(F) any other existing or proposed tech-
nologies or methods for reducing access by mi-
nors to such material.
(3) ANALYSIS.—In analyzing technologies and
other methods identified pursuant to paragraph (2),
the Commission shall examine—
(A) the cost of such technologies and
methods;
(B) the effects of such technologies and
methods on law enforcement entities;
(C) the effects of such technologies and
methods on privacy;
(D) the extent to which material that is
harmful to minors is globally distributed and
the effect of such technologies and methods on
such distribution;
(E) the accessibility of such technologies
and methods to parents; and
(F) such other factors and issues as the
Commission considers relevant and appropriate.
(d) REPORT.—Not later than 1 year after the enact-
ment of this Act, the Commission shall submit a report
to the Congress containing the results of the study under
this section, which shall include—
(1) a description of the technologies and meth-
ods identified by the study and the results of the
analysis of each such technology and method;
(2) the conclusions and recommendations of the
Commission regarding each such technology or
method;
(3) recommendations for legislative or adminis-
trative actions to implement the conclusions of the
committee; and
(4) a description of the technologies or methods
identified by the study that may meet the require-
ments for use as affirmative defenses for purposes of
section 231(c) of the Communications Act of 1934
(as added by this Act).
(e) STAFF
AND RESOURCES.—The Assistant Sec-
retary for Communication and Information of the Depart-
ment of Commerce shall provide to the Commission such
staff and resources as the Assistant Secretary determines
necessary for the Commission to perform its duty effi-
ciently and in accordance with this section.
(f) TERMINATION.—The Commission shall terminate
30 days after the submission of the report under sub-
section (d).
(g) INAPPLICABILITY OF FEDERAL ADVISORY COM-
MITTEE ACT.—The Federal Advisory Committee Act (5
U.S.C. App.) shall not apply to the Commission.
SEC. 105. EFFECTIVE DATE.
This title and the amendments made by this title
shall take effect 30 days after the date of enactment of
this Act.
TITLE II—CHILDREN’S ONLINE
PRIVACY PROTECTION
SEC. 201. DEFINITIONS.
In this title:
(1) CHILD.—The term ‘‘child’’ means an indi-
vidual under the age of 13.
(2) OPERATOR.—The term ‘‘operator’’ means
any person operating a website on the World Wide
Web or any online service for commercial purposes,
including any person offering products or services
for sale through that website or online service, in-
volving commerce—
(A) among the several States or with 1 or
more foreign nations;
(B) in any territory of the United States
or in the District of Columbia, or between any
such territory and—
(i) another such territory; or
(ii) any State or foreign nation; or
(C) between the District of Columbia and
any State, territory, or foreign nation.
For purposes of this title, the term ‘‘operator’’ does
not include any non-profit entity that would other-
wise be exempt from coverage under section 5 of the
Federal Trade Commission Act (15 U.S.C. 45).
(3) COMMISSION.—The term ‘‘Commission’’
means the Federal Trade Commission.
(4) 
DISCLOSURE.—The 
term 
‘‘disclosure’’
means, with respect to personal information—
(A) the release of personal information col-
lected from a child in identifiable form by an
operator for any purpose, except where such in-
formation is provided to a person other than
the operator who provides support for the inter-
nal operations of the website and does not dis-
close or use that information for any other pur-
pose; and
(B) making personal information collected
from a child by a website or online service di-
rected to children or with actual knowledge that
such information was collected from a child,
publicly available in identifiable form, by any
means including by a public posting, through
the Internet, or through—
(i) a home page of a website;
(ii) a pen pal service;
(iii) an electronic mail service;
(iv) a message board; or
(v) a chat room.
(5) FEDERAL
AGENCY.—The term ‘‘Federal
agency’’ means an agency, as that term is defined
in section 551(1) of title 5, United States Code.
(6) INTERNET.—The term ‘‘Internet’’ means
collectively the myriad of computer and tele-
communications facilities, including equipment and
operating software, which comprise the inter-
connected world-wide network of networks that em-
ploy the Transmission Control Protocol/Internet
Protocol, or any predecessor or successor protocols
to such protocol, to communicate information of all
kinds by wire or radio.
(7) PARENT.—The term ‘‘parent’’ includes a
legal guardian.
(8) PERSONAL INFORMATION.—The term ‘‘per-
sonal information’’ means individually identifiable
information about an individual collected online, in-
cluding—
(A) a first and last name;
(B) a home or other physical address in-
cluding street name and name of a city or town;
(C) an e-mail address;
(D) a telephone number;
(E) a Social Security number;
(F) any other identifier that the Commis-
sion determines permits the physical or online
contacting of a specific individual; or
(G) information concerning the child or the
parents of that child that the website collects
online from the child and combines with an
identifier described in this paragraph.
(9) VERIFIABLE
PARENTAL
CONSENT.—The
term ‘‘verifiable parental consent’’ means any rea-
sonable effort (taking into consideration available
technology), including a request for authorization for
future collection, use, and disclosure described in the
notice, to ensure that a parent of a child receives no-
tice of the operator’s personal information collection,
use, and disclosure practices, and authorizes the col-
lection, use, and disclosure, as applicable, of per-
sonal information and the subsequent use of that in-
formation before that information is collected from
that child.
(10) WEBSITE OR ONLINE SERVICE DIRECTED
TO CHILDREN.—
(A) IN GENERAL.—The term ‘‘website or
online service directed to children’’ means —
(i) a commercial website or online
service that is targeted to children; or
(ii) that portion of a commercial
website or online service that is targeted to
children.
(B) LIMITATION.—A commercial website
or online service, or a portion of a commercial
website or online service, shall not be deemed
directed to children solely for referring or link-
ing to a commercial website or online service di-
rected to children by using information location
tools, including a directory, index, reference,
pointer, or hypertext link.
(11) PERSON.—The term ‘‘person’’ means any
individual, partnership, corporation, trust, estate, co-
operative, association, or other entity.
(12) ONLINE
CONTACT
INFORMATION.—The
term ‘‘online contact information’’ means an e-mail
address or another substantially similar identifier
that permits direct contact with a person online.
SEC. 202. REGULATION OF UNFAIR AND DECEPTIVE ACTS
AND PRACTICES IN CONNECTION WITH THE
COLLECTION AND USE OF PERSONAL INFOR-
MATION FROM AND ABOUT CHILDREN ON
THE INTERNET.
(a) ACTS PROHIBITED.—
(1) IN GENERAL.—It is unlawful for an opera-
tor of a website or online service directed to chil-
dren, or any operator that has actual knowledge that
it is collecting personal information from a child, to
collect personal information from a child in a man-
ner that violates the regulations prescribed under
subsection (b).
(2) DISCLOSURE
TO
PARENT
PROTECTED.—
Notwithstanding paragraph (1), neither an operator
of such a website or online service nor the operator’s
agent shall be held to be liable under any Federal
or State law for any disclosure made in good faith
and following reasonable procedures in responding to
a request for disclosure of personal information
under subsection (b)(1)(B)(iii) to the parent of a
child.
(b) REGULATIONS.—
(1) IN GENERAL.—Not later than 1 year after
the date of the enactment of this Act, the Commis-
sion shall promulgate under section 553 of title 5,
United States Code, regulations that—
(A) require the operator of any website or
online service directed to children that collects
personal information from children or the oper-
ator of a website or online service that has ac-
tual knowledge that it is collecting personal in-
formation from a child—
(i) to provide notice on the website of
what information is collected from children
by the operator, how the operator uses
such information, and the operator’s dis-
closure practices for such information; and
(ii) to obtain verifiable parental con-
sent for the collection, use, or disclosure of
personal information from children;
(B) require the operator to provide, upon
request of a parent whose child has provided
personal information to that website or online
service—
(i) a description of the specific types
of personal information collected from the
child by that operator;
(ii) notwithstanding any other provi-
sion of law, the opportunity at any time to
refuse to permit the operator’s further use
or maintenance in retrievable form, or fu-
ture online collection, of personal informa-
tion on that child; and
(iii) a means that is reasonable under
the circumstances for the parent to obtain
any personal information collected from
that child;
(C) prohibit conditioning a child’s partici-
pation in a game, the offering of a prize, or an-
other activity on the child disclosing more per-
sonal information than is reasonably necessary
to participate in such activity;
(D) require the operator of such a website
or online service to establish and maintain rea-
sonable procedures to protect the confidential-
ity, security, and integrity of personal informa-
tion collected from children; and
(E) permit the operator of such a website
or online service to collect, use, and disseminate
such information as is necessary—
(i) to protect the security or integrity
of its website;
(ii) to take precautions against liabil-
ity;
(iii) to respond to judicial process;
and
(iv) to provide information to law en-
forcement agencies or for an investigation
on a matter related to public safety.
(2) WHEN CONSENT NOT REQUIRED.—Verifi-
able parental consent under paragraph (1)(A)(ii) is
not required in the case of—
(A) online contact information collected
from a child that is used only to respond di-
rectly on a one-time basis to a specific request
from the child and is not used to recontact the
child and is not maintained in retrievable form
by the operator;
(B) a request for the name or online con-
tact information of a parent or child that is
used for the sole purpose of obtaining parental
consent or providing notice under this section
and where such information is not maintained
in retrievable form by the operator if parental
consent is not obtained after a reasonable time;
(C) online contact information collected
from a child that is used only to respond more
than once directly to a specific request from the
child and is not used to recontact the child be-
yond the scope of that request—
(i) if, before any additional response
after the initial response to the child, the
operator uses reasonable efforts to provide
a parent notice of the online contact infor-
mation collected from the child, the pur-
poses for which it is to be used, and an op-
portunity for the parent to request that the
operator make no further use of the infor-
mation and that it not be maintained in re-
trievable form; or
(ii) without notice to the parent in
such circumstances as the Commission
may determine are appropriate, taking into
consideration the benefits to the child of
access to information and services, and
risks to the security and privacy of the
child, in regulations promulgated under
this subsection; or
(D) the name of the child and online con-
tact information (to the extent necessary to
protect the safety of a child participant in the
site)—
(i) used only for the purpose of pro-
tecting such safety;
(ii) not used to recontact the child or
for any other purpose; and
(iii) not disclosed on the site,
if the operator uses reasonable efforts to pro-
vide a parent notice of the name and online
contact information collected from the child, the
purposes for which it is to be used, and an op-
portunity for the parent to request that the op-
erator make no further use of the information
and that it not be maintained in retrievable
form.
(c) ENFORCEMENT.—Subject to sections 203 and
205, a violation of a regulation prescribed under sub-
section (a) shall be treated as a violation of a rule defining
an unfair or deceptive act or practice prescribed under sec-
tion 18(a)(1)(B) of the Federal Trade Commission Act
(15 U.S.C. 57a(a)(1)(B)).
(d) INCONSISTENT STATE LAW.—No State or local
government may impose any liability for commercial ac-
tivities or actions by operators in interstate or foreign
commerce in connection with an activity or action de-
scribed in this title that is inconsistent with the treatment
of those activities or actions under this section.
SEC. 203. SAFE HARBORS.
(a) GUIDELINES.—An operator may satisfy the re-
quirements of regulations issued under section 202(b) by
following a set of self-regulatory guidelines, issued by rep-
resentatives of the marketing or online industries, or by
other persons, approved under subsection (b).
(b) INCENTIVES.—
(1) SELF-REGULATORY
INCENTIVES.—In pre-
scribing regulations under section 202, the Commis-
sion shall provide incentives for self-regulation by
operators to implement the protections afforded chil-
dren under the regulatory requirements described in
subsection (b) of that section.
(2) DEEMED
COMPLIANCE.—Such incentives
shall include provisions for ensuring that a person
will be deemed to be in compliance with the require-
ments of the regulations under section 202 if that
person complies with guidelines that, after notice
and comment, are approved by the Commission upon
making a determination that the guidelines meet the
requirements of the regulations issued under section
202.
(3) EXPEDITED RESPONSE TO REQUESTS.—The
Commission shall act upon requests for safe harbor
treatment within 180 days of the filing of the re-
quest, and shall set forth in writing its conclusions
with regard to such requests.
(c) APPEALS.—Final action by the Commission on a
request for approval of guidelines, or the failure to act
within 180 days on a request for approval of guidelines,
submitted under subsection (b) may be appealed to a dis-
trict court of the United States of appropriate jurisdiction
as provided for in section 706 of title 5, United States
Code.
SEC. 204. ACTIONS BY STATES.
(a) IN GENERAL.—
(1) CIVIL ACTIONS.—In any case in which the
attorney general of a State has reason to believe
that an interest of the residents of that State has
been or is threatened or adversely affected by the
engagement of any person in a practice that violates
any regulation of the Commission prescribed under
section 202(b), the State, as parens patriae, may
bring a civil action on behalf of the residents of the
State in a district court of the United States of ap-
propriate jurisdiction to—
(A) enjoin that practice;
(B) enforce compliance with the regulation;
(C) obtain damage, restitution, or other
compensation on behalf of residents of the
State; or
(D) obtain such other relief as the court
may consider to be appropriate.
(2) NOTICE.—
(A) IN GENERAL.—Before filing an action
under paragraph (1), the attorney general of
the State involved shall provide to the Commis-
sion—
(i) written notice of that action; and
(ii) a copy of the complaint for that
action.
(B) EXEMPTION.—
(i) IN GENERAL.—Subparagraph (A)
shall not apply with respect to the filing of
an action by an attorney general of a State
under this subsection, if the attorney gen-
eral determines that it is not feasible to
provide the notice described in that sub-
paragraph before the filing of the action.
(ii) NOTIFICATION.—In an action de-
scribed in clause (i), the attorney general
of a State shall provide notice and a copy
of the complaint to the Commission at the
same time as the attorney general files the
action.
(b) INTERVENTION.—
(1) IN GENERAL.—On receiving notice under
subsection (a)(2), the Commission shall have the
right to intervene in the action that is the subject
of the notice.
(2) EFFECT OF INTERVENTION.—If the Com-
mission intervenes in an action under subsection(a),
it shall have the right—
(A) to be heard with respect to any matter
that arises in that action; and
(B) to file a petition for appeal.
(3) AMICUS CURIAE.—Upon application to the
court, a person whose self-regulatory guidelines have
been approved by the Commission and are relied
upon as a defense by any defendant to a proceeding
under this section may file amicus curiae in that
proceeding.
(c) CONSTRUCTION.—For purposes of bringing any
civil action under subsection (a), nothing in this title shall
be construed to prevent an attorney general of a State
from exercising the powers conferred on the attorney gen-
eral by the laws of that State to—
(1) conduct investigations;
(2) administer oaths or affirmations; or
(3) compel the attendance of witnesses or the
production of documentary and other evidence.
(d) ACTIONS BY THE COMMISSION.—In any case in
which an action is instituted by or on behalf of the Com-
mission for violation of any regulation prescribed under
section 202, no State may, during the pendency of that
action, institute an action under subsection (a) against
any defendant named in the complaint in that action for
violation of that regulation.
(e) VENUE; SERVICE OF PROCESS.—
(1) VENUE.—Any action brought under sub-
section (a) may be brought in the district court of
the United States that meets applicable require-
ments relating to venue under section 1391 of title
28, United States Code.
(2) SERVICE
OF
PROCESS.—In an action
brought under subsection (a), process may be served
in any district in which the defendant—
(A) is an inhabitant; or
(B) may be found.
SEC. 205. ADMINISTRATION AND APPLICABILITY OF ACT.
(a) IN GENERAL.—Except as otherwise provided, this
title shall be enforced by the Commission under the Fed-
eral Trade Commission Act (15 U.S.C. 41 et seq.).
(b) PROVISIONS.—Compliance with the requirements
imposed under this title shall be enforced under—
(1) section 8 of the Federal Deposit Insurance
Act (12 U.S.C. 1818), in the case of—
(A) national banks, and Federal branches
and Federal agencies of foreign banks, by the
Office of the Comptroller of the Currency;
(B) member banks of the Federal Reserve
System (other than national banks), branches
and agencies of foreign banks (other than Fed-
eral branches, Federal agencies, and insured
State branches of foreign banks), commercial
lending companies owned or controlled by for-
eign banks, and organizations operating under
section 25 or 25(a) of the Federal Reserve Act
(12 U.S.C. 601 et seq. and 611 et. seq.), by the
Board; and
(C) banks insured by the Federal Deposit
Insurance Corporation (other than members of
the Federal Reserve System) and insured State
branches of foreign banks, by the Board of Di-
rectors of the Federal Deposit Insurance Cor-
poration;
(2) section 8 of the Federal Deposit Insurance
Act (12 U.S.C. 1818), by the Director of the Office
of Thrift Supervision, in the case of a savings asso-
ciation the deposits of which are insured by the Fed-
eral Deposit Insurance Corporation;
(3) the Federal Credit Union Act (12 U.S.C.
1751 et seq.) by the National Credit Union Adminis-
tration Board with respect to any Federal credit
union;
(4) part A of subtitle VII of title 49, United
States Code, by the Secretary of Transportation
with respect to any air carrier or foreign air carrier
subject to that part;
(5) the Packers and Stockyards Act, 1921 (7
U.S.C. 181 et. seq.) (except as provided in section
406 of that Act (7 U.S.C. 226, 227)), by the Sec-
retary of Agriculture with respect to any activities
subject to that Act; and
(6) the Farm Credit Act of 1971 (12 U.S.C.
(2001 et seq.) by the Farm Credit Administration
with respect to any Federal land bank, Federal land
bank association, Federal intermediate credit bank,
or production credit association.
(c) EXERCISE OF CERTAIN POWERS.—For the pur-
pose of the exercise by any agency referred to in sub-
section (a) of its powers under any Act referred to in that
subsection, a violation of any requirement imposed under
this title shall be deemed to be a violation of a requirement
imposed under that Act. In addition to its powers under
any provision of law specifically referred to in subsection
(a), each of the agencies referred to in that subsection may
exercise, for the purpose of enforcing compliance with any
requirement imposed under this title, any other authority
conferred on it by law.
(d) ACTIONS BY THE COMMISSION.—The Commis-
sion shall prevent any person from violating a rule of the
Commission under section 202 in the same manner, by
the same means, and with the same jurisdiction, powers,
and duties as though all applicable terms and provisions
of the Federal Trade Commission Act (15 U.S.C. 41 et
seq.) were incorporated into and made a part of this title.
Any entity that violates such rule shall be subject to the
penalties and entitled to the privileges and immunities
provided in the Federal Trade Commission Act in the
same manner, by the same means, and with the same ju-
risdiction, power, and duties as though all applicable terms
and provisions of the Federal Trade Commission Act were
incorporated into and made a part of this title.
(e) EFFECT ON OTHER LAWS.—Nothing contained in
this title shall be construed to limit the authority of the
Commission under any other provisions of law.
SEC. 206. REVIEW.
Not later than 5 years after the effective date of the
regulations initially issued under section 202, the Commis-
sion shall—
(1) review the implementation of this title, in-
cluding the effect of the implementation of this title
on practices relating to the collection and disclosure
of information relating to children, children’s ability
to obtain access to information of their choice online,
and on the availability of websites directed to chil-
dren; and
(2) prepare and submit to Congress a report on
the results of the review under paragraph (1).
SEC. 207. EFFECTIVE DATE.
Sections 202(a), 204, and 205 of this title take effect
on the later of—
(1) the date that is 18 months after the date
of enactment of this Act; or
(2) the date on which the Commission rules on
the first application for safe harbor treatment under
section 203 if the Commission does not rule on the
first such application within one year after the date
of enactment of this Act, but in no case later than
the date that is 30 months after the date of enact-
ment of this Act.
Passed the House of Representatives October 7,
1998.
Attest:
Clerk.