II 

Calendar No. 288 

118TH CONGRESS 

1ST SESSION S. 1418 

To amend the Children’s Online Privacy Protection Act of 1998 to strengthen 

protections relating to the online collection, use, and disclosure of personal information of children and teens, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MAY 3, 2023 

Mr. MARKEY (for himself and Mr. CASSIDY) introduced the following bill; 

which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

DECEMBER 13, 2023 

Reported by Ms. CANTWELL, with an amendment 

[Strike out all after the enacting clause and insert the part printed in italic] 

A BILL 

To amend the Children’s Online Privacy Protection Act of 

1998 to strengthen protections relating to the online 

collection, use, and disclosure of personal information 

of children and teens, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

2 

•S 1418 RS

1 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

2 (a) SHORT TITLE.—This Act may be cited as the 

3 ‘‘Children and Teens’ Online Privacy Protection Act’’. 

4 (b) TABLE OF CONTENTS.—The table of contents for 

5 this Act is as follows: 

Sec. 1. Short title; table of contents. 

Sec. 2. Definitions. 

Sec. 3. Online collection, use, and disclosure of personal information of children 

and teens. 

Sec. 4. Fair Information Practices Principles. 

Sec. 5. Digital Marketing Bill of Rights for Teens. 

Sec. 6. Targeted marketing to children or teens. 

Sec. 7. Removal of content. 

Sec. 8. Rule for treatment of users of websites, services, and applications directed to children or teens. 

Sec. 9. Study of mobile and online application oversight. 

Sec. 10. Youth Privacy and Marketing Division. 

Sec. 11. Enforcement and applicability. 

Sec. 12. GAO study. 

6 SEC. 2. DEFINITIONS. 

7 (a) IN GENERAL.—In this Act: 

8 (1) COMMISSION.—The term ‘‘Commission’’ 

9 means the Federal Trade Commission. 

10 (2) STANDARDS.—The term ‘‘standards’’ means 

11 benchmarks, guidelines, best practices, methodolo12 gies, procedures, and processes. 

13 (b) OTHER DEFINITIONS.—The definitions set forth 

14 in section 1302 of the Children’s Online Privacy Protec15 tion Act of 1998 (15 U.S.C. 6501), as amended by section 

16 3(a) of this Act, shall apply in this Act, except to the ex17 tent the Commission provides otherwise by regulations 

18 issued under section 553 of title 5, United States Code. 

3 

•S 1418 RS

1 SEC. 3. ONLINE COLLECTION, USE, AND DISCLOSURE OF 

2 PERSONAL INFORMATION OF CHILDREN AND 

3 TEENS. 

4 (a) DEFINITIONS.—Section 1302 of the Children’s 

5 Online Privacy Protection Act of 1998 (15 U.S.C. 6501) 

6 is amended— 

7 (1) by amending paragraph (2) to read as fol8 lows: 

9 ‘‘(2) OPERATOR.—The term ‘operator’— 

10 ‘‘(A) means any person— 

11 ‘‘(i) who, for commercial purposes, in 

12 interstate or foreign commerce operates or 

13 provides a website on the internet, an on14 line service, an online application, a mobile 

15 application, or a connected device; and 

16 ‘‘(ii) who— 

17 ‘‘(I) collects or maintains, either 

18 directly or through a service provider, 

19 personal information from or about 

20 the users of that website, service, ap21 plication, or connected device; 

22 ‘‘(II) allows another person to 

23 collect personal information directly 

24 from users of that website, service, 

25 application, or connected device (in 

4 

•S 1418 RS

1 which case, the operator is deemed to 

2 have collected the information); or 

3 ‘‘(III) allows users of that 

4 website, service, application, or con5 nected device to publicly disclose per6 sonal information (in which case, the 

7 operator is deemed to have collected 

8 the information); and 

9 ‘‘(B) does not include any nonprofit entity 

10 that would otherwise be exempt from coverage 

11 under section 5 of the Federal Trade Commis12 sion Act (15 U.S.C. 45).’’; 

13 (2) in paragraph (4)— 

14 (A) by amending subparagraph (A) to read 

15 as follows: 

16 ‘‘(A) the release of personal information 

17 collected from a child or teen for any purpose, 

18 except where the personal information is pro19 vided to a person other than an operator who— 

20 ‘‘(i) provides support for the internal 

21 operations of the website, online service, 

22 online application, mobile application, or 

23 connected device of the operator, excluding 

24 any activity relating to targeted marketing 

5 

•S 1418 RS

1 directed to children, teens, or connected 

2 devices; and 

3 ‘‘(ii) does not disclose or use that per4 sonal information for any other purpose; 

5 and’’; and 

6 (B) in subparagraph (B)— 

7 (i) by inserting ‘‘or teen’’ after 

8 ‘‘child’’ each place the term appears; 

9 (ii) by inserting ‘‘or teens’’ after 

10 ‘‘children’’; and 

11 (iii) by striking ‘‘website or online 

12 service’’ and inserting ‘‘website, online 

13 service, online application, mobile applica14 tion, or connected device’’; 

15 (3) in paragraph (8), by striking subparagraphs 

16 (F) and (G) and inserting the following: 

17 ‘‘(F) geolocation information; 

18 ‘‘(G) information generated from the meas19 urement or technological processing of an indi20 vidual’s biological, physical, or physiological 

21 characteristics, including— 

22 ‘‘(i) fingerprints; 

23 ‘‘(ii) voice prints; 

24 ‘‘(iii) iris or retina imagery scans; 

25 ‘‘(iv) facial imagery or templates; 

6 

•S 1418 RS

1 ‘‘(v) deoxyribonucleic acid (DNA) in2 formation; or 

3 ‘‘(vi) gait; 

4 ‘‘(H) information reasonably associated 

5 with or attributed to a child or teen; 

6 ‘‘(I) information (including an internet 

7 protocol address) that permits the identification 

8 of— 

9 ‘‘(i) an individual; or 

10 ‘‘(ii) any device used by an individual 

11 to directly or indirectly access the internet 

12 or an online service, online application, mo13 bile application, or connected device; or 

14 ‘‘(J) information concerning a child or teen 

15 or the parents of that child or teen (including 

16 any unique or substantially unique identifier, 

17 such as a customer number) that an operator 

18 collects online from the child or teen and com19 bines with an identifier described in this para20 graph.’’; 

21 (4) by amending paragraph (9) to read as fol22 lows: 

23 ‘‘(9) VERIFIABLE CONSENT.—The term 

24 ‘verifiable consent’ means any reasonable effort (tak25 ing into consideration available technology), includVerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418
7 

•S 1418 RS

1 ing a request for authorization for future collection, 

2 use, and disclosure described in the notice, to ensure 

3 that, in the case of a child, a parent of the child, 

4 or, in the case of a teen, the teen— 

5 ‘‘(A) receives specific notice of the personal 

6 information collection, use, and disclosure prac7 tices of the operator; and 

8 ‘‘(B) before the personal information of the 

9 child or teen is collected, freely and unambig10 uously authorizes— 

11 ‘‘(i) the collection, use, and disclosure, 

12 as applicable, of that personal information; 

13 and 

14 ‘‘(ii) any subsequent use of that per15 sonal information.’’; 

16 (5) by striking paragraph (10) and redesig17 nating paragraphs (11) and (12) as paragraphs (10) 

18 and (11), respectively; and 

19 (6) by adding at the end the following: 

20 ‘‘(12) CONNECTED DEVICE.—The term ‘con21 nected device’ means a device that is capable of con22 necting to the internet, directly or indirectly, or to 

23 another connected device. 

24 ‘‘(13) ONLINE APPLICATION.—The term ‘online 

25 application’— 

8 

•S 1418 RS

1 ‘‘(A) means an internet-connected software 

2 program; and 

3 ‘‘(B) includes a service or application of4 fered via a connected device. 

5 ‘‘(14) ONLINE SERVICE.— 

6 ‘‘(A) IN GENERAL.—The term ‘online serv7 ice’ means a mass-market retail service by wire 

8 or radio that provides the capability to transmit 

9 data and receive data from all or substantially 

10 all Internet endpoints, including any capabilities 

11 that are incidental to and enable the operation 

12 of a communications service, but excluding dial13 up Internet service. 

14 ‘‘(B) SCOPE.—Such term includes— 

15 ‘‘(i) any service that the Federal Com16 munications Commission finds to be pro17 viding a functionally equivalent service to a 

18 service described in subparagraph (A); and 

19 ‘‘(ii) a service or application offered 

20 via a connected device. 

21 ‘‘(15) DIRECTED TO CHILDREN OR TEENS.— 

22 ‘‘(A) IN GENERAL.—The terms ‘directed to 

23 children’, ‘directed to teens’, and ‘directed to 

24 children or teens’ mean, with respect to a 

25 website, online service, online application, moVerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418
9 

•S 1418 RS

1 bile application, or connected device, that the 

2 website, online service, online application, mo3 bile application, or connected device, or a por4 tion thereof, is targeted to children or teens, as 

5 the case may be, as demonstrated by— 

6 ‘‘(i) the subject matter of the website, 

7 online service, online application, mobile 

8 application, or connected device; 

9 ‘‘(ii) the visual content of the website, 

10 online service, online application, mobile 

11 application, or connected device; 

12 ‘‘(iii) the use of animated characters 

13 or child-oriented activities for children, or 

14 the use of teen-oriented characters or teen15 oriented activities for teens, and related in16 centives on the website, online service, on17 line application, mobile application, or con18 nected device; 

19 ‘‘(iv) the music or other audio content 

20 on the website, online service, online appli21 cation, mobile application, or connected de22 vice; 

23 ‘‘(v) the age of models on the website, 

24 online service, online application, mobile 

25 application, or connected device; 

10 

•S 1418 RS

1 ‘‘(vi) the presence, on the website, on2 line service, online application, mobile ap3 plication, or connected device, of— 

4 ‘‘(I) child celebrities; 

5 ‘‘(II) celebrities who appeal to 

6 children; 

7 ‘‘(III) teen celebrities; or 

8 ‘‘(IV) celebrities who appeal to 

9 teens; 

10 ‘‘(vii) the language used on the 

11 website, online service, online application, 

12 mobile application, or connected device; 

13 ‘‘(viii) advertising content used on, or 

14 used to advertise, the website, online serv15 ice, online application, mobile application, 

16 or connected device; or 

17 ‘‘(ix) reliable empirical evidence relat18 ing to— 

19 ‘‘(I) the composition of the audi20 ence of the website, online service, on21 line application, mobile application, or 

22 connected device; and 

23 ‘‘(II) the intended audience of 

24 the website, online service, online apVerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418
11 

•S 1418 RS

1 plication, mobile application, or con2 nected device. 

3 ‘‘(B) RULES OF CONSTRUCTION.— 

4 ‘‘(i) SERVICES DEEMED DIRECTED TO

5 CHILDREN OR TEENS.—For the purposes 

6 of this title, a website, online service, on7 line application, mobile application, or con8 nected device, or a portion thereof, shall be 

9 deemed to be directed to children or teens 

10 if it collects personal information directly 

11 from users of any other website, online 

12 service, online application, mobile applica13 tion, or connected device that is— 

14 ‘‘(I) directed to children or teens 

15 under the criteria described in sub16 paragraph (A); or 

17 ‘‘(II) used or reasonably likely to 

18 be used by children or teens. 

19 ‘‘(ii) SERVICES DEEMED DIRECTED TO

20 MIXED AUDIENCES.— 

21 ‘‘(I) IN GENERAL.—A website, 

22 online service, online application, mo23 bile application, or connected device 

24 that is directed to children or teens 

25 under the criteria described in subVerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418
12 

•S 1418 RS

1 paragraph (A), but that does not tar2 get children or teens as the primary 

3 audience of the website, online service, 

4 online application, mobile application, 

5 or connected device shall not be 

6 deemed to be directed to children or 

7 teens for purposes of this title if the 

8 website, online service, online applica9 tion, mobile application, or connected 

10 device— 

11 ‘‘(aa) does not collect per12 sonal information from any user 

13 of the website, online service, on14 line application, mobile applica15 tion, or connected device before 

16 verifying age information of the 

17 user; and 

18 ‘‘(bb) does not, without first 

19 complying with any relevant no20 tice and consent provision under 

21 this title, collect, use, or disclose 

22 personal information of any user 

23 who identifies themselves to the 

24 website, online service, online ap25 plication, mobile application, or 

13 

•S 1418 RS

1 connected device as an individual 

2 who is age 16 or younger. 

3 ‘‘(II) USE OF CERTAIN TOOLS.— 

4 For purposes of this title, a website, 

5 online service, online application, mo6 bile application, or connected device, 

7 shall not be deemed directed to chil8 dren or teens solely because the 

9 website, online service, online applica10 tion, mobile application, or connected 

11 device refers or links to any other 

12 website, online service, online applica13 tion, mobile application, or connected 

14 device directed to children or teens by 

15 using information location tools, in16 cluding— 

17 ‘‘(aa) a directory; 

18 ‘‘(bb) an index; 

19 ‘‘(cc) a reference; 

20 ‘‘(dd) a pointer; or 

21 ‘‘(ee) a hypertext link. 

22 ‘‘(16) MOBILE APPLICATION.—The term ‘mo23 bile application’— 

24 ‘‘(A) means a software program that runs 

25 on the operating system of— 

14 

•S 1418 RS

1 ‘‘(i) a cellular telephone; 

2 ‘‘(ii) a tablet computer; or 

3 ‘‘(iii) a similar portable computing de4 vice that transmits data over a wireless 

5 connection; and 

6 ‘‘(B) includes a service or application of7 fered via a connected device. 

8 ‘‘(17) GEOLOCATION INFORMATION.—The term 

9 ‘geolocation information’ means information suffi10 cient to identify a street name and name of a city 

11 or town. 

12 ‘‘(18) TEEN.—The term ‘teen’ means an indi13 vidual over the age of 12 and under the age of 17. 

14 ‘‘(19) TARGETED MARKETING.— 

15 ‘‘(A) IN GENERAL.—The term ‘targeted 

16 marketing’ means advertising or any other ef17 fort to market a product or service that is di18 rected to a specific individual or device— 

19 ‘‘(i) based on— 

20 ‘‘(I) the personal information 

21 of— 

22 ‘‘(aa) the individual; or 

23 ‘‘(bb) a group of individuals 

24 who are similar in gender, age, 

25 income level, race, or ethnicity to 

15 

•S 1418 RS

1 the specific individual to whom 

2 the product or service is mar3 keted; 

4 ‘‘(II) psychological profiling of an 

5 individual or group of individuals; or 

6 ‘‘(III) a unique identifier of the 

7 device; or 

8 ‘‘(ii) as a result of use by the indi9 vidual, access by any device of the indi10 vidual, or use by a group of individuals 

11 who are similar to the specific individual, 

12 of more than a single— 

13 ‘‘(I) website; 

14 ‘‘(II) online service; 

15 ‘‘(III) online application; 

16 ‘‘(IV) mobile application; 

17 ‘‘(V) connected device; or 

18 ‘‘(VI) operating system. 

19 ‘‘(B) EXCLUSIONS.—The term ‘targeted 

20 marketing’ shall not include— 

21 ‘‘(i) advertising or marketing to an in22 dividual or the device of an individual in 

23 response to the individual’s specific request 

24 for information or feedback; 

16 

•S 1418 RS

1 ‘‘(ii) contextual advertising, such as 

2 when an advertisement is displayed based 

3 on the context in which the advertisement 

4 appears and does not vary based on who is 

5 viewing the advertisement; or 

6 ‘‘(iii) processing personal information 

7 solely for measuring or reporting adver8 tising or content performance, reach, or 

9 frequency, including independent measure10 ment. 

11 ‘‘(C) AUTHORITY TO FURTHER DEFINE.— 

12 The Commission may promulgate rules under 

13 section 553 of title 5, United State Code, to 

14 further define the term ‘targeted marketing’ 

15 but only as necessary to address changes to or 

16 innovations of technology, changes in how per17 sonal information is used or transferred, 

18 changes to the means and manners by which 

19 children or teens interact with a website, online 

20 service, online application, mobile application, 

21 or connected device, or evolving concerns re22 garding the privacy of children or teens. 

23 ‘‘(20) REASONABLY LIKELY TO BE USED.—The 

24 Commission may promulgate rules under section 553 

25 of title 5, United States Code, or issue guidance to 

17 

•S 1418 RS

1 establish factors that should be considered in apply2 ing the term ‘reasonably likely to be used’ for the 

3 purposes of this title. 

4 ‘‘(21) REASONABLY LIKELY TO BE A CHILD OR

5 TEEN.—The Commission may promulgate rules 

6 under section 553 of title 5, United States Code, or 

7 issue guidance to establish factors that should be 

8 considered in applying the term ‘reasonably likely to 

9 be a child or teen’ for the purposes of this title.’’. 

10 (b) ONLINE COLLECTION, USE, AND DISCLOSURE OF

11 PERSONAL INFORMATION OF CHILDREN AND TEENS.— 

12 Section 1303 of the Children’s Online Privacy Protection 

13 Act of 1998 (15 U.S.C. 6502) is amended— 

14 (1) by striking the heading and inserting the 

15 following: ‘‘ONLINE COLLECTION, USE, AND DIS16 CLOSURE OF PERSONAL INFORMATION OF

17 CHILDREN AND TEENS.’’; 

18 (2) in subsection (a)— 

19 (A) by amending paragraph (1) to read as 

20 follows: 

21 ‘‘(1) IN GENERAL.—It is unlawful for an oper22 ator of a website, online service, online application, 

23 mobile application, or connected device that is di24 rected to children or teens or is used or reasonably 

25 likely to be used by children or teens in a manner 

18 

•S 1418 RS

1 that involves the collection of personal information, 

2 to collect personal information from a child or teen 

3 in a manner that violates the regulations prescribed 

4 under subsection (b).’’; and 

5 (B) in paragraph (2)— 

6 (i) by striking ‘‘of such a website or 

7 online service’’; and 

8 (ii) by striking ‘‘subsection 

9 (b)(1)(B)(iii) to the parent of a child’’ and 

10 inserting ‘‘subsection (b)(1)(A)(iii) to the 

11 parent of a child or under subsection 

12 (b)(1)(A)(iv) to a teen’’; and 

13 (3) in subsection (b)— 

14 (A) in paragraph (1)— 

15 (i) by striking ‘‘this Act’’ and insert16 ing ‘‘the Children and Teens’ Online Pri17 vacy Protection Act’’; 

18 (ii) in subparagraph (A)— 

19 (I) by striking ‘‘operator of any 

20 website’’ and all that follows through 

21 ‘‘from a child’’ and inserting ‘‘oper22 ator of a website, online service, on23 line application, mobile application, or 

24 connected device that is directed to 

25 children or teens or is used or is reaVerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00018 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418
19 

•S 1418 RS

1 sonably likely to be used by children 

2 or teens in a manner that involves the 

3 collection of their personal informa4 tion’’; 

5 (II) in clause (i)— 

6 (aa) by striking ‘‘notice on 

7 the website’’ and inserting ‘‘clear 

8 and conspicuous notice’’; 

9 (bb) by inserting ‘‘or teens’’ 

10 after ‘‘children’’; 

11 (cc) by striking ‘‘, and the 

12 operator’s’’ and inserting ‘‘, the 

13 operator’s’’; and 

14 (dd) by striking ‘‘; and’’ and 

15 inserting ‘‘, and the procedures 

16 or mechanisms the operator uses 

17 to ensure that personal informa18 tion is not collected from children 

19 or teens except in accordance 

20 with the regulations promulgated 

21 under this paragraph;’’; and 

22 (III) in clause (ii)— 

23 (aa) by striking ‘‘parental’’; 

24 and 

20 

•S 1418 RS

1 (bb) by inserting ‘‘or teens’’ 

2 after ‘‘children’’; 

3 (iii) in subparagraph (B)— 

4 (I) in the matter preceding clause 

5 (i), by striking ‘‘website or online 

6 service’’ and inserting ‘‘operator’’; 

7 (II) in clause (ii), by inserting 

8 ‘‘to delete personal information col9 lected from the child or’’ after ‘‘the 

10 opportunity at any time’’; and 

11 (III) in clause (iii), by inserting 

12 ‘‘, if such information is available to 

13 the operator at the time the parent 

14 makes the request’’ before the semi15 colon; 

16 (iv) by redesignating subparagraphs 

17 (C) and (D) as subparagraphs (D) and 

18 (E), respectively; 

19 (v) by inserting after subparagraph 

20 (B) the following new subparagraph: 

21 ‘‘(C) require the operator to provide, upon 

22 the request of a teen under this subparagraph 

23 who has provided personal information to the 

24 operator, upon proper identification of that 

25 teen— 

21 

•S 1418 RS

1 ‘‘(i) a description of the specific types 

2 of personal information collected from the 

3 teen by the operator; 

4 ‘‘(ii) the opportunity at any time to 

5 delete personal information collected from 

6 the teen and refuse further use or collec7 tion of personal information from the teen; 

8 and 

9 ‘‘(iii) a means that is reasonable 

10 under the circumstances for the teen to ob11 tain any personal information collected 

12 from the teen, if such information is avail13 able to the operator at the time the teen 

14 makes the request;’’; 

15 (vi) in subparagraph (D), as so redes16 ignated, by striking ‘‘conditioning’’ and all 

17 that follows through ‘‘such activity’’ and 

18 inserting the following: ‘‘the collection from 

19 a child or teen of more personal informa20 tion that is reasonably required to use the 

21 website, online service, online application, 

22 mobile application, or connected device’’; 

23 (vii) in subparagraph (E), as so redes24 ignated— 

22 

•S 1418 RS

1 (I) by striking ‘‘of such a website 

2 or online service’’; and 

3 (II) by inserting ‘‘and teens’’ 

4 after ‘‘children’’; and 

5 (viii) by adding at the end the fol6 lowing flush text: 

7 ‘‘The Commission shall review and update the regu8 lations promulgated under this paragraph as nec9 essary.’’; 

10 (B) in paragraph (2)— 

11 (i) in the matter preceding subpara12 graph (A), by striking ‘‘verifiable parental 

13 consent’’ and inserting ‘‘verifiable con14 sent’’; 

15 (ii) in subparagraph (A)— 

16 (I) by inserting ‘‘or teen’’ after 

17 ‘‘collected from a child’’; 

18 (II) by inserting ‘‘or teen’’ after 

19 ‘‘request from the child’’; and 

20 (III) by inserting ‘‘or teen or to 

21 contact another child or teen’’ after 

22 ‘‘to recontact the child’’; 

23 (iii) in subparagraph (B)— 

24 (I) by striking ‘‘parent or child’’ 

25 and inserting ‘‘parent or teen’’; and 

23 

•S 1418 RS

1 (II) by striking ‘‘parental con2 sent’’ each place the term appears and 

3 inserting ‘‘verifiable consent’’; 

4 (iv) in subparagraph (C)— 

5 (I) in the matter preceding clause 

6 (i), by inserting ‘‘or teen’’ after 

7 ‘‘child’’ each place the term appears; 

8 (II) in clause (i)— 

9 (aa) by inserting ‘‘or teen’’ 

10 after ‘‘child’’ each place the term 

11 appears; and 

12 (bb) by inserting ‘‘or teen, 

13 as applicable,’’ after ‘‘parent’’ 

14 each place the term appears; and 

15 (III) in clause (ii)— 

16 (aa) by inserting ‘‘or teen, 

17 as applicable,’’ after ‘‘parent’’; 

18 and 

19 (bb) by inserting ‘‘or teen’’ 

20 after ‘‘child’’ each place the term 

21 appears; and 

22 (v) in subparagraph (D)— 

23 (I) in the matter preceding clause 

24 (i), by inserting ‘‘or teen’’ after 

25 ‘‘child’’ each place the term appears; 

24 

•S 1418 RS

1 (II) in clause (ii), by inserting 

2 ‘‘or teen’’ after ‘‘child’’; and 

3 (III) in the flush text following 

4 clause (iii)— 

5 (aa) by inserting ‘‘or teen, 

6 as applicable,’’ after ‘‘parent’’ 

7 each place the term appears; and 

8 (bb) by inserting ‘‘or teen’’ 

9 after ‘‘child’’; and 

10 (C) by amending paragraph (3) to read as 

11 follows: 

12 ‘‘(3) CONTINUATION OF SERVICE.—The regula13 tions shall prohibit an operator from discontinuing 

14 service provided to a child or teen on the basis of 

15 a request by the parent of the child or by the teen, 

16 under the regulations prescribed under subpara17 graph (B) or (C) of paragraph (1), respectively, to 

18 delete personal information collected from the child 

19 or teen, to the extent that the operator is capable of 

20 providing such service without such information.’’. 

21 (c) SAFE HARBORS.—Section 1304 of the Children’s 

22 Online Privacy Protection Act of 1998 (15 U.S.C. 6503) 

23 is amended— 

24 (1) in subsection (b)(1), by inserting ‘‘and 

25 teens’’ after ‘‘children’’; and 

25 

•S 1418 RS

1 (2) by adding at the end the following: 

2 ‘‘(d) PUBLICATION.— 

3 ‘‘(1) IN GENERAL.—The Commission shall pub4 lish on the internet website of the Commission any 

5 report or documentation required by regulation to be 

6 submitted to the Commission to carry out this sec7 tion. 

8 ‘‘(2) RESTRICTIONS ON PUBLICATION.—The re9 strictions described in subsection (f) of section 6 of 

10 the Federal Trade Commission Act (15 U.S.C. 

11 46(f)) applicable to the publication of information 

12 obtained by the Commission through investigations 

13 conducted under such section shall apply in same 

14 manner to the publication under this subsection of 

15 information obtained by the Commission from a re16 port or documentation described in paragraph (1).’’. 

17 (d) ADMINISTRATION AND APPLICABILITY OF ACT.— 

18 Section 1306 of the Children’s Online Privacy Protection 

19 Act of 1998 (15 U.S.C. 6505) is amended— 

20 (1) in subsection (b)— 

21 (A) in paragraph (1), by striking ‘‘, in the 

22 case of’’ and all that follows through ‘‘the 

23 Board of Directors of the Federal Deposit In24 surance Corporation;’’ and inserting the fol25 lowing: ‘‘by the appropriate Federal banking 

26 

•S 1418 RS

1 agency, with respect to any insured depository 

2 institution (as those terms are defined in sec3 tion 3 of that Act (12 U.S.C. 1813));’’; and 

4 (B) by striking paragraph (2) and redesig5 nating paragraphs (3) through (6) as para6 graphs (2) through (5), respectively; and 

7 (2) by adding at the end the following new sub8 section: 

9 ‘‘(f) TELECOMMUNICATIONS CARRIERS AND CABLE

10 OPERATORS.— 

11 ‘‘(1) ENFORCEMENT BY COMMISSION.—Not12 withstanding section 4, 5(a)(2), or 6 of the Federal 

13 Trade Commission Act (15 U.S.C. 44, 45(a)(2), 46), 

14 or any jurisdictional limitation of the Commission, 

15 the Commission shall also enforce this Act and the 

16 regulations promulgated under this Act, in the same 

17 manner provided in subsection (d), with respect to 

18 common carriers subject to the Communications Act 

19 of 1934 (47 U.S.C. 151 et seq.) and Acts amend20 atory thereof and supplementary thereto. 

21 ‘‘(2) RELATIONSHIP TO OTHER LAW.—To the 

22 extent that section 222, 338(i), or 631 of the Com23 munications Act of 1934 (47 U.S.C. 222, 338(i), 

24 551) is inconsistent with this title, this title con25 trols.’’. 

27 

•S 1418 RS

1 SEC. 4. FAIR INFORMATION PRACTICES PRINCIPLES. 

2 (a) IN GENERAL.—The Fair Information Practices 

3 Principles described in this section are the following: 

4 (1) COLLECTION LIMITATION PRINCIPLE.—Ex5 cept as provided in paragraph (3), personal informa6 tion should be collected from a child or teen only 

7 when collection of the personal information is— 

8 (A) consistent with the context of a par9 ticular transaction or service or the relationship 

10 of the child or teen with the operator, including 

11 collection necessary to fulfill a transaction or 

12 provide a service requested by the child or teen; 

13 or 

14 (B) required or specifically authorized by 

15 law. 

16 (2) DATA QUALITY PRINCIPLE.—The personal 

17 information of a child or teen should be accurate, 

18 complete, and kept up-to-date to the extent nec19 essary to fulfill the purposes described in subpara20 graphs (A) through (D) of paragraph (3). 

21 (3) PURPOSE SPECIFICATION PRINCIPLE.—The 

22 purposes for which personal information is collected 

23 and used should be specified to the parent of a child 

24 or to a teen not later than at the time of the collec25 tion of the information. The subsequent use or dis26 closure of the information should be limited to— 

28 

•S 1418 RS

1 (A) fulfillment of the transaction or service 

2 requested by the teen or parent of the child; 

3 (B) support for the internal operations of 

4 the website, service, or application, as described 

5 in section 312.2 of title 16, Code of Federal 

6 Regulations (as in effect on the date of enact7 ment of this Act), excluding any activity relat8 ing to targeted marketing directed to children, 

9 teens, or a device of a child or teen if the sup10 port for internal operations in consistent with 

11 the interest of the child or teen; 

12 (C) compliance with legal process or other 

13 purposes expressly authorized under specific 

14 legal authority; or 

15 (D) other purposes— 

16 (i) that are specified in a notice to the 

17 teen or parent of the child; and 

18 (ii) to which the teen or parent of the 

19 child has consented under paragraph (7) 

20 before the information is used or disclosed 

21 for such other purposes. 

22 (4) RETENTION LIMITATION PRINCIPLE.— 

23 (A) IN GENERAL.—The personal informa24 tion of a child or teen should not be retained 

25 for longer than is necessary to fulfill a transVerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00028 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418
29 

•S 1418 RS

1 action or provide a service requested by the 

2 child or teen or such other purposes specified in 

3 subparagraphs (A) through (D) of paragraph 

4 (3). 

5 (B) DATA DISPOSAL.—The operator should 

6 implement a reasonable and appropriate data 

7 disposal policy based on the nature and sensi8 tivity of personal information described in sub9 paragraph (A). 

10 (5) SECURITY SAFEGUARDS PRINCIPLE.—The 

11 personal information of a child or teen should be 

12 protected by reasonable and appropriate security 

13 safeguards against risks such as loss or unauthor14 ized access, destruction, use, modification, or disclo15 sure. 

16 (6) TRANSPARENCY PRINCIPLE.— 

17 (A) GENERAL PRINCIPLE.—The operator 

18 should be transparent about developments, 

19 practices, and policies with respect to the per20 sonal information of a child or teen. 

21 (B) PROVISION OF INFORMATION.—The 

22 operator should provide to each parent of a 

23 child, or to each teen, using the website, online 

24 service, online application, mobile application, 

30 

•S 1418 RS

1 or connected device of the operator with a clear 

2 and prominent means— 

3 (i) to identify and contact the oper4 ator, by, at a minimum, disclosing, clearly 

5 and prominently, the identity of the oper6 ator and— 

7 (I) in the case of an operator 

8 who is an individual, the address of 

9 the principal residence (but not a per10 sonal residence) of the operator and 

11 an email address or online contact 

12 form and telephone number for the 

13 operator; or 

14 (II) in the case of any other op15 erator, the address of the principal 

16 place of business of the operator and 

17 an email address or online contact 

18 form and telephone number for the 

19 operator; 

20 (ii) to determine whether the operator 

21 possesses any personal information of the 

22 child or teen, the nature of any such infor23 mation, and the purposes for which the in24 formation was collected and is being re25 tained; 

31 

•S 1418 RS

1 (iii) to obtain any personal informa2 tion of the child or teen that is in the pos3 session of the operator from the operator, 

4 or from a person specified by the operator, 

5 within a reasonable time after making a 

6 request, at a charge (if any) that is not ex7 cessive, in a reasonable manner, and in a 

8 form that is readily intelligible to the child 

9 or teen; 

10 (iv) to challenge the accuracy of per11 sonal information of the child or teen that 

12 is in the possession of the operator; 

13 (v) to determine if the child or teen 

14 has established the inaccuracy of personal 

15 information in a challenge under clause 

16 (iv) in order to have such information 

17 erased, corrected, completed, or otherwise 

18 amended; and 

19 (vi) to determine the method by which 

20 the operator obtains data relevant to the 

21 child or teen. 

22 (C) LIMITATION.—Nothing in this para23 graph shall be construed to permit an operator 

24 to erase or otherwise modify personal informaVerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00031 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418
32 

•S 1418 RS

1 tion requested by a law enforcement agency 

2 pursuant to legal authority. 

3 (7) INDIVIDUAL PARTICIPATION PRINCIPLE.— 

4 The operator should— 

5 (A) obtain consent from a parent of a child 

6 or from a teen before using or disclosing the 

7 personal information of the child or teen for 

8 any purpose other than the purposes described 

9 in subparagraph (A) of paragraph (3); and 

10 (B) obtain affirmative express consent 

11 from a parent of a child or from a teen before 

12 using or disclosing previously collected personal 

13 information of the child or teen for purposes 

14 that constitute a material change in practice 

15 from the original purposes specified to the child 

16 or teen under paragraph (3). 

17 (8) RACIAL AND SOCIOECONOMIC PROFILING.— 

18 The personal information of a child or teen shall not 

19 be used to direct content to the child or teen, or a 

20 group of individuals similar to the child or teen, on 

21 the basis of race, socioeconomic factors, or any 

22 proxy thereof. 

23 (b) RULE OF CONSTRUCTION.—Nothing in this sec24 tion, including compliance with the Fair Information Prin25 ciples, shall be construed to permit an operator to avoid 

33 

•S 1418 RS

1 compliance with other requirements set forth in this Act 

2 or the Children’s Online Privacy Protection Act (15 

3 U.S.C. 6501 et seq.). 

4 SEC. 5. DIGITAL MARKETING BILL OF RIGHTS FOR TEENS. 

5 (a) ACTS PROHIBITED.— 

6 (1) PROHIBITION.— 

7 (A) IN GENERAL.—Except as provided in 

8 subparagraph (B), it shall be unlawful for an 

9 operator of a website, online service, online ap10 plication, mobile application, or connected de11 vice to collect personal information from a user 

12 if— 

13 (i) the user is reasonably likely to be 

14 a teen; or 

15 (ii) the website, online service, online 

16 application, mobile application, or con17 nected device is directed to teens. 

18 (B) EXCEPTION.—Subparagraph (A) shall 

19 not apply to an operator that has adopted and 

20 complies with a Digital Marketing Bill of 

21 Rights for Teens that meets the Fair Informa22 tion Practices Principles described in section 4. 

23 (2) EFFECTIVE DATE.—This subsection shall 

24 take effect on the date that is 180 days after the 

25 promulgation of regulations under subsection (b). 

34 

•S 1418 RS

1 (b) REGULATIONS.— 

2 (1) IN GENERAL.—Not later than 1 year after 

3 the date of enactment of this Act, the Commission 

4 shall promulgate, under section 553 of title 5, 

5 United States Code, regulations to implement this 

6 section, including regulations further defining the 

7 Fair Information Practices Principles described in 

8 section 4. 

9 (2) UPDATES.—Not less frequently than once 

10 every 4 years after the date on which regulations are 

11 promulgated under paragraph (1), the Commission 

12 shall review and update those regulations as nec13 essary. 

14 SEC. 6. TARGETED MARKETING TO CHILDREN AND TEENS. 

15 (a) PROHIBITED ACTS WITH RESPECT TO CHILDREN

16 AND TEENS.—It shall be unlawful for an operator of a 

17 website, online service, online application, mobile applica18 tion, or connected device to collect, use, disclose to third 

19 parties, or compile personal information of a user for pur20 poses of targeted marketing (or to allow another person 

21 to collect, use, disclose, or compile such information for 

22 such purpose) if— 

23 (1) such use, disclosure, or compiling of per24 sonal information involves or is reasonably likely to 

35 

•S 1418 RS

1 involve collection of personal information from a 

2 child or teen; or 

3 (2) the website, online service, online applica4 tion, mobile application, or connected device is di5 rected to children or teens. 

6 (b) EFFECTIVE DATE.—This section shall take effect 

7 on the date that is 180 days after the date of enactment 

8 of this Act. 

9 SEC. 7. REMOVAL OF CONTENT. 

10 (a) ACTS PROHIBITED.—It is unlawful for an oper11 ator to make, or enable a child or teen to make, publicly 

12 available through a website, online service, online applica13 tion, mobile application, or connected device content or in14 formation that contains or displays personal information 

15 of children or teens in a manner that violates subsection 

16 (b). 

17 (b) REQUIREMENT.— 

18 (1) IN GENERAL.—An operator, to the extent 

19 technologically feasible, shall— 

20 (A) implement mechanisms that permit a 

21 user of the website, online service, online appli22 cation, mobile application, or connected device 

23 of the operator (and, in the case of a user that 

24 is a child, a parent of that user) to erase or 

36 

•S 1418 RS

1 otherwise eliminate content or information that 

2 is— 

3 (i) submitted to the website, online 

4 service, online application, mobile applica5 tion, or connected device by that user; 

6 (ii) publicly available through the 

7 website, online service, online application, 

8 mobile application, or connected device; 

9 and 

10 (iii) contains or displays personal in11 formation of children or teens; and 

12 (B) take appropriate steps to— 

13 (i) make users and parents of users 

14 who are children aware of the mechanisms 

15 described in subparagraph (A); and 

16 (ii) provide notice to users and par17 ents of users who are children that the 

18 mechanisms described in subparagraph (A) 

19 do not necessarily provide comprehensive 

20 removal of the content or information sub21 mitted by users. 

22 (2) EXCEPTIONS.—Paragraph (1) shall not be 

23 construed to require an operator or third party to 

24 erase or otherwise eliminate content or information 

25 that— 

37 

•S 1418 RS

1 (A) any other provision of Federal or State 

2 law requires the operator or third party to 

3 maintain; or 

4 (B) was submitted to the website, online 

5 service, online application, mobile application, 

6 or connected device of the operator by any per7 son other than the user who is attempting to 

8 erase or otherwise eliminate the content or in9 formation, including content or information 

10 submitted by the user that was republished or 

11 resubmitted by another person. 

12 (c) LIMITATION.—Nothing in this section shall be 

13 construed to limit the authority of a law enforcement 

14 agency to obtain any content or information from an oper15 ator as authorized by law or pursuant to an order of a 

16 court of competent jurisdiction. 

17 (d) EFFECTIVE DATE.—This section shall take effect 

18 on the date that is 180 days after the date of enactment 

19 of this Act. 

20 SEC. 8. RULE FOR TREATMENT OF USERS OF WEBSITES, 

21 SERVICES, AND APPLICATIONS DIRECTED TO 

22 CHILDREN OR TEENS. 

23 For the purposes of this Act, an operator of a 

24 website, online service, online application, mobile applica25 tion, or connected device that is directed to children or 

38 

•S 1418 RS

1 teens shall treat each user of that website, online service, 

2 online application, mobile application, or connected device 

3 as a child or teen, except as permitted by the Commission 

4 pursuant to a regulation promulgated under this Act, and 

5 except to the extent the website, online service, online ap6 plication, mobile application, or connected device is 

7 deemed directed to mixed audiences. 

8 SEC. 9. STUDY OF MOBILE AND ONLINE APPLICATION 

9 OVERSIGHT. 

10 Not later than 3 years after the date of enactment 

11 of this Act, the Commission shall submit to each com12 mittee of the Senate and each committee of the House 

13 of Representatives that has jurisdiction over the Commis14 sion a report on the processes of platforms that offer mo15 bile and online applications for ensuring that, of those ap16 plications that are directed to children or teens, the appli17 cations operate in accordance with— 

18 (1) this Act, the amendments made by this Act, 

19 and rules promulgated under this Act; and 

20 (2) rules promulgated by the Commission under 

21 section 5 of the Federal Trade Commission Act (15 

22 U.S.C. 45) relating to unfair or deceptive acts or 

23 practices in marketing. 

39 

•S 1418 RS

1 SEC. 10. YOUTH PRIVACY AND MARKETING DIVISION. 

2 (a) ESTABLISHMENT.—There is established within 

3 the Commission a division to be known as the Youth Pri4 vacy and Marketing Division. 

5 (b) DIRECTOR.—The Youth Privacy and Marketing 

6 Division shall be headed by a Director. 

7 (c) DUTIES.—The Youth Privacy and Marketing Di8 vision established under subsection (a) shall be responsible 

9 for assisting the Commission to address, as it relates to 

10 this Act and the amendments made by this Act— 

11 (1) the privacy of children and teens; and 

12 (2) marketing directed at children and teens. 

13 (d) STAFF.—The Director of the Youth Privacy and 

14 Marketing Division shall hire adequate staff to carry out 

15 the duties under subsection (c), including individuals who 

16 are experts in data protection, digital advertising, data 

17 analytics, and youth development. 

18 (e) REPORTS.—Not later than 1 year after the date 

19 of enactment of this Act, and each year thereafter, the 

20 Director of the Youth and Privacy Marketing Division 

21 shall submit to the Committee on Commerce, Science, and 

22 Transportation of the Senate and the Committee on En23 ergy and Commerce of the House of Representatives a re24 port that includes— 

25 (1) a description of the work of the Youth Pri26 vacy and Marketing Division on emerging concerns 

40 

•S 1418 RS

1 relating to youth privacy and marketing practices; 

2 and 

3 (2) an assessment of how effectively the Com4 mission has, during the period for which the report 

5 is submitted, addressed youth privacy and marketing 

6 practices. 

7 SEC. 11. ENFORCEMENT AND APPLICABILITY. 

8 (a) ENFORCEMENT BY THE COMMISSION.— 

9 (1) IN GENERAL.—Except as otherwise pro10 vided, this Act and the regulations prescribed under 

11 this Act shall be enforced by the Commission under 

12 the Federal Trade Commission Act (15 U.S.C. 41 et 

13 seq.). 

14 (2) UNFAIR OR DECEPTIVE ACTS OR PRAC15 TICES.—Subject to subsection (b), a violation of this 

16 Act or a regulation prescribed under this Act shall 

17 be treated as a violation of a rule defining an unfair 

18 or deceptive act or practice prescribed under section 

19 18(a)(1)(B) of the Federal Trade Commission Act 

20 (15 U.S.C. 57a(a)(1)(B)). 

21 (3) ACTIONS BY THE COMMISSION.— 

22 (A) IN GENERAL.—Subject to subsection 

23 (b), and except as provided in subsection (d)(1), 

24 the Commission shall prevent any person from 

25 violating this Act or a regulation prescribed 

41 

•S 1418 RS

1 under this Act in the same manner, by the 

2 same means, and with the same jurisdiction, 

3 powers, and duties as though all applicable 

4 terms and provisions of the Federal Trade 

5 Commission Act (15 U.S.C. 41 et seq.) were in6 corporated into and made a part of this Act, 

7 and any person who violates this Act or such 

8 regulation shall be subject to the penalties and 

9 entitled to the privileges and immunities pro10 vided in the Federal Trade Commission Act. 

11 (B) VIOLATIONS.—Notwithstanding sec12 tion 5(m) of the Federal Trade Commission Act 

13 (15 U.S.C. 45(m)), a civil penalty recovered for 

14 a violation of this Act or a regulation prescribed 

15 under this Act may be in excess of the amounts 

16 provided for in that section as the court finds 

17 appropriate to deter violations of this Act and 

18 regulations prescribed under this Act. 

19 (b) ENFORCEMENT BY CERTAIN OTHER AGEN20 CIES.—Notwithstanding subsection (a), compliance with 

21 the requirements imposed under this Act shall be enforced 

22 as follows: 

23 (1) Under section 8 of the Federal Deposit In24 surance Act (12 U.S.C. 1818) by the appropriate 

25 Federal banking agency, with respect to an insured 

42 

•S 1418 RS

1 depository institution (as such terms are defined in 

2 section 3 of such Act (12 U.S.C. 1813)). 

3 (2) Under the Federal Credit Union Act (12 

4 U.S.C. 1751 et seq.) by the National Credit Union 

5 Administration Board, with respect to any Federal 

6 credit union. 

7 (3) Under part A of subtitle VII of title 49, 

8 United States Code, by the Secretary of Transpor9 tation, with respect to any air carrier or foreign air 

10 carrier subject to such part. 

11 (4) Under the Packers and Stockyards Act, 

12 1921 (7 U.S.C. 181 et seq.) (except as provided in 

13 section 406 of that Act (7 U.S.C. 226, 227)) by the 

14 Secretary of Agriculture, with respect to any activi15 ties subject to that Act. 

16 (5) Under the Farm Credit Act of 1971 (12 

17 U.S.C. 2001 et seq.) by the Farm Credit Adminis18 tration, with respect to any Federal land bank, Fed19 eral land bank association, Federal intermediate 

20 credit bank, or production credit association. 

21 (c) ENFORCEMENT BY STATE ATTORNEYS GEN22 ERAL.— 

23 (1) IN GENERAL.— 

24 (A) CIVIL ACTIONS.—In any case in which 

25 the attorney general of a State has reason to 

43 

•S 1418 RS

1 believe that an interest of the residents of that 

2 State has been or is threatened or adversely af3 fected by the engagement of any person in a 

4 practice that violates this Act or a regulation 

5 prescribed under this Act, the State, as parens 

6 patriae, may bring a civil action on behalf of 

7 the residents of the State in a district court of 

8 the United States of appropriate jurisdiction 

9 to— 

10 (i) enjoin that practice; 

11 (ii) enforce compliance with this Act 

12 or such regulation; 

13 (iii) obtain damages, restitution, or 

14 other compensation on behalf of residents 

15 of the State; or 

16 (iv) obtain such other relief as the 

17 court may consider to be appropriate. 

18 (B) NOTICE.— 

19 (i) IN GENERAL.—Before filing an ac20 tion under subparagraph (A), the attorney 

21 general of the State involved shall provide 

22 to the Commission— 

23 (I) written notice of that action; 

24 and 

44 

•S 1418 RS

1 (II) a copy of the complaint for 

2 that action. 

3 (ii) EXEMPTION.— 

4 (I) IN GENERAL.—Clause (i) 

5 shall not apply with respect to the fil6 ing of an action by an attorney gen7 eral of a State under this paragraph 

8 if the attorney general of the State 

9 determines that it is not feasible to 

10 provide the notice described in that 

11 clause before the filing of the action. 

12 (II) NOTIFICATION.—In an ac13 tion described in subclause (I), the at14 torney general of a State shall provide 

15 notice and a copy of the complaint to 

16 the Commission at the same time as 

17 the attorney general files the action. 

18 (2) INTERVENTION.— 

19 (A) IN GENERAL.—On receiving notice 

20 under paragraph (1)(B), the Commission shall 

21 have the right to intervene in the action that is 

22 the subject of the notice. 

23 (B) EFFECT OF INTERVENTION.—If the 

24 Commission intervenes in an action under para25 graph (1), it shall have the right— 

45 

•S 1418 RS

1 (i) to be heard with respect to any 

2 matter that arises in that action; and 

3 (ii) to file a petition for appeal. 

4 (3) CONSTRUCTION.—For purposes of bringing 

5 any civil action under paragraph (1), nothing in this 

6 Act shall be construed to prevent an attorney gen7 eral of a State from exercising the powers conferred 

8 on the attorney general by the laws of that State 

9 to— 

10 (A) conduct investigations; 

11 (B) administer oaths or affirmations; or 

12 (C) compel the attendance of witnesses or 

13 the production of documentary and other evi14 dence. 

15 (4) ACTIONS BY THE COMMISSION.—In any 

16 case in which an action is instituted by or on behalf 

17 of the Commission for violation of this Act or a reg18 ulation prescribed under this Act, no State may, 

19 during the pendency of that action, institute a sepa20 rate action under paragraph (1) against any defend21 ant named in the complaint in the action instituted 

22 by or on behalf of the Commission for that violation. 

23 (5) VENUE; SERVICE OF PROCESS.— 

24 (A) VENUE.—Any action brought under 

25 paragraph (1) may be brought in the district 

46 

•S 1418 RS

1 court of the United States that meets applicable 

2 requirements relating to venue under section 

3 1391 of title 28, United States Code. 

4 (B) SERVICE OF PROCESS.—In an action 

5 brought under paragraph (1), process may be 

6 served in any district in which the defendant— 

7 (i) is an inhabitant; or 

8 (ii) may be found. 

9 (d) TELECOMMUNICATIONS CARRIERS AND CABLE

10 OPERATORS.— 

11 (1) ENFORCEMENT BY COMMISSION.—Notwith12 standing section 4, 5(a)(2), or 6 of the Federal 

13 Trade Commission Act (15 U.S.C. 44, 45(a)(2), 46) 

14 or any jurisdictional limitation of the Commission, 

15 the Commission shall also enforce this Act and regu16 lations promulgated under this Act, in the same 

17 manner provided in paragraph (a), with respect to 

18 common carriers subject to the Communications Act 

19 of 1934 (47 U.S.C. 151 et seq.) and Acts amend20 atory thereof and supplementary thereto. 

21 (2) RELATIONSHIP TO OTHER LAWS.—To the 

22 extent that section 222, 338(i), or 631 of the Com23 munications Act of 1934 (47 U.S.C. 222, 338(i), 

24 551) is inconsistent with this Act, this Act controls. 

25 (e) SAFE HARBORS.— 

47 

•S 1418 RS

1 (1) DEFINITION.—In this subsection— 

2 (A) the term ‘‘applicable section’’ means 

3 section 5, 6, 7, or 8 of this Act; 

4 (B) the term ‘‘covered operator’’ means an 

5 operator subject to guidelines approved under 

6 paragraph (2); 

7 (C) the term ‘‘requesting entity’’ means an 

8 entity that submits a safe harbor request to the 

9 Commission; and 

10 (D) the term ‘‘safe harbor request’’ means 

11 a request to have self-regulatory guidelines de12 scribed in paragraph (2)(A) approved under 

13 that paragraph. 

14 (2) GUIDELINES.— 

15 (A) IN GENERAL.—An operator may sat16 isfy the requirements of regulations issued 

17 under an applicable section by following a set of 

18 self-regulatory guidelines, issued by representa19 tives of the marketing or online industries, or 

20 by other persons, that, after notice and an op21 portunity for comment, are approved by the 

22 Commission upon making a determination that 

23 the guidelines meet the requirements of the reg24 ulations issued under that applicable section. 

48 

•S 1418 RS

1 (B) EXPEDITED RESPONSE TO RE2 QUESTS.—Not later than 180 days after the 

3 date on which a safe harbor request is filed 

4 under subparagraph (A), the Commission shall 

5 act upon the request set forth in writing the 

6 conclusions of the Commission with regard to 

7 the request. 

8 (C) APPEALS.—A requesting entity may 

9 appeal the final action of the Commission under 

10 subparagraph (B), or a failure by the Commis11 sion to act in the period described in that para12 graph, to a district court of the United States 

13 of appropriate jurisdiction, as provided for in 

14 section 706 of title 5, United States Code. 

15 (3) INCENTIVES.— 

16 (A) SELF-REGULATORY INCENTIVES.—In 

17 prescribing regulations under an applicable sec18 tion, the Commission shall provide incentives 

19 for self-regulation by covered operators to im20 plement the protections afforded children and 

21 teens, as applicable, under the regulatory re22 quirements described in those sections. 

23 (B) DEEMED COMPLIANCE.—The incen24 tives under subparagraph (A) shall include pro25 visions for ensuring that a covered operator will 

49 

•S 1418 RS

1 be deemed to be in compliance with the require2 ments of the regulations under an applicable 

3 section if that person complies with guidelines 

4 approved under paragraph (2). 

5 (4) REGULATIONS.— 

6 (A) IN GENERAL.—In prescribing regula7 tions relating to safe harbor guidelines under 

8 an applicable section, the Commission shall— 

9 (i) establish criteria for the approval 

10 of guidelines that will ensure that a cov11 ered operator provides substantially the 

12 same or greater protections for children 

13 and teens, as applicable, as those contained 

14 in the regulations issued under the applica15 ble section; and 

16 (ii) subject to subsection (B), require 

17 that any report or documentation required 

18 to be submitted to the Commission by a 

19 covered operator or requesting entity will 

20 be published on the internet website of the 

21 Commission. 

22 (B) RESTRICTIONS ON PUBLICATION.— 

23 The restrictions described in subsection (f) of 

24 section 6 of the Federal Trade Commission Act 

25 (15 U.S.C. 46(f)) applicable to the publication 

50 

•S 1418 RS

1 of information obtained by the Commission 

2 through investigations conducted under such 

3 section shall apply in same manner to the publi4 cation under this paragraph of information in5 cluded in a report or documentation described 

6 in subparagraph (A). 

7 (5) REPORT BY THE INSPECTOR GENERAL.— 

8 (A) IN GENERAL.—Not later than 2 years 

9 after the date of enactment of this Act, and 

10 once each 2 years thereafter, the Inspector Gen11 eral of the Commission shall submit to the 

12 Commission and each committee of the Senate 

13 and each committee of the House of Represent14 atives that has jurisdiction over the Commission 

15 a report regarding the safe harbor provisions 

16 under this subparagraph, which shall include— 

17 (i) an analysis of whether the safe 

18 harbor provisions are— 

19 (I) operating fairly and effec20 tively; and 

21 (II) effectively protecting the in22 terests of children and teens; and 

23 (ii) proposals for policy changes that 

24 would improve the effectiveness of the safe 

25 harbor provisions. 

51 

•S 1418 RS

1 (B) PUBLICATION.—Not later than 10 

2 days after the date on which a report under 

3 subparagraph (A) is submitted, the Commission 

4 shall publish the report on the internet website 

5 of the Commission. 

6 (f) EFFECTIVE DATE.—This section shall take effect 

7 on the date that is 90 days after the date of enactment 

8 of this Act. 

9 (g) RULE OF CONSTRUCTION.—Nothing in this Act 

10 may be construed to authorize any action by the Commis11 sion that would violate section 18(h) of the Federal Trade 

12 Commission Act (15 U.S.C. 57a(h)). 

13 SEC. 12. GAO STUDY. 

14 (a) STUDY.—The Comptroller General of the United 

15 States (in this section referred to as the ‘‘Comptroller 

16 General’’) shall conduct a study on the privacy of teens 

17 who use financial technology products. Such study shall— 

18 (1) identify the type of financial technology 

19 products that teens are using; 

20 (2) identify the potential risks to teens’ privacy 

21 from using such financial technology products; and 

22 (3) determine whether existing laws are suffi23 cient to address such risks to teens’ privacy. 

24 (b) REPORT.—Not later than 1 year after the date 

25 of enactment of this section, the Comptroller General shall 

52 

•S 1418 RS

1 submit to Congress a report containing the results of the 

2 study conducted under subsection (a), together with rec3 ommendations for such legislation and administrative ac4 tion as the Comptroller General determines appropriate. 

5 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

6 (a) SHORT TITLE.—This Act may be cited as the 

7 ‘‘Children and Teens’ Online Privacy Protection Act’’. 

8 (b) TABLE OF CONTENTS.—The table of contents for 

9 this Act is as follows: 

Sec. 1. Short title; table of contents. 

Sec. 2. Online collection, use, disclosure, and deletion of personal information of 

children and teens. 

Sec. 3. Study and reports of mobile and online application oversight and enforcement. 

Sec. 4. GAO study. 

10 SEC. 2. ONLINE COLLECTION, USE, DISCLOSURE, AND DE11 LETION OF PERSONAL INFORMATION OF 

12 CHILDREN AND TEENS. 

13 (a) DEFINITIONS.—Section 1302 of the Children’s On14 line Privacy Protection Act of 1998 (15 U.S.C. 6501) is 

15 amended— 

16 (1) by amending paragraph (2) to read as fol17 lows: 

18 ‘‘(2) OPERATOR.—The term ‘operator’— 

19 ‘‘(A) means any person— 

20 ‘‘(i) who, for commercial purposes, in 

21 interstate or foreign commerce operates or 

22 provides a website on the internet, an online 

53 

•S 1418 RS

1 service, an online application, or a mobile 

2 application; and 

3 ‘‘(ii) who— 

4 ‘‘(I) collects or maintains, either 

5 directly or through a service provider, 

6 personal information from or about the 

7 users of that website, service, or appli8 cation; 

9 ‘‘(II) allows another person to col10 lect personal information directly from 

11 users of that website, service, or appli12 cation (in which case, the operator is 

13 deemed to have collected the informa14 tion); or 

15 ‘‘(III) allows users of that website, 

16 service, or application to publicly dis17 close personal information (in which 

18 case, the operator is deemed to have 

19 collected the information); and 

20 ‘‘(B) does not include any nonprofit entity 

21 that would otherwise be exempt from coverage 

22 under section 5 of the Federal Trade Commission 

23 Act (15 U.S.C. 45).’’; 

24 (2) in paragraph (4)— 

54 

•S 1418 RS

1 (A) by amending subparagraph (A) to read 

2 as follows: 

3 ‘‘(A) the release of personal information col4 lected from a child or teen by an operator for 

5 any purpose, except where the personal informa6 tion is provided to a person other than an oper7 ator who— 

8 ‘‘(i) provides support for the internal 

9 operations of the website, online service, on10 line application, or mobile application of 

11 the operator, excluding any activity relating 

12 to individual-specific advertising to chil13 dren or teens; and 

14 ‘‘(ii) does not disclose or use that per15 sonal information for any other purpose; 

16 and’’; and 

17 (B) in subparagraph (B)— 

18 (i) by inserting ‘‘or teen’’ after ‘‘child’’ 

19 each place the term appears; and 

20 (ii) by striking ‘‘website or online serv21 ice’’ and inserting ‘‘website, online service, 

22 online application, or mobile application’’; 

23 (3) by striking paragraph (8) and inserting the 

24 following: 

25 ‘‘(8) PERSONAL INFORMATION.— 

55 

•S 1418 RS

1 ‘‘(A) IN GENERAL.—The term ‘personal in2 formation’ means individually identifiable infor3 mation about an individual collected online, in4 cluding— 

5 ‘‘(i) a first and last name; 

6 ‘‘(ii) a home or other physical address 

7 including street name and name of a city or 

8 town; 

9 ‘‘(iii) an e-mail address; 

10 ‘‘(iv) a telephone number; 

11 ‘‘(v) a Social Security number; 

12 ‘‘(vi) any other identifier that the 

13 Commission determines permits the phys14 ical or online contacting of a specific indi15 vidual; 

16 ‘‘(vii) geolocation information; 

17 ‘‘(viii) information generated from the 

18 measurement or technological processing of 

19 an individual’s biological, physical, or 

20 physiological characteristics that is used to 

21 identify an individual, including— 

22 ‘‘(I) fingerprints; 

23 ‘‘(II) voice prints; 

24 ‘‘(III) iris or retina imagery 

25 scans; 

56 

•S 1418 RS

1 ‘‘(IV) facial templates; 

2 ‘‘(V) deoxyribonucleic acid (DNA) 

3 information; or 

4 ‘‘(VI) gait; 

5 ‘‘(ix) information linked or reasonably 

6 linkable to a child or teen; or 

7 ‘‘(x) information linked or reasonably 

8 linkable to a child or teen or the parents of 

9 that child or teen (including any unique 

10 identifier) that an operator collects online 

11 from the child or teen and combines with an 

12 identifier described in this subparagraph. 

13 ‘‘(B) EXCLUSION.—The term ‘personal in14 formation’ shall not include an audio file that 

15 contains a child’s or teen’s voice so long as the 

16 operator— 

17 ‘‘(i) does not request information via 

18 voice that would otherwise be considered 

19 personal information under this paragraph; 

20 ‘‘(ii) provides clear notice of its collec21 tion and use of the audio file and its dele22 tion policy in its privacy policy; 

23 ‘‘(iii) only uses the voice within the 

24 audio file solely as a replacement for writ25 ten words, to perform a task, or engage with 

57 

•S 1418 RS

1 a website, online service, online application, 

2 or mobile application, such as to perform a 

3 search or fulfill a verbal instruction or re4 quest; and 

5 ‘‘(iv) only maintains the audio file 

6 long enough to complete the stated purpose 

7 and then immediately deletes the audio file 

8 and does not make any other use of the 

9 audio file prior to deletion.’’; 

10 (4) by amending paragraph (9) to read as fol11 lows: 

12 ‘‘(9) VERIFIABLE CONSENT.—The term ‘verifiable 

13 consent’ means any reasonable effort (taking into con14 sideration available technology), including a request 

15 for authorization for future collection, use, and disclo16 sure described in the notice, to ensure that, in the case 

17 of a child, a parent of the child, or, in the case of a 

18 teen, the teen— 

19 ‘‘(A) receives specific notice of the personal 

20 information collection, use, and disclosure prac21 tices of the operator; and 

22 ‘‘(B) before the personal information of the 

23 child or teen is collected, freely and unambig24 uously authorizes— 

58 

•S 1418 RS

1 ‘‘(i) the collection, use, and disclosure, 

2 as applicable, of that personal information; 

3 and 

4 ‘‘(ii) any subsequent use of that per5 sonal information.’’; 

6 (5) in paragraph (10)— 

7 (A) in the paragraph header, by striking 

8 ‘‘WEBSITE OR ONLINE SERVICE DIRECTED TO

9 CHILDREN’’ and inserting ‘‘WEBSITE, ONLINE

10 SERVICE, ONLINE APPLICATION, OR MOBILE AP11 PLICATION DIRECTED TO CHILDREN’’; 

12 (B) by striking ‘‘website or online service’’ 

13 each place it appears and inserting ‘‘website, on14 line service, online application, or mobile appli15 cation’’; and 

16 (C) by adding at the end the following new 

17 subparagraph: 

18 ‘‘(C) RULE OF CONSTRUCTION.—In consid19 ering whether a website, online service, online 

20 application, or mobile application is directed to 

21 children, the Commission shall, using competent 

22 and reliable empirical evidence, apply a totality 

23 of circumstances test to consider the intended au24 dience of the website, online service, online appli25 cation, or mobile application, as a whole.’’; and 

59 

•S 1418 RS

1 (6) by adding at the end the following: 

2 ‘‘(13) CONNECTED DEVICE.—The term ‘connected 

3 device’ means a device that is capable of connecting 

4 to the internet, directly or indirectly, or to another 

5 connected device. 

6 ‘‘(14) ONLINE APPLICATION.—The term ‘online 

7 application’— 

8 ‘‘(A) means an internet-connected software 

9 program; and 

10 ‘‘(B) includes a service or application of11 fered via a connected device. 

12 ‘‘(15) MOBILE APPLICATION.—The term ‘mobile 

13 application’— 

14 ‘‘(A) means a software program that runs 

15 on the operating system of— 

16 ‘‘(i) a cellular telephone; 

17 ‘‘(ii) a tablet computer; or 

18 ‘‘(iii) a similar portable computing de19 vice that transmits data over a wireless con20 nection; and 

21 ‘‘(B) includes a service or application of22 fered via a connected device. 

23 ‘‘(16) GEOLOCATION INFORMATION.—The term 

24 ‘geolocation information’ means information suffiVerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00059 Fmt 6652 Sfmt 6203 E:\BILLS\S1418.RS S1418
60 

•S 1418 RS

1 cient to identify a street name and name of a city or 

2 town. 

3 ‘‘(17) TEEN.—The term ‘teen’ means an indi4 vidual over the age of 12 and under the age of 17. 

5 ‘‘(18) INDIVIDUAL-SPECIFIC ADVERTISING TO

6 CHILDREN OR TEENS.— 

7 ‘‘(A) IN GENERAL.—The term ‘individual8 specific advertising to children or teens’ means 

9 advertising or any other effort to market a prod10 uct or service that is directed to a specific child 

11 or teen or a device that is linked or reasonably 

12 linkable to a child or teen— 

13 ‘‘(i) based on— 

14 ‘‘(I) the personal information of— 

15 ‘‘(aa) the child or teen; or 

16 ‘‘(bb) a group of children or 

17 teens who are similar in sex, age, 

18 income level, race, or ethnicity to 

19 the specific child or teen to whom 

20 the product or service is marketed; 

21 ‘‘(II) psychological profiling of a 

22 child or teen or group of children or 

23 teens; or 

24 ‘‘(III) a unique identifier of the 

25 device; or 

61 

•S 1418 RS

1 ‘‘(ii) as a result of use by the child or 

2 teen, access by any device of the child or 

3 teen, or use by a group of children or teens 

4 who are similar to the specific child or teen, 

5 of more than a single— 

6 ‘‘(I) website; 

7 ‘‘(II) online service; 

8 ‘‘(III) online application; 

9 ‘‘(IV) mobile application; or 

10 ‘‘(V) connected device. 

11 ‘‘(B) EXCLUSIONS.—The term ‘individual12 specific advertising to children or teens’ shall not 

13 include— 

14 ‘‘(i) advertising or marketing to an in15 dividual or the device of an individual in 

16 response to the individual’s specific request 

17 for information or feedback, such as a 

18 child’s or teen’s current search query; 

19 ‘‘(ii) contextual advertising, such as 

20 when an advertisement is displayed based 

21 on the content of the website, online service, 

22 online application, mobile application, or 

23 connected device in which the advertisement 

24 appears and does not vary based on per25 sonal information related to the viewer; or 

62 

•S 1418 RS

1 ‘‘(iii) processing personal information 

2 solely for measuring or reporting adver3 tising or content performance, reach, or fre4 quency, including independent measure5 ment. 

6 ‘‘(C) RULE OF CONSTRUCTION.—Nothing in 

7 subparagraph (A) shall be construed to prohibit 

8 an operator with actual knowledge or knowledge 

9 fairly implied on the basis of objective cir10 cumstances that an individual is under the age 

11 of 17 from delivering advertising or marketing 

12 that is age-appropriate and intended for a child 

13 or teen audience, so long as the operator does not 

14 use any personal information other than whether 

15 the user is under the age of 17.’’. 

16 (b) ONLINE COLLECTION, USE, DISCLOSURE, AND DE17 LETION OF PERSONAL INFORMATION OF CHILDREN AND

18 TEENS.—Section 1303 of the Children’s Online Privacy 

19 Protection Act of 1998 (15 U.S.C. 6502) is amended— 

20 (1) by striking the heading and inserting the fol21 lowing: ‘‘ONLINE COLLECTION, USE, DISCLO22 SURE, AND DELETION OF PERSONAL INFORMA23 TION OF CHILDREN AND TEENS.’’; 

24 (2) in subsection (a)— 

63 

•S 1418 RS

1 (A) by amending paragraph (1) to read as 

2 follows: 

3 ‘‘(1) IN GENERAL.—It is unlawful for an oper4 ator of a website, online service, online application, 

5 or mobile application directed to children or for any 

6 operator of a website, online service, online applica7 tion, or mobile application with actual knowledge or 

8 knowledge fairly implied on the basis of objective cir9 cumstances— 

10 ‘‘(A) to collect personal information from a 

11 child or teen in a manner that violates the regu12 lations prescribed under subsection (b); 

13 ‘‘(B) to collect, use, disclose to third parties, 

14 or compile personal information of a child or 

15 teen for purposes of individual-specific adver16 tising to children or teens (or to allow another 

17 person to collect, use, disclose, or compile such 

18 information for such purpose); 

19 ‘‘(C) to collect the personal information of a 

20 child or teen except when the collection of the 

21 personal information is— 

22 ‘‘(i) consistent with the context of a 

23 particular or service or the relationship of 

24 the child or teen with the operator, includ25 ing collection necessary to fulfill a transVerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00063 Fmt 6652 Sfmt 6203 E:\BILLS\S1418.RS S1418
64 

•S 1418 RS

1 action or provide a product or service re2 quested by the child or teen; or 

3 ‘‘(ii) required or specifically authorized 

4 by Federal or State law; or 

5 ‘‘(D) to store or transfer the personal infor6 mation of a child or teen outside of the United 

7 States unless the operator discloses to the child or 

8 teen involved that their personal information is 

9 being stored or transferred outside of the United 

10 States; or 

11 ‘‘(E) to retain the personal information of 

12 a child or teen for longer than is reasonably nec13 essary to fulfill a transaction or provide a serv14 ice requested by the child or teen except as re15 quired or specifically authorized by Federal or 

16 State law.’’; and 

17 (B) in paragraph (2)— 

18 (i) by striking ‘‘Notwithstanding para19 graph (1)’’ and inserting ‘‘Notwithstanding 

20 paragraph (1)(A)’’; 

21 (ii) by striking ‘‘of such a website or 

22 online service’’; and 

23 (iii) by striking ‘‘subsection 

24 (b)(1)(B)(iii) to the parent of a child’’ and 

25 inserting ‘‘subsection (b)(1)(B)(iii) to the 

65 

•S 1418 RS

1 parent of a child or under subsection 

2 (b)(1)(C)(iii) to a teen’’; 

3 (3) in subsection (b)— 

4 (A) in paragraph (1)— 

5 (i) in subparagraph (A)— 

6 (I) by striking ‘‘operator of any 

7 website’’ and all that follows through 

8 ‘‘from a child’’ and inserting ‘‘operator 

9 of a website, online service, online ap10 plication, or mobile application di11 rected to children or that has actual 

12 knowledge or knowledge fairly implied 

13 on the basis of objective circumstances 

14 that it is collecting personal informa15 tion from children or teens’’; 

16 (II) in clause (i)— 

17 (aa) by striking ‘‘notice on 

18 the website’’ and inserting ‘‘clear 

19 and conspicuous notice’’; 

20 (bb) by inserting ‘‘or teens’’ 

21 after ‘‘children’’; 

22 (cc) by striking ‘‘, and the 

23 operator’s’’ and inserting ‘‘, the 

24 operator’s’’; and 

66 

•S 1418 RS

1 (dd) by striking ‘‘; and’’ and 

2 inserting ‘‘, the rights and oppor3 tunities available to the parent of 

4 the child or teen under subpara5 graphs (B) and (C), and the pro6 cedures or mechanisms the oper7 ator uses to ensure that personal 

8 information is not collected from 

9 children or teens except in accord10 ance with the regulations promul11 gated under this paragraph;’’; 

12 (III) in clause (ii)— 

13 (aa) by striking ‘‘parental’’; 

14 (bb) by inserting ‘‘or teens’’ 

15 after ‘‘children’’; 

16 (cc) by striking the semicolon 

17 at the end and inserting ‘‘; and’’; 

18 and 

19 (IV) by inserting after clause (ii) 

20 the following new clause: 

21 ‘‘(iii) to obtain verifiable consent from 

22 a parent of a child or a teen before using 

23 or disclosing personal information of the 

24 child or teen for any purpose that is a ma25 terial change from the original purposes 

67 

•S 1418 RS

1 and disclosure practices specified to the par2 ent of the child or the teen under clause 

3 (i);’’; 

4 (ii) in subparagraph (B)— 

5 (I) in the matter preceding clause 

6 (i), by striking ‘‘website or online serv7 ice’’ and inserting ‘‘operator’’; 

8 (II) in clause (i), by inserting 

9 ‘‘and the method by which the operator 

10 obtained the personal information, and 

11 the purposes for which the operator col12 lects, uses, discloses, and retains the 

13 personal information’’ before the semi14 colon; 

15 (III) in clause (ii)— 

16 (aa) by inserting ‘‘to delete 

17 personal information collected 

18 from the child or content or infor19 mation submitted by the child to 

20 a website, online service, online 

21 application, or mobile application 

22 and’’ after ‘‘the opportunity at 

23 any time’’; and 

24 (bb) by striking ‘‘; and’’ and 

25 inserting a semicolon; 

68 

•S 1418 RS

1 (IV) by redesignating clause (iii) 

2 as clause (iv) and inserting after 

3 clause (ii) the following new clause: 

4 ‘‘(iii) the opportunity to challenge the 

5 accuracy of the personal information and, if 

6 the parent of the child establishes the inac7 curacy of the personal information, to have 

8 the inaccurate personal information cor9 rected;’’; and 

10 (V) in clause (iv), as so redesig11 nated, by inserting ‘‘, if such informa12 tion is available to the operator at the 

13 time the parent makes the request’’ be14 fore the semicolon; 

15 (iii) by redesignating subparagraphs 

16 (C) and (D) as subparagraphs (D) and (E), 

17 respectively; 

18 (iv) by inserting after subparagraph 

19 (B) the following new subparagraph: 

20 ‘‘(C) require the operator to provide, upon 

21 the request of a teen under this subparagraph 

22 who has provided personal information to the 

23 operator, upon proper identification of that 

24 teen— 

69 

•S 1418 RS

1 ‘‘(i) a description of the specific types 

2 of personal information collected from the 

3 teen by the operator, the method by which 

4 the operator obtained the personal informa5 tion, and the purposes for which the oper6 ator collects, uses, discloses, and retains the 

7 personal information; 

8 ‘‘(ii) the opportunity at any time to 

9 delete personal information collected from 

10 the teen or content or information submitted 

11 by the teen to a website, online service, on12 line application, or mobile application and 

13 to refuse further use or collection of personal 

14 information from the teen; 

15 ‘‘(iii) the opportunity to challenge the 

16 accuracy of the personal information and, if 

17 the parent of the child establishes the inac18 curacy of the personal information, to have 

19 the inaccurate personal information cor20 rected; and 

21 ‘‘(iv) a means that is reasonable under 

22 the circumstances for the teen to obtain any 

23 personal information collected from the teen, 

24 if such information is available to the operVerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00069 Fmt 6652 Sfmt 6203 E:\BILLS\S1418.RS S1418
70 

•S 1418 RS

1 ator at the time the teen makes the re2 quest;’’; and 

3 (v) by amending subparagraph (E), as 

4 so redesignated, to read as follows: 

5 ‘‘(E) require the operator to establish, im6 plement, and maintain reasonable security prac7 tices to protect the confidentiality, integrity, and 

8 accessibility of personal information of children 

9 or teens collected by the operator, and to protect 

10 such personal information against unauthorized 

11 access.’’; 

12 (B) in paragraph (2)— 

13 (i) in the matter preceding subpara14 graph (A), by striking ‘‘verifiable parental 

15 consent’’ and inserting ‘‘verifiable consent’’; 

16 (ii) in subparagraph (A)— 

17 (I) by inserting ‘‘or teen’’ after 

18 ‘‘collected from a child’’; 

19 (II) by inserting ‘‘or teen’’ after 

20 ‘‘request from the child’’; and 

21 (III) by inserting ‘‘or teen or to 

22 contact another child or teen’’ after ‘‘to 

23 recontact the child’’; 

24 (iii) in subparagraph (B)— 

71 

•S 1418 RS

1 (I) by striking ‘‘parent or child’’ 

2 and inserting ‘‘parent or teen’’; and 

3 (II) by striking ‘‘parental con4 sent’’ each place the term appears and 

5 inserting ‘‘verifiable consent’’; 

6 (iv) in subparagraph (C)— 

7 (I) in the matter preceding clause 

8 (i), by inserting ‘‘or teen’’ after ‘‘child’’ 

9 each place the term appears; 

10 (II) in clause (i)— 

11 (aa) by inserting ‘‘or teen’’ 

12 after ‘‘child’’ each place the term 

13 appears; and 

14 (bb) by inserting ‘‘or teen, as 

15 applicable,’’ after ‘‘parent’’ each 

16 place the term appears; and 

17 (III) in clause (ii), by inserting 

18 ‘‘or teen’’ after ‘‘child’’ each place the 

19 term appears; and 

20 (v) in subparagraph (D)— 

21 (I) in the matter preceding clause 

22 (i), by inserting ‘‘or teen’’ after ‘‘child’’ 

23 each place the term appears; 

24 (II) in clause (ii), by inserting 

25 ‘‘or teen’’ after ‘‘child’’; and 

72 

•S 1418 RS

1 (III) in the flush text following 

2 clause (iii)— 

3 (aa) by inserting ‘‘or teen, as 

4 applicable,’’ after ‘‘parent’’ each 

5 place the term appears; and 

6 (bb) by inserting ‘‘or teen’’ 

7 after ‘‘child’’; and 

8 (C) by adding after paragraph (3) the fol9 lowing: 

10 ‘‘(4) CONTINUATION OF SERVICE.—The regula11 tions shall prohibit an operator from discontinuing 

12 service provided to a child or teen on the basis of a 

13 request by the parent of the child or by the teen, 

14 under the regulations prescribed under subparagraph 

15 (B) or (C) of paragraph (1), respectively, to delete 

16 personal information collected from the child or teen, 

17 to the extent that the operator is capable of providing 

18 such service without such information. 

19 ‘‘(5) RULE OF CONSTRUCTION.—A request made 

20 pursuant to subparagraph (B) or (C) of paragraph 

21 (1) to delete personal information of a child or teen 

22 shall not be construed— 

23 ‘‘(A) to limit the authority of a law enforce24 ment agency to obtain any content or informa25 tion from an operator pursuant to a lawfully exVerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00072 Fmt 6652 Sfmt 6203 E:\BILLS\S1418.RS S1418
73 

•S 1418 RS

1 ecuted warrant or an order of a court of com2 petent jurisdiction; 

3 ‘‘(B) to require an operator or third party 

4 delete information that— 

5 ‘‘(i) any other provision of Federal or 

6 State law requires the operator or third 

7 party to maintain; or 

8 ‘‘(ii) was submitted to the website, on9 line service, online application, or mobile 

10 application of the operator by any person 

11 other than the user who is attempting to 

12 erase or otherwise eliminate the content or 

13 information, including content or informa14 tion submitted by the user that was repub15 lished or resubmitted by another person; or 

16 ‘‘(C) prohibit an operator from— 

17 ‘‘(i) retaining a record of the deletion 

18 request and the minimum information nec19 essary for the purposes of ensuring compli20 ance with a request made pursuant to sub21 paragraph (B) or (C); or 

22 ‘‘(ii) ensuring that the child or teen’s 

23 information remains deleted.’’; and 

24 (4) in subsection (c), by striking ‘‘a regulation 

25 prescribed under subsection (a)’’ and inserting ‘‘subVerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00073 Fmt 6652 Sfmt 6203 E:\BILLS\S1418.RS S1418
74 

•S 1418 RS

1 paragraph (B), (C), (D), or (E) of subsection (a)(1), 

2 or a of a regulation prescribed under subparagraph 

3 (A) of such subsection,’’. 

4 (c) SAFE HARBORS.—Section 1304 of the Children’s 

5 Online Privacy Protection Act of 1998 (15 U.S.C. 6503) 

6 is amended— 

7 (1) in subsection (b)(1), by inserting ‘‘and teens’’ 

8 after ‘‘children’’; and 

9 (2) by adding at the end the following: 

10 ‘‘(d) PUBLICATION.— 

11 ‘‘(1) IN GENERAL.—The Commission shall pub12 lish on the internet website of the Commission any re13 port or documentation required by regulation to be 

14 submitted to the Commission to carry out this section. 

15 ‘‘(2) RESTRICTIONS ON PUBLICATION.—The re16 strictions described in subsection (f) of section 6 of the 

17 Federal Trade Commission Act (15 U.S.C. 46(f)) ap18 plicable to the publication of information obtained by 

19 the Commission through investigations conducted 

20 under such section shall apply in same manner to the 

21 publication under this subsection of information ob22 tained by the Commission from a report or docu23 mentation described in paragraph (1).’’. 

75 

•S 1418 RS

1 (d) ADMINISTRATION AND APPLICABILITY OF ACT.— 

2 Section 1306 of the Children’s Online Privacy Protection 

3 Act of 1998 (15 U.S.C. 6505) is amended— 

4 (1) in subsection (b)— 

5 (A) in paragraph (1), by striking ‘‘, in the 

6 case of’’ and all that follows through ‘‘the Board 

7 of Directors of the Federal Deposit Insurance 

8 Corporation;’’ and inserting the following: ‘‘by 

9 the appropriate Federal banking agency, with re10 spect to any insured depository institution (as 

11 those terms are defined in section 3 of that Act 

12 (12 U.S.C. 1813));’’; and 

13 (B) by striking paragraph (2) and redesig14 nating paragraphs (3) through (6) as para15 graphs (2) through (5), respectively; and 

16 (2) by adding at the end the following new sub17 sections: 

18 ‘‘(f) DETERMINATION OF WHETHER AN OPERATOR

19 HAS KNOWLEDGE FAIRLY IMPLIED ON THE BASIS OF OB20 JECTIVE CIRCUMSTANCES.— 

21 ‘‘(1) RULE OF CONSTRUCTION.—For purposes of 

22 enforcing this Act or a regulation promulgated under 

23 this Act, in making a determination as to whether an 

24 operator has knowledge fairly implied on the basis of 

25 objective circumstances that a user is a child or teen, 

76 

•S 1418 RS

1 the Commission shall rely on competent and reliable 

2 empirical evidence, taking into account the totality of 

3 the circumstances, including consideration of whether 

4 the operator, using available technology, exercised rea5 sonable care. 

6 ‘‘(2) PROTECTIONS FOR PRIVACY.—Nothing in 

7 the Commission’s determination under paragraph (1) 

8 shall be construed to require an operator to— 

9 ‘‘(A) affirmatively collect any personal in10 formation with respect to the age of a child or 

11 teen that an operator is not already collecting in 

12 the normal course of business; or 

13 ‘‘(B) implement an age gating or age 

14 verification functionality. 

15 ‘‘(3) COMMISSION GUIDANCE.— 

16 ‘‘(A) IN GENERAL.—Within 180 days of en17 actment, the Commission shall issue guidance to 

18 provide information, including best practices 

19 and examples for operators to understand the 

20 Commission’s determination of whether an oper21 ator has knowledge fairly implied on the basis of 

22 objective circumstances. 

23 ‘‘(B) LIMITATION.—No guidance issued by 

24 the Commission with respect to this Act shall 

25 confer any rights on any person, State, or localVerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00076 Fmt 6652 Sfmt 6203 E:\BILLS\S1418.RS S1418
77 

•S 1418 RS

1 ity, nor shall operate to bind the Commission or 

2 any person to the approach recommended in 

3 such guidance. In any enforcement action 

4 brought pursuant to this Act, the Commission 

5 shall allege a specific violation of a provision of 

6 this Act. The Commission may not base an en7 forcement action on, or execute a consent order 

8 based on, practices that are alleged to be incon9 sistent with any such guidance, unless the prac10 tices allegedly violate this Act. 

11 ‘‘(g) ADDITIONAL REQUIREMENT.—Any regulations 

12 issued under this Act shall include a description and anal13 ysis of the impact of proposed and final Rules on small 

14 entities per the Regulatory Flexibility Act of 1980 (5 U.S.C. 

15 601 et seq.).’’. 

16 SEC. 3. STUDY AND REPORTS OF MOBILE AND ONLINE AP17 PLICATION OVERSIGHT AND ENFORCEMENT. 

18 (a) OVERSIGHT REPORT.—Not later than 3 years after 

19 the date of enactment of this Act, the Federal Trade Com20 mission shall submit to the Committee on Commerce, 

21 Science, and Transportation of the Senate and the Com22 mittee on Energy and Commerce of the House of Represent23 atives a report on the processes of platforms that offer mo24 bile and online applications for ensuring that, of those ap25 plications that are websites, online services, online applicaVerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00077 Fmt 6652 Sfmt 6203 E:\BILLS\S1418.RS S1418
78 

•S 1418 RS

1 tions, or mobile applications directed to children, the appli2 cations operate in accordance with— 

3 (1) this Act, the amendments made by this Act, 

4 and rules promulgated under this Act; and 

5 (2) rules promulgated by the Commission under 

6 section 5 of the Federal Trade Commission Act (15 

7 U.S.C. 45) relating to unfair or deceptive acts or 

8 practices in marketing. 

9 (b) ENFORCEMENT REPORT.—Not later than 1 year 

10 after the date of enactment of this Act, and each year there11 after, the Federal Trade Commission shall submit to the 

12 Committee on Commerce, Science, and Transportation of 

13 the Senate and the Committee on Energy and Commerce 

14 of the House of Representatives a report that addresses, at 

15 a minimum— 

16 (1) the number of actions brought by the Com17 mission during the reporting year to enforce the Chil18 dren’s Online Privacy Protection Act of 1998 (15 

19 U.S.C. 6501) (referred to in this subsection as the 

20 ‘‘Act’’) and the outcome of each such action; 

21 (2) the total number of investigations or inquir22 ies into potential violations of the Act; during the re23 porting year; 

79 

•S 1418 RS

1 (3) the total number of open investigations or in2 quiries into potential violations of the Act as of the 

3 time the report is submitted; 

4 (4) the number and nature of complaints re5 ceived by the Commission relating to an allegation of 

6 a violation of the Act during the reporting year; and 

7 (5) policy or legislative recommendations to 

8 strengthen online protections for children and teens. 

9 SEC. 4. GAO STUDY. 

10 (a) STUDY.—The Comptroller General of the United 

11 States (in this section referred to as the ‘‘Comptroller Gen12 eral’’) shall conduct a study on the privacy of teens who 

13 use financial technology products. Such study shall— 

14 (1) identify the type of financial technology 

15 products that teens are using; 

16 (2) identify the potential risks to teens’ privacy 

17 from using such financial technology products; and 

18 (3) determine whether existing laws are suffi19 cient to address such risks to teens’ privacy. 

20 (b) REPORT.—Not later than 1 year after the date of 

21 enactment of this section, the Comptroller General shall sub22 mit to Congress a report containing the results of the study 

23 conducted under subsection (a), together with recommenda24 tions for such legislation and administrative action as the 

25 Comptroller General determines appropriate. 

Calendar No. 288 

118TH CONGRESS 

1ST SESSION S. 1418 

A BILL 

To amend the Children’s Online Privacy Protection 

other purposes. sonal information of children and teens, and for the online collection, use, and disclosure of perAct of 1998 to strengthen protections relating to 

DECEMBER 13, 2023 

Reported with an amendment