the covered 
                entity or other service provider and collect, process, 
                retain, or transfer covered data only to the extent 
                necessary, proportionate, and limited to provide a 
                service requested by the covered entity or other 
                service provider, as set out in the contract described 
                in paragraph (2);
                    (B) may not collect, process, retain, or transfer 
                covered data if the service provider has actual 
                knowledge that the covered entity or other service 
                provider violated this title with respect to such data;
                    (C) shall assist the covered entity or other 
                service provider in fulfilling the obligations of the 
                covered entity or other service provider to respond to 
                consumer rights requests pursuant to this title by--
                            (i) providing appropriate technical and 
                        organizational support, taking into account the 
                        nature of the processing and the information 
                        reasonably available to the service provider; 
                        or
                            (ii) fulfilling a request by the covered 
                        entity or other service provider to execute a 
                        consumer rights request that the covered entity 
                        or other service provider has determined should 
                        be compiled with, by either--
                                    (I) complying with the request 
                                pursuant to the instructions of the 
                                covered entity or other service 
                                provider; or
                                    (II) providing written verification 
                                to the covered entity or other service 
                                provider that the service provider does 
                                not hold data related to the request, 
                                that complying with the request would 
                                be inconsistent with the legal 
                                obligations of the service provider, or 
                                that the request falls within an 
                                exception pursuant to this title;
                    (D) shall, upon the reasonable request of the 
                covered entity or other service provider, make 
                available to the covered entity or other service 
                provider all information necessary to demonstrate the 
                compliance of the service provider with the 
                requirements of this title;
                    (E) shall delete or return, as directed by the 
                covered entity or other service provider, all covered 
                data as soon as practicable after the contractually 
                agreed upon end of the provision of services, unless 
                the retention by the service provider of covered data 
                is required by law;
                    (F) may engage another service provider for 
                purposes of processing or retaining covered data on 
                behalf of the covered entity or other service provider 
                only after exercising reasonable care in selecting 
                another service provider as required by subsection (d), 
                providing the covered entity or other service provider 
                with written notice of the engagement, and entering 
                into a written contract that requires the other service 
                provider to satisfy the requirements of this title with 
                respect to covered data; and
                    (G) shall--
                            (i) allow and cooperate with reasonable 
                        assessments by the covered entity or other 
                        service provider at least annually; or
                            (ii) arrange for a qualified and 
                        independent assessor to conduct an assessment 
                        of the policies and technical and 
                        organizational measures of the service provider 
                        in support of the obligations of the service 
                        provider under this title at least annually, 
                        using an appropriate and accepted control 
                        standard or framework and assessment procedure 
                        for such assessments, and report the results of 
                        such assessment to the covered entity or other 
                        service provider.
            (2) Contract requirements.--An entity may only operate as a 
        service provider pursuant to a contract between a covered 
        entity and a service provider. Such contract--
                    (A) shall govern the data processing procedures of 
                the service provider with respect to any collection, 
                processing, retention, or transfer performed on behalf 
                of the covered entity;
                    (B) shall clearly set forth--
                            (i) instructions for collecting, 
                        processing, retaining, or transferring data;
                            (ii) the nature and purpose of the 
                        collection, processing, retention, or transfer;
                            (iii) the type of data subject to 
                        collection, processing, retention, or transfer;
                            (iv) the duration of the processing or 
                        retention; and
                            (v) the rights and obligations of both 
                        parties;
                    (C) may not relieve the covered entity or service 
                provider of any obligation under this title; and
                    (D) shall prohibit--
                            (i) the collection, processing, retention, 
                        or transfer of covered data in a manner that 
                        does not comply with the requirements of 
                        paragraph (1); and
                            (ii) combining covered data that the 
                        service provider receives from or on behalf of 
                        a covered entity with covered data that the 
                        service provider receives from or on behalf of 
                        another entity or collects from the interaction 
                        of the service provider with an individual, 
                        unless such combining is necessary for a 
                        purpose described in section 102(d), other than 
                        a purpose described in paragraph (7), (14), 
                        (15), or (16) of such section, and is otherwise 
                        permitted under the contract.
    (b) Third Parties.--
            (1) In general.--A third party may not process, retain, or 
        transfer third-party data for a purpose other than--
                    (A) in the case of sensitive covered data--
                            (i) except as provided in clause (ii), a 
                        purpose for which an individual gave 
                        affirmative express consent pursuant to 
                        subsection (b) or (c) of section 102; or
                            (ii) in the case of sensitive covered data 
                        with respect to which affirmative express 
                        consent is not required pursuant to subsection 
                        (b) of section 102, a purpose for which the 
                        covered entity or service provider made a 
                        disclosure pursuant to section 104; or
                    (B) in the case of covered data that is not 
                sensitive covered data, a purpose for which the covered 
                entity or service provider made a disclosure pursuant 
                to section 104.
            (2) Contract requirements.--Before transferring covered 
        data to a third party, a covered entity or service provider 
        shall enter into a contract with the third party that--
                    (A) identifies the purposes for which covered data 
                is being transferred;
                    (B) specifies that the third party may only use the 
                covered data for such purposes;
                    (C) with respect to the covered data transferred, 
                requires the third party to comply with all applicable 
                provisions of, and regulations promulgated under, this 
                title;
                    (D) requires the third party to notify the covered 
                entity or service provider if the third party makes a 
                determination that the third party can no longer meet 
                the obligations of the third party under this title; 
                and
                    (E) grants the covered entity or service provider 
                the right, upon notice (including under subparagraph 
                (D)), to take reasonable and appropriate steps to stop 
                and remediate unauthorized use of covered data by the 
                third party.
    (c) Rules of Construction.--
            (1) Successive actor violations.--
                    (A) In general.--With respect to a violation of 
                this title by a service provider or third party 
                regarding covered data received by the service provider 
                or third party from a covered entity or another service 
                provider, the covered entity or service provider that 
                transferred such covered data may not be considered to 
                be in violation of this title if the covered entity or 
                service provider transferred the covered data in 
                compliance with the requirements of this title and, at 
                the time of transferring such covered data, did not 
                have actual knowledge, or reason to believe, that the 
                service provider or third party to which the covered 
                data was transferred intended to violate this title.
                    (B) Knowledge of violation.--A covered entity or 
                service provider that transfers covered data to a 
                service provider or third party and has actual 
                knowledge, or reason to believe, that such service 
                provider or third party is violating, or is about to 
                violate, the requirements of this title shall 
                immediately cease the transfer of covered data to such 
                service provider or third party.
            (2) Prior actor violations.--An entity that collects, 
        processes, retains, or transfers covered data in compliance 
        with the requirements of this title may not be considered to be 
        in violation of this title as a result of a violation by an 
        entity from which it receives, or on whose behalf it collects, 
        processes, retains, or transfers, covered data.
    (d) Reasonable Care.--
            (1) Service provider selection.--A covered entity or 
        service provider shall exercise reasonable care in selecting a 
        service provider.
            (2) Transfer to third party.--A covered entity or service 
        provider shall exercise reasonable care in deciding to transfer 
        covered data to a third party.
            (3) Guidance.--Not later than 2 years after the date of the 
        enactment of this Act, the Commission shall publish guidance 
        regarding compliance with this subsection.
    (e) Rule of Construction.--Solely for purposes of this section, the 
requirements under this section for service providers to contract with, 
assist, and follow the instructions of covered entities shall also 
apply to any entity that collects, processes, retains, or transfers 
covered data for the purpose of performing services on behalf of, or at 
the direction of, a government entity, as though such government entity 
were a covered entity.

SEC. 112. DATA BROKERS.

    (a) Notice.--A data broker shall--
            (1) establish and maintain a publicly available website; 
        and
            (2) place a clear and conspicuous, and not misleading, 
        notice on such publicly available website, and any mobile 
        application of the data broker, that--
                    (A) states that the entity is a data broker;
                    (B) states that an individual may exercise a right 
                described in section 105 or 106, and includes a link or 
                other tool to allow an individual to exercise such 
                right;
                    (C) includes a link to the website described in 
                subsection (c)(3);
                    (D) is reasonably accessible to and usable by 
                individuals living with disabilities; and
                    (E) is provided in any language in which the data 
                broker provides products or services.
    (b) Prohibited Practices.--A data broker may not--
            (1) advertise or market access to, or the transfer of, 
        covered data for the purposes of--
                    (A) stalking or harassing an individual; or
                    (B) engaging in fraud, identity theft, or unfair or 
                deceptive acts or practices; or
            (2) misrepresent the business practices of the data broker.
    (c) Data Broker Registration.--
            (1) In general.--Not later than January 31 of each calendar 
        year that follows a calendar year during which an entity acted 
        as a data broker with respect to more than 5,000 individuals or 
        devices that identify or are linked or reasonably linkable to 
        an individual, such entity shall register with the Commission 
        in accordance with this subsection.
            (2) Registration requirements.--In registering with the 
        Commission as required under paragraph (1), a data broker shall 
        do the following:
                    (A) Pay to the Commission a registration fee of 
                $100.
                    (B) Provide the Commission with the following 
                information:
                            (i) The legal name and primary valid 
                        physical postal address, email address, and 
                        internet address of the data broker.
                            (ii) A description of the categories of 
                        covered data the data broker collects, 
                        processes, retains, or transfers.
                            (iii) The contact information of the data 
                        broker, including the name of a contact person, 
                        a human-monitored telephone number, a human-
                        monitored e-mail address, a website, and a 
                        physical mailing address.
                            (iv) A link to a website through which an 
                        individual may easily exercise the rights 
                        described in sections 105 and 106.
            (3) Data broker registry.--
                    (A) Establishment.--The Commission shall establish 
                and maintain on a publicly available website a 
                searchable list of data brokers that are registered 
                with the Commission under this subsection.
                    (B) Requirements.--The registry established under 
                subparagraph (A) shall--
                            (i) allow members of the public to search 
                        for and identify data brokers;
                            (ii) include the information required under 
                        paragraph (2)(B) for each data broker;
                            (iii) include a mechanism by which an 
                        individual, including a parent acting on behalf 
                        of a child of the parent, may submit to all 
                        registered data brokers a ``Do Not Collect'' 
                        request that results in registered data brokers 
                        no longer collecting covered data related to 
                        such individual or child (as applicable) 
                        without the affirmative express consent of such 
                        individual; and
                            (iv) include a mechanism by which an 
                        individual, including a parent acting on behalf 
                        of a child of the parent, may submit to all 
                        registered data brokers a ``Delete My Data'' 
                        request that results in registered data brokers 
                        deleting all covered data related to such 
                        individual or child (as applicable) that the 
                        data broker did not collect directly from such 
                        individual or when acting as a service 
                        provider.
                    (C) Affordability.--A data broker may not charge an 
                individual a fee to exercise a right under this 
                paragraph.
            (4) Do not collect and delete my data requests.--
                    (A) Compliance.--Subject to subparagraph (B), each 
                data broker that receives a request from an individual, 
                including a parent acting on behalf of a child of the 
                parent, using the mechanism established under paragraph 
                (3)(B)(iii) or paragraph (3)(B)(iv) shall comply with 
                such request not later than 30 days after the date on 
                which the request is received by the data broker.
                    (B) Exception.--A data broker may decline to 
                fulfill a request from an individual, if--
                            (i) the data broker has actual knowledge 
                        that the individual has been convicted of a 
                        crime related to the abduction or sexual 
                        exploitation of a child; and
                            (ii) the data collected by the data broker 
                        is necessary--
                                    (I) to carry out a national or 
                                State-run sex offender registry; or
                                    (II) for the National Center for 
                                Missing and Exploited Children.

SEC. 113. COMMISSION-APPROVED COMPLIANCE GUIDELINES.

    (a) Application for Compliance Guideline Approval.--
            (1) In general.--A covered entity that is not a data broker 
        and is not a large data holder, or a group of such covered 
        entities, may apply to the Commission for approval of 1 or more 
        sets of compliance guidelines governing the collection, 
        processing, retention, or transfer of covered data by the 
        covered entity or covered entities.
            (2) Application requirements.--An application under 
        paragraph (1) shall include--
                    (A) a description of how the proposed guidelines 
                will meet or exceed the applicable requirements of this 
                title;
                    (B) a description of the entities or activities the 
                proposed guidelines are designed to cover;
                    (C) a list of the covered entities, to the extent 
                known at the time of application, that intend to adhere 
                to the proposed guidelines;
                    (D) a description of an independent organization, 
                not associated with any of the intended adhering 
                covered entities, that will administer the proposed 
                guidelines; and
                    (E) a description of how such intended adhering 
                entities will be assessed for adherence to the proposed 
                guidelines by the independent organization described in 
                subparagraph (D).
            (3) Commission review.--
                    (A) Initial approval.--
                            (i) Public comment period.--Not later than 
                        90 days after receipt of an application 
                        regarding proposed guidelines submitted 
                        pursuant to paragraph (1), the Commission shall 
                        publish the application and provide an 
                        opportunity for public comment on such proposed 
                        guidelines.
                            (ii) Approval criteria.--The Commission 
                        shall approve an application regarding proposed 
                        guidelines submitted pursuant to paragraph (1), 
                        including the independent organization that 
                        will administer the guidelines, if the 
                        applicant demonstrates that the proposed 
                        guidelines--
                                    (I) meet or exceed the applicable 
                                requirements of this title;
                                    (II) provide for regular review and 
                                validation by an independent 
                                organization to ensure that the covered 
                                entity or covered entities adhering to 
                                the guidelines continue to meet or 
                                exceed the applicable requirements of 
                                this title; and
                                    (III) include a means of 
                                enforcement if a covered entity does 
                                not meet or exceed the requirements in 
                                the guidelines, which may include 
                                referral to the Commission for 
                                enforcement under section 115 or 
                                referral to the appropriate State 
                                attorney general for enforcement under 
                                section 116.
                            (iii) Timeline.--Not later than 1 year 
                        after the date on which the Commission receives 
                        an application regarding proposed guidelines 
                        pursuant to paragraph (1), the Commission shall 
                        issue a determination approving or denying the 
                        application, including the relevant independent 
                        organization, and providing the reasons for 
                        approving or denying the application.
                    (B) Approval of modifications.--
                            (i) In general.--If the independent 
                        organization administering a set of guidelines 
                        approved under subparagraph (A) makes 
                        significant changes to the guidelines, the 
                        independent organization shall submit the 
                        updated guidelines to the Commission for 
                        approval. As soon as feasible, the Commission 
                        shall publish the updated guidelines and 
                        provide an opportunity for public comment.
                            (ii) Timeline.--The Commission shall 
                        approve or deny any significant change to 
                        guidelines submitted under clause (i) not later 
                        than 180 days after the date on which the 
                        Commission receives the submission for 
                        approval.
    (b) Withdrawal of Approval.--
            (1) In general.--If at any time the Commission determines 
        that guidelines previously approved under this section no 
        longer meet the applicable requirements of this title or that 
        compliance with the approved guidelines is insufficiently 
        enforced by the independent organization administering the 
        guidelines, the Commission shall notify the relevant covered 
        entity or group of covered entities and the independent 
        organization of the determination of the Commission to withdraw 
        approval of the guidelines, including the basis for the 
        determination.
            (2) Opportunity to cure.--
                    (A) In general.--Not later than 180 days after 
                receipt of a notice under paragraph (1), the covered 
                entity or group of covered entities and the independent 
                organization may cure any alleged deficiency with the 
                guidelines or the enforcement of the guidelines and 
                submit each proposed cure to the Commission.
                    (B) Effect on withdrawal of approval.--If the 
                Commission determines that cures proposed under 
                subparagraph (A) eliminate alleged deficiencies in the 
                guidelines, the Commission may not withdraw the 
                approval of such guidelines on the basis of such 
                deficiencies.
    (c) Certification.--A covered entity with guidelines approved by 
the Commission under this section shall--
            (1) publicly self-certify that the covered entity is in 
        compliance with the guidelines; and
            (2) as part of the self-certification under paragraph (1), 
        indicate the independent organization responsible for assessing 
        compliance with the guidelines.
    (d) Rebuttable Presumption of Compliance.--A covered entity that is 
eligible to participate in guidelines approved under this section, 
participates in the guidelines, and is in compliance with the 
guidelines shall be entitled to a rebuttable presumption that the 
covered entity is in compliance with the relevant provisions of this 
title to which the guidelines apply.
    (e) Eligibility of Service Providers.--This section shall apply to 
a service provider that is not a large data holder, or a group of such 
service providers, in the same manner as this section applies to a 
covered entity or group of covered entities. Such a service provider or 
group of service providers may apply for approval of, and participate 
in, the same guidelines as a covered entity or group of covered 
entities.

SEC. 114. PRIVACY-ENHANCING TECHNOLOGY PILOT PROGRAM.

    (a) Privacy-Enhancing Technology Defined.--In this section, the 
term ``privacy-enhancing technology''--
            (1) means any software or hardware solution, cryptographic 
        algorithm, or other technical process of extracting the value 
        of information without substantially reducing the privacy and 
        security of the information; and
            (2) includes technologies with functionality similar to 
        homomorphic encryption, differential privacy, zero-knowledge 
        proofs, synthetic data generation, federated learning, and 
        secure multi-party computation.
    (b) Establishment.--Not later than 1 year after the date of the 
enactment of this Act, the Commission shall establish and carry out a 
pilot program to encourage private sector use of privacy-enhancing 
technologies for the purposes of protecting covered data to comply with 
section 109.
    (c) Purposes.--Under the pilot program established under subsection 
(b), the Commission shall--
            (1) develop and implement a petition process for covered 
        entities to request to be a part of the pilot program; and
            (2) build an auditing system that leverages privacy-
        enhancing technologies to support the enforcement actions of 
        the Commission.
    (d) Petition Process.--A covered entity wishing to be accepted into 
the pilot program established under subsection (b) shall demonstrate to 
the Commission that the privacy-enhancing technologies to be used under 
the pilot program by the covered entity will establish data security 
practices that meet or exceed all or some of the requirements in 
section 109. If the covered entity demonstrates the privacy-enhancing 
technologies meet or exceed the requirements in section 109, the 
Commission may accept the covered entity to be a part of the pilot 
program. If the Commission does not accept a covered entity to be a 
part of the pilot program, the Commission shall provide an adequate 
response to the covered entity detailing why the covered entity was not 
accepted, and the covered entity may subsequently revise the petition 
of the covered entity to address any deficiencies indicated by the 
Commission in the response of the Commission to the covered entity.
    (e) Requirements.--In carrying out the pilot program established 
under subsection (b), the Commission shall--
            (1) receive input from private, public, and academic 
        stakeholders; and
            (2) develop ongoing public and private sector engagement, 
        in consultation with the Secretary of Commerce, to disseminate 
        voluntary, consensus-based resources to increase the 
        integration of privacy-enhancing technologies in data 
        collection, sharing, and analytics by the public and private 
        sectors.
    (f) Conclusion of Pilot Program.--The Commission shall terminate 
the pilot program established under subsection (b) not later than 10 
years after the commencement of the program.
    (g) Study Required.--
            (1) In general.--The Comptroller General of the United 
        States shall conduct a study--
                    (A) to assess the progress of the pilot program 
                established under subsection (b);
                    (B) to determine the effectiveness of using 
                privacy-enhancing technologies at the Commission to 
                support oversight of the data security practices of 
                covered entities; and
                    (C) to develop recommendations to improve and 
                advance privacy-enhancing technologies, including by 
                improving communication and coordination between 
                covered entities and the Commission to increase 
                implementation of privacy-enhancing technologies by 
                such entities and the Commission.
            (2) Initial briefing.--Not later than 3 years after the 
        date of the enactment of this Act, the Comptroller General 
        shall brief the Committee on Energy and Commerce of the House 
        of Representatives and the Committee on Commerce, Science, and 
        Transportation of the Senate on the initial results of the 
        study conducted under paragraph (1).
            (3) Final report.--Not later than 240 days after the date 
        on which the briefing required by paragraph (2) is conducted, 
        the Comptroller General shall submit to the Committee on Energy 
        and Commerce of the House of Representatives and the Committee 
        on Commerce, Science, and Transportation of the Senate a final 
        report setting forth the results of the study conducted under 
        paragraph (1), including the recommendations developed under 
        subparagraph (C) of such paragraph.
    (h) Audit of Covered Entities.--The Commission shall, on an ongoing 
basis, audit covered entities who have been accepted to be part of the 
pilot program established under subsection (b) to determine whether 
such a covered entity is maintaining the use and implementation of 
privacy-enhancing technologies to secure covered data.
    (i) Withdrawal From the Pilot Program.--If at any time the 
Commission determines that a covered entity accepted to be a part of 
the pilot program established under subsection (b) is no longer 
maintaining the use of privacy-enhancing technologies, the Commission 
shall notify the covered entity of the determination of the Commission 
to withdraw approval for the covered entity to be a part of the pilot 
program and the basis for doing so. Not later than 180 days after the 
date on which a covered entity receives such notice, the covered entity 
may cure any alleged deficiency with the use of privacy-enhancing 
technologies and submit each proposed cure to the Commission. If the 
Commission determines that such cures eliminate alleged deficiencies 
with the use of privacy-enhancing technologies, the Commission may not 
withdraw the approval of the covered entity to be a part of the pilot 
program on the basis of such deficiencies.
    (j) Limitations on Liability.--Any covered entity that petitions, 
and is accepted, to be part of the pilot program established under 
subsection (b), actively implements and maintains the use of privacy-
enhancing technologies, and is determined by the Commission to be in 
compliance with the program shall--
            (1) for any action under section 115 or 116 for a violation 
        of section 109, be deemed to be in compliance with section 109 
        with respect to the covered data subject to the privacy-
        enhancing technologies; and
            (2) for any action under section 117 for a violation of 
        section 109, be entitled to a rebuttable presumption that such 
        entity is in compliance with section 109 with respect to the 
        covered data subject to the privacy-enhancing technologies.

SEC. 115. ENFORCEMENT BY FEDERAL TRADE COMMISSION.

    (a) New Bureau.--
            (1) In general.--Subject to the availability of 
        appropriations, the Commission shall establish, within the 
        Commission, a new bureau comparable in structure, size, 
        organization, and authority to the existing bureaus within the 
        Commission related to consumer protection and competition.
            (2) Mission.--The mission of the bureau established under 
        this subsection shall be to assist the Commission in exercising 
        the authority of the Commission under this title and related 
        authorities.
            (3) Staff.--
                    (A) In general.--In staffing the bureau established 
                under this subsection, the Commission shall ensure the 
                allocation of full time employees or full time employee 
                equivalents that include attorneys, economists, 
                investigators, technologists, and mental health 
                professionals with experience in the well-being of 
                children and teens.
                    (B) Technologist defined.--For the purposes of this 
                paragraph, the term ``technologist'' means an 
                individual with training and expertise with respect to 
                technology, including state-of-the art information 
                technology, network or data security, hardware or 
                software development, privacy-enhancing technologies, 
                cryptography, computer science, data science, 
                advertising technology, web tracking, machine learning, 
                and other related fields and applications.
            (4) Timeline.--The bureau established under this subsection 
        shall be established, staffed, and fully operational not later 
        than 180 days after the date of the enactment of this Act.
    (b) Enforcement by Commission.--
            (1) Unfair or deceptive acts or practices.--A violation of 
        this title or a regulation promulgated under this title shall 
        be treated as a violation of a rule defining an unfair or 
        deceptive act or practice prescribed under section 18(a)(1)(B) 
        of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
            (2) Powers of commission.--
                    (A) In general.--Except as provided in paragraph 
                (3) or otherwise provided in this title, the Commission 
                shall enforce this title and the regulations 
                promulgated under this title in the same manner, by the 
                same means, and with the same jurisdiction, powers, and 
                duties as though all applicable terms and provisions of 
                the Federal Trade Commission Act (15 U.S.C. 41 et seq.) 
                were incorporated into and made a part of this title.
                    (B) Privileges and immunities.--Any entity that 
                violates this title or a regulation promulgated under 
                this title shall be subject to the penalties and 
                entitled to the privileges and immunities provided in 
                the Federal Trade Commission Act (15 U.S.C. 41 et 
                seq.).
            (3) Common carriers and nonprofits.--Notwithstanding 
        section 4, 5(a)(2), or 6 of the Federal Trade Commission Act 
        (15 U.S.C. 44; 45(a)(2); 46) or any jurisdictional limitation 
        of the Commission, the Commission shall also enforce this 
        title, and the regulations promulgated under this title, in the 
        same manner provided in paragraphs (1) and (2) of this 
        subsection with respect to--
                    (A) common carriers subject to title II of the 
                Communications Act of 1934 (47 U.S.C. 201 et seq.); and
                    (B) organizations not organized to carry on 
                business for their own profit or that of their members.
            (4) Penalty offset for state or individual actions.--Any 
        amount that a court orders an entity to pay in an action 
        brought under this subsection shall be offset by any amount a 
        court has ordered the entity to pay in an action brought 
        against the entity for the same violation under section 116 or 
        117.
            (5) Privacy and security victims relief fund.--
                    (A) Establishment of victims relief fund.--There is 
                established in the Treasury of the United States a 
                separate fund to be known as the ``Privacy and Security 
                Victims Relief Fund'' (in this paragraph referred to as 
                the ``Victims Relief Fund'').
                    (B) Deposits.--The Commission or the Attorney 
                General of the United States, as applicable, shall 
                deposit into the Victims Relief Fund the amount of any 
                civil penalty obtained in any civil action the 
                Commission, or the Attorney General on behalf of the 
                Commission, commences to enforce this title or a 
                regulation promulgated under this title.
                    (C) Use of fund amounts.--
                            (i) Availability to the commission.--
                        Notwithstanding section 3302 of title 31, 
                        United States Code, amounts in the Victims 
                        Relief Fund shall be available to the 
                        Commission, without fiscal year limitation, to 
                        provide redress, damages, payments or 
                        compensation, or other monetary relief to 
                        persons affected by an act or practice for 
                        which civil penalties, other monetary relief, 
                        or any other forms of relief (including 
                        injunctive relief) have been ordered in a civil 
                        action or administrative proceeding the 
                        Commission commences, or in any civil action 
                        the Attorney General of the United States 
                        commences on behalf of the Commission, to 
                        enforce this title or a regulation promulgated 
                        under this title.
                            (ii) Other permissible uses.--To the extent 
                        that individuals cannot be located or such 
                        redress, damages, payments or compensation, or 
                        other monetary relief are otherwise not 
                        practicable, the Commission may use amounts in 
                        the Victims Relief Fund for the purpose of--
                                    (I) consumer or business education 
                                relating to data privacy or data 
                                security; or
                                    (II) engaging in technological 
                                research that the Commission considers 
                                necessary to implement this title, 
                                including promoting privacy-enhancing 
                                technologies that promote compliance 
                                with this title.
                    (D) Calculation.--Any amount that the Commission 
                provides to a person as redress, payments or 
                compensation, or other monetary relief under 
                subparagraph (C) with respect to a violation by an 
                entity shall be offset by any amount the person 
                received from an action brought against the entity for 
                the same violation under section 116 or 117.
                    (E) Rule of construction.--Amounts collected and 
                deposited in the Victims Relief Fund may not be 
                construed to be Government funds or appropriated monies 
                and may not be subject to apportionment for the purpose 
                of chapter 15 of title 31, United States Code, or under 
                any other authority.
    (c) Report.--
            (1) In general.--Not later than 4 years after the date of 
        the enactment of this Act, and annually thereafter, the 
        Commission shall submit to Congress a report describing 
        investigations conducted during the prior year with respect to 
        violations of this title, including--
                    (A) the number of such investigations the 
                Commission commenced;
                    (B) the number of such investigations the 
                Commission closed with no official agency action;
                    (C) the disposition of such investigations, if such 
                investigations have concluded and resulted in official 
                agency action; and
                    (D) for each investigation that was closed with no 
                official agency action, the industry sectors of the 
                covered entities subject to each investigation.
            (2) Privacy protections.--A report required under paragraph 
        (1) may not include the identity of any person who is the 
        subject of an investigation or any other information that 
        identifies such a person.
            (3) Annual plan.--Not later than 540 days after the date of 
        the enactment of this Act, and annually thereafter, the 
        Commission shall submit to Congress a plan for the next 
        calendar year describing the projected activities of the 
        Commission under this title, including--
                    (A) the policy priorities of the Commission and any 
                changes to the previous policy priorities of the 
                Commission;
                    (B) any rulemaking proceedings projected to be 
                commenced, including any such proceedings to amend or 
                repeal a rule;
                    (C) any plans to develop, update, or withdraw 
                guidelines or guidance required under this title;
                    (D) any plans to restructure the Commission; and
                    (E) projected dates and timelines, or changes to 
                projected dates and timelines, associated with any of 
                the requirements under this title.

SEC. 116. ENFORCEMENT BY STATES.

    (a) Civil Action.--
            (1) In general.--In any case in which the attorney general 
        of a State, the chief consumer protection officer of a State, 
        or an officer or office of a State authorized to enforce 
        privacy or data security laws applicable to covered entities or 
        service providers has reason to believe that an interest of the 
        residents of the State has been or is adversely affected by the 
        engagement of any entity in an act or practice that violates 
        this title or a regulation promulgated under this title, the 
        attorney general, chief consumer protection officer, or other 
        authorized officer or office of the State may bring a civil 
        action in the name of the State, or as parens patriae on behalf 
        of the residents of the State, in an appropriate Federal 
        district court of the United States to--
                    (A) enjoin such act or practice;
                    (B) enforce compliance with this title or the 
                regulations promulgated under this title;
                    (C) obtain civil penalties;
                    (D) obtain damages, restitution, or other 
                compensation on behalf of the residents of the State;
                    (E) obtain reasonable attorney's fees and other 
                litigation costs reasonably incurred; or
                    (F) obtain such other relief as the court may 
                consider to be appropriate.
            (2) Limitation.--In any case with respect to which the 
        attorney general of a State, the chief consumer protection 
        officer of a State, or an officer or office of a State 
        authorized to enforce privacy or data security laws applicable 
        to covered entities or service providers brings an action under 
        paragraph (1), no other officer or office of the same State may 
        institute a civil action under paragraph (1) against the same 
        defendant for the same violation of this title or regulation 
        promulgated under this title.
    (b) Rights of the Commission.--
            (1) In general.--Except if not feasible, a State officer 
        shall notify the Commission in writing prior to initiating a 
        civil action under subsection (a). Such notice shall include a 
        copy of the complaint to be filed to initiate such action. Upon 
        receiving such notice, the Commission may intervene in such 
        action and, upon intervening--
                    (A) be heard on all matters arising in such action; 
                and
                    (B) file petitions for appeal of a decision in such 
                action.
            (2) Notification timeline.--If not feasible for a State 
        officer to provide the notification required by paragraph (1) 
        before initiating a civil action under subsection (a), the 
        State officer shall notify the Commission immediately after 
        initiating the civil action.
    (c) Actions by the Commission.--In any case in which a civil action 
is instituted by or on behalf of the Commission for a violation of this 
title or a regulation promulgated under this title, no attorney general 
of a State, chief consumer protection officer of a State, or officer or 
office of a State authorized to enforce privacy or data security laws 
may, during the pendency of such action, institute a civil action 
against any defendant named in the complaint in the action instituted 
by or on behalf of the Commission for a violation of this title or a 
regulation promulgated under this title that is alleged in such 
complaint.
    (d) Investigatory Powers.--Nothing in this title may be construed 
to prevent the attorney general of a State, the chief consumer 
protection officer of a State, or an officer or office of a State 
authorized to enforce privacy or data security laws applicable to 
covered entities or service providers from exercising the powers 
conferred on such officer or office to conduct investigations, to 
administer oaths or affirmations, or to compel the attendance of 
witnesses or the production of documentary or other evidence.
    (e) Venue; Service of Process.--
            (1) Venue.--Any action brought under subsection (a) may be 
        brought in any Federal district court of the United States that 
        meets applicable requirements relating to venue under section 
        1391 of title 28, United States Code.
            (2) Service of process.--In an action brought under 
        subsection (a), process may be served in any district in which 
        the defendant--
                    (A) is an inhabitant; or
                    (B) may be found.
    (f) GAO Study.--
            (1) In general.--The Comptroller General of the United 
        States shall conduct a study of the practice of State attorneys 
        general hiring, or otherwise contracting with, outside firms to 
        assist in enforcement efforts pursuant to this title, which 
        shall include the study of--
                    (A) the frequency with which each State attorney 
                general hires or contracts with outside firms to assist 
                in such enforcement efforts;
                    (B) the contingency fees, hourly rates, and other 
                costs of hiring or contracting with outside firms;
                    (C) the types of matters for which outside firms 
                are hired or contracted;
                    (D) the bid and selection process for such outside 
                firms, including reviews of conflicts of interest;
                    (E) the practices State attorneys general set in 
                place to protect sensitive information that would 
                become accessible by outside firms while the outside 
                firms are assisting in such enforcement efforts;
                    (F) the percentage of monetary recovery that is 
                returned to victims and the percentage of such recovery 
                that is retained by outside firms; and
                    (G) the market average for the hourly rate of hired 
                or contracted attorneys in each market.
            (2) Report.--Not later than 1 year after the date of the 
        enactment of this Act, the Comptroller General shall submit to 
        the Committee on Energy and Commerce of the House of 
        Representatives and the Committee on Commerce, Science, and 
        Transportation of the Senate a report on the results of the 
        study conducted under paragraph (1).
    (g) Preservation of State Powers.--Except as provided in 
subsections (a)(2) and (c), no provision of this section may be 
construed as altering, limiting, or affecting the authority of a State 
attorney general, the chief consumer protection officer of a State, or 
an officer or office of a State authorized to enforce laws applicable 
to covered entities or service providers to--
            (1) bring an action or other regulatory proceeding arising 
        solely under the laws in effect in such State; or
            (2) exercise the powers conferred on the attorney general, 
        chief consumer protection officer, or officer or office by the 
        laws of such State, including the ability to conduct 
        investigations, to administer oaths or affirmations, or to 
        compel the attendance of witnesses or the production of 
        documentary or other evidence.
    (h) Calculation.--Any amount that a court orders an entity to pay 
to a person under this section shall be offset by any amount the person 
received from an action brought against the entity for the same 
violation under section 115 or 117.

SEC. 117. ENFORCEMENT BY PERSONS.

    (a) Civil Action.--
            (1) In general.--Subject to subsections (b) and (c), a 
        person may bring a civil action against a covered entity or 
        service provider for a violation of subsection (b) or (c) of 
        section 102, subsection (a) or (e) of section 104, section 105, 
        subsection (a) or (b)(2) of section 106, section 107, section 
        108, section 109 to the extent such action alleges a data 
        breach arising from a violation of subsection (a) of such 
        section, subsection (d) of section 111, or subsection (c)(4) of 
        section 112, or a regulation promulgated thereunder, in an 
        appropriate Federal district court of the United States.
            (2) Relief.--
                    (A) In general.--In a civil action brought under 
                paragraph (1) in which the plaintiff prevails, the 
                court may award the plaintiff--
                            (i) an amount equal to the sum of any 
                        actual damages;
                            (ii) injunctive relief, including an order 
                        that an entity retrieve any covered data 
                        transferred in violation of this title;
                            (iii) declaratory relief; and
                            (iv) reasonable attorney fees and 
                        litigation costs.
                    (B) Biometric and genetic information.--In a civil 
                action brought under paragraph (1) for a violation of 
                this title with respect to section 102(c), in which the 
                plaintiff prevails, if the conduct underlying the 
                violation occurred primarily and substantially in 
                Illinois, the court may award the plaintiff--
                            (i) for a violation involving biometric 
                        information, the same relief as set forth in 
                        section 20 of the Biometric Information Privacy 
                        Act (740 ILCS 14/20), as such statute reads on 
                        December 31, 2024; or
                            (ii) for a violation involving genetic 
                        information, the same relief as set forth in 
                        section 40 of the Genetic Information Privacy 
                        Act (410 ILCS 513/40), as such statute reads on 
                        December 31, 2024.
                    (C) Data security.--
                            (i) In general.--In a civil action brought 
                        under paragraph (1) for a violation of this 
                        title alleging unauthorized access of covered 
                        information as a result of a violation of 
                        section 109(a), in which the plaintiff 
                        prevails, the court may award a plaintiff who 
                        is a resident of California the same relief as 
                        set forth in section 1798.150 of the California 
                        Civil Code, as such statute read on January 1, 
                        2024.
                            (ii) Covered information defined.--For 
                        purposes of this subparagraph, the term 
                        ``covered information'' means the following:
                                    (I) A username, email address, or 
                                telephone number of an individual in 
                                combination with a password or security 
                                question or answer that would permit 
                                access to an account held by the 
                                individual that contains or provides 
                                access to sensitive covered data.
                                    (II) The first name or first 
                                initial of an individual and the last 
                                name of the individual in combination 
                                with 1 or more of the following 
                                categories of sensitive covered data, 
                                if either the name or the sensitive 
                                covered data are not encrypted or 
                                redacted:
                                            (aa) A government-issued 
                                        identifier described in section 
                                        101(49)(A)(i).
                                            (bb) A financial account 
                                        number described in section 
                                        101(49)(A)(iv).
                                            (cc) Health information, 
                                        but only to the extent such 
                                        information reveals the history 
                                        of medical treatment or 
                                        diagnosis by a health care 
                                        professional of the individual.
                                            (dd) Biometric information.
                                            (ee) Genetic information.
                    (D) Limitations on dual actions.--Any amount that a 
                court orders an entity to pay to a person under 
                subparagraph (A)(i), (B), or (C) shall be offset by any 
                amount the person received from an action brought 
                against the entity for the same violation under section 
                115 or 116.
    (b) Opportunity to Cure in Actions for Injunctive Relief.--
            (1) Notice.--Subject to paragraph (3), an action for 
        injunctive relief may be brought by a person under this section 
        only if, prior to initiating such action against an entity, the 
        person provides to the entity written notice identifying the 
        specific provisions of this title the person alleges have been 
        or are being violated.
            (2) Effect of cure.--In the event a cure is possible with 
        respect to a violation alleged in a notice described in 
        paragraph (1) and, not later than 60 days after the date of 
        receipt of such notice, the entity cures such violation and 
        provides the person an express written statement that the 
        violation has been cured and that no further such violations 
        shall occur, an action for injunctive relief may not be 
        permitted with respect to the noticed violation.
            (3) Injunctive relief for a substantial privacy harm.--
        Notice is not required under paragraph (1) prior to bringing an 
        action for injunctive relief for a violation that resulted in a 
        substantial privacy harm.
    (c) Notice of Actions Seeking Actual Damages.--
            (1) Notice.--Subject to paragraph (4), an action under this 
        section for actual damages may be brought by a person only if, 
        60 days prior to initiating such action against an entity, the 
        person provides the entity written notice identifying the 
        specific provisions of this title the person alleges have been 
        or are being violated.
            (2) Settlement.--An entity that receives a written notice 
        from a person under paragraph (1) may settle with the person 
        who sent the written notice.
            (3) Effect of settlement.--In the event of a settlement 
        under paragraph (2), the terms of such settlement shall govern 
        any future action under this section for actual damages between 
        the parties to the settlement that relates to the underlying 
        facts that resulted in the settlement.
            (4) No notice required for a substantial privacy harm.--
        Notice is not required under paragraph (1) prior to bringing an 
        action for actual damages for a violation of this title that 
        resulted in a substantial privacy harm, if such action includes 
        a claim for a preliminary injunction or temporary restraining 
        order.
    (d) Pre-Dispute Arbitration Agreements.--
            (1) In general.--Notwithstanding any other provision of 
        law, at the election of the person alleging a violation of this 
        title, no pre-dispute arbitration agreement shall be valid or 
        enforceable with respect to--
                    (A) a claim alleging a violation involving an 
                individual under the age of 18; or
                    (B) a claim alleging a violation that resulted in a 
                substantial privacy harm.
            (2) Determination of applicability.--Any issue as to 
        whether this subsection applies to a dispute shall be 
        determined under Federal law. The applicability of this 
        subsection to an agreement to arbitrate and the validity and 
        enforceability of an agreement to which this subsection applies 
        shall be determined by a Federal court, rather than an 
        arbitrator, irrespective of whether the party resisting 
        arbitration challenges the arbitration agreement specifically 
        or in conjunction with other terms of the contract containing 
        the agreement, and irrespective of whether the agreement 
        purports to delegate the determination to an arbitrator.
            (3) Pre-dispute arbitration agreement defined.--For 
        purposes of this subsection, the term ``pre-dispute arbitration 
        agreement'' means any agreement to arbitrate a dispute that has 
        not arisen at the time of the making of the agreement.
    (e) Combined Notices.--A person may combine the notices required by 
subsections (b)(1) and (c)(1) into a single notice, if the single 
notice complies with the requirements of each such subsection.
    (f) Bad Faith.--If a person represented by counsel brings a civil 
action under this section against a covered entity or service provider 
requesting actual damages from the covered entity or service provider, 
and fails to provide notice to the covered entity or service provider 
in accordance with this section, the action may be dismissed without 
prejudice and may not be reinstated until the person has complied with 
the notice requirements of this section.

SEC. 118. RELATION TO OTHER LAWS.

    (a) Preemption of State Laws.--
            (1) Congressional intent.--The purposes of this section are 
        to--
                    (A) establish a uniform national privacy and data 
                security standard in the United States to prevent 
                administrative costs and burdens from being placed on 
                interstate commerce; and
                    (B) expressly preempt the laws of a State or 
                political subdivision of a State as provided in this 
                subsection.
            (2) Preemption.--Except as provided in paragraphs (3) and 
        (4), no State or political subdivision of a State may adopt, 
        maintain, enforce, impose, or continue in effect any law, 
        regulation, rule, requirement, prohibition, standard, or other 
        provision covered by the provisions of this title or a rule, 
        regulation, or requirement promulgated under this title.
            (3) State law preservation.--Paragraph (2) may not be 
        construed to preempt, displace, or supplant the following State 
        laws, rules, regulations, or requirements:
                    (A) Consumer protection laws of general 
                applicability, such as laws regulating deceptive, 
                unfair, or unconscionable practices.
                    (B) Civil rights laws.
                    (C) Provisions of laws that address the privacy 
                rights or other protections of employees or employee 
                information.
                    (D) Provisions of laws that address the privacy 
                rights or other protections of students or student 
                information.
                    (E) Provisions of laws, insofar as such provisions 
                address notification requirements in the event of a 
                data breach.
                    (F) Contract or tort law.
                    (G) Criminal laws.
                    (H) Civil laws regarding--
                            (i) blackmail;
                            (ii) stalking (including cyberstalking);
                            (iii) cyberbullying;
                            (iv) intimate images (whether authentic or 
                        computer-generated) known to be nonconsensual;
                            (v) child abuse;
                            (vi) child sexual abuse material;
                            (vii) child abduction or attempted child 
                        abduction;
                            (viii) child trafficking; or
                            (ix) sexual harassment.
                    (I) Public safety or sector-specific laws unrelated 
                to privacy or data security, but only to the extent 
                such laws do not directly conflict with the provisions 
                of this title.
                    (J) Provisions of laws that address public records, 
                criminal justice information systems, arrest records, 
                mug shots, conviction records, or non-conviction 
                records.
                    (K) Provisions of laws that address banking 
                records, financial records, tax records, Social 
                Security numbers, credit cards, identity theft, credit 
                reporting and investigations, credit repair, credit 
                clinics, or check-cashing services.
                    (L) Provisions of laws that address electronic 
                surveillance, wiretapping, or telephone monitoring.
                    (M) Provisions of laws that address unsolicited 
                email messages, telephone solicitation, or caller 
                identification.
                    (N) Provisions of laws that protect the privacy of 
                health information, healthcare information, medical 
                information, medical records, HIV status, or HIV 
                testing.
                    (O) Provisions of laws that address the 
                confidentiality of library records.
                    (P) Provisions of laws that address the use of 
                encryption as a means of providing data security.
            (4) Additional preemption limitations.--Notwithstanding 
        paragraph (2), the provisions of this title shall preempt any 
        State law, rule, or regulation that provides protections for 
        children or teens only to the extent that such State law, rule, 
        or regulation conflicts with a provision of this title. Nothing 
        in this title shall be construed to prohibit any State from 
        enacting a law, rule, or regulation that provides greater 
        protection to children or teens than the provisions of this 
        title.
    (b) Federal Law Preservation.--
            (1) In general.--Nothing in this title or a regulation 
        promulgated under this title may be construed to limit--
                    (A) the authority of the Commission, or any other 
                Executive agency, under any other provision of law;
                    (B) any requirement for a common carrier subject to 
                section 64.2011 of title 47, Code of Federal 
                Regulations (or any successor regulation), regarding 
                information security breaches; or
                    (C) any other provision of Federal law, except as 
                otherwise provided in this title.
            (2) Antitrust savings clause.--
                    (A) Antitrust laws defined.--For purposes of this 
                paragraph, the term ``antitrust laws''--
                            (i) has the meaning given such term in 
                        subsection (a) of the first section of the 
                        Clayton Act (15 U.S.C. 12(a)); and
                            (ii) includes section 5 of the Federal 
                        Trade Commission Act (15 U.S.C. 45), to the 
                        extent such section applies to unfair methods 
                        of competition.
                    (B) Full application of the antitrust laws.--
                Nothing in this title or a regulation promulgated under 
                this title may be construed to modify, impair, 
                supersede the operation of, or preclude the application 
                of the antitrust laws.
            (3) Application of other federal privacy and data security 
        requirements.--
                    (A) In general.--To the extent that a covered 
                entity or service provider is required to comply with 
                any Federal law or regulation described in subparagraph 
                (B), such covered entity or service provider is not 
                subject to this title with respect to the activities 
                governed by the requirements of such law or regulation.
                    (B) Laws and regulations described.--The Federal 
                laws and regulations described in this subparagraph are 
                the following:
                            (i) Title V of the Gramm-Leach-Bliley Act 
                        (15 U.S.C. 6801 et seq.).
                            (ii) Part C of title XI of the Social 
                        Security Act (42 U.S.C. 1320d et seq.).
                            (iii) Subtitle D of the Health Information 
                        Technology for Economic and Clinical Health Act 
                        (42 U.S.C. 17921 et seq.).
                            (iv) The regulations promulgated pursuant 
                        to section 264(c) of the Health Insurance 
                        Portability and Accountability Act of 1996 (42 
                        U.S.C. 1320d-2 note).
                            (v) The requirements regarding the 
                        confidentiality of substance use disorder 
                        information under section 543 of the Public 
                        Health Service Act (42 U.S.C. 290dd-2) or any 
                        regulation promulgated under such section.
                            (vi) The Fair Credit Reporting Act (15 
                        U.S.C. 1681 et seq.).
                            (vii) Section 444 of the General Education 
                        Provisions Act (commonly known as the ``Family 
                        Educational Rights and Privacy Act of 1974'') 
                        (20 U.S.C. 1232g) and part 99 of title 34, Code 
                        of Federal Regulations (or any successor 
                        regulation), to the extent a covered entity or 
                        service provider is an educational agency or 
                        institution (as defined in such section or 
                        section 99.3 of title 34, Code of Federal 
                        Regulations (or any successor regulation)).
                            (viii) The regulations related to the 
                        protection of human subjects under part 46 of 
                        title 45, Code of Federal Regulations.
                            (x) The Health Care Quality Improvement Act 
                        of 1986 (42 U.S.C. 11101 et seq.).
                            (xi) Part C of title IX of the Public 
                        Health Service Act (42 U.S.C. 299b-21 et seq.).
                            (xii) Chapter 123 of title 18, United 
                        States Code.
                    (C) Implementation guidance.--Not later than 1 year 
                after the date of the enactment of this Act, the 
                Commission shall issue guidance with respect to the 
                implementation of this paragraph.
    (c) Preservation of Common Law or Statutory Causes of Action for 
Civil Relief.--Nothing in this title, nor any amendment, standard, 
rule, requirement, assessment, or regulation promulgated under this 
title, may be construed to preempt, displace, or supplant any Federal 
or State common law rights or remedies, or any State statute creating a 
remedy for civil relief, including any cause of action for personal 
injury, wrongful death, property damage, or other financial, physical, 
reputational, or psychological injury based in negligence, strict 
liability, products liability, failure to warn, an objectively 
offensive intrusion into the private affairs or concerns of an 
individual, or any other legal theory of liability under any Federal or 
State common law, or any State statutory law, except that the fact of a 
violation of this title or a regulation promulgated under this title 
may not be pleaded as an element of any violation of such law.
    (d) Nonapplication of Certain Provisions of Communications Act of 
1934 and Telecommunications Act of 1996 Related to FCC Privacy and Data 
Security Laws and Regulations.--
            (1) In general.--Except as provided in paragraph (2), 
        sections 201, 202, 222, 338(i), and 631 of the Communications 
        Act of 1934 (47 U.S.C. 201; 202; 222; 338(i); 551) and section 
        706 of the Telecommunications Act of 1996 (47 U.S.C. 1302), and 
        any regulation or order issued by the Federal Communications 
        Commission under any such section, do not apply to any covered 
        entity or service provider with respect to the collection, 
        processing, retention, transfer, or security of covered data 
        (or the equivalent of such data), to the extent that such 
        sections or any regulation or order issued under such sections 
        would otherwise cover the collection, processing, retention, 
        transfer, or security of covered data (or the equivalent of 
        such data) in order to protect consumer privacy or the security 
        of such data, and a covered entity or service provider shall 
        instead be covered by the requirements of this title with 
        respect to the collection, processing, retention, transfer, and 
        security of covered data.
            (2) Exceptions.--Paragraph (1) does not supersede any 
        authority of the Federal Communications Commission with respect 
        to the following:
                    (A) Emergency services (as defined in section 7 of 
                the Wireless Communications and Public Safety Act of 
                1999 (47 U.S.C. 615b)).
                    (B) Proceedings to implement section 227 of the 
                Communications Act of 1934 (47 U.S.C. 227) or the 
                Pallone-Thune Telephone Robocall Abuse Criminal 
                Enforcement and Deterrence Act (Public Law 116-105; 133 
                Stat. 3274), or any other authority used by the Federal 
                Communications Commission to prevent or reduce unwanted 
                telephone calls or text messages.
                    (C) An enforcement action alleging or finding a 
                violation of a section of the Communications Act of 
                1934 specified in paragraph (1), if such action was 
                adopted by the Federal Communications Commission prior 
                to the date of the enactment of this Act.
                    (D) Subsection (a) of section 222 of the 
                Communications Act of 1934 (47 U.S.C. 222), to the 
                extent such subsection imposes a duty on every 
                telecommunications carrier to protect the 
                confidentiality of proprietary information of, and 
                relating to, other telecommunications carriers and 
                equipment manufacturers.
                    (E) Subsections (b), (d), and (g) of section 222 of 
                the Communications Act of 1934 (47 U.S.C. 222).
                    (F) Any obligation of an international treaty 
                related to the exchange of traffic implemented and 
                enforced by the Federal Communications Commission.

SEC. 119. CHILDREN'S ONLINE PRIVACY PROTECTION ACT OF 1998.

    Nothing in this title may be construed to relieve or change any 
obligation that a covered entity or other person may have under the 
Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6501 et 
seq.).

SEC. 120. DATA PROTECTIONS FOR COVERED MINORS.

    (a) Prohibition on Targeted and First-Party Advertising to Covered 
Minors.--A covered entity or service provider acting on behalf of a 
covered entity may not engage in targeted advertising or first-party 
advertising to an individual if the covered entity has knowledge that 
the individual is a covered minor, except that a covered entity or 
service provider may present or display to a covered minor age-
appropriate advertisements intended for an audience of covered minors, 
if the covered entity or service provider does not use any covered data 
in relation to such advertisements, other than data relating to the 
status of the individual as a covered minor.
    (b) Data Transfer Requirements Related to Covered Minors.--
            (1) In general.--Except as provided in paragraph (2), and 
        notwithstanding section 102(b), a covered entity or a service 
        provider acting on behalf of a covered entity may not transfer 
        or direct a service provider to transfer the covered data of an 
        individual to a third party if the covered entity--
                    (A) has knowledge that the individual is a covered 
                minor; and
                    (B) has not obtained affirmative express consent, 
                unless the transfer is necessary, proportionate, and 
                limited to a purpose expressly permitted by paragraph 
                (2), (3), (4), (8), (9), (11), (12), or (13) of section 
                102(d).
            (2) Exception.--A covered entity or service provider may 
        collect, process, retain, or transfer covered data of an 
        individual that the covered entity or service provider knows is 
        a covered minor in order to submit information relating to 
        child victimization to law enforcement or to the nonprofit, 
        national resource center and clearinghouse congressionally 
        designated to provide assistance to victims, families, child-
        serving professionals, and the general public on missing and 
        exploited children issues.
    (c) Rulemaking.--The Commission may conduct a rulemaking pursuant 
to section 553 of title 5, United States Code, to establish processes 
for parents and teens to exercise the rights provided in this title 
with respect to covered entities and data brokers. Any such rulemaking 
shall take into account--
            (1) the specific needs of parents, children, and teens;
            (2) how best to harmonize the processes provided for under 
        this title with the processes and guidance provided for under 
        the Children's Online Privacy Protection Act of 1998 (15 U.S.C. 
        6501 et seq.), as amended by title II of this Act, and any 
        regulations promulgated by the Commission thereunder; and
            (3) options for reducing undue burdens on parents, 
        children, teens, covered entities, and data brokers.

SEC. 121. TERMINATION OF FTC RULEMAKING ON COMMERCIAL SURVEILLANCE AND 
              DATA SECURITY.

    Beginning on the date of the enactment of this Act, the rulemaking 
proposed in the advance notice of proposed rulemaking titled ``Trade 
Regulation Rule on Commercial Surveillance and Data Security'' and 
published on August 22, 2022 (87 Fed. Reg. 51273) shall be terminated.

SEC. 122. SEVERABILITY.

    If any provision of this title, or the application thereof to any 
person or circumstance, is held invalid, the remainder of this title, 
and the application of such provision to other persons not similarly 
situated or to other circumstances, may not be affected by the 
invalidation.

SEC. 123. INNOVATION RULEMAKINGS.

    The Commission may conduct a rulemaking pursuant to section 553 of 
title 5, United States Code--
            (1) to include other covered data in the definition of the 
        term ``sensitive covered data'', except that the Commission may 
        not expand the category of information described in section 
        101(49)(A)(ii); and
            (2) to include in the list of permitted purposes in section 
        102(d) other permitted purposes for collecting, processing, 
        retaining, or transferring covered data.

SEC. 124. EFFECTIVE DATE.

    Unless otherwise specified in this title, this title shall take 
effect on the date that is 180 days after the date of the enactment of 
this Act.

         TITLE II--CHILDREN'S ONLINE PRIVACY PROTECTION ACT 2.0

SEC. 201. SHORT TITLE.

    This title may be cited as the ``Children's Online Privacy 
Protection Act 2.0''.

SEC. 202. ONLINE COLLECTION, USE, DISCLOSURE, AND DELETION OF PERSONAL 
              INFORMATION OF CHILDREN.

    (a) Definitions.--Section 1302 of the Children's Online Privacy 
Protection Act of 1998 (15 U.S.C. 6501) is amended--
            (1) by amending paragraph (2) to read as follows:
            ``(2) Operator.--The term `operator'--
                    ``(A) means any person--
                            ``(i) who, for commercial purposes, in 
                        interstate or foreign commerce, operates or 
                        provides a website on the internet, an online 
                        service, an online application, or a mobile 
                        application; and
                            ``(ii) who--
                                    ``(I) collects or maintains, either 
                                directly or through a service provider, 
                                personal information from or about the 
                                users of that website, service, or 
                                application;
                                    ``(II) allows another person to 
                                collect personal information directly 
                                from users of that website, service, or 
                                application (in which case, the 
                                operator is deemed to have collected 
                                the information); or
                                    ``(III) allows users of that 
                                website, service, or application to 
                                publicly disclose personal information 
                                (in which case, the operator is deemed 
                                to have collected the information); and
                    ``(B) does not include any nonprofit entity that 
                would otherwise be exempt from coverage under section 5 
                of the Federal Trade Commission Act (15 U.S.C. 45).'';
            (2) in paragraph (4)--
                    (A) by amending subparagraph (A) to read as 
                follows:
                    ``(A) the release of personal information collected 
                from a child by an operator for any purpose, except 
                where the personal information is provided to a person 
                other than an operator who--
                            ``(i) provides support for the internal 
                        operations of a website, online service, online 
                        application, or mobile application (as defined 
                        in paragraph (8)(C)) of the operator, excluding 
                        any activity relating to targeted advertising 
                        or first-party advertising (as such terms are 
                        defined in section 101 of the American Privacy 
                        Rights Act of 2024) to children; and
                            ``(ii) does not disclose or use that 
                        personal information for any other purpose; 
                        and''; and
                    (B) in subparagraph (B)--
                            (i) by striking ``website or online 
                        service'' and inserting ``website, online 
                        service, online application, or mobile 
                        application''; and
                            (ii) by striking ``actual knowledge'' and 
                        inserting ``actual knowledge or knowledge 
                        fairly implied on the basis of objective 
                        circumstances'';
            (3) by striking paragraph (8) and inserting the following:
            ``(8) Personal information.--
                    ``(A) In general.--The term `personal information' 
                means individually identifiable information about an 
                individual collected online, including--
                            ``(i) a first and last name;
                            ``(ii) a home or other physical address 
                        including street name and name of a city or 
                        town;
                            ``(iii) an e-mail address;
                            ``(iv) a telephone number;
                            ``(v) a Social Security number;
                            ``(vi) any other identifier that the 
                        Commission determines permits the physical or 
                        online contacting of a specific individual;
                            ``(vii) a persistent identifier that can be 
                        used to recognize a specific child over time 
                        and across different websites, online services, 
                        online applications, or mobile applications, 
                        including a customer number held in a cookie, 
                        an Internet Protocol (IP) address, a processor 
                        or device serial number, or a unique device 
                        identifier, but excluding an identifier that is 
                        used by an operator solely for providing 
                        support for the internal operations of a 
                        website, online service, online application, or 
                        mobile application;
                            ``(viii) a photograph, video, or audio 
                        file, if such file contains the image or voice 
                        of a specific child;
                            ``(ix) geolocation information;
                            ``(x) information generated from the 
                        measurement or technological processing of the 
                        biological, physical, or physiological 
                        characteristics of an individual that is used 
                        to identify an individual, including--
                                    ``(I) fingerprints;
                                    ``(II) voice prints;
                                    ``(III) iris or retina imagery 
                                scans;
                                    ``(IV) facial templates;
                                    ``(V) deoxyribonucleic acid (DNA) 
                                information; or
                                    ``(VI) gait; or
                            ``(xi) information linked or reasonably 
                        linkable to a child or the parents of that 
                        child (including any unique identifier) that an 
                        operator collects online from the child and 
                        combines with an identifier described in this 
                        subparagraph.
                    ``(B) Exclusion.--The term `personal information' 
                does not include an audio file that contains the voice 
                of a child, if the operator--
                            ``(i) does not request information via 
                        voice that would otherwise be considered 
                        personal information under this paragraph;
                            ``(ii) provides, in the privacy policy of 
                        the operator, clear notice of the collection 
                        and use of the audio file by the operator and 
                        the deletion policy of the operator;
                            ``(iii) uses the voice within the audio 
                        file solely as a replacement for written words, 
                        to perform a task, or to engage with a website, 
                        online service, online application, or mobile 
                        application, such as to perform a search or 
                        fulfill a verbal instruction or request; and
                            ``(iv) only maintains the audio file long 
                        enough to complete the stated purpose and then 
                        immediately deletes the audio file and does not 
                        make any other use of the audio file prior to 
                        deletion.
                    ``(C) Support for the internal operations of a 
                website, online service, online application, or mobile 
                application.--
                            ``(i) In general.--For purposes of 
                        subparagraph (A)(vii), the term `support for 
                        the internal operations of a website, online 
                        service, online application, or mobile 
                        application' means those activities necessary 
                        to--
                                    ``(I) maintain or analyze the 
                                functioning of the website, online 
                                service, online application, or mobile 
                                application;
                                    ``(II) perform network 
                                communications;
                                    ``(III) authenticate users of, or 
                                personalize the content on, the 
                                website, online service, online 
                                application, or mobile application;
                                    ``(IV) cap the frequency of 
                                advertising;
                                    ``(V) protect the security or 
                                integrity of the user, website, online 
                                service, online application, or mobile 
                                application;
                                    ``(VI) ensure legal or regulatory 
                                compliance; or
                                    ``(VII) fulfill a request of a 
                                child as permitted by subparagraphs (A) 
                                through (C) of section 1303(b)(2).
                            ``(ii) Condition.--Except as specifically 
                        permitted under clause (i), information 
                        collected for the activities listed in clause 
                        (i) may not be used or disclosed to contact a 
                        specific individual, including through targeted 
                        advertising or first-party advertising (as such 
                        terms are defined in section 101 of the 
                        American Privacy Rights Act of 2024) to 
                        children, to amass a profile on a specific 
                        individual, in connection with processes that 
                        encourage or prompt use of a website, online 
                        service, online application, or mobile 
                        application, or for any other purpose.'';
            (4) by amending paragraph (9) to read as follows:
            ``(9) Verifiable consent.--The term `verifiable consent' 
        means any reasonable effort (taking into consideration 
        available technology), including a request for authorization 
        for future collection, use, and disclosure described in the 
        notice, to ensure that a parent of the child--
                    ``(A) receives direct notice of the personal 
                information collection, use, and disclosure practices 
                of the operator; and
                    ``(B) before the personal information of the child 
                is collected, freely and unambiguously authorizes--
                            ``(i) the collection, use, and disclosure, 
                        as applicable, of that personal information; 
                        and
                            ``(ii) any subsequent use of that personal 
                        information.'';
            (5) in paragraph (10)--
                    (A) in the paragraph heading, by striking ``Website 
                or online service directed to children'' and inserting 
                ``Website, online service, online application, or 
                mobile application directed to children'';
                    (B) by striking ``website or online service'' each 
                place it appears and inserting ``website, online 
                service, online application, or mobile application''; 
                and
                    (C) by adding at the end the following new 
                subparagraph:
                    ``(C) Rule of construction.--In considering whether 
                a website, online service, online application, or 
                mobile application, or portion thereof, is directed to 
                children, the Commission shall apply a totality of 
                circumstances test and shall also consider competent 
                and reliable empirical evidence regarding audience 
                composition and evidence regarding the intended 
                audience of the website, online service, online 
                application, or mobile application.''; and
            (6) by adding at the end the following:
            ``(13) Connected device.--The term `connected device' has 
        the meaning given such term in section 101 of the American 
        Privacy Rights Act of 2024.
            ``(14) Educational agency or institution.--The term 
        `educational agency or institution' means a State educational 
        agency or local educational agency as defined under Federal 
        law, as well as an institutional day or residential school, 
        including a public school, charter school, or private school, 
        that provides elementary or secondary education, as determined 
        under State law.
            ``(15) Mobile application.--The term `mobile application' 
        has the meaning given such term in section 101 of the American 
        Privacy Rights Act of 2024.
            ``(16) Online application.--The term `online application' 
        has the meaning given such term in section 101 of the American 
        Privacy Rights Act of 2024.
            ``(17) Precise geolocation information.--The term `precise 
        geolocation information' has the meaning given such term in 
        section 101 of the American Privacy Rights Act of 2024.''.
    (b) Online Collection, Use, Disclosure, and Deletion of Personal 
Information of Children.--Section 1303 of the Children's Online Privacy 
Protection Act of 1998 (15 U.S.C. 6502) is amended--
            (1) by striking the heading and inserting the following: 
        ``online collection, use, disclosure, and deletion of personal 
        information of children.'';
            (2) by amending subsection (a) to read as follows:
    ``(a) Acts Prohibited.--It is unlawful for an operator of a 
website, online service, online application, or mobile application 
directed to children or for any operator of a website, online service, 
online application, or mobile application with actual knowledge or 
knowledge fairly implied on the basis of objective circumstances that a 
user is a child--
            ``(1) to collect personal information from a child in a 
        manner that violates the American Privacy Rights Act of 2024 or 
        the regulations prescribed under subsection (b); or
            ``(2) to store or transfer the personal information of a 
        child outside of the United States, unless--
                    ``(A) the operator provides direct notice to the 
                parent of the child that the personal information of 
                the child is being stored or transferred outside of the 
                United States; and
                    ``(B) with respect to transfer, the operator meets 
                the requirements of section 102(b) of the American 
                Privacy Rights Act of 2024.'';
            (3) in subsection (b)--
                    (A) in paragraph (1)--
                            (i) in subparagraph (A)--
                                    (I) in the matter preceding clause 
                                (i), by striking ``operator of any 
                                website'' and all that follows through 
                                ``from a child'' and inserting 
                                ``operator of a website, online 
                                service, online application, or mobile 
                                application directed to children or 
                                that has actual knowledge or knowledge 
                                fairly implied on the basis of 
                                objective circumstances that a user is 
                                a child'';
                                    (II) in clause (i)--
                                            (aa) by striking ``notice 
                                        on the website'' and inserting 
                                        ``clear and conspicuous notice 
                                        on the website, service, or 
                                        application''; and
                                            (bb) by striking ``; and'' 
                                        and inserting a semicolon;
                                    (III) in clause (ii)--
                                            (aa) by striking 
                                        ``verifiable parental consent'' 
                                        and inserting ``verifiable 
                                        consent''; and
                                            (bb) by striking the 
                                        semicolon at the end and 
                                        inserting ``; and''; and
                                    (IV) by inserting after clause (ii) 
                                the following new clause:
                            ``(iii) to obtain verifiable consent from a 
                        parent of a child before using or disclosing 
                        personal information of the child for any 
                        purpose that is a material change from the 
                        original purposes and disclosure practices 
                        specified to the parent of the child under 
                        clause (i);'';
                            (ii) by striking subparagraph (B);
                            (iii) in subparagraph (C)--
                                    (I) by striking ``reasonably''; and
                                    (II) by inserting ``, 
                                proportionate, and limited'' after 
                                ``necessary'';
                            (iv) in subparagraph (D), by striking 
                        ``website or online service'' and inserting 
                        ``website, online service, online application, 
                        or mobile application''; and
                            (v) by redesignating subparagraphs (C) and 
                        (D) as subparagraphs (B) and (C), respectively;
                    (B) in paragraph (2)--
                            (i) in the matter preceding subparagraph 
                        (A)--
                                    (I) by striking ``verifiable 
                                parental consent'' and inserting 
                                ``verifiable consent''; and
                                    (II) by striking ``paragraph 
                                (1)(A)(ii)'' and inserting ``clause 
                                (ii) or (iii) of paragraph (1)(A)'';
                            (ii) in subparagraph (A), by inserting ``or 
                        to contact another child'' after ``to recontact 
                        the child'';
                            (iii) in subparagraph (B)--
                                    (I) by striking ``or child''; and
                                    (II) by striking ``parental 
                                consent'' each place the term appears 
                                and inserting ``verifiable consent'';
                            (iv) in subparagraph (D), in the matter 
                        preceding clause (i)--
                                    (I) by striking ``reasonably''; and
                                    (II) by inserting ``, 
                                proportionate, and limited'' after 
                                ``necessary''; and
                            (v) in subparagraph (E)--
                                    (I) in the matter preceding clause 
                                (i), by striking ``website or online 
                                service'' and inserting ``website, 
                                online service, online application, or 
                                mobile application''; and
                                    (II) in clause (i), by striking 
                                ``website'' and inserting ``website, 
                                service, or application'';
                    (C) by redesignating paragraph (3) as paragraph (4) 
                and inserting after paragraph (2) the following new 
                paragraph:
            ``(3) Application to operators acting under agreements with 
        educational agencies or institutions.--The regulations may 
        provide that verifiable consent under clause (ii) or (iii) of 
        paragraph (1)(A) is not required for an operator that is acting 
        under a written agreement with an educational agency or 
        institution that, at a minimum, requires--
                    ``(A) the operator to--
                            ``(i) limit its collection, use, and 
                        disclosure of the personal information from a 
                        child to solely educational purposes and for no 
                        other commercial purposes;
                            ``(ii) provide the educational agency or 
                        institution with a notice of the specific types 
                        of personal information the operator will 
                        collect from the child, the method by which the 
                        operator will obtain the personal information, 
                        and the purposes for which the operator will 
                        collect, use, disclose, and retain the personal 
                        information;
                            ``(iii) provide the educational agency or 
                        institution with a link to the online notice of 
                        information practices of the operator as 
                        required under paragraph (1)(A)(i); and
                            ``(iv) provide the educational agency or 
                        institution, upon request, with a means to 
                        review the personal information collected from 
                        a child, to prevent further use or maintenance 
                        or future collection of personal information 
                        from a child, and to delete personal 
                        information collected from a child or content 
                        or information submitted by a child to the 
                        website, online service, online application, or 
                        mobile application of the operator;
                    ``(B) a representative of the educational agency or 
                institution to--
                            ``(i) acknowledge and agree that the 
                        representative has authority to authorize the 
                        collection, use, and disclosure of personal 
                        information from children on behalf of the 
                        educational agency or institution; and
                            ``(ii) provide the name of the 
                        representative and the title of the 
                        representative at the educational agency or 
                        institution; and
                    ``(C) the educational agency or institution to--
                            ``(i) provide on the website of the 
                        educational agency or institution a notice that 
                        identifies the operator with which the 
                        educational agency or institution has entered 
                        into a written agreement under this paragraph 
                        and a link to the online notice of information 
                        practices of the operator as required under 
                        paragraph (1)(A)(i);
                            ``(ii) provide the notice of the operator 
                        regarding the information practices of the 
                        operator, as required under subparagraph 
                        (A)(ii), upon request, to a parent; and
                            ``(iii) upon the request of a parent, 
                        request the operator provide a means to review 
                        the personal information collected from the 
                        child of the parent and provide the parent a 
                        means to review the personal information.'';
                    (D) by amending paragraph (4), as so redesignated, 
                to read as follows:
            ``(4) Termination of service.--The regulations shall permit 
        the operator of a website, online service, online application, 
        or mobile application to terminate service provided to a child 
        whose parent has requested to delete covered data of the child 
        pursuant to section 105 of the American Privacy Rights Act of 
        2024.''; and
                    (E) by adding at the end the following new 
                paragraphs:
            ``(5) Continuation of service.--The regulations shall 
        prohibit an operator from discontinuing service provided to a 
        child on the basis of a request by the parent of the child to 
        delete personal information collected from the child, to the 
        extent that the operator is capable of providing such service 
        without such information.
            ``(6) Common verifiable consent mechanism.--
                    ``(A) In general.--
                            ``(i) Feasibility of mechanism.--The 
                        Commission shall conduct an assessment, with 
                        notice and public comment, of the feasibility 
                        of allowing operators the option to use a 
                        common verifiable consent mechanism that fully 
                        meets the requirements of this title.
                            ``(ii) Requirements.--The feasibility 
                        assessment described in clause (i) shall 
                        consider whether a single operator could use a 
                        common verifiable consent mechanism to obtain 
                        verifiable consent, as required under this 
                        title, from a parent of a child on behalf of 
                        multiple, listed operators that provide a joint 
                        or related service.
                    ``(B) Report.--Not later than 1 year after the date 
                of the enactment of this paragraph, the Commission 
                shall submit to the Committee on Commerce, Science, and 
                Transportation of the Senate and the Committee on 
                Energy and Commerce of the House of Representatives a 
                report with the findings of the assessment required by 
                subparagraph (A).
                    ``(C) Regulations.--If the Commission finds, in the 
                assessment required by subparagraph (A), that the use 
                of a common verifiable consent mechanism is feasible 
                and would meet the requirements of this title, the 
                Commission shall issue regulations, pursuant to section 
                553 of title 5, United States Code, to permit the use 
                of a common verifiable consent mechanism in accordance 
                with the findings outlined in the report submitted 
                under subparagraph (B).'';
            (4) in subsection (c), by striking ``a regulation 
        prescribed under subsection (a)'' and inserting ``paragraph (2) 
        of subsection (a), or of a regulation prescribed under 
        subsection (b),''; and
            (5) by striking subsection (d) and inserting the following:
    ``(d) Relationship to State Law.--The provisions of this title 
shall preempt any State law, rule, or regulation only to the extent 
that such State law, rule, or regulation conflicts with a provision of 
this title. Nothing in this title may be construed to prohibit any 
State from enacting a law, rule, or regulation that provides greater 
protection to children than the provisions of this title.''.
    (c) Safe Harbors.--Section 1304 of the Children's Online Privacy 
Protection Act of 1998 (15 U.S.C. 6503) is amended by adding at the end 
the following:
    ``(d) Publication.--
            ``(1) In general.--Subject to the restrictions described in 
        paragraph (2), the Commission shall publish on the website of 
        the Commission any report or documentation required by 
        regulation to be submitted to the Commission to carry out this 
        section.
            ``(2) Restrictions on publication.--The restrictions 
        described in sections 6(f) and 21 of the Federal Trade 
        Commission Act (15 U.S.C. 46(f); 57b-2) applicable to the 
        disclosure of information obtained by the Commission shall 
        apply in the same manner to the disclosure under this 
        subsection of information obtained by the Commission from a 
        report or documentation described in paragraph (1).''.
    (d) Actions by States.--Section 1305 of the Children's Online 
Privacy Protection Act of 1998 (15 U.S.C. 6504) is amended--
            (1) in subsection (a)(1)--
                    (A) in the matter preceding subparagraph (A), by 
                inserting ``section 1303(a) or'' before ``any 
                regulation''; and
                    (B) in subparagraph (B), by striking ``the 
                regulation'' and inserting ``such section or 
                regulation''; and
            (2) in subsection (d)--
                    (A) by inserting ``section 1303(a) or'' before 
                ``any regulation''; and
                    (B) by striking ``that regulation'' and inserting 
                ``such section or regulation''.
    (e) Administration and Applicability of Act.--Section 1306 of the 
Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6505) is 
amended--
            (1) in subsection (d)--
                    (A) by inserting ``section 1303(a) or'' before ``a 
                rule''; and
                    (B) by striking ``such rule'' and inserting 
                ``section 1303(a) or a rule of the Commission under 
                section 1303''; and
            (2) by adding at the end the following new subsections:
    ``(f) Determination of Whether an Operator Has Knowledge Fairly 
Implied on the Basis of Objective Circumstances.--
            ``(1) Rule of construction.--For purposes of enforcing this 
        title or a regulation promulgated under this title, in making a 
        determination as to whether an operator has knowledge fairly 
        implied on the basis of objective circumstances that a specific 
        user is a child, the Commission or a State attorney general 
        shall rely on competent and reliable evidence, taking into 
        account the totality of the circumstances, including whether a 
        reasonable and prudent person under the circumstances would 
        have known that the user is a child. Nothing in this title, 
        including a determination described in the preceding sentence, 
        may be construed to require an operator to--
                    ``(A) affirmatively collect any personal 
                information with respect to the age of a child that an 
                operator is not already collecting in the normal course 
                of business; or
                    ``(B) implement an age gating or age verification 
                functionality.
            ``(2) Commission guidance.--
                    ``(A) In general.--Not later than 180 days after 
                the date of the enactment of this subsection, the 
                Commission shall issue guidance to provide information, 
                including best practices and examples, for operators to 
                understand the process of the Commission for 
                determining whether an operator has knowledge fairly 
                implied on the basis of objective circumstances that a 
                user is a child.
                    ``(B) Limitation.--No guidance issued by the 
                Commission under subparagraph (A) confers any rights on 
                any person, State, or locality, or operates to bind the 
                Commission or any person, State, or locality to the 
                approach recommended in such guidance. In any 
                enforcement action brought pursuant to this title, the 
                Commission or State attorney general, as applicable, 
                shall allege a specific violation of a provision of 
                this title, and the Commission or State attorney 
                general, as applicable, may not base an enforcement 
                action on, or execute a consent order based on, 
                practices that are alleged to be inconsistent with any 
                such guidance, unless the practices allegedly violate 
                this title.
    ``(g) Additional Requirement.--Any regulations issued under this 
title shall include a description and analysis of the impact of 
proposed and final rules on small entities per chapter 6 of title 5, 
United States Code.''.

SEC. 203. STUDY AND REPORTS ON MOBILE AND ONLINE APPLICATION OVERSIGHT 
              AND ENFORCEMENT.

    (a) Oversight Report.--Not later than 3 years after the date of the 
enactment of this Act, the Federal Trade Commission shall submit to the 
Committee on Commerce, Science, and Transportation of the Senate and 
the Committee on Energy and Commerce of the House of Representatives a 
report on the processes of platforms that offer mobile and online 
applications for ensuring that, for those applications that are 
websites, online services, online applications, or mobile applications 
directed to children, the applications operate in accordance with--
            (1) this title, the amendments made by this title, and any 
        rules promulgated under this title or the amendments made by 
        this title; and
            (2) rules promulgated by the Commission under section 18 of 
        the Federal Trade Commission Act (15 U.S.C. 57a) relating to 
        unfair or deceptive acts or practices in marketing.
    (b) Enforcement Report.--Not later than 1 year after the date of 
the enactment of this Act, and annually thereafter, the Federal Trade 
Commission shall submit to the Committee on Commerce, Science, and 
Transportation of the Senate and the Committee on Energy and Commerce 
of the House of Representatives a report that addresses, at a minimum--
            (1) the number of actions brought by the Commission during 
        the reporting year to enforce the Children's Online Privacy 
        Protection Act of 1998 (15 U.S.C. 6501 et seq.) and the outcome 
        of each such action;
            (2) the total number of investigations or inquiries into 
        potential violations of such Act commenced during the reporting 
        year;
            (3) the total number of open investigations or inquiries 
        into potential violations of such Act as of the time the report 
        is submitted;
            (4) the number and nature of complaints received by the 
        Commission relating to an allegation of a violation of such Act 
        during the reporting year; and
            (5) policy or legislative recommendations to strengthen 
        online protections for children.
    (c) Report by the Inspector General.--
            (1) In general.--Not later than 2 years after the date of 
        the enactment of this Act, the Inspector General of the Federal 
        Trade Commission shall submit to the Federal Trade Commission 
        and to the Committee on Commerce, Science, and Transportation 
        of the Senate and the Committee on Energy and Commerce of the 
        House of Representatives a report regarding the safe harbor 
        provisions in section 1304 of the Children's Online Privacy 
        Protection Act of 1998 (15 U.S.C. 6503), which shall include--
                    (A) an analysis of whether the safe harbor 
                provisions are--
                            (i) operating fairly and effectively; and
                            (ii) effectively protecting the interests 
                        of children; and
                    (B) any proposal or recommendation for policy 
                changes that would improve the effectiveness of the 
                safe harbor provisions.
            (2) Publication.--Not later than 10 days after the date on 
        which a report is submitted under paragraph (1), the Commission 
        shall publish the report on the website of the Commission.

SEC. 204. SEVERABILITY.

    If any provision of this title or the amendments made by this 
title, or the application thereof to any person or circumstance, is 
held invalid, the remainder of this title and the amendments made by 
this title, and the application of such provision to other persons not 
similarly situated or to other circumstances, may not be affected by 
the invalidation.
                                 <all>
```