```

[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 1409 Introduced in Senate (IS)]

<DOC>

118th CONGRESS
  1st Session
                                S. 1409

           To protect the safety of children on the internet.

_______________________________________________________________________

                   IN THE SENATE OF THE UNITED STATES

                              May 2, 2023

 Mr. Blumenthal (for himself, Mrs. Blackburn, Mr. Lujan, Mrs. Capito, 
  Ms. Baldwin, Mr. Cassidy, Ms. Klobuchar, Ms. Ernst, Mr. Peters, Mr. 
  Daines, Mr. Hickenlooper, Mr. Rubio, Mr. Warner, Mr. Sullivan, Mr. 
Coons, Mr. Young, Mr. Schatz, Mr. Grassley, Mr. Murphy, Mr. Graham, Mr. 
   Welch, Mr. Marshall, Ms. Hassan, Mrs. Hyde-Smith, Mr. Durbin, Mr. 
Mullin, Mr. Casey, Mr. Risch, Mr. Whitehouse, Mrs. Britt, Mr. Scott of 
  Florida, Ms. Lummis, and Mr. Cornyn) introduced the following bill; 
    which was read twice and referred to the Committee on Commerce, 
                      Science, and Transportation

_______________________________________________________________________

                                 A BILL

 
           To protect the safety of children on the internet.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

    (a) Short Title.--This Act may be cited as the ``Kids Online Safety 
Act''.
    (b) Table of Contents.--The table of contents for this Act is as 
follows:

Sec. 1. Short title; table of contents.
Sec. 2. Definitions.
Sec. 3. Duty of care.
Sec. 4. Safeguards for minors.
Sec. 5. Disclosure.
Sec. 6. Transparency.
Sec. 7. Independent research.
Sec. 8. Market research.
Sec. 9. Age verification study and report.
Sec. 10. Guidance.
Sec. 11. Enforcement.
Sec. 12. Kids online safety council.
Sec. 13. Effective date.
Sec. 14. Rules of construction and other matters.
Sec. 15. Severability.

SEC. 2. DEFINITIONS.

    In this Act:
            (1) Child.--The term ``child'' means an individual who is 
        under the age of 13.
            (2) Compulsive usage.--The term ``compulsive usage'' means 
        any response stimulated by external factors that causes an 
        individual to engage in repetitive behavior reasonably likely 
        to cause psychological distress, loss of control, anxiety, 
        depression, or harmful stress responses.
            (3) Covered platform.--
                    (A) In general.--The term ``covered platform'' 
                means a social media service, social network, online 
                video game (including educational games), messaging 
                application, video streaming service, or an online 
                platform that connects to the internet and that is 
                used, or is reasonably likely to be used, by a minor.
                    (B) Exceptions.--The term ``covered platform'' does 
                not include--
                            (i) an entity acting in its capacity as a 
                        provider of--
                                    (I) a common carrier service 
                                subject to the Communications Act of 
                                1934 (47 U.S.C. 151 et seq.) and all 
                                Acts amendatory thereof and 
                                supplementary thereto;
                                    (II) a broadband internet access 
                                service (as such term is defined for 
                                purposes of section 8.1(b) of title 47, 
                                Code of Federal Regulations, or any 
                                successor regulation);
                                    (III) an email service; or
                                    (IV) a wireless messaging service 
                                provided through the short messaging 
                                service or multimedia messaging service 
                                protocols;
                            (ii) an organization not organized to carry 
                        on business for its own profit or that of its 
                        members;
                            (iii) any public or private preschool, 
                        elementary, or secondary school, or any 
                        institution of vocational, professional, or 
                        higher education; or
                            (iv) a product or service that primarily 
                        functions as business-to-business software.
            (4) Mental health disorder.--The term ``mental health 
        disorder'' has the meaning given the term ``mental disorder'' 
        in the Diagnostic and Statistical Manual of Mental Health 
        Disorders, 5th Edition (or the most current successor edition).
            (5) Minor.--The term ``minor'' means an individual who is 
        under the age of 17.
            (6) Online platform.--The term ``online platform'' means 
        any public-facing website, online service, online application, 
        or mobile application that predominantly provides a community 
        forum for user generated content, including sharing videos, 
        images, games, audio files, or other content.
            (7) Parent.--The term ``parent'' includes a legal guardian 
        or an individual with legal custody over a minor.
            (8) Personal data.--The term ``personal data'' means 
        information that identifies or is linked or reasonably linkable 
        to a particular minor, including a consumer device identifier 
        associated with a minor.
            (9) Personalized recommendation system.--The term 
        ``personalized recommendation system'' means a fully or 
        partially automated system used to suggest, promote, or rank 
        information based on the personal data of users.
            (10) Sexual exploitation and abuse.--The term ``sexual 
        exploitation and abuse'' means any of the following:
                    (A) Coercion and enticement, as described in 
                section 2422 of title 18, United States Code.
                    (B) Child sexual abuse material, as described in 
                sections 2251, 2252, 2252A, and 2260 of title 18, 
                United States Code.
                    (C) Trafficking for the production of images, as 
                described in section 2251A of title 18, United States 
                Code.
                    (D) Sex trafficking of children, as described in 
                section 1591 of title 18, United States Code.
            (11) Targeted advertising.--
                    (A) In general.--The term ``targeted advertising'' 
                means displaying an advertisement to an individual 
                where the advertisement is selected based on personal 
                data about the individual to predict the individual's 
                preferences and interests.
                    (B) Exclusions.--Such term does not include--
                            (i) advertising or marketing directed to an 
                        individual in response to the individual's 
                        request for information or express selection of 
                        a product or service;
                            (ii) contextual advertising where an 
                        advertisement is displayed to an individual 
                        based on the content in which the advertisement 
                        appears and does not vary based on who the 
                        individual is; or
                            (iii) processing personal data solely to 
                        measure or report advertising performance, 
                        reach, or frequency.

SEC. 3. DUTY OF CARE.

    (a) Prevention of Harm to Minors.--A covered platform shall act in 
the best interests of a user that the platform knows or reasonably 
should know is a minor by taking reasonable measures in its design and 
operation of products and services to prevent and mitigate the 
following:
            (1) Consistent with evidence-informed medical information, 
        the following mental health disorders: anxiety, depression, 
        eating disorders, substance use disorders, and suicidal 
        behaviors.
            (2) Patterns of use that indicate or encourage addiction-
        like behaviors.
            (3) Physical violence, online bullying, and harassment of 
        the minor.
            (4) Sexual exploitation and abuse.
            (5) Promotion and marketing of narcotic drugs (as defined 
        in section 102 of the Controlled Substances Act (21 U.S.C. 
        802)), tobacco products, gambling, or alcohol.
            (6) Predatory, unfair, or deceptive marketing practices, or 
        other financial harms.
    (b) Limitation.--Nothing in subsection (a) shall be construed to 
require a covered platform to prevent or preclude--
            (1) any minor from deliberately and independently searching 
        for, or specifically requesting, content; or
            (2) the covered platform or individuals on the platform 
        from providing resources for the prevention or mitigation of 
        suicidal behaviors, substance use, and other harms, including 
        evidence-informed information and clinical resources.

SEC. 4. SAFEGUARDS FOR MINORS.

    (a) Safeguards for Minors.--
            (1) Safeguards.--A covered platform shall provide an 
        individual that the covered platform knows or reasonably should 
        know is a minor with readily accessible and easy-to-use 
        safeguards to, as applicable--
                    (A) limit the ability of other individuals to 
                communicate with the minor;
                    (B) prevent other users, whether registered or not, 
                from viewing the minor's personal data collected by or 
                shared on the covered platform, in particular 
                restricting public access to personal data;
                    (C) limit features that increase, sustain, or 
                extend use of the covered platform by the minor, such 
                as automatic playing of media, rewards for time spent 
                on the platform, notifications, and other features that 
                result in compulsive usage of the covered platform by 
                the minor;
                    (D) control personalized recommendation systems, 
                including the right to--
                            (i) opt out of such personalized 
                        recommendation systems, while still allowing 
                        the display of content based on a chronological 
                        format; or
                            (ii) limit types or categories of 
                        recommendations from such systems; and
                    (E) restrict the sharing of the geolocation of the 
                minor and provide notice regarding the tracking of the 
                minor's geolocation.
            (2) Options.--A covered platform shall provide an 
        individual that the covered platform knows or reasonably should 
        know is a minor with readily accessible and easy-to-use options 
        to--
                    (A) delete the minor's account and delete any 
                personal data collected from, or shared by, the minor 
                on the covered platform; or
                    (B) limit the amount of time spent by the minor on 
                the covered platform.
            (3) Default safeguard settings for minors.--A covered 
        platform shall provide that, in the case of a user that the 
        platform knows or reasonably should know is a minor, the 
        default setting for any safeguard described under paragraph (1) 
        shall be the option available on the platform that provides the 
        most protective level of control that is offered by the 
        platform over privacy and safety for that user.
    (b) Parental Tools.--
            (1) Tools.--A covered platform shall provide readily 
        accessible and easy-to-use settings for parents to support an 
        individual that the platform knows or reasonably should know is 
        a minor with respect to the individual's use of the platform.
            (2) Requirements.--The parental tools provided by a covered 
        platform shall include--
                    (A) the ability to manage a minor's privacy and 
                account settings, including the safeguards and options 
                established under subsection (a), in a manner that 
                allows parents to--
                            (i) view the privacy and account settings; 
                        and
                            (ii) in the case of a user that the 
                        platform knows or reasonably should know is a 
                        child, change and control the privacy and 
                        account settings;
                    (B) the ability to restrict purchases and financial 
                transactions by the minor, where applicable; and
                    (C) the ability to view metrics of total time spent 
                on the platform.
            (3) Notice to minors.--A covered platform shall provide 
        clear and conspicuous notice to an individual that the platform 
        knows or reasonably should know is a minor when tools described 
        in this subsection are in effect and what settings or controls 
        have been applied.
            (4) Default tools.--A covered platform shall provide that, 
        in the case of a user that the platform knows or reasonably 
        should know is a child, the tools described in this subsection 
        shall be enabled by default.
    (c) Reporting Mechanism.--
            (1) Reports submitted by parents, minors, and schools.--A 
        covered platform shall provide--
                    (A) a readily accessible and easy-to-use means to 
                submit reports to the covered platform of harms to 
                minors;
                    (B) an electronic point of contact specific to 
                matters involving harms to a minor; and
                    (C) confirmation of the receipt of such a report 
                and a means to track a submitted report.
            (2) Timing.--A covered platform shall establish an internal 
        process to receive and substantively respond to reports in a 
        reasonable and timely manner, but in no case later than--
                    (A) 7 days after the receipt of a report, if, for 
                the most recent calendar year, the platform averaged 
                more than 10,000,000 active users on a monthly basis in 
                the United States;
                    (B) 21 days after the receipt of a report, if, for 
                the most recent calendar year, the platform averaged 
                less than 10,000,000 active users on a monthly basis in 
                the United States; and
                    (C) notwithstanding subparagraphs (A) and (B), if 
                the report involves an imminent threat to the safety of 
                a minor, as promptly as needed to address the reported 
                threat to safety.
    (d) Advertising of Illegal Products.--A covered platform shall not 
facilitate the advertising of narcotic drugs (as defined in section 102 
of the Controlled Substances Act (21 U.S.C. 802)), tobacco products, 
gambling, or alcohol to an individual that the covered platform knows 
or reasonably should know is a minor.
    (e) Application.--
            (1) Accessibility.--With respect to safeguards and parental 
        controls described under subsections (a) and (b), a covered 
        platform shall provide--
                    (A) information and control options in a clear and 
                conspicuous manner that takes into consideration the 
                differing ages, capacities, and developmental needs of 
                the minors most likely to access the covered platform 
                and does not encourage minors or parents to weaken or 
                disable safeguards or parental controls;
                    (B) readily accessible and easy-to-use controls to 
                enable or disable safeguards or parental controls, as 
                appropriate; and
                    (C) information and control options in the same 
                language, form, and manner as the covered platform 
                provides the product or service used by minors and 
                their parents.
            (2) Dark patterns prohibition.--It shall be unlawful for 
        any covered platform to design, modify, or manipulate a user 
        interface of a covered platform with the purpose or substantial 
        effect of subverting or impairing user autonomy, decision-
        making, or choice in order to weaken or disable safeguards or 
        parental controls required under this section.
            (3) Rules of construction.--Nothing in this section shall 
        be construed to--
                    (A) prevent a covered platform from taking 
                reasonable measures to--
                            (i) block, detect, or prevent the 
                        distribution of unlawful, obscene, or other 
                        harmful material to minors as described in 
                        section 3(a); or
                            (ii) block or filter spam, prevent criminal 
                        activity, or protect the security of a platform 
                        or service; or
                    (B) require the disclosure of a minor's browsing 
                behavior, search history, messages, contact list, or 
                other content or metadata of their communications.

SEC. 5. DISCLOSURE.

    (a) Notice.--
            (1) Registration.--Prior to registration or purchase of a 
        covered platform by an individual that the platform knows or 
        reasonably should know is a minor, the platform shall provide 
        clear, conspicuous, and easy-to-understand--
                    (A) notice of the policies and practices of the 
                covered platform with respect to personal data and 
                safeguards for minors;
                    (B) information about how to access the safeguards 
                and parental tools required under section 4; and
                    (C) notice about whether the covered platform, 
                including any personalized recommendation systems used 
                by the platform, pose any heightened risks of harms to 
                minors.
            (2) Parental notification.--
                    (A) Notice and acknowledgment.--In the case of an 
                individual that a covered platform knows or reasonably 
                should know is a child, the platform shall additionally 
                provide information about the parental tools and 
                safeguards required under section 4 to a parent of the 
                child and obtain express affirmative acknowledgment 
                from the parent prior to the initial use of the covered 
                platform by the child.
                    (B) Reasonable effort.--A covered platform shall be 
                deemed to have satisfied the requirement described in 
                subparagraph (A) if the covered platform has undertaken 
                a reasonable effort (taking into consideration 
                available technology) to ensure a parent receives the 
                information described in such subparagraph and to 
                obtain a parent's express affirmative acknowledgment.
            (3) Consolidated notices.--A covered platform may 
        consolidate the process for providing information and (if 
        applicable) obtaining parental acknowledgment as required under 
        this subsection with its obligations to obtain consent for data 
        privacy practices, provided the content of the notice meets the 
        requirements of this subsection.
            (4) Rulemaking.--The Federal Trade Commission may issue 
        rules pursuant to section 553 of title 5, United States Code, 
        to establish templates or models of short-form notices that 
        include the minimum level of information and labels necessary 
        for the disclosures required under paragraph (1).
    (b) Personalized Recommendation System.--A covered platform that 
operates personalized recommendation systems shall set out in its terms 
and conditions, in a clear, conspicuous, and easy-to-understand 
manner--
            (1) an overview of how those personalized recommendation 
        systems are used by the covered platform to provide information 
        to users of the platform who are minors, including how such 
        systems use the personal data of minors; and
            (2) information about options for minors or their parents 
        to control personalized recommendation systems (including by 
        opting out of such systems).
    (c) Advertising and Marketing Information and Labels.--
            (1) Information and labels.--A covered platform that 
        facilitates advertising aimed at users that the platform knows 
        or reasonably should know are minors shall provide clear, 
        conspicuous, and easy-to-understand information and labels to 
        minors on advertisements regarding--
                    (A) the name of the product, service, or brand and 
                the subject matter of an advertisement;
                    (B) why the minor is being targeted for a 
                particular advertisement if the covered platform 
                engages in targeted advertising, including material 
                information about how the minor's personal data was 
                used to target the advertisement; and
                    (C) whether particular media displayed to the minor 
                is an advertisement or marketing material, including 
                disclosure of endorsements of products, services, or 
                brands made for commercial consideration by other users 
                of the platform.
            (2) Rulemaking.--The Federal Trade Commission may issue 
        rules pursuant to section 553 of title 5, United States Code, 
        to establish templates or models of short-form notices that 
        include the minimum level of information and labels necessary 
        for the disclosures required under paragraph (1).
    (d) Resources for Parents and Minors.--A covered platform shall 
provide to minors and parents clear, conspicuous, easy-to-understand, 
and comprehensive information in a prominent location regarding--
            (1) its policies and practices with respect to personal 
        data and safeguards for minors; and
            (2) how to access the safeguards and tools required under 
        section 4.
    (e) Resources in Additional Languages.--A covered platform shall 
ensure, to the extent practicable, that the disclosures required by 
this section are made available in the same language, form, and manner 
as the covered platform provides any product or service used by minors 
and their parents.

SEC. 6. TRANSPARENCY.

    (a) In General.--Subject to subsection (b), not less frequently 
than once a year, a covered platform shall issue a public report 
identifying the reasonably foreseeable risk of material harms to minors 
and describing the prevention and mitigation measures taken to address 
such risk based on an independent, third-party audit conducted through 
reasonable inspection of the covered platform.
    (b) Scope of Application.--The requirements of this section shall 
apply to a covered platform if--
            (1) for the most recent calendar year, the platform 
        averaged more than 10,000,000 active users on a monthly basis 
        in the United States; and
            (2) the platform predominantly provides a community forum 
        for user-generated content and discussion, including sharing 
        videos, images, games, audio files, discussion in a virtual 
        setting, or other content, such as acting as a social media 
        platform, virtual reality environment, or a social network 
        service.
    (c) Content.--
            (1) Transparency.--The public reports required of a covered 
        platform under this section shall include--
                    (A) an assessment of the extent to which the 
                platform is likely to be accessed by minors;
                    (B) a description of the commercial interests of 
                the covered platform in use by minors;
                    (C) an accounting, based on the data held by the 
                covered platform, of--
                            (i) the number of individuals using the 
                        covered platform reasonably believed to be 
                        minors in the United States, disaggregated by 
                        the age ranges of 0-5, 6-9, 10-12, and 13-16; 
                        and
                            (ii) the median and mean amounts of time 
                        spent on the platform by minors in the United 
                        States who have accessed the platform during 
                        the reporting year on a daily, weekly, and 
                        monthly basis, disaggregated by the age ranges 
                        of 0-5, 6-9, 10-12, and 13-16;
                    (D) an accounting of total reports received 
                regarding, and the prevalence (which can be based on 
                scientifically valid sampling methods using the content 
                available to the covered platform in the normal course 
                of business) of content related to, the harms described 
                in section 3(a), disaggregated by category of harm; and
                    (E) a description of any material breaches of 
                parental tools or assurances regarding minors, 
                representations regarding the use of the personal data 
                of minors, and other matters regarding non-compliance.
            (2) Systemic risks assessment.--The public reports required 
        of a covered platform under this section shall include--
                    (A) an assessment of the reasonably foreseeable 
                risk of harms to minors posed by the covered platform, 
                including identifying any other physical, mental, 
                developmental, or financial harms in addition to those 
                described in section 3(a);
                    (B) an assessment of how recommendation systems and 
                targeted advertising systems can contribute to harms to 
                minors;
                    (C) a description of whether and how the covered 
                platform uses system design features that increase, 
                sustain, or extend use of a product or service by a 
                minor, such as automatic playing of media, rewards for 
                time spent, and notifications;
                    (D) a description of whether, how, and for what 
                purpose the platform collects or processes categories 
                of personal data that may cause reasonably foreseeable 
                risk of harms to minors;
                    (E) an evaluation of the efficacy of safeguards for 
                minors under section 4, and any issues in delivering 
                such safeguards and the associated parental tools; and
                    (F) an evaluation of any other relevant matters of 
                public concern over risk of harms to minors.
            (3) Mitigation.--The public reports required of a covered 
        platform under this section shall include--
                    (A) a description of the safeguards and parental 
                tools available to minors and parents on the covered 
                platform;
                    (B) a description of interventions by the covered 
                platform when it had or has reason to believe that 
                harms to minors could occur;
                    (C) a description of the prevention and mitigation 
                measures intended to be taken in response to the known 
                and emerging risks identified in its assessment of 
                system risks, including steps taken to--
                            (i) prevent harms to minors, including 
                        adapting or removing system design features or 
                        addressing through parental controls;
                            (ii) provide the most protective level of 
                        control over privacy and safety by default; and
                            (iii) adapt recommendation systems to 
                        prioritize the best interests of users who are 
                        minors, as described in section 3(a);
                    (D) a description of internal processes for 
                handling reports and automated detection mechanisms for 
                harms to minors, including the rate, timeliness, and 
                effectiveness of responses under the requirement of 
                section 4(c);
                    (E) the status of implementing prevention and 
                mitigation measures identified in prior assessments; 
                and
                    (F) a description of the additional measures to be 
                taken by the covered platform to address the 
                circumvention of safeguards for minors and parental 
                tools.
    (d) Reasonable Inspection.--In conducting an inspection of the 
systemic risks of harm to minors under this section, an independent, 
third-party auditor shall--
            (1) take into consideration the function of recommendation 
        systems;
            (2) consult parents and youth experts, including youth and 
        families with relevant past or current experience, public 
        health and mental health nonprofit organizations, health and 
        development organizations, and civil society with respect to 
        the prevention of harms to minors;
            (3) conduct research based on experiences of minors that 
        use the covered platform, including reports under section 4(c) 
        and information provided by law enforcement;
            (4) take account of research, including research regarding 
        system design features, marketing, or product integrity, 
        industry best practices, or outside research; and
            (5) consider indicia or inferences of age of users, in 
        addition to any self-declared information about the age of 
        individuals.
    (e) Cooperation With Independent, Third-Party Audit.--To facilitate 
the report required by subsection (c), a covered platform shall--
            (1) provide or otherwise make available to the independent 
        third-party conducting the audit all information and material 
        in its possession, custody, or control that is relevant to the 
        audit;
            (2) provide or otherwise make available to the independent 
        third-party conducting the audit access to all network, 
        systems, and assets relevant to the audit; and
            (3) disclose all relevant facts to the independent third-
        party conducting the audit, and not misrepresent in any manner, 
        expressly or by implication, any relevant fact.
    (f) Privacy Safeguards.--
            (1) In issuing the public reports required under this 
        section, a covered platform shall take steps to safeguard the 
        privacy of its users, including ensuring that data is presented 
        in a de-identified, aggregated format such that it is 
        reasonably impossible for the data to be linked back to any 
        individual user.
            (2) This section shall not be construed to require the 
        disclosure of information that will lead to material 
        vulnerabilities for the privacy of users or the security of a 
        covered platform's service or create a significant risk of the 
        violation of Federal or State law.
    (g) Location.--The public reports required under this section 
should be posted by a covered platform on an easy to find location on a 
publicly available website.

SEC. 7. INDEPENDENT RESEARCH.

    (a) Definitions.--In this section:
            (1) Assistant secretary.--The term ``Assistant Secretary'' 
        means the Assistant Secretary of Commerce for Communications 
        and Information.
            (2) De-identified data.--The term ``de-identified data'' 
        means information--
                    (A) that does not identify and is not linked or 
                reasonably linkable to an individual or an individual's 
                device; and
                    (B) with respect to which a covered platform or 
                researcher takes reasonable technical and contractual 
                measures to ensure that the information is not used to 
                re-identify any individual or individual's device.
            (3) Eligible researcher.--
                    (A) In general.--The term ``eligible researcher'' 
                means an individual or group of individuals affiliated 
                with or employed by--
                            (i) an institution of higher education (as 
                        defined in section 101 of the Higher Education 
                        Act of 1965 (20 U.S.C. 1001)); or
                            (ii) a nonprofit organization described in 
                        section 501(c)(3) of the Internal Revenue Code 
                        of 1986.
                    (B) Limitation.--Such term shall not include an 
                individual or group of individuals that is--
                            (i) not located in the United States; or
                            (ii) affiliated with the government of a 
                        foreign adversary (as defined in section 
                        8(c)(2) of the Secure and Trusted 
                        Communications Networks Act of 2019 (47 U.S.C. 
                        1607(c)(2))).
            (4) Independent research.--The term ``independent 
        research'' means the scientific or historical analysis of 
        information that is performed for the primary purpose of 
        advancing understanding, knowledge, and remedies regarding the 
        harms to minors described in section 3(a).
            (5) Noncommercial purpose.--The term ``noncommercial 
        purpose'' means a purpose that does not involve any direct or 
        indirect use of data sets for the sale, resale, solicitation, 
        rental, or lease of a service, or any use by which the user 
        expects a profit, including the sale to the general public of a 
        publication containing independent research.
            (6) Program.--The term ``Program'' means the program 
        established under subsection (b)(1).
            (7) Qualified researcher.--The term ``qualified 
        researcher'' means an eligible researcher who is approved by 
        the Assistant Secretary to conduct independent research 
        regarding harms to minors under the Program.
    (b) Independent Research Program Relating to Identified Harms to 
Minors.--
            (1) Establishment.--Subject to paragraph (2), the Assistant 
        Secretary shall establish a program, with public notice and an 
        opportunity to comment, under which an eligible researcher may 
        apply for, and a covered platform shall provide, access to data 
        sets from the covered platform for the sole purpose of 
        conducting independent research regarding the harms described 
        in section 3(a).
            (2) Scope of application.--The requirements of this 
        subsection shall apply to a covered platform if--
                    (A) for the most recent calendar year, the platform 
                averaged more than 10,000,000 active users on a monthly 
                basis in the United States; and
                    (B) the platform predominantly provides a community 
                forum for user generated content and discussion, 
                including sharing videos, images, games, audio files, 
                discussion in a virtual setting, or other content, such 
                as acting as a social media platform, virtual reality 
                environment, or social network service.
            (3) Processes, procedures, and standards.--Not later than 1 
        year after the date of enactment of this Act, the Assistant 
        Secretary shall establish for the program established under 
        this subsection--
                    (A) definitions for data sets (related to harms 
                described in section 3(a)) that qualify for disclosure 
                to researchers under the program and standards of 
                access for data sets to be provided under the program;
                    (B) a process by which an eligible researcher may 
                submit an application described in paragraph (1);
                    (C) an appeals process for eligible researchers to 
                appeal adverse decisions on applications described in 
                paragraph (1) (including a decision to grant an appeal 
                under paragraph (4)(C));
                    (D) procedures for implementation of the program, 
                including methods for--
                            (i) participation by covered platforms;
                            (ii) evaluation of researcher proposals for 
                        alignment with program objectives and scoping; 
                        and
                            (iii) verification by the Assistant 
                        Secretary of the credentials of eligible 
                        researchers and processes for the application 
                        or disqualification to participate in the 
                        program;
                    (E) standards for privacy, security, and 
                confidentiality required to participate in the program, 
                including rules to ensure that the privacy and safety 
                of users is not infringed by the program;
                    (F) a mechanism to allow individuals to control the 
                use of their personal data under the program, including 
                the ability to opt out of the program;
                    (G) standards for transparency regarding the 
                operation and administration of the program; and
                    (H) rules to prevent requests for data sets that 
                present financial conflicts of interest, including 
                efforts by covered platforms to gain a competitive 
                advantage by directly funding data access requests, the 
                use of qualified researcher status for commercial gain, 
                or efforts by covered platforms to obtain access to 
                intellectual property that is otherwise protected by 
                law.
            (4) Duties and rights of covered platforms.--
                    (A) Access to data sets.--
                            (i) In general.--If the Assistant Secretary 
                        approves an application under paragraph (1) 
                        with respect to a covered platform, the covered 
                        platform shall, in a timely manner, provide the 
                        qualified researcher with access to data sets 
                        necessary to conduct independent research 
                        described in that paragraph.
                            (ii) Limitations.--Nothing in this section 
                        shall be construed to require a covered 
                        platform to provide access to data sets that 
                        are intellectual property protected by Federal 
                        law, trade secrets, or commercial or financial 
                        information.
                            (iii) Form of access.--A covered platform 
                        shall provide to a qualified researcher access 
                        to data sets under clause (i) through online 
                        databases, application programming interfaces, 
                        and data files as appropriate.
                    (B) Nondisclosure agreement.--A covered platform 
                may require, as a condition of access to the data sets 
                of the covered platform, that a qualified researcher 
                enter into a nondisclosure agreement restricting the 
                release of data sets, provided that--
                            (i) the agreement does not restrict the 
                        publication or discussion regarding the 
                        qualified researcher's findings; and
                            (ii) the terms of the agreement allow the 
                        qualified researcher to provide the original 
                        agreement or a copy of the agreement to the 
                        Assistant Secretary.
                    (C) Appeal.--
                            (i) Agency appeal.--A covered platform may 
                        appeal the granting of an application under 
                        paragraph (1) on the grounds that, and the 
                        Assistant Secretary shall grant such appeal 
                        if--
                                    (I) the covered platform does not 
                                have access to the requested data sets 
                                or the requested data sets are not 
                                reasonably tailored to application; or
                                    (II) providing access to the data 
                                sets will lead to material 
                                vulnerabilities for the privacy of 
                                users or the security of the covered 
                                platform's service or create a 
                                significant risk of the violation of 
                                Federal or state law.
                            (ii) Judicial review.--A decision of the 
                        Assistant Secretary with respect to an appeal 
                        under clause (i) shall be considered to be a 
                        final agency action for purposes of judicial 
                        review under chapter 7 of title 5, United 
                        States Code.
                            (iii) Alternative means of fulfillment.--As 
                        part of an appeal under clause (i) that is made 
                        on the basis of subclause (II) of such clause, 
                        a covered platform shall propose one or more 
                        alternative data sets or means of accessing the 
                        requested data sets that are appropriate and 
                        sufficient to fulfill the purpose of the 
                        application, or shall explain why there are no 
                        alternative data sets or means of access which 
                        acceptably mitigate the applicable privacy, 
                        security, or legal concerns.
                    (D) Timing.--A covered platform for which this 
                provision applies shall participate in the program 
                established under this subsection no later than two 
                years after enactment of this Act.
            (5) Application requirements.--In order to be approved to 
        access data sets from a covered platform, an eligible 
        researcher shall, in the application submitted under paragraph 
        (1)--
                    (A) explain the purpose for which the independent 
                research is undertaken;
                    (B) commit to conduct the research for 
                noncommercial purposes;
                    (C) demonstrate a proven record of expertise on the 
                proposed research topic and related research 
                methodologies;
                    (D) if the eligible researcher is seeking access to 
                data sets that include personal data, explain why the 
                data sets are requested, and the means through which 
                such data sets shall be accessed are the least 
                sensitive and the most privacy-protective means that 
                will permit completion of the research and not 
                compromise the privacy or safety of users; and
                    (E) commit to fulfill, and demonstrate a capacity 
                to fulfill, the specific data security and 
                confidentiality requirements corresponding to the 
                application.
            (6) Privacy and duty of confidentiality.--
                    (A) Researcher confidentiality.--To protect user 
                privacy, a qualified researcher shall keep data sets 
                provided by a covered platform under the program 
                confidential and secure to the specifications set forth 
                under the program rules and the approved application.
                    (B) Platform confidentiality.--A covered platform 
                shall use reasonable measures to enable researcher 
                access to data sets under the program in a secure and 
                privacy-protective manner, including through the de-
                identification of personal data or use of other 
                privacy-enhancing technologies.
                    (C) Federal agencies.--Nothing in this subsection 
                shall be construed to authorize--
                            (i) a Federal agency to seek access to the 
                        data of a covered platform through the program; 
                        or
                            (ii) a qualified researcher to transfer or 
                        share any data sets provided by a covered 
                        platform under the program with a Federal 
                        agency.
                    (D) Security.--Nothing in this subsection shall be 
                construed in a manner that would result in data sets 
                from a covered platform being transferred to the 
                Government of the People's Republic of China or the 
                government of another foreign adversary (as defined in 
                section 8(c)(2) of the Secure and Trusted 
                Communications Networks Act of 2019 (47 U.S.C. 
                1607(c)(2))).
    (c) Safe Harbor for Collection of Data for Independent Research 
Regarding Identified Harms to Minors.--If, in the course of conducting 
independent research for noncommercial purposes regarding harms 
described in section 3(a) (without regard to whether such research is 
conducted under the program), an eligible researcher collects or uses 
data from a covered platform in a manner that violates the terms of 
service of the platform, no cause of action based on such violation 
shall lie or be maintained in any court against such researcher unless 
the violation relates to the failure of the researcher to take 
reasonable measures to protect user privacy and security.
    (d) Rulemaking.--The Assistant Secretary, in consultation with the 
Secretary of Commerce, the Director of the National Institute of 
Standards and Technology, the Director of the National Science 
Foundation, and the Director of the National Institutes of Health shall 
promulgate rules in accordance with section 553 of title 5, United 
States Code, as necessary to implement this section.

SEC. 8. MARKET RESEARCH.

    (a) Market Research by Covered Platforms.--The Federal Trade 
Commission, in consultation with the Secretary of Commerce, shall issue 
guidance for covered platforms seeking to conduct market- and product-
focused research on minors. Such guidance shall include--
            (1) a standard consent form that provides minors and their 
        parents a clear, conspicuous, and easy-to-understand 
        explanation of the scope and purpose of the research to be 
        conducted, and provides an opportunity for informed consent; 
        and
            (2) recommendations for research practices for studies that 
        may include minors, disaggregated by the age ranges of 0-5, 6-
        9, 10-12, and 13-16.
    (b) Timing.--The Federal Trade Commission shall issue such guidance 
not later than 18 months after the date of enactment of this Act. In 
doing so, they shall seek input from members of the public and the 
representatives of the Kids Online Safety Council established under 
section 12.

SEC. 9. AGE VERIFICATION STUDY AND REPORT.

    (a) Study.--The Director of the National Institute of Standards and 
Technology, in coordination with the Federal Communications Commission, 
Federal Trade Commission, and the Secretary of Commerce, shall conduct 
a study evaluating the most technologically feasible methods and 
options for developing systems to verify age at the device or operating 
system level.
    (b) Contents.--Such study shall consider --
            (1) the benefits of creating a device or operating system 
        level age verification system;
            (2) what information may need to be collected to create 
        this type of age verification system;
            (3) the accuracy of such systems and their impact or steps 
        to improve accessibility, including for individuals with 
        disabilities;
            (4) how such a system or systems could verify age while 
        mitigating risks to user privacy and data security and 
        safeguarding minors' personal data, emphasizing minimizing the 
        amount of data collected and processed by covered platforms and 
        age verification providers for such a system; and
            (5) the technical feasibility, including the need for 
        potential hardware and software changes, including for devices 
        currently in commerce and owned by consumers.
    (c) Report.--Not later than 1 year after the date of enactment of 
this Act, the agencies described in subsection (a) shall submit a 
report containing the results of the study conducted under such 
subsection to the Committee on Commerce, Science, and Transportation of 
the Senate and the Committee on Energy and Commerce of the House of 
Representatives.

SEC. 10. GUIDANCE.

    (a) In General.--Not later than 18 months after the date of 
enactment of this Act, the Federal Trade Commission, in consultation 
with the Kids Online Safety Council established under section 12, shall 
issue guidance to--
            (1) provide information and examples for covered platforms 
        and auditors regarding--
                    (A) identifying features that are used to increase, 
                sustain, or extend use of the covered platform by a 
                minor;
                    (B) safeguarding minors against the possible misuse 
                of parental tools;
                    (C) best practices in providing minors and parents 
                the most protective level of control over privacy and 
                safety;
                    (D) using indicia or inferences of age of users for 
                assessing use of the covered platform by minors;
                    (E) methods for evaluating the efficacy of 
                safeguards; and
                    (F) providing additional control options that allow 
                parents to address the harms described in section 3(a); 
                and
            (2) outline conduct that does not have the purpose or 
        substantial effect of subverting or impairing user autonomy, 
        decision-making, or choice, or of causing, increasing, or 
        encouraging compulsive usage for a minor, such as--
                    (A) de minimis user interface changes derived from 
                testing consumer preferences, including different 
                styles, layouts, or text, where such changes are not 
                done with the purpose of weakening or disabling 
                safeguards or parental controls;
                    (B) algorithms or data outputs outside the control 
                of a covered platform; and
                    (C) establishing default settings that provide 
                enhanced privacy protection to users or otherwise 
                enhance their autonomy and decision-making ability.
    (b) Guidance to Schools.--Not later than 18 months after the date 
of enactment of this Act, the Secretary of Education, in consultation 
with the Federal Trade Commission and the Kids Online Safety Council 
established under section 12, shall issue guidance to assist to assist 
elementary and secondary schools in using the notice, safeguards and 
tools provided under this Act and providing information on online 
safety for students and teachers.
    (c) Limitation on Federal Trade Commission Guidance.--
            (1) Effect of guidance.--No guidance issued by the Federal 
        Trade Commission with respect to this Act shall--
                    (A) confer any rights on any person, State, or 
                locality; or
                    (B) operate to bind the Federal Trade Commission or 
                any person to the approach recommended in such 
                guidance.
            (2) Use in enforcement actions.--In any enforcement action 
        brought pursuant to this Act, the Federal Trade Commission--
                    (A) shall allege a violation of a provision of this 
                Act; and
                    (B) may not base such enforcement action on, or 
                execute a consent order based on, practices that are 
                alleged to be inconsistent with guidance issued by the 
                Federal Trade Commission with respect to this Act, 
                unless the practices are alleged to violate a provision 
                of this Act.

SEC. 11. ENFORCEMENT.

    (a) Enforcement by Federal Trade Commission.--
            (1) Unfair and deceptive acts or practices.--A violation of 
        this Act or a regulation promulgated under this Act shall be 
        treated as a violation of a rule defining an unfair or 
        deceptive act or practice prescribed under section 18(a)(1)(B) 
        of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
            (2) Powers of the commission.--
                    (A) In general.--The Federal Trade Commission 
                (referred to in this section as the ``Commission'') 
                shall enforce this Act and any regulation promulgated 
                under this Act in the same manner, by the same means, 
                and with the same jurisdiction, powers, and duties as 
                though all applicable terms and provisions of the 
                Federal Trade Commission Act (15 U.S.C. 41 et seq.) 
                were incorporated into and made a part of this Act.
                    (B) Privileges and immunities.--Any person that 
                violates this Act or a regulation promulgated under 
                this Act shall be subject to the penalties, and 
                entitled to the privileges and immunities, provided in 
                the Federal Trade Commission Act (15 U.S.C. 41 et 
                seq.).
            (3) Authority preserved.--Nothing in this Act shall be 
        construed to limit the authority of the Commission under any 
        other provision of law.
    (b) Enforcement by State Attorneys General.--
            (1) In general.--
                    (A) Civil actions.--In any case in which the 
                attorney general of a State has reason to believe that 
                an interest of the residents of that State has been or 
                is threatened or adversely affected by the engagement 
                of any person in a practice that violates this Act or a 
                regulation promulgated under this Act, the State, as 
                parens patriae, may bring a civil action on behalf of 
                the residents of the State in a district court of the 
                United States or a State court of appropriate 
                jurisdiction to--
                            (i) enjoin that practice;
                            (ii) enforce compliance with this Act or 
                        such regulation;
                            (iii) on behalf of residents of the State, 
                        obtain damages, restitution, or other 
                        compensation, each of which shall be 
                        distributed in accordance with State law; or
                            (iv) obtain such other relief as the court 
                        may consider to be appropriate.
                    (B) Notice.--
                            (i) In general.--Before filing an action 
                        under subparagraph (A), the attorney general of 
                        the State involved shall provide to the 
                        Commission--
                                    (I) written notice of that action; 
                                and
                                    (II) a copy of the complaint for 
                                that action.
                            (ii) Exemption.--
                                    (I) In general.--Clause (i) shall 
                                not apply with respect to the filing of 
                                an action by an attorney general of a 
                                State under this paragraph if the 
                                attorney general of the State 
                                determines that it is not feasible to 
                                provide the notice described in that 
                                clause before the filing of the action.
                                    (II) Notification.--In an action 
                                described in subclause (I), the 
                                attorney general of a State shall 
                                provide notice and a copy of the 
                                complaint to the Commission at the same 
                                time as the attorney general files the 
                                action.
            (2) Intervention.--
                    (A) In general.--On receiving notice under 
                paragraph (1)(B), the Commission shall have the right 
                to intervene in the action that is the subject of the 
                notice.
                    (B) Effect of intervention.--If the Commission 
                intervenes in an action under paragraph (1), it shall 
                have the right--
                            (i) to be heard with respect to any matter 
                        that arises in that action; and
                            (ii) to file a petition for appeal.
            (3) Construction.--For purposes of bringing any civil 
        action under paragraph (1), nothing in this Act shall be 
        construed to prevent an attorney general of a State from 
        exercising the powers conferred on the attorney general by the 
        laws of that State to--
                    (A) conduct investigations;
                    (B) administer oaths or affirmations; or
                    (C) compel the attendance of witnesses or the 
                production of documentary and other evidence.
            (4) Actions by the commission.--In any case in which an 
        action is instituted by or on behalf of the Commission for 
        violation of this Act or a regulation promulgated under this 
        Act, no State may, during the pendency of that action, 
        institute a separate action under paragraph (1) against any 
        defendant named in the complaint in the action instituted by or 
        on behalf of the Commission for that violation.
            (5) Venue; service of process.--
                    (A) Venue.--Any action brought under paragraph (1) 
                may be brought in--
                            (i) the district court of the United States 
                        that meets applicable requirements relating to 
                        venue under section 1391 of title 28, United 
                        States Code; or
                            (ii) a State court of competent 
                        jurisdiction.
                    (B) Service of process.--In an action brought under 
                paragraph (1) in a district court of the United States, 
                process may be served wherever defendant--
                            (i) is an inhabitant; or
                            (ii) may be found.

SEC. 12. KIDS ONLINE SAFETY COUNCIL.

    (a) Establishment.--Not later than 180 days after the date of 
enactment of this Act, the Secretary of Commerce shall establish and 
convene the Kids Online Safety Council for the purpose of providing 
advice on matters related to this Act.
    (b) Participation.--The Kids Online Safety Council shall include 
diverse participation from--
            (1) academic experts, health professionals, and members of 
        civil society with expertise in mental health, substance use 
        disorders, and the prevention of harms to minors;
            (2) representatives in academia and civil society with 
        specific expertise in privacy and civil liberties;
            (3) parents and youth representation;
            (4) representatives of covered platforms;
            (5) representatives of the National Telecommunications and 
        Information Administration, the National Institute of Standards 
        and Technology, the Federal Trade Commission, the Department of 
        Justice, and the Department of Health and Human Services;
            (6) State attorneys general or their designees acting in 
        State or local government; and
            (7) representatives of communities of socially 
        disadvantaged individuals (as defined in section 8 of the Small 
        Business Act (15 U.S.C. 637)).
    (c) Activities.--The matters to be addressed by the Kids Online 
Safety Council shall include--
            (1) identifying emerging or current risks of harms to 
        minors associated with online platforms;
            (2) recommending measures and methods for assessing, 
        preventing, and mitigating harms to minors online;
            (3) recommending methods and themes for conducting research 
        regarding online harms to minors; and
            (4) recommending best practices and clear, consensus-based 
        technical standards for transparency reports and audits, as 
        required under this Act, including methods, criteria, and scope 
        to promote overall accountability.

SEC. 13. EFFECTIVE DATE.

    Except as otherwise provided in this Act, this Act shall take 
effect on the date that is 18 months after the date of enactment of 
this Act.

SEC. 14. RULES OF CONSTRUCTION AND OTHER MATTERS.

    (a) Relationship to Other Laws.--Nothing in this Act shall be 
construed to--
            (1) preempt section 444 of the General Education Provisions 
        Act (20 U.S.C. 1232g, commonly known as the ``Family 
        Educational Rights and Privacy Act of 1974'') or other Federal 
        or State laws governing student privacy;
            (2) preempt the Children's Online Privacy Protection Act of 
        1998 (15 U.S.C. 6501 et seq.) or any rule or regulation 
        promulgated under such Act; or
            (3) authorize any action that would conflict with section 
        18(h) of the Federal Trade Commission Act (15 U.S.C. 57a(h)).
    (b) Protections for Privacy.--Nothing in this Act shall be 
construed to require--
            (1) the affirmative collection of any personal data with 
        respect to the age of users that a covered platform is not 
        already collecting in the normal course of business; or
            (2) a covered platform to implement an age gating or age 
        verification functionality.
    (c) Compliance.--Nothing in this Act shall be construed to restrict 
a covered platform's ability to--
            (1) cooperate with law enforcement agencies regarding 
        activity that the covered platform reasonably and in good faith 
        believes may violate Federal, State, or local laws, rules, or 
        regulations;
            (2) comply with a civil, criminal, or regulatory inquiry or 
        any investigation, subpoena, or summons by Federal, State, 
        local, or other government authorities; or
            (3) investigate, establish, exercise, respond to, or defend 
        against legal claims.

SEC. 15. SEVERABILITY.

    If any provision of this Act, or an amendment made by this Act, is 
determined to be unenforceable or invalid, the remaining provisions of 
this Act and the amendments made by this Act shall not be affected.
                                 <all>
```