I 
117TH CONGRESS 
1ST SESSION H. R. 4801 
To amend the Children’s Online Privacy Protection Act of 1998 to update 
and expand the coverage of such Act, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 29, 2021 
Ms. CASTOR of Florida introduced the following bill; which was referred to the 
Committee on Energy and Commerce 
A BILL 
To amend the Children’s Online Privacy Protection Act of 
1998 to update and expand the coverage of such Act, 
and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Protecting the Information of our Vulnerable Children 
and Youth Act’’ or the ‘‘Kids PRIVCY Act’’. 
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
Sec. 2. Definitions. 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6211
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
Sec. 3. Requirements for processing of covered information of children or teen-
agers. 
Sec. 4. Repeal of safe harbors provision. 
Sec. 5. Administration and applicability of Act. 
Sec. 6. Review. 
Sec. 7. Private right of action. 
Sec. 8. Relationship to other law. 
Sec. 9. Additional conforming amendment. 
Sec. 10. Implementing regulations. 
Sec. 11. Youth Privacy and Marketing Division. 
Sec. 12. Commission defined. 
Sec. 13. Effective date. 
SEC. 2. DEFINITIONS. 
Section 1302 of the Children’s Online Privacy Protec-
tion Act of 1998 (15 U.S.C. 6501) is amended— 
(1) by striking paragraphs (5) and (10); 
(2) by redesignating paragraphs (2), (3), (4), 
(6), (7), (8), and (9) as paragraphs (3), (5), (6), 
(7), (8), (9), and (10), respectively; 
(3) by inserting after paragraph (1) the fol-
lowing: 
‘‘(2) TEENAGER.—The term ‘teenager’ means 
an individual over the age of 12 and under the age 
of 18.’’; 
(4) by striking paragraph (3) (as so redesig-
nated) and inserting the following: 
‘‘(3) COVERED ENTITY.—The term ‘covered en-
tity’ means— 
‘‘(A) any organization, corporation, trust, 
partnership, sole proprietorship, unincorporated 
association, or venture over which the Commis-
sion has authority pursuant to section 5(a)(2) 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
of the Federal Trade Commission Act (15 
U.S.C. 45(a)(2)); 
‘‘(B) notwithstanding section 5(a)(2) of 
the Federal Trade Commission Act (15 U.S.C. 
45(a)(2)), common carriers; and 
‘‘(C) 
notwithstanding 
sections 
and 
5(a)(2) of the Federal Trade Commission Act 
(15 U.S.C. 44 and 45(a)(2)), any nonprofit or-
ganization, including any organization described 
in section 501(c) of the Internal Revenue Code 
of 1986 that is exempt from taxation under sec-
tion 501(a) of the Internal Revenue Code of 
1986. 
‘‘(4) OPERATOR.—The term ‘operator’ means, 
with respect to a digital service, the covered entity 
that operates such service, to the extent the covered 
entity is engaged in operating such service or in 
processing covered information obtained in connec-
tion with such service.’’; 
(5) by amending paragraph (6) (as so redesig-
nated) to read as follows: 
‘‘(6) DISCLOSE.—The term ‘disclose’ means to 
intentionally or unintentionally release, transfer, sell, 
disseminate, share, publish, lease, license, make 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
available, allow access to, fail to restrict access to, 
or otherwise communicate covered information.’’; 
(6) by amending paragraph (9) (as so redesig-
nated) to read as follows: 
‘‘(9) COVERED INFORMATION.—The term ‘cov-
ered information’— 
‘‘(A) means any information, linked or rea-
sonably linkable to a specific teenager or child, 
or specific consumer device of a teenager or 
child; 
‘‘(B) may include— 
‘‘(i) a name, alias, home or other 
physical address, online identifier, Internet 
Protocol address, email address, account 
name, Social Security number, physical 
characteristics or description, telephone 
number, State identification card number, 
driver’s license number, passport number, 
or other similar identifier; 
‘‘(ii) actual or perceived race, religion, 
sex, sexual orientation, sexual behavior, fa-
milial status, gender identity, disability, 
age, political affiliation, or national origin; 
‘‘(iii) commercial information, includ-
ing records relating to personal property, 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(xiii) financial information, including 
bank account numbers, credit card num-
bers, debit card numbers, or insurance pol-
icy numbers; and 
‘‘(xiv) inferences drawn from any of 
the information described in this para-
graph to create a profile about a teenager 
or child reflecting the teenager’s or child’s 
preferences, characteristics, psychological 
trends, predispositions, behavior, attitudes, 
intelligence, abilities, or aptitudes; and 
‘‘(C) does not include— 
‘‘(i) information that is processed 
solely for the purpose of employment of a 
teenager; or 
‘‘(ii) de-identified information.’’; 
(7) by amending paragraph (10) (as so redesig-
nated) to read as follows: 
‘‘(10) 
VERIFIABLE
CONSENT.—The 
term 
‘verifiable consent’ means express, affirmative con-
sent freely given by a teenager, or by the parent of 
a child, to the processing of covered information of 
that teenager or child, respectively— 
‘‘(A) that is specific, informed, and unam-
biguous, taking into account the age and the 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
developmental or cognitive needs and capabili-
ties of the teenager or parent of a child, as ap-
plicable; 
‘‘(B) that is given separately for each proc-
essing activity; 
‘‘(C) where the teenager or parent of a 
child, as applicable, has not received any finan-
cial or other incentive in exchange for such con-
sent; 
‘‘(D) that is given before any processing 
occurs, at a time and in a context in which the 
teenager or parent of a child, as applicable, 
would reasonably expect to make choices con-
cerning such processing; and 
‘‘(E) that is not obtained through the use 
of a design, modification, or manipulation of a 
user interface with the purpose or substantial 
effect of obscuring, subverting, or impairing 
user autonomy, decision making, or choice.’’; 
and 
(8) by adding at the end the following: 
‘‘(13) PROCESS.—The term ‘process’ means to 
perform any operation or set of operations on cov-
ered information, whether or not by automated 
means, including collecting, creating, acquiring, dis-
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
closing, sharing, classifying, sorting, recording, de-
riving, inferring, obtaining, assembling, organizing, 
structuring, storing, retaining, adapting or altering, 
using, or retrieving covered information. 
‘‘(14) DE-IDENTIFIED INFORMATION; RE-IDEN-
TIFY.— 
‘‘(A) DE-IDENTIFIED INFORMATION.—The 
term ‘de-identified information’ means informa-
tion that cannot reasonably be used to infer in-
formation about, or otherwise be linked to, a 
specific teenager or child or specific consumer 
device of a teenager or child, if the covered enti-
ty that possesses the information— 
‘‘(i) takes reasonable measures to en-
sure that the information cannot be associ-
ated with a teenager or child; 
‘‘(ii) publicly commits to maintain and 
use the information in de-identified form 
and not to attempt to re-identify the infor-
mation, except for the purpose of testing 
the sufficiency of the de-identification 
measures; and 
‘‘(iii) contractually obligates any re-
cipients of the information to comply with 
clauses (i) and (ii). 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(B) RE-IDENTIFY.—The term ‘re-identify’ 
means to link information that has been de- 
identified to a specific teenager or child or spe-
cific consumer device of a teenager or child. 
‘‘(15) STATE.—The term ‘State’ means each of 
the several States, the District of Columbia, each 
territory of the United States, and each federally 
recognized Indian Tribe. 
‘‘(16) SERVICE PROVIDER.—The term ‘service 
provider’ means a covered entity that processes cov-
ered information at the direction of, and for the sole 
benefit of, another covered entity, and— 
‘‘(A) is contractually or legally prohibited 
from processing such covered information for 
any other purpose; and 
‘‘(B) complies with all of the requirements 
of this title and the regulations promulgated 
under this title. 
‘‘(17) DIGITAL
SERVICE.—The term ‘digital 
service’ means a website, online service, online appli-
cation, mobile application, or any other service that 
processes covered information digitally. 
‘‘(18) CHILDREN’S SERVICE.—The term ‘chil-
dren’s service’ means— 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(A) a digital service or portion thereof 
that is directed to children; or 
‘‘(B) any other digital service or portion 
thereof, if the operator of the service decides to 
treat all users of the service or portion, as the 
case may be, as children. 
‘‘(19) PRIVACY RISK.—The term ‘privacy risk’ 
means potential adverse consequences to an indi-
vidual, group of individuals, or society arising from 
the processing of covered information, including— 
‘‘(A) physical harm; 
‘‘(B) psychological or emotional harm; 
‘‘(C) negative or harmful outcomes or deci-
sions with respect to an individual’s eligibility 
for rights, benefits, or opportunities; 
‘‘(D) reputational and dignity harm; 
‘‘(E) financial harm, including price dis-
crimination; 
‘‘(F) inconvenience or expenditure of time; 
‘‘(G) disruption and intrusion from un-
wanted communications or contacts; 
‘‘(H) other effects that limit an individ-
ual’s choices, influence an individual’s re-
sponses, or predetermine results or outcomes 
for that individual; and 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(I) other demonstrable adverse con-
sequences that affect an individual’s private 
life, including private family matters, actions, 
and communications within an individual’s 
home or similar physical, online, or digital loca-
tion. 
‘‘(20) PRIVACY AND SECURITY IMPACT ASSESS-
MENT AND MITIGATION (PSIAM).— 
‘‘(A) IN
GENERAL.—The terms ‘privacy 
and security impact assessment and mitigation’ 
and ‘PSIAM’ mean, with respect to a digital 
service, an assessment and mitigation by the 
operator of the service of risks to the children 
and teenagers who access the service that arise 
from the processing of covered information, tak-
ing into account privacy risks, security risks, 
the rights and best interests of children and 
teenagers, differing ages, capacities, and devel-
opmental needs of children and teenagers, and 
any significant internal or external emerging 
risks, and ensuring that the PSIAM builds in 
risk mitigation and compliance with the other 
requirements of this title. 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(B) REQUIREMENTS.—In conducting a 
PSIAM with respect to a digital service, the op-
erator of the service shall do the following: 
‘‘(i) Embed the PSIAM into the de-
sign process of the service and complete 
the PSIAM before the launch of the service 
and on an ongoing basis, and before mak-
ing significant changes to the processing of 
covered information. 
‘‘(ii) Publicly disclose the nature, 
scope, context, and purposes of the proc-
essing of covered information. 
‘‘(iii) Depending on the size of the 
service and level of risks identified— 
‘‘(I) seek and document the views 
of children, teenagers, and parents (or 
their representatives), as well as ex-
perts in children’s and teenagers’ de-
velopmental needs; and 
‘‘(II) take such views into ac-
count in the design of the service. 
‘‘(iv) Publicly disclose an explanation 
of why the operator’s processing of covered 
information is necessary and proportionate 
vis a vis the risks for the service, and how 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
the operator complies with the require-
ments of this title. 
‘‘(v) Assess any processing of covered 
information that is not in the best inter-
ests of children or teenagers or that can be 
detrimental to their wellbeing and safety, 
whether 
physical, 
emotional, 
develop-
mental, or material. 
‘‘(vi) Identify, assess, and mitigate 
high-risk processing of covered informa-
tion. 
‘‘(vii) Identify measures taken to miti-
gate the risks identified under clause (vi) 
and comply with the other requirements of 
this title. 
‘‘(viii) Provide for regular internal re-
porting on the effectiveness of controls and 
residual risks of the operator. 
‘‘(C) AUDITABLE
BY
COMMISSION.—The 
Commission may audit a PSIAM conducted by 
an operator as the Commission considers nec-
essary. 
‘‘(21) DIRECTED TO CHILDREN.— 
‘‘(A) IN GENERAL.—The term ‘directed to 
children’ means, with respect to a digital serv-
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
ice, that the digital service is targeted to or at-
tractive to children, as demonstrated by— 
‘‘(i) the subject matter of the digital 
service; 
‘‘(ii) the visual content of the digital 
service; 
‘‘(iii) the use of animated characters 
or child-oriented activities for children, and 
related incentives, on the digital service; 
‘‘(iv) the music or other audio content 
on the digital service; 
‘‘(v) the age of models on the digital 
service; 
‘‘(vi) the presence on the digital serv-
ice of— 
‘‘(I) child celebrities; or 
‘‘(II) celebrities who appeal to 
children; 
‘‘(vii) the language used on the digital 
service; 
‘‘(viii) advertising content used on, or 
used to advertise, the digital service; 
‘‘(ix) reliable empirical evidence relat-
ing to— 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(I) the composition of the audi-
ence of the digital service, including— 
‘‘(aa) data the operator of 
the digital service may directly or 
indirectly collect, use, profile, 
buy, sell, classify, or analyze (via 
algorithms or other forms of data 
analytics, 
including 
look-alike 
modeling) about a user or groups 
of users to estimate, identify, or 
classify the age or age range (or 
a proxy thereof) of such user or 
groups of users; 
‘‘(bb) advertising informa-
tion or results, such as data, re-
porting, or information from the 
internal communications of the 
operator of the digital service, in-
cluding documentation about its 
advertising practices, such as an 
advertisement insertion order, or 
other promotional material to 
marketers, that indicates that 
covered information is being col-
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
lected from children that are 
using the digital service; 
‘‘(cc) data or reporting from 
the general or trade press of the 
digital service indicating that 
children are using the digital 
service; 
‘‘(dd) complaints from par-
ents or other third parties about 
child users using the digital serv-
ice, whether through the com-
plaint mechanism of the digital 
service, by email, or by other 
means; and 
‘‘(ee) data or reporting from 
a privacy and security impact as-
sessment and mitigation, compli-
ance program, or other compli-
ance, risk management, or inter-
nal process that documents pri-
vacy risks and controls related to 
children’s privacy, including the 
existence of data analytics con-
trolled by the operator of the dig-
ital service, including those of 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
service providers, and content 
analytics capabilities and func-
tions or outputs; and 
‘‘(II) the intended audience of 
the digital service, including data the 
operator of the digital service directly 
or indirectly collects, uses, profiles, 
buys, sells, classifies, or analyzes (via 
algorithms or other forms of data 
analytics, including look-alike mod-
eling) about the nature of the content 
of the digital service that estimates, 
identifies, or classifies the content as 
child-directed or similarly estimates, 
identifies, or classifies the intended or 
likely audience for the content; or 
‘‘(x) any other evidence or cir-
cumstances the Commission determines ap-
propriate. 
‘‘(B) 
COVERED
INFORMATION
FROM 
OTHER
SERVICES.—A digital service shall be 
deemed to be directed to children if the oper-
ator of the digital service has actual or con-
structive knowledge that the digital service col-
lects covered information directly from users of 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
any other digital service that is directed to chil-
dren under the criteria described in subpara-
graph (A). 
‘‘(C) SIGNALS FROM THIRD PARTIES.—A 
digital service shall be deemed directed to chil-
dren if the digital service receives a signal from 
a third party indicating that the digital service 
is intended for children or likely to appeal to 
children, whether directly or using a flag or 
other formal industry standard or convention. 
‘‘(D) LIMITATION.—A digital service that 
does not target children as its primary audience 
shall not be deemed directed to children if the 
digital service— 
‘‘(i) does not collect covered informa-
tion from any visitor prior to collecting age 
information; and 
‘‘(ii) prevents the collection, use, or 
disclosure of covered information from visi-
tors who identify themselves as under age 
13 without first complying with the notice 
and parental consent provisions of this title 
and the regulations promulgated under 
this title. 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(E) FURTHER
LIMITATION.—A digital 
service shall not be deemed directed to children 
solely because the digital service refers or links 
to another digital service that is directed to 
children by using information location tools, in-
cluding a directory, index, reference, pointer, or 
hypertext link. 
‘‘(F) DETERMINATION REGARDING A POR-
TION OF A DIGITAL SERVICE.—For purposes of 
determining whether a portion of a digital serv-
ice is directed to children, any reference in this 
paragraph to a digital service shall be consid-
ered to refer to such portion. 
‘‘(22) LIKELY TO BE ACCESSED BY CHILDREN 
OR TEENAGERS.—The term ‘likely to be accessed by 
children or teenagers’ means, with respect to a dig-
ital service, that the possibility of more than a de 
minimis number of children or teenagers accessing 
the digital service is more probable than not. In de-
termining whether a digital service is likely to be 
accessed by children or teenagers, the operator of 
the service shall consider whether the service has 
particular appeal to children or teenagers and 
whether effective measures (such as age gating) are 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
in place that prevent children or teenagers from 
gaining access to the service. 
‘‘(23) AGE ASSURANCE.—The term ‘age assur-
ance’ means a verifiable process to estimate or de-
termine the age of a user of a digital service with 
a given and documented degree of certainty. 
‘‘(24) AGE GATE.—The term ‘age gate’ means 
to use a verifiable process that meets a documented 
degree of certainty to restrict or block access to a 
digital service for users that do not meet an age re-
quirement.’’. 
SEC. 3. REQUIREMENTS FOR PROCESSING OF COVERED IN-
FORMATION OF CHILDREN OR TEENAGERS. 
(a) IN GENERAL.—Section 1303 of the Children’s 
Online Privacy Protection Act of 1998 (15 U.S.C. 6502) 
is amended to read as follows: 
‘‘SEC. 1303. REQUIREMENTS FOR PROCESSING OF COVERED 
INFORMATION OF CHILDREN OR TEENAGERS. 
‘‘(a) REQUIREMENTS FOR CHILDREN’S SERVICES.— 
‘‘(1) DATA MINIMIZATION.—An operator of a 
children’s service shall process covered information 
under the principle of data minimization, requiring 
the operator to only process the minimum amount 
necessary for a specified purpose. 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(2) TRANSPARENCY.—An operator of a chil-
dren’s service shall develop and make publicly avail-
able, at all times and in a machine-readable format, 
a privacy policy, in a manner that is clear, easily un-
derstood, and written in plain and concise language, 
that includes— 
‘‘(A) the categories of covered information 
that the operator processes about teenagers and 
children; 
‘‘(B) how and under what circumstances 
covered information is collected directly from a 
teenager or child; 
‘‘(C) the categories and the sources of any 
covered information processed by the operator 
that is not collected directly from a teenager or 
child; 
‘‘(D) a description of the purposes for 
which the operator processes covered informa-
tion, including— 
‘‘(i) a description of whether and how 
the operator customizes products or serv-
ices, or adjusts the prices of products or 
services for teenagers or children or based 
in any part on processing of covered infor-
mation; 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(ii) a description of whether and how 
the operator, or the operator’s affiliates or 
service providers, de-identifies information, 
including the methods used to de-identify 
such information; and 
‘‘(iii) a description of whether and 
how the operator, or the operator’s affili-
ates or service providers, generates or uses 
any consumer score to make decisions con-
cerning a teenager or child, and the source 
or sources of any such consumer score; 
‘‘(E) a description of how long and the cir-
cumstances under which the operator retains 
covered information; 
‘‘(F) a description of all of the purposes 
for which the operator discloses covered infor-
mation to service providers and, on a biennial 
basis, the categories of service providers; 
‘‘(G) a description of whether and for what 
purposes the operator discloses covered infor-
mation to third parties, and the categories of 
covered information disclosed; 
‘‘(H) a description of the categories of 
third parties to which covered information de-
scribed in subparagraph (G) is disclosed, by 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
category or categories of covered information 
for each category of third party to which the 
covered information is disclosed; 
‘‘(I) whether the operator discloses covered 
information to data brokers; 
‘‘(J) whether the operator collects covered 
information about teenagers or children over 
time and across different digital services when 
a teenager or child uses the operator’s digital 
service; 
‘‘(K) how a teenager or a parent of a child 
can exercise their rights to access, correct, and 
delete such teenager’s or child’s covered infor-
mation as set forth in paragraph (6); 
‘‘(L) a listing of all possible consents that 
may be obtained by the operator for the proc-
essing of covered information, how a teenager 
or the parent of a child can grant, withhold, 
withdraw, or modify any such consent, and the 
consequences of withholding, withdrawing, or 
modifying any such consent; 
‘‘(M) the effective date of the notice; and 
‘‘(N) how the operator will communicate 
material changes of the privacy policy to the 
teenager or the parent of a child. 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(3) CONSENT REQUIRED.— 
‘‘(A) IN GENERAL.—An operator of a chil-
dren’s service shall— 
‘‘(i) provide clear and concise notice 
to a teenager or the parent of a child of 
the items of covered information about 
such teenager or child, respectively, that is 
processed by such operator and how such 
operator processes such covered informa-
tion and obtain verifiable consent for such 
processing; and 
‘‘(ii) if such operator determines, in-
cluding through actual or constructive 
knowledge, that such operator has not ob-
tained verifiable consent for any specific 
processing of covered information about a 
teenager or child, not later than 48 hours 
after such determination— 
‘‘(I) obtain verifiable consent; or 
‘‘(II) delete all covered informa-
tion about such teenager or child. 
‘‘(B) WHEN CONSENT NOT REQUIRED.— 
Verifiable consent under this paragraph is not 
required in the case of— 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
agencies or for an investigation on a 
matter related to public safety. 
‘‘(C) WITHDRAWAL OF CONSENT.— 
‘‘(i) 
MECHANISM
FOR
WITH-
DRAWAL.—An operator of a children’s 
service shall provide a teenager or the par-
ent of a child, as applicable— 
‘‘(I) a mechanism to withdraw 
consent to the processing of covered 
information at any time in a manner 
that is as easy as the mechanism to 
give consent; and 
‘‘(II) clear and conspicuous no-
tice of the mechanism required by 
subclause (I). 
‘‘(ii) EFFECT
OF
WITHDRAWAL
ON 
PRIOR
PROCESSING.—Withdrawal of con-
sent to the processing of covered informa-
tion shall not be construed to affect the 
lawfulness of any processing of covered in-
formation based on verifiable consent that 
was in effect before such withdrawal. 
‘‘(D) PROHIBITION ON LIMITING OR DIS-
CONTINUING SERVICE.—An operator of a chil-
dren’s service may not refuse to provide a serv-
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
ice, or discontinue a service provided, to a teen-
ager or child, if the teenager or parent of the 
child, as applicable, refuses to consent, or with-
draws consent, to the processing of any covered 
information not technically required for the op-
erator to provide such service. 
‘‘(4) RETENTION OF DATA.— 
‘‘(A) RETENTION
LIMITATIONS.—Subject 
to the exceptions provided in subparagraph (B), 
an operator of a children’s service may not 
keep, retain, or otherwise store covered infor-
mation for longer than is reasonably necessary 
for the purposes for which the covered informa-
tion is processed. 
‘‘(B) EXCEPTIONS.—Further retention of 
covered information shall not be considered to 
be incompatible with the purposes of processing 
described in subparagraph (A) if such proc-
essing is necessary and done solely for the pur-
poses of— 
‘‘(i) compliance with— 
‘‘(I) requirements to document 
compliance under this title; or 
‘‘(II) other laws, regulations, or 
legal obligations; 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(ii) preventing risks to the health or 
safety of a child or teenager or groups of 
children or teenagers; or 
‘‘(iii) repairing errors that impair ex-
isting functionality. 
‘‘(5) LIMITATION ON DISCLOSING COVERED IN-
FORMATION TO THIRD PARTIES.— 
‘‘(A) DISCLOSURES.—An operator of a 
children’s service may not disclose covered in-
formation to a third party unless the operator 
has a written agreement with such third party 
that— 
‘‘(i) specifies all of the purposes for 
which the third party may process the cov-
ered information for which the operator 
has verifiable consent; 
‘‘(ii) prohibits the third party from 
processing covered information for any 
purpose other than the purposes specified 
under clause (i); and 
‘‘(iii) requires the third party to pro-
vide at least the same privacy and security 
protections as the operator. 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(B) RESPONSIBILITIES
OF
OPERATORS 
REGARDING THIRD PARTIES.—An operator of a 
children’s service— 
‘‘(i) shall perform reasonable due dili-
gence in selecting any third party with 
which to enter into an agreement described 
in subparagraph (A) and shall exercise rea-
sonable oversight over all such third par-
ties to assure compliance with the require-
ments of this title and the regulations pro-
mulgated under this title; and 
‘‘(ii) if the operator has actual or con-
structive knowledge that a third party has 
violated an agreement described in sub-
paragraph (A), shall— 
‘‘(I) to the extent practicable, 
promptly take steps to ensure compli-
ance with such agreement; and 
‘‘(II) promptly report to the 
Commission that such a violation oc-
curred. 
‘‘(6) RIGHT TO ACCESS, CORRECT, AND DELETE 
COVERED INFORMATION.— 
‘‘(A) ACCESS.—An operator of a children’s 
service, subject to the exceptions in subpara-
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
graph (D), shall, upon request of a teenager or 
the parent of a child and after proper identi-
fication of such teenager or parent, promptly 
provide to such teenager or parent, as applica-
ble— 
‘‘(i) access to all covered information 
processed by the operator pertaining to 
such teenager or child, including a descrip-
tion of— 
‘‘(I) each type of covered infor-
mation processed by the operator per-
taining to the teenager or child, as ap-
plicable; 
‘‘(II) each purpose for which the 
operator processes each category of 
covered information pertaining to the 
teenager or child, as applicable; 
‘‘(III) the names of each third 
party to which the operator disclosed 
the covered information; 
‘‘(IV) each source other than the 
teenager or child, as applicable, from 
which the operator obtained covered 
information pertaining to that teen-
ager or child, as applicable; 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(V) how long the covered infor-
mation will be retained or stored by 
the operator and, if not known, the 
criteria the operator uses to determine 
how long the covered information will 
be retained or stored by the operator; 
and 
‘‘(VI) with respect to any score 
of the teenager or child, as applicable, 
processed by the operator— 
‘‘(aa) how such score is used 
by the operator to make decisions 
with respect to that teenager or 
child, as applicable; and 
‘‘(bb) the source that cre-
ated the score if not created by 
the operator; and 
‘‘(ii) a simple and reasonable mecha-
nism by which a teenager or parent of a 
child may request access to the informa-
tion described under clause (i), as applica-
ble. 
‘‘(B) DELETION.—An operator of a chil-
dren’s service, subject to the exceptions in sub-
paragraph (D), shall— 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(i) establish a simple, publicly and 
easily accessible, and reasonable mecha-
nism by which a teenager or parent of a 
child with respect to whom the operator 
processes covered information may request 
the operator to delete any such covered in-
formation (or any component thereof), in-
cluding publicly available covered informa-
tion submitted to the service by the child 
or teenager; and 
‘‘(ii) delete such covered information 
not later than 45 days after receiving such 
request. 
‘‘(C) CORRECTION.—An operator of a chil-
dren’s service, subject to the exceptions in sub-
paragraph (D), shall— 
‘‘(i) provide each teenager or parent 
of a child with respect to whom the oper-
ator processes covered information, as ap-
plicable, a simple, publicly and easily ac-
cessible, and reasonable mechanism by 
which that teenager or parent may submit 
a request to the operator— 
‘‘(I) to dispute the accuracy or 
completeness of that covered informa-
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(ii) with respect to the request made, 
the operator determines that— 
‘‘(I) the operator is limited from 
fulfilling the request by law, legally 
recognized privilege, or other legal ob-
ligation; or 
‘‘(II) fulfilling the request would 
create a legitimate risk to the privacy, 
security, or safety of someone other 
than the teenager or child, as applica-
ble; 
‘‘(iii) with respect to a request to de-
lete covered information made under sub-
paragraph (B) or a request to correct cov-
ered information made under subpara-
graph (C), the operator determines that 
the retention of the covered information is 
necessary to— 
‘‘(I) complete the transaction 
with the teenager or child, as applica-
ble, for which the covered information 
was collected; 
‘‘(II) provide a product or service 
affirmatively requested by the teen-
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
ager or parent of a child, as applica-
ble; 
‘‘(III) perform a contract with 
the teenager or a parent of a child, as 
applicable, including a contract for 
billing, financial reporting, or account-
ing; 
‘‘(IV) keep a record of the cov-
ered information for law enforcement 
purposes; or 
‘‘(V) identify and repair errors 
that impair the functionality of the 
children’s service; or 
‘‘(iv) the covered information is used 
in public or peer-reviewed scientific, med-
ical, or statistical research in the public in-
terest that adheres to commonly accepted 
ethical standards or laws, with informed 
consent consistent with section 50.20 of 
title 21, Code of Federal Regulations, if 
the research is already in progress at the 
time when the request to access, delete, or 
correct is made under subparagraph (A), 
(B), or (C). 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(E) PROHIBITION ON LIMITING OR DIS-
CONTINUING SERVICE.—An operator of a chil-
dren’s service may not refuse to provide a serv-
ice, or discontinue a service provided, to a teen-
ager or child, if the teenager or parent of the 
child, as applicable, exercises any of the rights 
set forth in this paragraph. 
‘‘(7) 
ADDITIONAL
PROHIBITED
PRACTICES 
WITH RESPECT TO TEENAGERS AND CHILDREN.— 
‘‘(A) IN GENERAL.—An operator of a chil-
dren’s service may not— 
‘‘(i) process any covered information 
in a manner that is inconsistent with what 
a reasonable teenager or parent of a child 
would expect in the context of a particular 
transaction or the teenager’s or parent’s 
relationship with such operator, or seek to 
obtain verifiable consent for such proc-
essing; 
‘‘(ii) process any covered information 
in a manner that is harmful or has been 
shown to be detrimental to the well-being 
of children or teenagers; 
‘‘(iii) process covered information for 
the purpose of providing for targeted per-
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
sonalized advertising or engage in other 
marketing to a specific child or teenager or 
group of children or teenagers based on— 
‘‘(I) using the covered informa-
tion, online behavior, or group identi-
fiers of such child or teenager or of 
the children or teenagers in such 
group; or 
‘‘(II) using the covered informa-
tion or online behavior of children or 
teenagers who share characteristics 
with such child or teenager or with 
the children or teenagers in such 
group, including income level or pro-
tected characteristics or proxies there-
of; 
‘‘(iv) condition the participation of a 
child or teenager in a game, sweepstakes, 
or other contest on consenting to the proc-
essing of more covered information than is 
necessary for such child or teenager to par-
ticipate; 
‘‘(v) engage in cross-device tracking of 
a child or teenager unless the child or 
teenager is logged-in to a specific service, 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
for the sole purpose of facilitating the pri-
mary purpose of the good or service or a 
specific feature thereof; 
‘‘(vi) engage in algorithmic processes 
that discriminate on the basis of race, age, 
gender, ability, or other protected charac-
teristics; 
‘‘(vii) disclose biometric information; 
‘‘(viii) disclose geolocation informa-
tion; or 
‘‘(ix) collect geolocation information 
by default or without making it clear to a 
user when geolocation tracking is in effect. 
‘‘(B) EXCEPTIONS.—Nothing in subpara-
graph (A) shall prohibit an operator from proc-
essing covered information if necessary solely 
for purposes of— 
‘‘(i) detecting and preventing security 
incidents; 
‘‘(ii) preventing imminent danger to 
the personal safety of an individual or 
group of individuals; 
‘‘(iii) identifying and repairing errors 
that impair the core functionality of the 
children’s service; or 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(iv) complying with any Federal, 
State, or local law, rule, regulation, or 
other legal obligation, including civil, crimi-
nal, or regulatory inquiries, investigations, 
subpoenas, or court orders or other prop-
erly executed compulsory process requiring 
the disclosure of information. 
‘‘(8) SECURITY REQUIREMENTS.— 
‘‘(A) IN GENERAL.—An operator of a chil-
dren’s service shall establish and implement 
reasonable security policies, practices, and pro-
cedures for the treatment and protection of cov-
ered information, taking into consideration— 
‘‘(i) the size, nature, scope, and com-
plexity of the activities engaged in by such 
operator; 
‘‘(ii) the sensitivity of any covered in-
formation at issue; 
‘‘(iii) the state of the art in adminis-
trative, technical, and physical safeguards 
for protecting such information; and 
‘‘(iv) the cost of implementing such 
policies, practices, and procedures. 
‘‘(B) SPECIFIC REQUIREMENTS.—The poli-
cies, practices, and procedures established by an 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS