I 

116TH CONGRESS 

1ST SESSION H. R. 3900 

To amend the Children’s Online Privacy Protection Act of 1998 to strengthen 

protections relating to the online collection, use, and disclosure of personal information of children and minors, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JULY 23, 2019 

Mr. RUSH introduced the following bill; which was referred to the Committee 

on Energy and Commerce 

A BILL 

To amend the Children’s Online Privacy Protection Act of 

1998 to strengthen protections relating to the online 

collection, use, and disclosure of personal information 

of children and minors, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. TABLE OF CONTENTS. 

4 The table of contents for this Act is as follows: 

Sec. 1. Table of contents. 

Sec. 2. Definitions. 

Sec. 3. Online collection, use, and disclosure of personal information of children 

and minors. 

Sec. 4. Fair Information Practices Principles. 

Sec. 5. Digital Marketing Bill of Rights for Minors. 

Sec. 6. Targeted marketing to children or minors. 

Sec. 7. Removal of content. 

Sec. 8. Privacy dashboard for connected devices for children and minors. 


kjohnson on DSK79L0C42 with BILLS
2 

•HR 3900 IH

Sec. 9. Prohibition on sale of connected devices for children and minors that 

fail to meet appropriate cybersecurity and data security standards. 

Sec. 10. Rule for treatment of users of websites, services, and applications directed to children or minors. 

Sec. 11. Study of mobile and online application oversight. 

Sec. 12. Youth Privacy and Marketing Division. 

Sec. 13. Enforcement and applicability. 

1 SEC. 2. DEFINITIONS. 

2 (a) IN GENERAL.—In this Act: 

3 (1) COMMISSION.—The term ‘‘Commission’’ 

4 means the Federal Trade Commission. 

5 (2) STANDARDS.—The term ‘‘standards’’ means 

6 benchmarks, guidelines, best practices, methodolo7 gies, procedures, and processes. 

8 (b) OTHER DEFINITIONS.—The definitions set forth 

9 in section 1302 of the Children’s Online Privacy Protec10 tion Act of 1998 (15 U.S.C. 6501), as amended by section 

11 3(a) of this Act, shall apply in this Act, except to the ex12 tent the Commission provides otherwise by regulations 

13 issued under section 553 of title 5, United States Code. 

14 SEC. 3. ONLINE COLLECTION, USE, AND DISCLOSURE OF 

15 PERSONAL INFORMATION OF CHILDREN AND 

16 MINORS. 

17 (a) DEFINITIONS.—Section 1302 of the Children’s 

18 Online Privacy Protection Act of 1998 (15 U.S.C. 6501) 

19 is amended— 

20 (1) by amending paragraph (2) to read as fol21 lows: 


kjohnson on DSK79L0C42 with BILLS
3 

•HR 3900 IH

1 ‘‘(2) OPERATOR.—The term ‘operator’— 

2 ‘‘(A) means any person— 

3 ‘‘(i) who, for commercial purposes, in 

4 interstate or foreign commerce operates or 

5 provides a website on the internet, an on6 line service, an online application, or a mo7 bile application; and 

8 ‘‘(ii) who— 

9 ‘‘(I) collects or maintains, either 

10 directly or through a service provider, 

11 personal information from or about 

12 the users of that website, service, ap13 plication, or connected device; 

14 ‘‘(II) allows another person to 

15 collect personal information directly 

16 from users of that website, service, 

17 application, or connected device (in 

18 which case, the operator is deemed to 

19 have collected the information); or 

20 ‘‘(III) allows users of that 

21 website, service, application, or con22 nected device to publicly disclose per23 sonal information (in which case, the 

24 operator is deemed to have collected 

25 the information); and 


kjohnson on DSK79L0C42 with BILLS
4 

•HR 3900 IH

1 ‘‘(B) does not include any nonprofit entity 

2 that would otherwise be exempt from coverage 

3 under section 5 of the Federal Trade Commis4 sion Act (15 U.S.C. 45).’’; 

5 (2) in paragraph (4)— 

6 (A) by amending subparagraph (A) to read 

7 as follows: 

8 ‘‘(A) the release of personal information 

9 collected from a child or minor for any purpose, 

10 except where the personal information is pro11 vided to a person other than an operator who— 

12 ‘‘(i) provides support for the internal 

13 operations of the website, online service, 

14 online application, or mobile application of 

15 the operator, excluding any activity relat16 ing to targeted marketing directed to chil17 dren, minors, or connected devices; and 

18 ‘‘(ii) does not disclose or use that per19 sonal information for any other purpose; 

20 and’’; and 

21 (B) in subparagraph (B)— 

22 (i) by inserting ‘‘or minor’’ after 

23 ‘‘child’’ each place the term appears; 

24 (ii) by inserting ‘‘or minors’’ after 

25 ‘‘children’’; and 


kjohnson on DSK79L0C42 with BILLS
5 

•HR 3900 IH

1 (iii) by striking ‘‘website or online 

2 service’’ and inserting ‘‘website, online 

3 service, online application, or mobile appli4 cation’’; 

5 (3) in paragraph (8), by striking subparagraphs 

6 (F) and (G) and inserting the following: 

7 ‘‘(F) geolocation information; 

8 ‘‘(G) information used for biometric identi9 fication, as defined in section 70123 of title 46, 

10 United States Code, of an individual; 

11 ‘‘(H) information reasonably associated 

12 with or attributed to an individual; 

13 ‘‘(I) information (including an internet 

14 protocol address) that permits the identification 

15 of— 

16 ‘‘(i) an individual; or 

17 ‘‘(ii) any device used by an individual 

18 to directly or indirectly access the internet 

19 or an online service, online application, or 

20 mobile application; or 

21 ‘‘(J) information concerning a child or 

22 minor or the parents of that child or minor (in23 cluding any unique or substantially unique iden24 tifier, such as a customer number) that an op25 erator collects online from the child or minor 


kjohnson on DSK79L0C42 with BILLS
6 

•HR 3900 IH

1 and combines with an identifier described in 

2 this paragraph.’’; 

3 (4) by amending paragraph (9) to read as fol4 lows: 

5 ‘‘(9) VERIFIABLE CONSENT.—The term 

6 ‘verifiable consent’ means any reasonable effort (tak7 ing into consideration available technology), includ8 ing a request for authorization for future collection, 

9 use, and disclosure described in the notice, to ensure 

10 that, in the case of a child, a parent of the child, 

11 or, in the case of a minor, the minor— 

12 ‘‘(A) receives specific notice of the personal 

13 information collection, use, and disclosure prac14 tices of the operator; and 

15 ‘‘(B) before the personal information of the 

16 child or minor is collected, freely and unambig17 uously authorizes— 

18 ‘‘(i) the collection, use, and disclosure, 

19 as applicable, of that personal information; 

20 and 

21 ‘‘(ii) any subsequent use of that per22 sonal information.’’; 

23 (5) by striking paragraph (10) and redesig24 nating paragraphs (11) and (12) as paragraphs (10) 

25 and (11), respectively; and 


kjohnson on DSK79L0C42 with BILLS
7 

•HR 3900 IH

1 (6) by adding at the end the following: 

2 ‘‘(12) CONNECTED DEVICE.—The term ‘con3 nected device’ means a device that is capable of con4 necting to the internet, directly or indirectly, or to 

5 another connected device. 

6 ‘‘(13) ONLINE.—The term ‘online’ means— 

7 ‘‘(A) connected to or compatible with the 

8 internet; or 

9 ‘‘(B) via the internet. 

10 ‘‘(14) ONLINE APPLICATION.—The term ‘online 

11 application’— 

12 ‘‘(A) means an internet-connected software 

13 program; and 

14 ‘‘(B) includes a service or application of15 fered via a connected device. 

16 ‘‘(15) ONLINE SERVICE.—The term ‘online 

17 service’— 

18 ‘‘(A) means broadband internet access 

19 service, as defined in the Report and Order on 

20 Remand, Declaratory Ruling, and Order in the 

21 matter of protecting and promoting the open 

22 internet, adopted by the Federal Communica23 tions Commission on February 26, 2015 (FCC 

24 15–24); and 


kjohnson on DSK79L0C42 with BILLS
8 

•HR 3900 IH

1 ‘‘(B) includes a service or application of2 fered via a connected device. 

3 ‘‘(16) DIRECTED TO A CHILD OR MINOR.— 

4 ‘‘(A) IN GENERAL.—The terms ‘directed to 

5 a child’ or ‘directed to a minor’ means, with re6 spect to a website, online service, online applica7 tion, or mobile application, the website, online 

8 service, online application, or mobile application 

9 is targeted to children or minors, as the case 

10 may be, as demonstrated by— 

11 ‘‘(i) the subject matter of the website, 

12 online service, online application, or mobile 

13 application; 

14 ‘‘(ii) the visual content of the website, 

15 online service, online application, or mobile 

16 application; 

17 ‘‘(iii) the use of animated characters 

18 or child-oriented activities for children, or 

19 the use of minor-oriented characters or 

20 minor-oriented activities for minors, and 

21 related incentives on the website, online 

22 service, online application, or mobile appli23 cation; 


kjohnson on DSK79L0C42 with BILLS
9 

•HR 3900 IH

1 ‘‘(iv) the music or other audio content 

2 on the website, online service, online appli3 cation, or mobile application; 

4 ‘‘(v) the age of models on the website, 

5 online service, online application, or mobile 

6 application; 

7 ‘‘(vi) the presence, on the website, on8 line service, online application, or mobile 

9 application, of— 

10 ‘‘(I) child celebrities; 

11 ‘‘(II) celebrities who appeal to 

12 children; 

13 ‘‘(III) teen celebrities; or 

14 ‘‘(IV) celebrities who appeal to 

15 minors; 

16 ‘‘(vii) the language used on the 

17 website, online service, online application, 

18 or mobile application; 

19 ‘‘(viii) advertising content used on, or 

20 used to advertise, the website, online serv21 ice, online application, or mobile applica22 tion; or 

23 ‘‘(ix) reliable empirical evidence relat24 ing to— 


kjohnson on DSK79L0C42 with BILLS
10 

•HR 3900 IH

1 ‘‘(I) the composition of the audi2 ence of the website, online service, on3 line application, or mobile application; 

4 and 

5 ‘‘(II) the intended audience of 

6 the website, online service, online ap7 plication, or mobile application. 

8 ‘‘(B) RULES OF CONSTRUCTION.— 

9 ‘‘(i) SERVICES DEEMED DIRECTED TO

10 CHILDREN OR MINORS.—For the purposes 

11 of this title, a website, online service, on12 line application, or mobile application shall 

13 be deemed to be directed to children or mi14 nors if the operator of the website, online 

15 service, online application, or mobile appli16 cation has actual knowledge that the 

17 website, online service, online application, 

18 or mobile application collects personal in19 formation directly from users of any other 

20 website, online service, online application, 

21 or mobile application that is directed to 

22 children or minors under the criteria de23 scribed in subparagraph (A). 

24 ‘‘(ii) SERVICES DEEMED DIRECTED TO

25 MIXED AUDIENCES.— 


kjohnson on DSK79L0C42 with BILLS
11 

•HR 3900 IH

1 ‘‘(I) IN GENERAL.—A website, 

2 online service, online application, or 

3 mobile application that is directed to 

4 children or minors under the criteria 

5 described in subparagraph (A), but 

6 that does not target children or mi7 nors as the primary audience of the 

8 website, online service, online applica9 tion, or mobile application, shall not 

10 be deemed to be directed to children 

11 or minors for purposes of this title if 

12 the website, online service, online ap13 plication, or mobile application— 

14 ‘‘(aa) does not collect per15 sonal information from any user 

16 of the website, online service, on17 line application, or mobile appli18 cation before verifying age infor19 mation of the user; and 

20 ‘‘(bb) does not, without first 

21 complying with any relevant no22 tice and consent provision under 

23 this title, collect, use, or disclose 

24 personal information of any user 

25 who identifies themselves to the 


kjohnson on DSK79L0C42 with BILLS
12 

•HR 3900 IH

1 website, online service, online ap2 plication, or mobile application as 

3 an individual who is under the 

4 age of 16. 

5 ‘‘(II) USE OF CERTAIN TOOLS.— 

6 For purposes of this title, a website, 

7 online service, online application, or 

8 mobile application, shall not be 

9 deemed directed to children or minors 

10 solely because the website, online serv11 ice, online application, or mobile appli12 cation refers or links to any other 

13 website, online service, online applica14 tion, or mobile application directed to 

15 children or minors by using informa16 tion location tools, including— 

17 ‘‘(aa) a directory; 

18 ‘‘(bb) an index; 

19 ‘‘(cc) a reference; 

20 ‘‘(dd) a pointer; or 

21 ‘‘(ee) a hypertext link. 

22 ‘‘(17) MOBILE APPLICATION.—The term ‘mo23 bile application’— 

24 ‘‘(A) means a software program that runs 

25 on the operating system of— 


kjohnson on DSK79L0C42 with BILLS
13 

•HR 3900 IH

1 ‘‘(i) a cellular telephone; 

2 ‘‘(ii) a tablet computer; or 

3 ‘‘(iii) a similar portable computing de4 vice that transmits data over a wireless 

5 connection; and 

6 ‘‘(B) includes a service or application of7 fered via a connected device. 

8 ‘‘(18) GEOLOCATION INFORMATION.—The term 

9 ‘geolocation information’ means information suffi10 cient to identify a street name and name of a city 

11 or town. 

12 ‘‘(19) MINOR.—The term ‘minor’ means an in13 dividual over the age of 12 and under the age of 16. 

14 ‘‘(20) TARGETED MARKETING.—The term ‘tar15 geted marketing’ means advertising or any other ef16 fort to market a product or service that is directed 

17 to a specific individual or device— 

18 ‘‘(A) based on— 

19 ‘‘(i) the personal information of— 

20 ‘‘(I) the individual; or 

21 ‘‘(II) a group of individuals who 

22 are similar in gender, age, income 

23 level, race, or ethnicity to the specific 

24 individual to whom the product or 

25 service is marketed; 


kjohnson on DSK79L0C42 with BILLS
14 

•HR 3900 IH

1 ‘‘(ii) psychological profiling; or 

2 ‘‘(iii) a unique identifier of the device; 

3 and 

4 ‘‘(B) as a result of use by the individual, 

5 access by any device of the individual, or use by 

6 a group of individuals who are similar to the 

7 specific individual, of— 

8 ‘‘(i) a website; 

9 ‘‘(ii) an online service; 

10 ‘‘(iii) an online application; 

11 ‘‘(iv) a mobile application; or 

12 ‘‘(v) an operating system.’’. 

13 (b) ONLINE COLLECTION, USE, AND DISCLOSURE OF

14 PERSONAL INFORMATION OF CHILDREN AND MINORS.— 

15 Section 1303 of the Children’s Online Privacy Protection 

16 Act of 1998 (15 U.S.C. 6502) is amended— 

17 (1) by striking the heading and inserting the 

18 following: ‘‘ONLINE COLLECTION, USE, AND DIS19 CLOSURE OF PERSONAL INFORMATION OF

20 CHILDREN AND MINORS.’’; 

21 (2) in subsection (a)— 

22 (A) by amending paragraph (1) to read as 

23 follows: 

24 ‘‘(1) IN GENERAL.—It is unlawful for an oper25 ator of a website, online service, online application, 


kjohnson on DSK79L0C42 with BILLS
15 

•HR 3900 IH

1 or mobile application directed to a child or minor, or 

2 an operator having constructive knowledge that per3 sonal information being collected is from a child or 

4 minor, to collect personal information from a child 

5 or minor in a manner that violates the regulations 

6 prescribed under subsection (b).’’; and 

7 (B) in paragraph (2)— 

8 (i) by striking ‘‘of such a website or 

9 online service’’; and 

10 (ii) by striking ‘‘subsection 

11 (b)(1)(B)(iii) to the parent of a child’’ and 

12 inserting ‘‘subsection (b)(1)(A)(iii) to the 

13 parent of a child or under subsection 

14 (b)(1)(A)(iv) to a minor’’; and 

15 (3) in subsection (b)— 

16 (A) by amending paragraph (1) to read as 

17 follows: 

18 ‘‘(1) REGULATIONS.— 

19 ‘‘(A) IN GENERAL.—Not later than 1 year 

20 after the date of the enactment of the Act enti21 tled ‘An Act to amend the Children’s Online 

22 Privacy Protection Act of 1998 to strengthen 

23 protections relating to the online collection, use, 

24 and disclosure of personal information of chil25 dren and minors, and for other purposes’, the 


kjohnson on DSK79L0C42 with BILLS
16 

•HR 3900 IH

1 Commission shall promulgate, under section 

2 553 of title 5, United States Code, regulations 

3 to require an operator of a website, online serv4 ice, online application, or mobile application di5 rected to children or minors, or an operator 

6 having constructive knowledge that personal in7 formation being collected is from a child or 

8 minor— 

9 ‘‘(i) to provide clear and conspicuous 

10 notice in clear and plain language of— 

11 ‘‘(I) the types of personal infor12 mation the operator collects; 

13 ‘‘(II) how the operator uses the 

14 information; 

15 ‘‘(III) whether and why the oper16 ator discloses the information; and 

17 ‘‘(IV) the procedures or mecha18 nisms the operator uses to ensure that 

19 personal information is not collected 

20 from children or minors except in ac21 cordance with the regulations promul22 gated under this paragraph; 

23 ‘‘(ii) to obtain verifiable consent for 

24 the collection, use, or disclosure of personal 

25 information of a child or minor; 


kjohnson on DSK79L0C42 with BILLS
17 

•HR 3900 IH

1 ‘‘(iii) to provide to a parent whose 

2 child has provided personal information to 

3 the operator, upon request by and proper 

4 identification of the parent— 

5 ‘‘(I) a description of the specific 

6 types of personal information collected 

7 from the child by the operator; 

8 ‘‘(II) the opportunity at any time 

9 to delete personal information col10 lected from the child; and 

11 ‘‘(III) a means that is reasonable 

12 under the circumstances for the par13 ent to obtain any personal information 

14 collected from the child, if such infor15 mation is available to the operator at 

16 the time the parent makes the re17 quest; 

18 ‘‘(iv) to provide to a minor who has 

19 provided personal information to the oper20 ator, upon request by and proper identi21 fication of the minor— 

22 ‘‘(I) a description of the specific 

23 types of personal information collected 

24 from the minor by the operator; 


kjohnson on DSK79L0C42 with BILLS
18 

•HR 3900 IH

1 ‘‘(II) the opportunity at any time 

2 to delete personal information col3 lected from the minor; and 

4 ‘‘(III) a means that is reasonable 

5 under the circumstances for the minor 

6 to obtain any personal information 

7 collected from the minor, if such in8 formation is available to the operator 

9 at the time the minor makes the re10 quest; 

11 ‘‘(v) not to condition participation in 

12 a game, or use of a website, service, or ap13 plication, by a child or minor on the provi14 sion by the child or minor of more personal 

15 information than is reasonably required to 

16 participate in the game or use the website, 

17 service, or application; and 

18 ‘‘(vi) to establish and maintain rea19 sonable procedures to protect the confiden20 tiality, security, and integrity of personal 

21 information collected from children and mi22 nors. 

23 ‘‘(B) UPDATES.—Not less frequently than 

24 once every 4 years after the date on which reg25 ulations are promulgated under subparagraph 


kjohnson on DSK79L0C42 with BILLS
19 

•HR 3900 IH

1 (A), the Commission shall update those regula2 tions as necessary.’’; 

3 (B) in paragraph (2)— 

4 (i) in the matter preceding subpara5 graph (A), by striking ‘‘verifiable parental 

6 consent’’ and inserting ‘‘verifiable con7 sent’’; 

8 (ii) in subparagraph (A)— 

9 (I) by inserting ‘‘or minor’’ after 

10 ‘‘collected from a child’’; 

11 (II) by inserting ‘‘or minor’’ after 

12 ‘‘request from the child’’; and 

13 (III) by inserting ‘‘or minor or to 

14 contact a different child or minor’’ 

15 after ‘‘to recontact the child’’; 

16 (iii) in subparagraph (B)— 

17 (I) by striking ‘‘parent or child’’ 

18 and inserting ‘‘parent, child, or 

19 minor’’; and 

20 (II) by striking ‘‘parental con21 sent’’ each place the term appears and 

22 inserting ‘‘verifiable consent’’; 

23 (iv) in subparagraph (C)— 


kjohnson on DSK79L0C42 with BILLS
20 

•HR 3900 IH

1 (I) in the matter preceding clause 

2 (i), by inserting ‘‘or minor’’ after 

3 ‘‘child’’ each place the term appears; 

4 (II) in clause (i)— 

5 (aa) by inserting ‘‘or minor’’ 

6 after ‘‘child’’ each place the term 

7 appears; and 

8 (bb) by inserting ‘‘or minor, 

9 as applicable,’’ after ‘‘parent’’ 

10 each place the term appears; and 

11 (III) in clause (ii)— 

12 (aa) by inserting ‘‘or minor, 

13 as applicable,’’ after ‘‘parent’’; 

14 and 

15 (bb) by inserting ‘‘or minor’’ 

16 after ‘‘child’’ each place the term 

17 appears; and 

18 (v) in subparagraph (D)— 

19 (I) in the matter preceding clause 

20 (i), by inserting ‘‘or minor’’ after 

21 ‘‘child’’ each place the term appears; 

22 (II) in clause (ii), by inserting 

23 ‘‘or minor’’ after ‘‘child’’; and 

24 (III) in the flush text following 

25 clause (iii)— 


kjohnson on DSK79L0C42 with BILLS
21 

•HR 3900 IH

1 (aa) by inserting ‘‘or minor, 

2 as applicable,’’ after ‘‘parent’’ 

3 each place the term appears; and 

4 (bb) by inserting ‘‘or minor’’ 

5 after ‘‘child’’; and 

6 (C) by amending paragraph (3) to read as 

7 follows: 

8 ‘‘(3) CONTINUATION OF SERVICE.—The regula9 tions shall prohibit an operator from discontinuing 

10 service provided to a child or minor on the basis of 

11 a request by the parent of the child or by the minor, 

12 under the regulations prescribed under clauses 

13 (iii)(II) and (iv)(II), respectively, of paragraph 

14 (1)(A) to delete personal information collected from 

15 the child or minor, to the extent that the operator 

16 is capable of providing such service without such in17 formation.’’. 

18 (c) SAFE HARBORS.—Section 1304 of the Children’s 

19 Online Privacy Protection Act of 1998 (15 U.S.C. 6503) 

20 is amended— 

21 (1) in subsection (b)(1), by inserting ‘‘and mi22 nors’’ after ‘‘children’’; and 

23 (2) by adding at the end the following: 

24 ‘‘(d) PUBLICATION.—The Commission shall publish 

25 on the internet website of the Commission any report or 


kjohnson on DSK79L0C42 with BILLS
22 

•HR 3900 IH

1 documentation required by regulation to be submitted to 

2 the Commission to carry out this section, except to the 

3 extent that the report or documentation contains propri4 etary information, which the Commission may in its dis5 cretion redact.’’. 

6 (d) ADMINISTRATION AND APPLICABILITY OF ACT.— 

7 Section 1306 of the Children’s Online Privacy Protection 

8 Act of 1998 (15 U.S.C. 6505) is amended— 

9 (1) in subsection (b)— 

10 (A) in paragraph (1), by striking ‘‘, in the 

11 case of’’ and all that follows and inserting the 

12 following: ‘‘by the appropriate Federal banking 

13 agency, with respect to any insured depository 

14 institution (as those terms are defined in sec15 tion 3 of that Act (12 U.S.C. 1813));’’; and 

16 (B) by striking paragraph (2) and redesig17 nating paragraphs (3) through (6) as para18 graphs (2) through (5), respectively; and 

19 (2) by adding at the end the following new sub20 section: 

21 ‘‘(f) TELECOMMUNICATIONS CARRIERS AND CABLE

22 OPERATORS.— 

23 ‘‘(1) ENFORCEMENT BY COMMISSION.—Not24 withstanding section 5(a)(2) of the Federal Trade 

25 Commission Act (15 U.S.C. 45(a)(2)), compliance 


kjohnson on DSK79L0C42 with BILLS
23 

•HR 3900 IH

1 with the requirements imposed under this title shall 

2 be enforced by the Commission with respect to any 

3 telecommunications carrier (as defined in section 3 

4 of the Communications Act of 1934 (47 U.S.C. 

5 153)). 

6 ‘‘(2) RELATIONSHIP TO OTHER LAW.—To the 

7 extent that section 222, 338(i), or 631 of the Com8 munications Act of 1934 (47 U.S.C. 222; 338(i); 

9 551) is inconsistent with this title, this title con10 trols.’’. 

11 SEC. 4. FAIR INFORMATION PRACTICES PRINCIPLES. 

12 The Fair Information Practices Principles described 

13 in this section are the following: 

14 (1) COLLECTION LIMITATION PRINCIPLE.—Ex15 cept as provided in paragraph (3), personal informa16 tion should be collected from a child or minor only 

17 when collection of the personal information is— 

18 (A) consistent with the context of a par19 ticular transaction or service or the relationship 

20 of the child or minor with the operator, includ21 ing collection necessary to fulfill a transaction 

22 or provide a service requested by the child or 

23 minor; or 

24 (B) required or specifically authorized by 

25 law. 


kjohnson on DSK79L0C42 with BILLS
24 

•HR 3900 IH

1 (2) DATA QUALITY PRINCIPLE.—The personal 

2 information of a child or minor should be accurate, 

3 complete, and kept up-to-date to the extent nec4 essary to fulfill the purposes described in subpara5 graphs (A) through (D) of paragraph (3). 

6 (3) PURPOSE SPECIFICATION PRINCIPLE.—The 

7 purposes for which personal information is collected 

8 should be specified to the parent of a child or to a 

9 minor not later than at the time of the collection of 

10 the information. The subsequent use or disclosure of 

11 the information should be limited to— 

12 (A) fulfillment of the transaction or service 

13 requested by the child or minor; 

14 (B) support for the internal operations of 

15 the website, service, or application, as described 

16 in section 312.2 of title 16, Code of Federal 

17 Regulations, excluding any activity relating to 

18 targeted marketing directed to children, minors, 

19 or a device of a child or minor; 

20 (C) compliance with legal process or other 

21 purposes expressly authorized under specific 

22 legal authority; or 

23 (D) other purposes— 

24 (i) that are specified in a notice to the 

25 child or minor; and 


kjohnson on DSK79L0C42 with BILLS
25 

•HR 3900 IH

1 (ii) to which the child or minor has 

2 consented under paragraph (7) before the 

3 information is used or disclosed for such 

4 other purposes. 

5 (4) RETENTION LIMITATION PRINCIPLE.— 

6 (A) IN GENERAL.—The personal informa7 tion of a child or minor should not be retained 

8 for longer than is necessary to fulfill a trans9 action or provide a service requested by the 

10 child or minor or such other purposes specified 

11 in subparagraphs (A) through (D) of paragraph 

12 (3). 

13 (B) DATA DISPOSAL.—The operator should 

14 implement a reasonable and appropriate data 

15 disposal policy based on the nature and sensi16 tivity of personal information described in sub17 paragraph (A). 

18 (5) SECURITY SAFEGUARDS PRINCIPLE.—The 

19 personal information of a child or minor should be 

20 protected by reasonable and appropriate security 

21 safeguards against risks such as loss or unauthor22 ized access, destruction, use, modification, or disclo23 sure. 

24 (6) OPENNESS PRINCIPLE.— 


kjohnson on DSK79L0C42 with BILLS
26 

•HR 3900 IH

1 (A) GENERAL PRINCIPLE.—The operator 

2 should maintain a general policy of openness 

3 about developments, practices, and policies with 

4 respect to the personal information of a child or 

5 minor. 

6 (B) PROVISION OF INFORMATION.—The 

7 operator should provide to each parent of a 

8 child, or to each minor, using the website, on9 line service, online application, or mobile appli10 cation of the operator with a clear and promi11 nent means— 

12 (i) to identify and contact the oper13 ator, by, at a minimum, disclosing, clearly 

14 and prominently, the identity of the oper15 ator and— 

16 (I) in the case of an operator 

17 who is an individual, the address of 

18 the principal residence of the operator 

19 and an email address and telephone 

20 number for the operator; or 

21 (II) in the case of any other op22 erator, the address of the principal 

23 place of business of the operator and 

24 an email address and telephone num25 ber for the operator; 


kjohnson on DSK79L0C42 with BILLS
27 

•HR 3900 IH

1 (ii) to determine whether the operator 

2 possesses any personal information of the 

3 child or minor, the nature of any such in4 formation, and the purposes for which the 

5 information was collected and is being re6 tained; 

7 (iii) to obtain any personal informa8 tion of the child or minor that is in the 

9 possession of the operator from the oper10 ator, or from a person specified by the op11 erator, within a reasonable time after mak12 ing a request, at a charge (if any) that is 

13 not excessive, in a reasonable manner, and 

14 in a form that is readily intelligible to the 

15 child or minor; 

16 (iv) to challenge the accuracy of per17 sonal information of the child or minor 

18 that is in the possession of the operator; 

19 (v) to determine if the child or minor 

20 has established the inaccuracy of personal 

21 information in a challenge under clause 

22 (iv) in order to have such information 

23 erased, corrected, completed, or otherwise 

24 amended; and 


kjohnson on DSK79L0C42 with BILLS
28 

•HR 3900 IH

1 (vi) to determine the method by which 

2 the operator obtains data relevant to the 

3 child or minor. 

4 (C) LIMITATION.—Nothing in this para5 graph shall be construed to permit an operator 

6 to erase or otherwise modify personal informa7 tion requested by a law enforcement agency 

8 pursuant to legal authority. 

9 (7) INDIVIDUAL PARTICIPATION PRINCIPLE.— 

10 The operator should— 

11 (A) obtain consent from a parent of a child 

12 or from a minor before using or disclosing the 

13 personal information of the child or minor for 

14 any purpose other than the purposes described 

15 in subparagraphs (A) through (C) of paragraph 

16 (3); and 

17 (B) obtain affirmative express consent 

18 from a parent of a child or from a minor before 

19 using or disclosing previously collected personal 

20 information of the child or minor for purposes 

21 that constitute a material change in practice 

22 from the original purposes specified to the child 

23 or minor under paragraph (3). 

24 (8) RACIAL AND SOCIOECONOMIC PROFILING.— 

25 The personal information of a child or minor shall 


kjohnson on DSK79L0C42 with BILLS
29 

•HR 3900 IH

1 not be used to direct content to the child or minor, 

2 or a group of individuals similar to the child or 

3 minor, on the basis of race, socioeconomic factors, or 

4 any proxy thereof. 

5 SEC. 5. DIGITAL MARKETING BILL OF RIGHTS FOR MINORS. 

6 (a) ACTS PROHIBITED.— 

7 (1) PROHIBITION.— 

8 (A) IN GENERAL.—Except as provided in 

9 subparagraph (B), it shall be unlawful for an 

10 operator of a website, online service, online ap11 plication, or mobile application to collect per12 sonal information from a minor if— 

13 (i)(I) the minor is a user of the 

14 website, online service, online application, 

15 or mobile application; and 

16 (II) the operator has constructive 

17 knowledge that the minor is a minor; or 

18 (ii) the website, online service, online 

19 application, or mobile application is di20 rected to minors. 

21 (B) EXCEPTION.—Subparagraph (A) shall 

22 not apply to an operator that has adopted and 

23 complies with a Digital Marketing Bill of 

24 Rights for Minors that is consistent with the 


kjohnson on DSK79L0C42 with BILLS
30 

•HR 3900 IH

1 Fair Information Practices Principles described 

2 in section 4. 

3 (2) EFFECTIVE DATE.—This subsection shall 

4 take effect on the date that is 180 days after the 

5 promulgation of regulations under subsection (b). 

6 (b) REGULATIONS.— 

7 (1) IN GENERAL.—Not later than 1 year after 

8 the date of enactment of this Act, the Commission 

9 shall promulgate, under section 553 of title 5, 

10 United States Code, regulations to implement this 

11 section, including regulations further defining the 

12 Fair Information Practices Principles described in 

13 section 4. 

14 (2) UPDATES.—Not less frequently than once 

15 every 4 years after the date on which regulations are 

16 promulgated under paragraph (1), the Commission 

17 shall update those regulations as necessary. 

18 SEC. 6. TARGETED MARKETING TO CHILDREN OR MINORS. 

19 (a) ACTS PROHIBITED.— 

20 (1) CHILDREN.—It shall be unlawful for an op21 erator of a website, online service, online application, 

22 or mobile application to use, disclose to third par23 ties, or compile personal information of a child for 

24 purposes of targeted marketing if— 


kjohnson on DSK79L0C42 with BILLS
31 

•HR 3900 IH

1 (A)(i) the child is a user of the website, 

2 online service, online application, or mobile ap3 plication; and 

4 (ii) the operator has constructive knowl5 edge that the child is a child; or 

6 (B) the website, online service, online ap7 plication, or mobile application is directed to a 

8 child. 

9 (2) MINORS.— 

10 (A) PROHIBITION.—Except as provided in 

11 subparagraph (B), it shall be unlawful for an 

12 operator of a website, online service, online ap13 plication, or mobile application to use, disclose 

14 to third parties, or compile personal informa15 tion of a minor for purposes of targeted mar16 keting if— 

17 (i)(I) the minor is a user of the 

18 website, online service, online application, 

19 or mobile application; and 

20 (II) the operator has constructive 

21 knowledge that the minor is a minor; or 

22 (ii) the website, online service, online 

23 application, or mobile application is di24 rected to a minor. 


kjohnson on DSK79L0C42 with BILLS
32 

•HR 3900 IH

1 (B) EXCEPTION.—Subparagraph (A) shall 

2 not apply to an operator that has obtained the 

3 verifiable consent of the relevant minor. 

4 (3) EFFECTIVE DATE.—This subsection shall 

5 take effect on the date that is 180 days after the 

6 promulgation of regulations under subsection (b). 

7 (b) REGULATIONS.— 

8 (1) IN GENERAL.—Not later than 1 year after 

9 the date of enactment of this Act, the Commission 

10 shall promulgate, under section 553 of title 5, 

11 United States Code, regulations to implement this 

12 section. 

13 (2) UPDATES.—Not less frequently than once 

14 every 4 years after the date on which regulations are 

15 promulgated under paragraph (1), the Commission 

16 shall update those regulations as necessary. 

17 SEC. 7. REMOVAL OF CONTENT. 

18 (a) ACTS PROHIBITED.—It is unlawful for an oper19 ator to make publicly available through a website, online 

20 service, online application, or mobile application content 

21 or information that contains or displays personal informa22 tion of children or minors in a manner that violates sub23 section (b). 

24 (b) REQUIREMENT.— 


kjohnson on DSK79L0C42 with BILLS
33 

•HR 3900 IH

1 (1) IN GENERAL.—An operator, to the extent 

2 technologically feasible, shall— 

3 (A) implement mechanisms that permit a 

4 user of the website, online service, online appli5 cation, or mobile application of the operator to 

6 erase or otherwise eliminate content or informa7 tion that is— 

8 (i) submitted to the website, online 

9 service, online application, or mobile appli10 cation by that user; 

11 (ii) publicly available through the 

12 website, online service, online application, 

13 or mobile application; and 

14 (iii) contains or displays personal in15 formation of children or minors; and 

16 (B) take appropriate steps to— 

17 (i) make users aware of the mecha18 nisms described in subparagraph (A); and 

19 (ii) provide notice to users that the 

20 mechanisms described in subparagraph (A) 

21 do not necessarily provide comprehensive 

22 removal of the content or information sub23 mitted by users. 

24 (2) EXCEPTIONS.—Paragraph (1) shall not be 

25 construed to require an operator or third party to 


kjohnson on DSK79L0C42 with BILLS
34 

•HR 3900 IH

1 erase or otherwise eliminate content or information 

2 that— 

3 (A) any other provision of Federal or State 

4 law requires the operator or third party to 

5 maintain; or 

6 (B) was submitted to the website, online 

7 service, online application, or mobile application 

8 of the operator by any person other than the 

9 user who is attempting to erase or otherwise 

10 eliminate the content or information, including 

11 content or information submitted by the user 

12 that was republished or resubmitted by another 

13 person. 

14 (c) LIMITATION.—Nothing in this section shall be 

15 construed to limit the authority of a law enforcement 

16 agency to obtain any content or information from an oper17 ator as authorized by law or pursuant to an order of a 

18 court of competent jurisdiction. 

19 (d) EFFECTIVE DATE.—This section shall take effect 

20 on the date that is 180 days after the date of enactment 

21 of this Act. 

22 SEC. 8. PRIVACY DASHBOARD FOR CONNECTED DEVICES 

23 FOR CHILDREN AND MINORS. 

24 (a) IN GENERAL.—A manufacturer of a connected 

25 device directed to a child or minor shall prominently disVerDate Sep 11 2014 22:08 Aug 06, 2019 Jkt 089200 PO 00000 Frm 00034 Fmt 6652 Sfmt 6201 E:\BILLS\H3900.IH H3900

kjohnson on DSK79L0C42 with BILLS
35 

•HR 3900 IH

1 play on the packaging for the connected device a standard2 ized and easy-to-understand privacy dashboard, detailing 

3 whether, what, and how personal information of a child 

4 or minor is— 

5 (1) collected from the connected device; 

6 (2) transmitted from the connected device; 

7 (3) retained on the connected device; 

8 (4) retained by the manufacturer or affiliated 

9 person; 

10 (5) used by the manufacturer or affiliated per11 son; and 

12 (6) protected. 

13 (b) FEATURES.—A privacy dashboard under sub14 section (a) shall inform a consumer of— 

15 (1) the extent to which the connected device 

16 meets the highest cybersecurity and data security 

17 standards, including if and how to obtain security 

18 patches; 

19 (2) the extent to which the connected device 

20 gives— 

21 (A) a parent meaningful control over the 

22 information of a child of the parent; and 

23 (B) a minor meaningful control over the 

24 information of the minor; 


kjohnson on DSK79L0C42 with BILLS
36 

•HR 3900 IH

1 (3) the extent to which the device minimizes the 

2 collection, retention, and use of information from a 

3 child or minor; 

4 (4) the location of privacy policies; 

5 (5) the type of personal information the con6 nected device may collect; 

7 (6) the minimum length of time during which 

8 a connected device will received security patches and 

9 software updates; 

10 (7) whether the connected device can be used 

11 without being connected to the internet; and 

12 (8) any other information as the Commission 

13 considers appropriate. 

14 (c) REGULATIONS.— 

15 (1) IN GENERAL.—Not later than 1 year after 

16 the date of enactment of this Act, the Commission 

17 shall promulgate, under section 553 of title 5, 

18 United States Code, regulations to implement this 

19 section. 

20 (2) UPDATES.—Not less frequently than once 

21 every 4 years after the date on which regulations are 

22 promulgated under paragraph (1), the Commission 

23 shall update those regulations as necessary. 


kjohnson on DSK79L0C42 with BILLS
37 

•HR 3900 IH

1 (d) EFFECTIVE DATE.—Subsections (a) and (b) shall 

2 take effect on the date that is 180 days after the promul3 gation of regulations under subsection (c). 

4 SEC. 9. PROHIBITION ON SALE OF CONNECTED DEVICES 

5 FOR CHILDREN AND MINORS THAT FAIL TO 

6 MEET APPROPRIATE CYBERSECURITY AND 

7 DATA SECURITY STANDARDS. 

8 (a) PROHIBITION.—Beginning 1 year after the date 

9 of enactment of this Act, no person may sell a connected 

10 device unless the connected device meets appropriate cy11 bersecurity and data security standards established by the 

12 Commission. 

13 (b) CYBERSECURITY AND DATA SECURITY STAND14 ARDS.— 

15 (1) IN GENERAL.—The Commission shall pro16 mulgate, under section 553 of title 5, United States 

17 Code, cybersecurity and data security standards de18 scribed in subsection (a). 

19 (2) CONSIDERATIONS.—In promulgating cyber20 security and data security standards under para21 graph (1), the Commission shall— 

22 (A) create cybersecurity and data security 

23 standards for different subsets of connected de24 vices based on the varying degrees of— 


kjohnson on DSK79L0C42 with BILLS
38 

•HR 3900 IH

1 (i) cybersecurity and data security 

2 risk associated with each subset of con3 nected device; 

4 (ii) sensitivity of information collected, 

5 stored, or transmitted by each subset of 

6 connected device; and 

7 (iii) functionality of each subset of 

8 connected device; 

9 (B) consider incorporating, to the extent 

10 practicable, existing cybersecurity and data se11 curity standards; and 

12 (C) ensure that the cybersecurity and data 

13 security standards— 

14 (i) are consistent with Fair Informa15 tion Practice Principles described in sec16 tion 4; and 

17 (ii) promote data minimization. 

18 SEC. 10. RULE FOR TREATMENT OF USERS OF WEBSITES, 

19 SERVICES, AND APPLICATIONS DIRECTED TO 

20 CHILDREN OR MINORS. 

21 For the purposes of this Act, an operator of a 

22 website, online service, online application, or mobile appli23 cation that is directed to children or minors shall treat 

24 each user of that website, online service, online applica25 tion, or mobile application as a child or minor, except as 


kjohnson on DSK79L0C42 with BILLS
39 

•HR 3900 IH

1 permitted by the Commission pursuant to a regulation 

2 promulgated under this Act. 

3 SEC. 11. STUDY OF MOBILE AND ONLINE APPLICATION 

4 OVERSIGHT. 

5 Not later than 2 years after the date of enactment 

6 of this Act, the Commission shall submit to each com7 mittee of the Senate and each committee of the House 

8 of Representatives that has jurisdiction over the Commis9 sion a report on the processes of platforms that offer mo10 bile and online applications for ensuring that, of those ap11 plications that are directed to children or minors, the ap12 plications operate in accordance with— 

13 (1) this Act, the amendments made by this Act, 

14 and rules promulgated under this Act; 

15 (2) rules promulgated by the Commission under 

16 section 5 of the Federal Trade Commission Act (15 

17 U.S.C. 45) relating to unfair or deceptive acts or 

18 practices in marketing; and 

19 (3) any other Federal or State law relating to 

20 the privacy of children or minors. 

21 SEC. 12. YOUTH PRIVACY AND MARKETING DIVISION. 

22 (a) ESTABLISHMENT.—There is established within 

23 the Commission a division to be known as the Youth Pri24 vacy and Marketing Division. 


kjohnson on DSK79L0C42 with BILLS
40 

•HR 3900 IH

1 (b) DIRECTOR.—The Youth Privacy and Marketing 

2 Division shall be headed by a Director, who shall be ap3 pointed by the Chairman of the Commission. 

4 (c) DUTIES.—The Youth Privacy and Marketing Di5 vision established under subsection (a) shall be responsible 

6 for addressing, as it relates to this Act and the amend7 ments made by this Act— 

8 (1) the privacy of children and minors; and 

9 (2) marketing directed at children and minors. 

10 (d) STAFF.—The Director of the Youth Privacy and 

11 Marketing Division shall hire adequate staff to carry out 

12 the duties under subsection (c), including individuals who 

13 are experts in data protection, digital advertising, data 

14 analytics, and youth development. 

15 (e) REPORTS.—Not later than 1 year after the date 

16 of enactment of this Act, and each year thereafter, the 

17 Director of the Youth and Privacy Marketing Division 

18 shall submit to the Committee on Commerce, Science, and 

19 Transportation of the Senate and the Committee on En20 ergy and Commerce of the House of Representatives a re21 port that includes— 

22 (1) a description of the work of the Youth Pri23 vacy and Marketing Division on emerging concerns 

24 relating to youth privacy and marketing practices; 

25 and 


kjohnson on DSK79L0C42 with BILLS
41 

•HR 3900 IH

1 (2) an assessment of how effectively the Com2 mission has, during the period for which the report 

3 is submitted, addressed youth privacy and marketing 

4 practices. 

5 SEC. 13. ENFORCEMENT AND APPLICABILITY. 

6 (a) ENFORCEMENT BY THE COMMISSION.— 

7 (1) IN GENERAL.—Except as otherwise pro8 vided, this Act and the regulations prescribed under 

9 this Act shall be enforced by the Commission under 

10 the Federal Trade Commission Act (15 U.S.C. 41 et 

11 seq.). 

12 (2) UNFAIR OR DECEPTIVE ACTS OR PRAC13 TICES.—Subject to subsection (b), a violation of this 

14 Act or a regulation prescribed under this Act shall 

15 be treated as a violation of a rule defining an unfair 

16 or deceptive act or practice prescribed under section 

17 18(a)(1)(B) of the Federal Trade Commission Act 

18 (15 U.S.C. 57a(a)(1)(B)). 

19 (3) ACTIONS BY THE COMMISSION.— 

20 (A) IN GENERAL.—Subject to subsection 

21 (b), and except as provided in subsection (d)(1), 

22 the Commission shall prevent any person from 

23 violating this Act or a regulation prescribed 

24 under this Act in the same manner, by the 

25 same means, and with the same jurisdiction, 


kjohnson on DSK79L0C42 with BILLS
42 

•HR 3900 IH

1 powers, and duties as though all applicable 

2 terms and provisions of the Federal Trade 

3 Commission Act (15 U.S.C. 41 et seq.) were in4 corporated into and made a part of this Act, 

5 and any person who violates this Act or such 

6 regulation shall be subject to the penalties and 

7 entitled to the privileges and immunities pro8 vided in the Federal Trade Commission Act. 

9 (B) VIOLATIONS.— 

10 (i) IN GENERAL.—In an action 

11 brought by the Commission to enforce this 

12 Act and the regulations prescribed under 

13 this Act, each connected device that fails to 

14 meet a standard promulgated under this 

15 Act shall be treated as a separate violation. 

16 (ii) CIVIL PENALTY.—Notwith17 standing section 5(m) of the Federal Trade 

18 Commission Act (15 U.S.C. 45(m)), a civil 

19 penalty recovered for a violation of this Act 

20 or a regulation prescribed under this Act 

21 may be in excess of the amounts provided 

22 for in that section as the court finds ap23 propriate to deter violations of this Act 

24 and regulations prescribed under this Act. 


kjohnson on DSK79L0C42 with BILLS
43 

•HR 3900 IH

1 (iii) FIRST VIOLATIONS.—In an action 

2 brought by the Commission to enforce this 

3 Act and the regulations prescribed under 

4 this Act, the Commission may seek a civil 

5 penalty for any violation of this Act or reg6 ulation prescribed under this Act, including 

7 any violation that is the first violation of 

8 this Act or a regulation prescribed under 

9 this Act that a person against whom the 

10 action is brought has committed. 

11 (b) ENFORCEMENT BY CERTAIN OTHER AGEN12 CIES.—Notwithstanding subsection (a), compliance with 

13 the requirements imposed under this Act shall be enforced 

14 as follows: 

15 (1) Under section 8 of the Federal Deposit In16 surance Act (12 U.S.C. 1818) by the appropriate 

17 Federal banking agency, with respect to an insured 

18 depository institution (as such terms are defined in 

19 section 3 of such Act (12 U.S.C. 1813)). 

20 (2) Under the Federal Credit Union Act (12 

21 U.S.C. 1751 et seq.) by the National Credit Union 

22 Administration Board, with respect to any Federal 

23 credit union. 

24 (3) Under part A of subtitle VII of title 49, 

25 United States Code, by the Secretary of TransporVerDate Sep 11 2014 22:08 Aug 06, 2019 Jkt 089200 PO 00000 Frm 00043 Fmt 6652 Sfmt 6201 E:\BILLS\H3900.IH H3900

kjohnson on DSK79L0C42 with BILLS
44 

•HR 3900 IH

1 tation, with respect to any air carrier or foreign air 

2 carrier subject to such part. 

3 (4) Under the Packers and Stockyards Act, 

4 1921 (7 U.S.C. 181 et seq.) (except as provided in 

5 section 406 of that Act (7 U.S.C. 226; 227)) by the 

6 Secretary of Agriculture, with respect to any activi7 ties subject to that Act. 

8 (5) Under the Farm Credit Act of 1971 (12 

9 U.S.C. 2001 et seq.) by the Farm Credit Adminis10 tration, with respect to any Federal land bank, Fed11 eral land bank association, Federal intermediate 

12 credit bank, or production credit association. 

13 (c) ENFORCEMENT BY STATE ATTORNEYS GEN14 ERAL.— 

15 (1) IN GENERAL.— 

16 (A) CIVIL ACTIONS.—In any case in which 

17 the attorney general of a State has reason to 

18 believe that an interest of the residents of that 

19 State has been or is threatened or adversely af20 fected by the engagement of any person in a 

21 practice that violates this Act or a regulation 

22 prescribed under this Act, the State, as parens 

23 patriae, may bring a civil action on behalf of 

24 the residents of the State in a district court of 


kjohnson on DSK79L0C42 with BILLS
45 

•HR 3900 IH

1 the United States of appropriate jurisdiction 

2 to— 

3 (i) enjoin that practice; 

4 (ii) enforce compliance with this Act 

5 or such regulation; 

6 (iii) obtain damages, restitution, or 

7 other compensation on behalf of residents 

8 of the State; or 

9 (iv) obtain such other relief as the 

10 court may consider to be appropriate. 

11 (B) NOTICE.— 

12 (i) IN GENERAL.—Before filing an ac13 tion under subparagraph (A), the attorney 

14 general of the State involved shall provide 

15 to the Commission— 

16 (I) written notice of that action; 

17 and 

18 (II) a copy of the complaint for 

19 that action. 

20 (ii) EXEMPTION.— 

21 (I) IN GENERAL.—Clause (i) 

22 shall not apply with respect to the fil23 ing of an action by an attorney gen24 eral of a State under this paragraph 

25 if the attorney general of the State 


kjohnson on DSK79L0C42 with BILLS
46 

•HR 3900 IH

1 determines that it is not feasible to 

2 provide the notice described in that 

3 clause before the filing of the action. 

4 (II) NOTIFICATION.—In an ac5 tion described in subclause (I), the at6 torney general of a State shall provide 

7 notice and a copy of the complaint to 

8 the Commission at the same time as 

9 the attorney general files the action. 

10 (2) INTERVENTION.— 

11 (A) IN GENERAL.—On receiving notice 

12 under paragraph (1)(B), the Commission shall 

13 have the right to intervene in the action that is 

14 the subject of the notice. 

15 (B) EFFECT OF INTERVENTION.—If the 

16 Commission intervenes in an action under para17 graph (1), it shall have the right— 

18 (i) to be heard with respect to any 

19 matter that arises in that action; and 

20 (ii) to file a petition for appeal. 

21 (3) CONSTRUCTION.—For purposes of bringing 

22 any civil action under paragraph (1), nothing in this 

23 Act shall be construed to prevent an attorney gen24 eral of a State from exercising the powers conferred 


kjohnson on DSK79L0C42 with BILLS
47 

•HR 3900 IH

1 on the attorney general by the laws of that State 

2 to— 

3 (A) conduct investigations; 

4 (B) administer oaths or affirmations; or 

5 (C) compel the attendance of witnesses or 

6 the production of documentary and other evi7 dence. 

8 (4) ACTIONS BY THE COMMISSION.—In any 

9 case in which an action is instituted by or on behalf 

10 of the Commission for violation of this Act or a reg11 ulation prescribed under this Act, no State may, 

12 during the pendency of that action, institute an ac13 tion under paragraph (1) against any defendant 

14 named in the complaint in the action instituted by 

15 or on behalf of the Commission for that violation. 

16 (5) VENUE; SERVICE OF PROCESS.— 

17 (A) VENUE.—Any action brought under 

18 paragraph (1) may be brought in the district 

19 court of the United States that meets applicable 

20 requirements relating to venue under section 

21 1391 of title 28, United States Code. 

22 (B) SERVICE OF PROCESS.—In an action 

23 brought under paragraph (1), process may be 

24 served in any district in which the defendant— 

25 (i) is an inhabitant; or 


kjohnson on DSK79L0C42 with BILLS
48 

•HR 3900 IH

1 (ii) may be found. 

2 (d) TELECOMMUNICATIONS CARRIERS AND CABLE

3 OPERATORS.— 

4 (1) ENFORCEMENT BY COMMISSION.—Notwith5 standing section 5(a)(2) of the Federal Trade Com6 mission Act (15 U.S.C. 45(a)(2)), compliance with 

7 the requirements imposed under this Act shall be en8 forced by the Commission with respect to any tele9 communications carrier (as defined in section 3 of 

10 the Communications Act of 1934 (47 U.S.C. 153)). 

11 (2) RELATIONSHIP TO OTHER LAWS.—To the 

12 extent that section 222, 338(i), or 631 of the Com13 munications Act of 1934 (47 U.S.C. 222; 338(i); 

14 551) is inconsistent with this Act, this Act controls. 

15 (e) SAFE HARBORS.— 

16 (1) DEFINITION.—In this subsection— 

17 (A) the term ‘‘applicable section’’ means 

18 section 5, 6, 7, 8, or 9 of this Act; 

19 (B) the term ‘‘covered operator’’ means an 

20 operator subject to guidelines approved under 

21 paragraph (2); 

22 (C) the term ‘‘requesting entity’’ means an 

23 entity that submits a safe harbor request to the 

24 Commission; and 


kjohnson on DSK79L0C42 with BILLS
49 

•HR 3900 IH

1 (D) the term ‘‘safe harbor request’’ means 

2 a request to have self-regulatory guidelines de3 scribed in paragraph (2)(A) approved under 

4 that paragraph. 

5 (2) GUIDELINES.— 

6 (A) IN GENERAL.—An operator may sat7 isfy the requirements of regulations issued 

8 under an applicable section by following a set of 

9 self-regulatory guidelines, issued by representa10 tives of the marketing or online industries, or 

11 by other persons, that, after notice and an op12 portunity for comment, are approved by the 

13 Commission upon making a determination that 

14 the guidelines meet the requirements of the reg15 ulations issued under that applicable section. 

16 (B) EXPEDITED RESPONSE TO RE17 QUESTS.—Not later than 180 days after the 

18 date on which a safe harbor request is filed 

19 under subparagraph (A), the Commission shall 

20 act upon the request set forth in writing the 

21 conclusions of the Commission with regard to 

22 the request. 

23 (C) APPEALS.—A requesting entity may 

24 appeal the final action of the Commission under 

25 subparagraph (B), or a failure by the CommisVerDate Sep 11 2014 22:08 Aug 06, 2019 Jkt 089200 PO 00000 Frm 00049 Fmt 6652 Sfmt 6201 E:\BILLS\H3900.IH H3900

kjohnson on DSK79L0C42 with BILLS
50 

•HR 3900 IH

1 sion to act in the period described in that para2 graph, to a district court of the United States 

3 of appropriate jurisdiction, as provided for in 

4 section 706 of title 5, United States Code. 

5 (3) INCENTIVES.— 

6 (A) SELF-REGULATORY INCENTIVES.—In 

7 prescribing regulations under an applicable sec8 tion, the Commission shall provide incentives 

9 for self-regulation by covered operators to im10 plement the protections afforded children and 

11 minors, as applicable, under the regulatory re12 quirements described in those sections. 

13 (B) DEEMED COMPLIANCE.—The incen14 tives under subparagraph (A) shall include pro15 visions for ensuring that a covered operator will 

16 be deemed to be in compliance with the require17 ments of the regulations under an applicable 

18 section if that person complies with guidelines 

19 approved under paragraph (2). 

20 (4) REGULATIONS.—In prescribing regulations 

21 relating to safe harbor guidelines under an applica22 ble section, the Commission shall— 

23 (A) establish criteria for the approval of 

24 guidelines that will ensure that a covered oper25 ator provides substantially the same or greater 


kjohnson on DSK79L0C42 with BILLS
51 

•HR 3900 IH

1 protections for children and minors, as applica2 ble, as those contained in the regulations issued 

3 under the applicable section; and 

4 (B) require that any report or documenta5 tion required to be submitted to the Commis6 sion by a covered operator or requesting entity 

7 will be published on the internet website of the 

8 Commission, except to the extent that the re9 port or documentation contains proprietary in10 formation, which the Commission may in its 

11 discretion redact. 

12 (5) REPORT BY THE INSPECTOR GENERAL.— 

13 (A) IN GENERAL.—Not later than 2 years 

14 after the date of enactment of this Act, and 

15 once each 2 years thereafter, the Inspector Gen16 eral of the Commission shall submit to the 

17 Commission and each committee of the Senate 

18 and each committee of the House of Represent19 atives that has jurisdiction over the Commission 

20 a report regarding the safe harbor provisions 

21 under this subparagraph, which shall include— 

22 (i) an analysis of whether the safe 

23 harbor provisions are— 

24 (I) operating fairly and effec25 tively; and 


kjohnson on DSK79L0C42 with BILLS
52 

•HR 3900 IH

1 (II) effectively protecting the in2 terests of children and minors; and 

3 (ii) proposals for policy changes that 

4 would improve the effectiveness of the safe 

5 harbor provisions. 

6 (B) PUBLICATION.—Not later than 10 

7 days after the date on which a report under 

8 subparagraph (A) is submitted, the Commission 

9 shall publish the report on the internet website 

10 of the Commission. 

11 (f) EFFECTIVE DATE.—This section shall take effect 

12 on the date that is 90 days after the date of enactment 

13 of this Act. 

Æ 


kjohnson on DSK79L0C42 with BILLS