EPRE,
(E* SSN
(3 RECEIVED

6 ve
= pare Sf 8

S TIME pee
wz BY
\

o. Re

Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City, Metro Manila

‘TWENTIETH CONGRESS
First Regular Session

HOUSE BILL No._ 470

Introduced by Representative Jaime R. Fresnedi

EXPLANATORY NOTE

This bill seeks to establish safeguards for the online privacy of children by regulating
the collection, storage, and use of their personal information. It requires verifiable parental
consent before any online service provider collects or processes a child’s data, prohibits
targeted advertising directed at minors, and ensures that online platforms implement default
privacy settings that prioritize children's safety. By strengthening enforcement mechanisms
through the National Privacy Commission, this measure aims to hold online platforms
accountable and prevent the exploitation of children’s personal data for commercial gain.

While the Data Privacy Act of 2012 (RA 10173) provides a general framework for data
protection, it does not contain specific provisions for children. The Consumer Act of the
Philippines (RA 7394) regulates deceptive advertising, but it does not explicitly ban targeted
advertising aimed at minors. The Cybercrime Prevention Act of 2012 (RA 10175) penalizes
online fraud and cyber-related crimes but does not address the legal yet harmful collection of
children’s personal information. These gaps leave Filipino children vulnerable to privacy
violations, behavioral profiling, and potential exploitation by online service providers. This
proposed measure addresses these gaps by providing clear parental control mechanisms over
children’s data, prohibiting platforms from collecting or processing minors’ information
without consent, and ensuring that default privacy settings minimize data collection.

Internationally, similar measures have been enacted to protect children’s online
privacy. The United States’ Children’s Online Privacy Protection Act (COPPA) requires
parental consent before collecting data from children under 13', while the European Union's
General Data Protection Regulation (GDPR) includes specific provisions to safeguard minors"
data*. These policies serve as models for strengthening child-specific data protections in the
Philippines.

By enacting this piece of legislation, the Philippines aligns its policies with international
best practices and provide Filipino children with stronger legal protections in the digital

USC prelim-title15-section6501&edition=prelim

)

+ https://uscode house gov/view xhtmI?rea=g
2 General Data Protection Regulation (https://adpr



environment. This bill ensures that children’s online experiences are safe, privacy-conscious,
and free from exploitative data collection practices.

In view of the foregoing, the immediate passage of this bill is earnestly sought.

JAIME FRESNEDI
resentative
Lone District, Muntinlupa City


Republic of the Philippines
HOUSE OF REPRESENTATIVES
Quezon City, Metro Manila

TWENTIETH CONGRESS
First Regular Session

7
HOUSE BILL NO. 470

Introduced by Representative Jaime R. Fresnedi

AN ACT
PROVIDING FOR THE ONLINE PRIVACY AND DATA PROTECTION OF
‘CHILDREN, PRESCRIBING REGULATIONS FOR THE COLLECTION AND USE
OF PERSONAL INFORMATION OF MINORS, AND FOR OTHER PURPOSES

Be it enacted by the Senate and House of Representatives of the Philippines in Congress
assembled:

Section 1. Short Title. - This Act shall be known as the "Children's Online Data Privacy
Act.”

SEC 2. Declaration of Policy. -- It is the policy of the State to promote the protection of
children’s rights, including their right to privacy and digital security. Recognizing the risks
associated with the collection and misuse of personal information of minors, the State shall
regulate online platforms and service providers to ensure that children’s data is not exploited
for commercial or harmful purposes.

SEC 3. Definition of Terms. ~ For purposes of this Act, the following terms shall mean:
) Child or Minor refers to any individual under the age of thirteen (13).

b) Personal Information refers to any data that can be used to identify an
individual, including but not limited to name, address, phone number, email,
biometric data, and online identifiers such as IP addresses and cookies.

©) Online Service Providers refers to any website, mobile application, or
digital platform that collects, processes, or stores user data.

d) Parental Consent refers to any express and verifiable permission ftom a
parent or legal guardian allowing the collection, use, or disclosure of a child’s
personal information.

e) Digital Space refers to the place or environment where digital exchanges
and transactions take place. It encompasses websites, social media platforms,
online communities, mobile applications, and other digital channels where people
can engage with each other, access content, and conduct various activities.


SEC 4. Regulation of Online Platforms. ~ The National Privacy Commission (NPC) shall
be primarily tasked in the protection of personal information of children in the digital space. It
shall ensure that:

a) Online service providers shall not collect, store, or process personal
information of children without verifiable parental consent;

b) Online platforms shall provide clear and accessible privacy policies
explaining how children’s data is collected, stored, and used;

©) Online platforms must implement default privacy settings that minimize
data collection from children and provide child-friendly user experiences;

d) No targeted advertising shall be directed at minors based on their personal
data, browsing habits, or online behavior.

SEC 5. Responsibilities of Online Platforms and Service Providers. -To ensure the
protection of children’s personal information in the digital space, online platforms and
service providers shall be required to:

a) Establish mechanisms for parental consent verification;

b) Provide parents or legal guardians with the option to review, modify, or
delete their child’s personal information;

¢) Delete a child’s personal information within a reasonable period upon
request by the parent or legal guardian,

SEC 6. Penalties. — Any online service provider found violating this Act shall be
‘subject to the following penalties:

a) A fine of not less than Five Hundred Thousand Pesos (P500,000.00) but
not exceeding Five Million Pesos (P5,000,000.00) for each instance of non-
compliance;

b) Suspension or revocation of business permits for repeated violations;

©) In cases of willful or reckless misuse of children’s data, criminal liability
may be imposed in accordance with applicable laws.

SEC 7. Implementing Rules and Regulations (IRR). ~ The NPC, in coordination with
the Department of Information and Communications Technology (DICT), Department of
Social Welfare and Development (DSWD), and other relevant agencies, shall jointly
promulgate the implementing rules and regulations (IRR) to implement the provisions of this
‘Act and issue the same within sixty (60) days from its effectivity.

The IRR issued pursuant to this section shall take effect thirty (30) days after its
publication in a newspaper of general circulation.


SEC. 8. Separability Clause. ~ If any portion or provision of this Act is subsequently
declared invalid or unconstitutional, other provisions hereof which are not affected thereby
shall remain in full force and effect.

SEC. 9. Repealing Clause. ~ All laws, decrees, ordinances, administrative order, rules
and regulations, or any part thereof, which are inconsistent with this Act are repealed or
amended accordingly.

SEC. 10. Effectivity. — This Act shall take effect fifteen (15) days after its publication
in the Official Gazette and at least two (2) newspapers of national circulation.

Approved,