I 

115TH CONGRESS 

2D SESSION H. R. 5930 

To strengthen protections relating to the online collection, use, and disclosure 

of personal information of children and minors, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

MAY 23, 2018 

Mr. BARTON (for himself and Mr. RUSH) introduced the following bill; which 

was referred to the Committee on Energy and Commerce 

A BILL 

To strengthen protections relating to the online collection, 

use, and disclosure of personal information of children 

and minors, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

4 (a) SHORT TITLE.—This Act may be cited as the 

5 ‘‘Do Not Track Kids Act of 2018’’. 

6 (b) TABLE OF CONTENTS.—The table of contents for 

7 this Act is as follows: 

Sec. 1. Short title; table of contents. 

Sec. 2. Definitions. 

Sec. 3. Online collection, use, and disclosure of personal information of children 

and minors. 

Sec. 4. Fair Information Practices Principles. 


pbinns on DSK79D2C42PROD with BILLS
2 

•HR 5930 IH

Sec. 5. Digital Marketing Bill of Rights for Minors. 

Sec. 6. Targeted marketing to children or minors. 

Sec. 7. Removal of content. 

Sec. 8. Privacy dashboard for connected devices for children and minors. 

Sec. 9. Prohibition on sale of connected devices for children and minors that 

fail to meet appropriate cybersecurity and data security standards. 

Sec. 10. Rule for treatment of users of websites, services, and applications directed to children or minors. 

Sec. 11. Enforcement and applicability. 

Sec. 12. Effective dates. 

1 SEC. 2. DEFINITIONS. 

2 (a) IN GENERAL.—In this Act: 

3 (1) COMMISSION.—The term ‘‘Commission’’ 

4 means the Federal Trade Commission. 

5 (2) STANDARDS.—The term ‘‘standards’’ means 

6 benchmarks, guidelines, best practices, methodolo7 gies, procedures, and processes. 

8 (b) OTHER DEFINITIONS.—The definitions set forth 

9 in section 1302 of the Children’s Online Privacy Protec10 tion Act of 1998 (15 U.S.C. 6501), as amended by section 

11 3(a) of this Act, shall apply in this Act, except to the ex12 tent the Commission provides otherwise by regulations 

13 issued under section 553 of title 5, United States Code. 

14 SEC. 3. ONLINE COLLECTION, USE, AND DISCLOSURE OF 

15 PERSONAL INFORMATION OF CHILDREN AND 

16 MINORS. 

17 (a) DEFINITIONS.—Section 1302 of the Children’s 

18 Online Privacy Protection Act of 1998 (15 U.S.C. 6501) 

19 is amended— 


pbinns on DSK79D2C42PROD with BILLS
3 

•HR 5930 IH

1 (1) by amending paragraph (2) to read as fol2 lows: 

3 ‘‘(2) OPERATOR.—The term ‘operator’— 

4 ‘‘(A) means any person— 

5 ‘‘(i) who, for commercial purposes, in 

6 interstate or foreign commerce— 

7 ‘‘(I) operates or provides a 

8 website on the Internet, an online 

9 service, an online application, or a 

10 mobile application; or 

11 ‘‘(II) manufactures a connected 

12 device; and 

13 ‘‘(ii) who— 

14 ‘‘(I) collects or maintains, either 

15 directly or through a service provider, 

16 personal information from or about 

17 the users of that website, service, ap18 plication, or connected device; 

19 ‘‘(II) allows another person to 

20 collect personal information directly 

21 from users of that website, service, 

22 application, or connected device (in 

23 which case, the operator is deemed to 

24 have collected the information); or 


pbinns on DSK79D2C42PROD with BILLS
4 

•HR 5930 IH

1 ‘‘(III) allows users of that 

2 website, service, application, or con3 nected device to publicly disclose per4 sonal information (in which case, the 

5 operator is deemed to have collected 

6 the information); and 

7 ‘‘(B) does not include any nonprofit entity 

8 that would otherwise be exempt from coverage 

9 under section 5 of the Federal Trade Commis10 sion Act (15 U.S.C. 45).’’; 

11 (2) in paragraph (4)— 

12 (A) by amending subparagraph (A) to read 

13 as follows: 

14 ‘‘(A) the release of personal information 

15 collected from a child or minor for any purpose, 

16 except where the personal information is pro17 vided to a person other than an operator who— 

18 ‘‘(i) provides support for the internal 

19 operations of the website, online service, 

20 online application, or mobile application of 

21 the operator, excluding any activity relat22 ing to targeted marketing directed to chil23 dren, minors, or connected devices; and 


pbinns on DSK79D2C42PROD with BILLS
5 

•HR 5930 IH

1 ‘‘(ii) does not disclose or use that per2 sonal information for any other purpose; 

3 and’’; and 

4 (B) in subparagraph (B)— 

5 (i) by inserting ‘‘or minor’’ after 

6 ‘‘child’’ each place the term appears; 

7 (ii) by inserting ‘‘or minors’’ after 

8 ‘‘children’’; and 

9 (iii) by striking ‘‘website or online 

10 service’’ and inserting ‘‘website, online 

11 service, online application, or mobile appli12 cation’’; 

13 (3) in paragraph (8)— 

14 (A) by amending subparagraph (G) to read 

15 as follows: 

16 ‘‘(G) information concerning a child or 

17 minor or the parents of that child or minor (in18 cluding any unique or substantially unique iden19 tifier, such as a customer number) that an op20 erator collects online from the child or minor 

21 and combines with an identifier described in 

22 subparagraphs (A) through (G).’’; 

23 (B) by redesignating subparagraphs (F) 

24 and (G) as subparagraphs (H) and (I), respec25 tively; and 


pbinns on DSK79D2C42PROD with BILLS
6 

•HR 5930 IH

1 (C) by inserting after subparagraph (E) 

2 the following: 

3 ‘‘(F) information (including an Internet 

4 protocol address) that permits the identification 

5 of— 

6 ‘‘(i) an individual; 

7 ‘‘(ii) a computer of an individual; or 

8 ‘‘(iii) any other device used by an in9 dividual to access the Internet or an online 

10 service, online application, or mobile appli11 cation; 

12 ‘‘(G) geolocation information;’’; 

13 (4) by amending paragraph (9) to read as fol14 lows: 

15 ‘‘(9) VERIFIABLE CONSENT.—The term 

16 ‘verifiable consent’ means any reasonable effort (tak17 ing into consideration available technology), includ18 ing a request for authorization for future collection, 

19 use, and disclosure described in the notice, to ensure 

20 that, in the case of a child, a parent of the child, 

21 or, in the case of a minor, the minor— 

22 ‘‘(A) receives notice of the personal infor23 mation collection, use, and disclosure practices 

24 of the operator; and 


pbinns on DSK79D2C42PROD with BILLS
7 

•HR 5930 IH

1 ‘‘(B) before the personal information of the 

2 child or minor is collected, authorizes— 

3 ‘‘(i) the collection, use, and disclosure, 

4 as applicable, of that personal information; 

5 and 

6 ‘‘(ii) any subsequent use of that per7 sonal information.’’; 

8 (5) by striking paragraph (10) and redesig9 nating paragraphs (11) and (12) as paragraphs (10) 

10 and (11), respectively; and 

11 (6) by adding at the end the following: 

12 ‘‘(12) CONNECTED DEVICE.—The term ‘con13 nected device’ means a device that is— 

14 ‘‘(A) capable of connecting to the Internet, 

15 directly or indirectly, or to another connected 

16 device; and 

17 ‘‘(B) directed towards a child or minor. 

18 ‘‘(13) ONLINE; ONLINE APPLICATION; ONLINE

19 SERVICE; DIRECTED TO A CHILD; DIRECTED TO A

20 MINOR; MOBILE APPLICATION.— 

21 ‘‘(A) IN GENERAL.—Subject to subpara22 graphs (C) and (D), the terms ‘online’, ‘online 

23 application’, ‘online service’, ‘directed to a 

24 child’, ‘directed to a minor’, and ‘mobile appli25 cation’ shall have the meanings given those 


pbinns on DSK79D2C42PROD with BILLS
8 

•HR 5930 IH

1 terms by regulation promulgated by the Com2 mission under subparagraph (B). 

3 ‘‘(B) PROMULGATION OF REGULATIONS.— 

4 Not later than 1 year after the date of the en5 actment of the Do Not Track Kids Act of 2018, 

6 the Commission shall promulgate, under section 

7 553 of title 5, United States Code, regulations 

8 that define the terms described in subparagraph 

9 (A) broadly enough to ensure that the terms 

10 are not limited to current technology, consistent 

11 with— 

12 ‘‘(i) the principles articulated by the 

13 Commission regarding the definition of the 

14 term ‘Internet’ in the statement of basis 

15 and purpose on the final rule under this 

16 title promulgated on November 3, 1999 

17 (64 Fed. Reg. 59891); and 

18 ‘‘(ii) the principles articulated by the 

19 Commission regarding the definition of the 

20 term ‘directed to children’ in the statement 

21 of basis and purpose on the final rule 

22 under this title promulgated on January 

23 17, 2013 (78 Fed. Reg. 3972). 

24 ‘‘(C) ONLINE SERVICE.—The definition of 

25 the term ‘online service’ in the regulations proVerDate Sep 11 2014 18:36 Jun 04, 2018 Jkt 079200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H5930.IH H5930

pbinns on DSK79D2C42PROD with BILLS
9 

•HR 5930 IH

1 mulgated under subparagraph (B) shall include 

2 broadband Internet access service (as defined in 

3 the Report and Order on Remand, Declaratory 

4 Ruling, and Order in the matter of protecting 

5 and promoting the open Internet, adopted by 

6 the Federal Communications Commission on 

7 February 26, 2015 (FCC 15–24)). 

8 ‘‘(D) ONLINE APPLICATION; ONLINE SERV9 ICE; MOBILE APPLICATION.—The terms ‘online 

10 service’, ‘online application’, and ‘mobile appli11 cation’ include a service or application offered 

12 via a connected device. 

13 ‘‘(14) GEOLOCATION INFORMATION.—The term 

14 ‘geolocation information’ means information suffi15 cient to identify a street name and name of a city 

16 or town. 

17 ‘‘(15) MINOR.—The term ‘minor’ means an in18 dividual over the age of 12 and under the age of 16. 

19 ‘‘(16) TARGETED MARKETING.—The term ‘tar20 geted marketing’ means advertising or any other ef21 fort to market a product or service that is directed 

22 to a specific individual or device— 

23 ‘‘(A) based on the personal information of 

24 the individual or a unique identifier of the de25 vice; and 


pbinns on DSK79D2C42PROD with BILLS
10 

•HR 5930 IH

1 ‘‘(B) as a result of use by the individual, 

2 or access by the device, of— 

3 ‘‘(i) a website; 

4 ‘‘(ii) an online service; 

5 ‘‘(iii) an online application; or 

6 ‘‘(iv) a mobile application.’’. 

7 (b) ONLINE COLLECTION, USE, AND DISCLOSURE OF

8 PERSONAL INFORMATION OF CHILDREN AND MINORS.— 

9 Section 1303 of the Children’s Online Privacy Protection 

10 Act of 1998 (15 U.S.C. 6502) is amended— 

11 (1) by striking the heading and inserting the 

12 following: ‘‘ONLINE COLLECTION, USE, AND DIS13 CLOSURE OF PERSONAL INFORMATION OF

14 CHILDREN AND MINORS.’’; 

15 (2) in subsection (a)— 

16 (A) by amending paragraph (1) to read as 

17 follows: 

18 ‘‘(1) IN GENERAL.—It is unlawful for an oper19 ator of a website, online service, online application, 

20 or mobile application directed to a child or minor, or 

21 an operator having actual knowledge that personal 

22 information being collected is from a child or minor, 

23 to collect personal information from a child or minor 

24 in a manner that violates the regulations prescribed 

25 under subsection (b).’’; and 


pbinns on DSK79D2C42PROD with BILLS
11 

•HR 5930 IH

1 (B) in paragraph (2)— 

2 (i) by striking ‘‘of such a website or 

3 online service’’; and 

4 (ii) by striking ‘‘subsection 

5 (b)(1)(B)(iii) to the parent of a child’’ and 

6 inserting ‘‘subsection (b)(1)(C)(iii) to the 

7 parent of a child or under subsection 

8 (b)(1)(D)(iii) to a minor’’; and 

9 (3) in subsection (b)— 

10 (A) by amending paragraph (1) to read as 

11 follows: 

12 ‘‘(1) IN GENERAL.—Not later than 1 year after 

13 the date of the enactment of the Do Not Track Kids 

14 Act of 2018, the Commission shall promulgate, 

15 under section 553 of title 5, United States Code, 

16 regulations to require an operator of a website, on17 line service, online application, or mobile application 

18 directed to children or minors, or an operator having 

19 actual knowledge that personal information being 

20 collected is from a child or minor— 

21 ‘‘(A) to provide clear and conspicuous no22 tice in clear and plain language of— 

23 ‘‘(i) the types of personal information 

24 the operator collects; 


pbinns on DSK79D2C42PROD with BILLS
12 

•HR 5930 IH

1 ‘‘(ii) how the operator uses the infor2 mation; 

3 ‘‘(iii) whether the operator discloses 

4 the information; and 

5 ‘‘(iv) the procedures or mechanisms 

6 the operator uses to ensure that personal 

7 information is not collected from children 

8 or minors except in accordance with the 

9 regulations promulgated under this para10 graph; 

11 ‘‘(B) to obtain verifiable consent for the 

12 collection, use, or disclosure of personal infor13 mation of a child or minor; 

14 ‘‘(C) to provide to a parent whose child 

15 has provided personal information to the oper16 ator, upon request by and proper identification 

17 of the parent— 

18 ‘‘(i) a description of the specific types 

19 of personal information collected from the 

20 child by the operator; 

21 ‘‘(ii) the opportunity at any time to 

22 refuse to permit the further use or mainte23 nance in retrievable form, or future collec24 tion, by the operator of personal informa25 tion collected from the child; and 


pbinns on DSK79D2C42PROD with BILLS
13 

•HR 5930 IH

1 ‘‘(iii) a means that is reasonable 

2 under the circumstances for the parent to 

3 obtain any personal information collected 

4 from the child, if such information is avail5 able to the operator at the time the parent 

6 makes the request; 

7 ‘‘(D) to provide to a minor who has pro8 vided personal information to the operator, 

9 upon request by and proper identification of the 

10 minor— 

11 ‘‘(i) a description of the specific types 

12 of personal information collected from the 

13 minor by the operator; 

14 ‘‘(ii) the opportunity at any time to 

15 refuse to permit the further use or mainte16 nance in retrievable form, or future collec17 tion, by the operator of personal informa18 tion collected from the minor; and 

19 ‘‘(iii) a means that is reasonable 

20 under the circumstances for the minor to 

21 obtain any personal information collected 

22 from the minor, if such information is 

23 available to the operator at the time the 

24 minor makes the request; 


pbinns on DSK79D2C42PROD with BILLS
14 

•HR 5930 IH

1 ‘‘(E) not to condition participation in a 

2 game, or use of a website, service, or applica3 tion, by a child or minor on the provision by the 

4 child or minor of more personal information 

5 than is reasonably required to participate in the 

6 game or use the website, service, or application; 

7 and 

8 ‘‘(F) to establish and maintain reasonable 

9 procedures to protect the confidentiality, secu10 rity, and integrity of personal information col11 lected from children and minors.’’; 

12 (B) in paragraph (2)— 

13 (i) in the matter preceding subpara14 graph (A), by striking ‘‘verifiable parental 

15 consent under paragraph (1)(A)(ii)’’ and 

16 inserting ‘‘verifiable consent under para17 graph (1)(B)’’; and 

18 (ii) in subparagraph (A)— 

19 (I) by inserting ‘‘or minor’’ after 

20 ‘‘collected from a child’’; 

21 (II) by inserting ‘‘or minor’’ after 

22 ‘‘request from the child’’; and 

23 (III) by inserting ‘‘or minor or to 

24 contact a different child or minor’’ 

25 after ‘‘to recontact the child’’; 


pbinns on DSK79D2C42PROD with BILLS
15 

•HR 5930 IH

1 (iii) in subparagraph (B)— 

2 (I) by striking ‘‘parent or child’’ 

3 and inserting ‘‘parent, child, or 

4 minor’’; and 

5 (II) by striking ‘‘parental con6 sent’’ each place the term appears and 

7 inserting ‘‘verifiable consent’’; 

8 (iv) in subparagraph (C)— 

9 (I) in the matter preceding clause 

10 (i), by inserting ‘‘or minor’’ after 

11 ‘‘child’’ each place the term appears; 

12 (II) in clause (i)— 

13 (aa) by inserting ‘‘or minor’’ 

14 after ‘‘child’’ each place the term 

15 appears; and 

16 (bb) by inserting ‘‘or minor, 

17 as applicable,’’ after ‘‘parent’’ 

18 each place the term appears; and 

19 (III) in clause (ii)— 

20 (aa) by inserting ‘‘or minor, 

21 as applicable,’’ after ‘‘parent’’; 

22 and 

23 (bb) by inserting ‘‘or minor’’ 

24 after ‘‘child’’ each place the term 

25 appears; and 


pbinns on DSK79D2C42PROD with BILLS
16 

•HR 5930 IH

1 (v) in subparagraph (D)— 

2 (I) in the matter preceding clause 

3 (i), by inserting ‘‘or minor’’ after 

4 ‘‘child’’ each place the term appears; 

5 (II) in clause (ii), by inserting 

6 ‘‘or minor’’ after ‘‘child’’; and 

7 (III) in the flush text following 

8 clause (iii)— 

9 (aa) by inserting ‘‘or minor, 

10 as applicable,’’ after ‘‘parent’’ 

11 each place the term appears; and 

12 (bb) by inserting ‘‘or minor’’ 

13 after ‘‘child’’; and 

14 (C) by amending paragraph (3) to read as 

15 follows: 

16 ‘‘(3) CONTINUATION OF SERVICE.—The regula17 tions shall prohibit an operator from discontinuing 

18 service provided to a child or minor on the basis of 

19 refusal by the parent of the child or by the minor, 

20 under the regulations prescribed under subpara21 graphs (C)(ii) and (D)(ii) of paragraph (1), respec22 tively, to permit the further use or maintenance in 

23 retrievable form, or future collection, by the operator 

24 of personal information collected from the child or 


pbinns on DSK79D2C42PROD with BILLS
17 

•HR 5930 IH

1 minor, to the extent that the operator is capable of 

2 providing such service without such information.’’. 

3 (c) SAFE HARBORS.—Section 1304 of the Children’s 

4 Online Privacy Protection Act of 1998 (15 U.S.C. 6503) 

5 is amended— 

6 (1) in subsection (b)(1), by inserting ‘‘and mi7 nors’’ after ‘‘children’’; and 

8 (2) by adding at the end the following: 

9 ‘‘(d) PUBLICATION.—The Commission shall publish 

10 on the internet website of the Commission any report or 

11 documentation required by regulation to be submitted to 

12 the Commission to carry out this section, except to the 

13 extent that the report or documentation contains propri14 etary information, which the Commission may in its dis15 cretion redact.’’. 

16 (d) ADMINISTRATION AND APPLICABILITY OF ACT.— 

17 Section 1306 of the Children’s Online Privacy Protection 

18 Act of 1998 (15 U.S.C. 6505) is amended— 

19 (1) in subsection (b)— 

20 (A) in paragraph (1), by striking ‘‘, in the 

21 case of’’ and all that follows and inserting the 

22 following: ‘‘by the appropriate Federal banking 

23 agency, with respect to any insured depository 

24 institution (as those terms are defined in sec25 tion 3 of that Act (12 U.S.C. 1813));’’; and 


pbinns on DSK79D2C42PROD with BILLS
18 

•HR 5930 IH

1 (B) by striking paragraph (2) and redesig2 nating paragraphs (3) through (6) as para3 graphs (2) through (5), respectively; and 

4 (2) by adding at the end the following new sub5 section: 

6 ‘‘(f) TELECOMMUNICATIONS CARRIERS AND CABLE

7 OPERATORS.— 

8 ‘‘(1) ENFORCEMENT BY COMMISSION.—Not9 withstanding section 5(a)(2) of the Federal Trade 

10 Commission Act (15 U.S.C. 45(a)(2)), compliance 

11 with the requirements imposed under this title shall 

12 be enforced by the Commission with respect to any 

13 telecommunications carrier (as defined in section 3 

14 of the Communications Act of 1934 (47 U.S.C. 

15 153)). 

16 ‘‘(2) RELATIONSHIP TO OTHER LAW.—To the 

17 extent that section 222, 338(i), or 631 of the Com18 munications Act of 1934 (47 U.S.C. 222; 338(i); 

19 551) is inconsistent with this title, this title con20 trols.’’. 

21 SEC. 4. FAIR INFORMATION PRACTICES PRINCIPLES. 

22 The Fair Information Practices Principles described 

23 in this section are the following: 

24 (1) COLLECTION LIMITATION PRINCIPLE.—Ex25 cept as provided in paragraph (3), personal informaVerDate Sep 11 2014 18:36 Jun 04, 2018 Jkt 079200 PO 00000 Frm 00018 Fmt 6652 Sfmt 6201 E:\BILLS\H5930.IH H5930

pbinns on DSK79D2C42PROD with BILLS
19 

•HR 5930 IH

1 tion should be collected from a minor only when col2 lection of the personal information is— 

3 (A) consistent with the context of a par4 ticular transaction or service or the relationship 

5 of the minor with the operator, including collec6 tion necessary to fulfill a transaction or provide 

7 a service requested by the minor; or 

8 (B) required or specifically authorized by 

9 law. 

10 (2) DATA QUALITY PRINCIPLE.—The personal 

11 information of a minor should be accurate, complete, 

12 and kept up-to-date to the extent necessary to fulfill 

13 the purposes described in subparagraphs (A) 

14 through (D) of paragraph (3). 

15 (3) PURPOSE SPECIFICATION PRINCIPLE.—The 

16 purposes for which personal information is collected 

17 should be specified to the minor not later than at 

18 the time of the collection of the information. The 

19 subsequent use or disclosure of the information 

20 should be limited to— 

21 (A) fulfillment of the transaction or service 

22 requested by the minor; 

23 (B) support for the internal operations of 

24 the website, service, or application, as described 

25 in section 312.2 of title 16, Code of Federal 


pbinns on DSK79D2C42PROD with BILLS
20 

•HR 5930 IH

1 Regulations, excluding any activity relating to 

2 targeted marketing directed to children, minors, 

3 or connected devices; 

4 (C) compliance with legal process or other 

5 purposes expressly authorized under specific 

6 legal authority; or 

7 (D) other purposes— 

8 (i) that are specified in a notice to the 

9 minor; and 

10 (ii) to which the minor has consented 

11 under paragraph (7) before the informa12 tion is used or disclosed for such other 

13 purposes. 

14 (4) RETENTION LIMITATION PRINCIPLE.—The 

15 personal information of a minor should not be re16 tained for longer than is necessary to fulfill a trans17 action or provide a service requested by the minor 

18 or such other purposes specified in subparagraphs 

19 (A) through (D) of paragraph (3). The operator 

20 should implement a reasonable and appropriate data 

21 disposal policy based on the nature and sensitivity of 

22 such personal information. 

23 (5) SECURITY SAFEGUARDS PRINCIPLE.—The 

24 personal information of a minor should be protected 

25 by reasonable and appropriate security safeguards 


pbinns on DSK79D2C42PROD with BILLS
21 

•HR 5930 IH

1 against risks such as loss or unauthorized access, 

2 destruction, use, modification, or disclosure. 

3 (6) OPENNESS PRINCIPLE.— 

4 (A) IN GENERAL.—The operator should 

5 maintain a general policy of openness about de6 velopments, practices, and policies with respect 

7 to the personal information of a minor. The op8 erator should provide each minor using the 

9 website, online service, online application, or 

10 mobile application of the operator with a clear 

11 and prominent means— 

12 (i) to identify and contact the oper13 ator, by, at a minimum, disclosing, clearly 

14 and prominently, the identity of the oper15 ator and— 

16 (I) in the case of an operator 

17 who is an individual, the address of 

18 the principal residence of the operator 

19 and an email address and telephone 

20 number for the operator; or 

21 (II) in the case of any other op22 erator, the address of the principal 

23 place of business of the operator and 

24 an email address and telephone num25 ber for the operator; 


pbinns on DSK79D2C42PROD with BILLS
22 

•HR 5930 IH

1 (ii) to determine whether the operator 

2 possesses any personal information of the 

3 minor, the nature of any such information, 

4 and the purposes for which the information 

5 was collected and is being retained; 

6 (iii) to obtain any personal informa7 tion of the minor that is in the possession 

8 of the operator from the operator, or from 

9 a person specified by the operator, within 

10 a reasonable time after making a request, 

11 at a charge (if any) that is not excessive, 

12 in a reasonable manner, and in a form that 

13 is readily intelligible to the minor; 

14 (iv) to challenge the accuracy of per15 sonal information of the minor that is in 

16 the possession of the operator; and 

17 (v) if the minor establishes the inaccu18 racy of personal information in a challenge 

19 under clause (iv), to have such information 

20 erased, corrected, completed, or otherwise 

21 amended. 

22 (B) LIMITATION.—Nothing in this para23 graph shall be construed to permit an operator 

24 to erase or otherwise modify personal informaVerDate Sep 11 2014 18:36 Jun 04, 2018 Jkt 079200 PO 00000 Frm 00022 Fmt 6652 Sfmt 6201 E:\BILLS\H5930.IH H5930

pbinns on DSK79D2C42PROD with BILLS
23 

•HR 5930 IH

1 tion requested by a law enforcement agency 

2 pursuant to legal authority. 

3 (7) INDIVIDUAL PARTICIPATION PRINCIPLE.— 

4 The operator should— 

5 (A) obtain consent from a minor before 

6 using or disclosing the personal information of 

7 the minor for any purpose other than the pur8 poses described in subparagraphs (A) through 

9 (C) of paragraph (3); and 

10 (B) obtain affirmative express consent 

11 from a minor before using or disclosing pre12 viously collected personal information of the 

13 minor for purposes that constitute a material 

14 change in practice from the original purposes 

15 specified to the minor under paragraph (3). 

16 SEC. 5. DIGITAL MARKETING BILL OF RIGHTS FOR MINORS. 

17 (a) ACTS PROHIBITED.—It is unlawful for an oper18 ator of a website, online service, online application, or mo19 bile application directed to minors, or an operator having 

20 actual knowledge that personal information being collected 

21 is from a minor, to collect personal information from a 

22 minor unless such operator has adopted and complies with 

23 a Digital Marketing Bill of Rights for Minors that is con24 sistent with the Fair Information Practices Principles de25 scribed in section 4. 


pbinns on DSK79D2C42PROD with BILLS
24 

•HR 5930 IH

1 (b) REGULATIONS.—Not later than 1 year after the 

2 date of enactment of this Act, the Commission shall pro3 mulgate, under section 553 of title 5, United States Code, 

4 regulations to implement this section, including regula5 tions further defining the Fair Information Practices 

6 Principles described in section 4. 

7 SEC. 6. TARGETED MARKETING TO CHILDREN OR MINORS. 

8 (a) ACTS PROHIBITED.—It is unlawful for— 

9 (1) an operator of a website, online service, on10 line application, mobile application, or connected de11 vice directed to children, or an operator having ac12 tual knowledge that personal information being col13 lected is from a child or a connected device of a 

14 child, to use, disclose to third parties, or compile 

15 personal information for purposes of targeted mar16 keting; or 

17 (2) an operator of a website, online service, on18 line application, mobile application, or connected de19 vice directed to minors, or an operator having actual 

20 knowledge that personal information being collected 

21 is from a minor or a connected device of a minor, 

22 to use, disclose to third parties, or compile personal 

23 information for purposes of targeted marketing with24 out the verifiable consent of the minor. 


pbinns on DSK79D2C42PROD with BILLS
25 

•HR 5930 IH

1 (b) REGULATIONS.—Not later than 1 year after the 

2 date of enactment of this Act, the Commission shall pro3 mulgate, under section 553 of title 5, United States Code, 

4 regulations to implement this section. 

5 SEC. 7. REMOVAL OF CONTENT. 

6 (a) ACTS PROHIBITED.—It is unlawful for an oper7 ator to make publicly available through a website, online 

8 service, online application, or mobile application content 

9 or information that contains or displays personal informa10 tion of children or minors in a manner that violates a reg11 ulation prescribed under subsection (b). 

12 (b) REGULATIONS.— 

13 (1) IN GENERAL.—Not later than 1 year after 

14 the date of enactment of this Act, the Commission 

15 shall promulgate, under section 553 of title 5, 

16 United States Code, regulations that require an op17 erator— 

18 (A) to the extent technologically feasible, 

19 to implement mechanisms that permit a user of 

20 the website, online service, online application, or 

21 mobile application of the operator to erase or 

22 otherwise eliminate content or information that 

23 is— 


pbinns on DSK79D2C42PROD with BILLS
26 

•HR 5930 IH

1 (i) submitted to the website, online 

2 service, online application, or mobile appli3 cation by that user; 

4 (ii) publicly available through the 

5 website, online service, online application, 

6 or mobile application; and 

7 (iii) contains or displays personal in8 formation of children or minors; and 

9 (B) to take appropriate steps to make 

10 users aware of the mechanisms described in 

11 subparagraph (A) and to provide notice to users 

12 that the mechanisms do not necessarily provide 

13 comprehensive removal of the content or infor14 mation submitted by users. 

15 (2) EXCEPTION.—The regulations promulgated 

16 under paragraph (1) may not require an operator or 

17 third party to erase or otherwise eliminate content 

18 or information that— 

19 (A) any other provision of Federal or State 

20 law requires the operator or third party to 

21 maintain; or 

22 (B) was submitted to the website, online 

23 service, online application, or mobile application 

24 of the operator by any person other than the 

25 user who is attempting to erase or otherwise 


pbinns on DSK79D2C42PROD with BILLS
27 

•HR 5930 IH

1 eliminate the content or information, including 

2 content or information submitted by the user 

3 that was republished or resubmitted by another 

4 person. 

5 (3) LIMITATION.—Nothing in this section shall 

6 be construed to limit the authority of a law enforce7 ment agency to obtain any content or information 

8 from an operator as authorized by law or pursuant 

9 to an order of a court of competent jurisdiction. 

10 SEC. 8. PRIVACY DASHBOARD FOR CONNECTED DEVICES 

11 FOR CHILDREN AND MINORS. 

12 (a) IN GENERAL.—A manufacturer of a connected 

13 device shall prominently display on the packaging for the 

14 connected device a standardized and easy-to-understand 

15 privacy dashboard, detailing whether, what, and how per16 sonal information of a child or minor is— 

17 (1) collected from the connected device; 

18 (2) transmitted from the connected device; 

19 (3) retained on the connected device; 

20 (4) retained by the manufacturer or affiliated 

21 person; 

22 (5) used by the manufacturer or affiliated per23 son; and 

24 (6) protected. 


pbinns on DSK79D2C42PROD with BILLS
28 

•HR 5930 IH

1 (b) FEATURES.—A privacy dashboard under sub2 section (a) shall inform a consumer of— 

3 (1) the extent to which the connected device 

4 meets the highest cybersecurity and data security 

5 standards, including if and how to obtain security 

6 patches; 

7 (2) the extent to which the connected device 

8 gives— 

9 (A) a parent meaningful control over the 

10 information of a child of the parent; and 

11 (B) a minor meaningful control over the 

12 information of the minor; 

13 (3) the extent to which the device minimizes the 

14 collection, retention, and use of information from a 

15 child or minor; 

16 (4) the location of privacy policies; 

17 (5) the type of personal information the con18 nected device may collect; and 

19 (6) any other information as the Commission 

20 considers appropriate. 

21 (c) REGULATIONS.—Not later than 1 year after the 

22 date of enactment of this Act, the Commission shall pro23 mulgate, under section 553 of title 5, United States Code, 

24 regulations to implement this section. 


pbinns on DSK79D2C42PROD with BILLS
29 

•HR 5930 IH

1 SEC. 9. PROHIBITION ON SALE OF CONNECTED DEVICES 

2 FOR CHILDREN AND MINORS THAT FAIL TO 

3 MEET APPROPRIATE CYBERSECURITY AND 

4 DATA SECURITY STANDARDS. 

5 (a) PROHIBITION.—Beginning 1 year after the date 

6 of enactment of this Act, or such earlier date as the Com7 mission considers appropriate, no person may sell a con8 nected device unless the connected device meets appro9 priate cybersecurity and data security standards estab10 lished by the Commission. 

11 (b) CYBERSECURITY AND DATA SECURITY STAND12 ARDS.— 

13 (1) IN GENERAL.—The Commission shall pro14 mulgate, under section 553 of title 5, United States 

15 Code, cybersecurity and data security standards de16 scribed in subsection (a). 

17 (2) CONSIDERATIONS.—In promulgating cyber18 security and data security standards under para19 graph (1), the Commission shall— 

20 (A) create cybersecurity and data security 

21 standards for different subsets of connected de22 vices based on the varying degrees of— 

23 (i) cybersecurity and data security 

24 risk associated with each subset of con25 nected device; 


pbinns on DSK79D2C42PROD with BILLS
30 

•HR 5930 IH

1 (ii) sensitivity of information collected, 

2 stored, or transmitted by each subset of 

3 connected device; and 

4 (iii) functionality of each subset of 

5 connected device; 

6 (B) consider incorporating, to the extent 

7 practicable, existing cybersecurity and data se8 curity standards; and 

9 (C) ensure that the cybersecurity and data 

10 security standards— 

11 (i) are consistent with Fair Informa12 tion Practice Principles described in sec13 tion 4; and 

14 (ii) promote data minimization. 

15 SEC. 10. RULE FOR TREATMENT OF USERS OF WEBSITES, 

16 SERVICES, AND APPLICATIONS DIRECTED TO 

17 CHILDREN OR MINORS. 

18 For the purposes of this Act, an operator of a 

19 website, online service, online application, or mobile appli20 cation that is directed to children or minors shall treat 

21 each user of that website, online service, online applica22 tion, or mobile application as a child or minor, respective 

23 to whether the website, online service, online application, 

24 or mobile application is directed to children or minors, exVerDate Sep 11 2014 18:36 Jun 04, 2018 Jkt 079200 PO 00000 Frm 00030 Fmt 6652 Sfmt 6201 E:\BILLS\H5930.IH H5930

pbinns on DSK79D2C42PROD with BILLS
31 

•HR 5930 IH

1 cept as permitted by the Commission pursuant to a regula2 tion promulgated under this Act. 

3 SEC. 11. ENFORCEMENT AND APPLICABILITY. 

4 (a) ENFORCEMENT BY THE COMMISSION.— 

5 (1) IN GENERAL.—Except as otherwise pro6 vided, this Act and the regulations prescribed under 

7 this Act shall be enforced by the Commission under 

8 the Federal Trade Commission Act (15 U.S.C. 41 et 

9 seq.). 

10 (2) UNFAIR OR DECEPTIVE ACTS OR PRAC11 TICES.—Subject to subsection (b), a violation of this 

12 Act or a regulation prescribed under this Act shall 

13 be treated as a violation of a rule defining an unfair 

14 or deceptive act or practice prescribed under section 

15 18(a)(1)(B) of the Federal Trade Commission Act 

16 (15 U.S.C. 57a(a)(1)(B)). 

17 (3) ACTIONS BY THE COMMISSION.— 

18 (A) IN GENERAL.—Subject to subsection 

19 (b), and except as provided in subsection (d)(1), 

20 the Commission shall prevent any person from 

21 violating this Act or a regulation prescribed 

22 under this Act in the same manner, by the 

23 same means, and with the same jurisdiction, 

24 powers, and duties as though all applicable 

25 terms and provisions of the Federal Trade 


pbinns on DSK79D2C42PROD with BILLS
32 

•HR 5930 IH

1 Commission Act (15 U.S.C. 41 et seq.) were in2 corporated into and made a part of this Act, 

3 and any person who violates this Act or such 

4 regulation shall be subject to the penalties and 

5 entitled to the privileges and immunities pro6 vided in the Federal Trade Commission Act. 

7 (B) VIOLATIONS.—In an action brought by 

8 the Commission to enforce this Act and the reg9 ulations prescribed under this Act, each con10 nected device that fails to meet a standard pro11 mulgated under this Act shall be treated as a 

12 separate violation. 

13 (b) ENFORCEMENT BY CERTAIN OTHER AGEN14 CIES.—Notwithstanding subsection (a), compliance with 

15 the requirements imposed under this Act shall be enforced 

16 as follows: 

17 (1) Under section 8 of the Federal Deposit In18 surance Act (12 U.S.C. 1818) by the appropriate 

19 Federal banking agency, with respect to an insured 

20 depository institution (as such terms are defined in 

21 section 3 of such Act (12 U.S.C. 1813)). 

22 (2) Under the Federal Credit Union Act (12 

23 U.S.C. 1751 et seq.) by the National Credit Union 

24 Administration Board, with respect to any Federal 

25 credit union. 


pbinns on DSK79D2C42PROD with BILLS
33 

•HR 5930 IH

1 (3) Under part A of subtitle VII of title 49, 

2 United States Code, by the Secretary of Transpor3 tation, with respect to any air carrier or foreign air 

4 carrier subject to such part. 

5 (4) Under the Packers and Stockyards Act, 

6 1921 (7 U.S.C. 181 et seq.) (except as provided in 

7 section 406 of that Act (7 U.S.C. 226; 227)) by the 

8 Secretary of Agriculture, with respect to any activi9 ties subject to that Act. 

10 (5) Under the Farm Credit Act of 1971 (12 

11 U.S.C. 2001 et seq.) by the Farm Credit Adminis12 tration, with respect to any Federal land bank, Fed13 eral land bank association, Federal intermediate 

14 credit bank, or production credit association. 

15 (c) ENFORCEMENT BY STATE ATTORNEYS GEN16 ERAL.— 

17 (1) IN GENERAL.— 

18 (A) CIVIL ACTIONS.—In any case in which 

19 the attorney general of a State has reason to 

20 believe that an interest of the residents of that 

21 State has been or is threatened or adversely af22 fected by the engagement of any person in a 

23 practice that violates this Act or a regulation 

24 prescribed under this Act, the State, as parens 

25 patriae, may bring a civil action on behalf of 


pbinns on DSK79D2C42PROD with BILLS
34 

•HR 5930 IH

1 the residents of the State in a district court of 

2 the United States of appropriate jurisdiction 

3 to— 

4 (i) enjoin that practice; 

5 (ii) enforce compliance with this Act 

6 or such regulation; 

7 (iii) obtain damages, restitution, or 

8 other compensation on behalf of residents 

9 of the State; or 

10 (iv) obtain such other relief as the 

11 court may consider to be appropriate. 

12 (B) NOTICE.— 

13 (i) IN GENERAL.—Before filing an ac14 tion under subparagraph (A), the attorney 

15 general of the State involved shall provide 

16 to the Commission— 

17 (I) written notice of that action; 

18 and 

19 (II) a copy of the complaint for 

20 that action. 

21 (ii) EXEMPTION.— 

22 (I) IN GENERAL.—Clause (i) 

23 shall not apply with respect to the fil24 ing of an action by an attorney gen25 eral of a State under this paragraph 


pbinns on DSK79D2C42PROD with BILLS
35 

•HR 5930 IH

1 if the attorney general of the State 

2 determines that it is not feasible to 

3 provide the notice described in that 

4 clause before the filing of the action. 

5 (II) NOTIFICATION.—In an ac6 tion described in subclause (I), the at7 torney general of a State shall provide 

8 notice and a copy of the complaint to 

9 the Commission at the same time as 

10 the attorney general files the action. 

11 (2) INTERVENTION.— 

12 (A) IN GENERAL.—On receiving notice 

13 under paragraph (1)(B), the Commission shall 

14 have the right to intervene in the action that is 

15 the subject of the notice. 

16 (B) EFFECT OF INTERVENTION.—If the 

17 Commission intervenes in an action under para18 graph (1), it shall have the right— 

19 (i) to be heard with respect to any 

20 matter that arises in that action; and 

21 (ii) to file a petition for appeal. 

22 (3) CONSTRUCTION.—For purposes of bringing 

23 any civil action under paragraph (1), nothing in this 

24 Act shall be construed to prevent an attorney gen25 eral of a State from exercising the powers conferred 


pbinns on DSK79D2C42PROD with BILLS
36 

•HR 5930 IH

1 on the attorney general by the laws of that State 

2 to— 

3 (A) conduct investigations; 

4 (B) administer oaths or affirmations; or 

5 (C) compel the attendance of witnesses or 

6 the production of documentary and other evi7 dence. 

8 (4) ACTIONS BY THE COMMISSION.—In any 

9 case in which an action is instituted by or on behalf 

10 of the Commission for violation of this Act or a reg11 ulation prescribed under this Act, no State may, 

12 during the pendency of that action, institute an ac13 tion under paragraph (1) against any defendant 

14 named in the complaint in the action instituted by 

15 or on behalf of the Commission for that violation. 

16 (5) VENUE; SERVICE OF PROCESS.— 

17 (A) VENUE.—Any action brought under 

18 paragraph (1) may be brought in the district 

19 court of the United States that meets applicable 

20 requirements relating to venue under section 

21 1391 of title 28, United States Code. 

22 (B) SERVICE OF PROCESS.—In an action 

23 brought under paragraph (1), process may be 

24 served in any district in which the defendant— 

25 (i) is an inhabitant; or 


pbinns on DSK79D2C42PROD with BILLS
37 

•HR 5930 IH

1 (ii) may be found. 

2 (d) TELECOMMUNICATIONS CARRIERS AND CABLE

3 OPERATORS.— 

4 (1) ENFORCEMENT BY COMMISSION.—Notwith5 standing section 5(a)(2) of the Federal Trade Com6 mission Act (15 U.S.C. 45(a)(2)), compliance with 

7 the requirements imposed under this Act shall be en8 forced by the Commission with respect to any tele9 communications carrier (as defined in section 3 of 

10 the Communications Act of 1934 (47 U.S.C. 153)). 

11 (2) RELATIONSHIP TO OTHER LAWS.—To the 

12 extent that section 222, 338(i), or 631 of the Com13 munications Act of 1934 (47 U.S.C. 222; 338(i); 

14 551) is inconsistent with this Act, this Act controls. 

15 (e) SAFE HARBORS.— 

16 (1) DEFINITION.—In this subsection— 

17 (A) the term ‘‘applicable section’’ means 

18 section 5, 6, 7, 8, or 9 of this Act; 

19 (B) the term ‘‘covered operator’’ means an 

20 operator subject to guidelines approved under 

21 paragraph (2); 

22 (C) the term ‘‘requesting entity’’ means an 

23 entity that submits a safe harbor request to the 

24 Commission; and 


pbinns on DSK79D2C42PROD with BILLS
38 

•HR 5930 IH

1 (D) the term ‘‘safe harbor request’’ means 

2 a request to have self-regulatory guidelines de3 scribed in paragraph (2)(A) approved under 

4 that paragraph. 

5 (2) GUIDELINES.— 

6 (A) IN GENERAL.—An operator may sat7 isfy the requirements of regulations issued 

8 under an applicable section by following a set of 

9 self-regulatory guidelines, issued by representa10 tives of the marketing or online industries, or 

11 by other persons, that, after notice and an op12 portunity for comment, are approved by the 

13 Commission upon making a determination that 

14 the guidelines meet the requirements of the reg15 ulations issued under that applicable section. 

16 (B) EXPEDITED RESPONSE TO RE17 QUESTS.—Not later than 180 days after the 

18 date on which a safe harbor request is filed 

19 under subparagraph (A), the Commission shall 

20 act upon the request set forth in writing the 

21 conclusions of the Commission with regard to 

22 the request. 

23 (C) APPEALS.—A requesting entity may 

24 appeal the final action of the Commission under 

25 subparagraph (B), or a failure by the CommisVerDate Sep 11 2014 18:36 Jun 04, 2018 Jkt 079200 PO 00000 Frm 00038 Fmt 6652 Sfmt 6201 E:\BILLS\H5930.IH H5930

pbinns on DSK79D2C42PROD with BILLS
39 

•HR 5930 IH

1 sion to act in the period described in that para2 graph, to a district court of the United States 

3 of appropriate jurisdiction, as provided for in 

4 section 706 of title 5, United States Code. 

5 (3) INCENTIVES.— 

6 (A) SELF-REGULATORY INCENTIVES.—In 

7 prescribing regulations under an applicable sec8 tion, the Commission shall provide incentives 

9 for self-regulation by covered operators to im10 plement the protections afforded children and 

11 minors, as applicable, under the regulatory re12 quirements described in those sections. 

13 (B) DEEMED COMPLIANCE.—The incen14 tives under subparagraph (A) shall include pro15 visions for ensuring that a covered operator will 

16 be deemed to be in compliance with the require17 ments of the regulations under an applicable 

18 section if that person complies with guidelines 

19 approved under paragraph (2). 

20 (4) REGULATIONS.—In prescribing regulations 

21 relating to safe harbor guidelines under an applica22 ble section, the Commission shall— 

23 (A) establish criteria for the approval of 

24 guidelines that will ensure that a covered oper25 ator provides substantially the same or greater 


pbinns on DSK79D2C42PROD with BILLS
40 

•HR 5930 IH

1 protections for children and minors, as applica2 ble, as those contained in the regulations issued 

3 under the applicable section; and 

4 (B) require that any report or documenta5 tion required to be submitted to the Commis6 sion by a covered operator or requesting entity 

7 will be published on the internet website of the 

8 Commission, except to the extent that the re9 port or documentation contains proprietary in10 formation, which the Commission may in its 

11 discretion redact. 

12 SEC. 12. EFFECTIVE DATES. 

13 (a) IN GENERAL.—Except as provided in subsections 

14 (b) and (c), this Act and the amendments made by this 

15 Act shall take effect on the date that is 1 year after the 

16 date of enactment of this Act. 

17 (b) AUTHORITY TO PROMULGATE REGULATIONS.— 

18 The following shall take effect on the date of enactment 

19 of this Act: 

20 (1) Section 2(b). 

21 (2) The amendments made by subsections 

22 (a)(6) and (b) of section 3. 

23 (3) Sections 5(b), 6(b), 7(b), 8(c), and 9(b). 

24 (c) DIGITAL MARKETING BILL OF RIGHTS FOR MI25 NORS.—Section 5(a) shall take effect on the date that is 


pbinns on DSK79D2C42PROD with BILLS
41 

•HR 5930 IH

1 180 days after the promulgation of regulations under that 

2 subsection. 

3 (d) PRIVACY DASHBOARD FOR CONNECTED DEVICES

4 FOR CHILDREN AND MINORS.—Subsections (a) and (b) 

5 of section 8 shall take effect on the date that is 180 days 

6 after the promulgation of regulations under such sub7 section. 

Æ 


pbinns on DSK79D2C42PROD with BILLS