operator under subparagraph (A) shall include 
the following: 
‘‘(i) A written security policy with re-
spect to the processing of such covered in-
formation. 
‘‘(ii) The identification of an officer or 
other individual as the point of contact 
with responsibility for the management of 
information security. 
‘‘(iii) A process for identifying and as-
sessing 
any 
reasonably 
foreseeable 
vulnerabilities in the system or systems 
maintained by such operator that contains 
such covered information, including regular 
monitoring for a breach of security of such 
system or systems. 
‘‘(iv) A process for taking preventive 
and corrective action to mitigate against 
any vulnerabilities identified in the process 
required by clause (iii), which may in-
clude— 
‘‘(I) implementing any changes to 
the security practices, architecture, in-
stallation, or implementation of net-
work or operating software; and 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(II) regular testing or otherwise 
monitoring the effectiveness of the 
safeguards. 
‘‘(v) A process for determining if the 
covered information is no longer needed 
and deleting such covered information by 
shredding, permanently erasing, or other-
wise modifying the covered information to 
make such covered information perma-
nently unreadable or indecipherable. 
‘‘(vi) A process for overseeing persons 
who have access to covered information, in-
cluding through internet-connected devices, 
by— 
‘‘(I) taking reasonable steps to 
select and retain persons that are ca-
pable of maintaining appropriate safe-
guards for the covered information or 
internet-connected devices at issue; 
and 
‘‘(II) requiring all such persons 
to implement and maintain such secu-
rity measures. 
‘‘(vii) A process for employee training 
and supervision for implementation of the 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
policies, practices, and procedures required 
by this subsection. 
‘‘(viii) A written plan or protocol for 
internal and public response in the event of 
a breach of security. 
‘‘(C) PERIODIC
ASSESSMENT
AND
CON-
SUMER
PRIVACY
AND
DATA
SECURITY
MOD-
ERNIZATION.—An operator of a children’s serv-
ice shall, not less frequently than every 12 
months, monitor, evaluate, and adjust, as ap-
propriate, the policies, practices, and procedures 
of such operator in light of any relevant 
changes in— 
‘‘(i) technology; 
‘‘(ii) internal or external threats and 
vulnerabilities to covered information; and 
‘‘(iii) the changing business arrange-
ments of the operator. 
‘‘(D) SUBMISSION
OF
POLICIES
TO
THE 
FTC.—An operator of a children’s service shall 
submit the policies, practices, and procedures 
established by the operator under subparagraph 
(A) to the Commission in conjunction with a 
notification of a breach of security required by 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
any Federal or State statute or regulation or 
upon request of the Commission. 
‘‘(b) RULEMAKING REGARDING REQUIREMENTS FOR 
DIGITAL SERVICES LIKELY TO BE ACCESSED BY CHIL-
DREN OR TEENAGERS.— 
‘‘(1) IN GENERAL.—The Commission shall pro-
mulgate regulations under section 553 of title 5, 
United States Code, that contain requirements for 
operators of digital services that are not children’s 
services but are likely to be accessed by children or 
teenagers, which shall be based on the requirements 
of subsection (a) but modified as the Commission 
considers appropriate given a risk-based approach to 
determine age and to determine and mitigate privacy 
risks and security risks to the child or teenager, and 
given differing developmental needs and cognitive ca-
pacities of children or teenagers. The Commission 
may include in such regulations different require-
ments for operators of different types of such serv-
ices. 
‘‘(2) BEST
INTERESTS
OF
CHILD
OR
TEEN-
AGER.—The regulations promulgated under para-
graph (1) shall require an operator to make the best 
interests of children and teenagers a primary design 
consideration when designing its service, including 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
by conducting a privacy and security impact assess-
ment and mitigation for the service, addressing all 
privacy risks to children and teenagers which arise 
from the processing of covered information, taking 
into account the best interests of children and teen-
agers. 
‘‘(3) RISK-BASED APPROACH TO DETERMINING 
AGE OF USER.— 
‘‘(A) IN GENERAL.—The regulations pro-
mulgated under paragraph (1) shall require a 
risk-based approach to determining the age of 
a specific user of a digital service under which 
higher privacy risks and security risks from the 
processing of covered information require a 
higher certainty of age assurance. 
‘‘(B) AGE
ASSURANCE.—The regulations 
promulgated under paragraph (1) shall require 
an operator to conduct an age assurance to de-
termine the age of each specific user. 
‘‘(C) 
APPROVAL
OF
AGE
ASSURANCE 
MECHANISMS.—The Commission shall establish 
in the regulations promulgated under paragraph 
(1) a process under which an operator may ob-
tain the approval of the Commission of par-
ticular mechanisms of age assurance as meeting 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
the age assurance requirements of such regula-
tions for particular levels of privacy risks. 
‘‘(D) DATA
MINIMIZATION.—The regula-
tions required by paragraph (1) shall provide 
that any data collected for age assurance shall 
be the minimal amount necessary and destroyed 
immediately or as determined by the Commis-
sion, but consistent with standards that still 
allow for auditing and compliance. 
‘‘(c) PROHIBITION
ON CERTAIN ADVERTISING
OR 
MARKETING
FOR DIGITAL SERVICES LIKELY TO BE 
ACCESSED BY CHILDREN OR TEENAGERS.—An operator 
of a digital service that is likely to be accessed by children 
or teenagers may not process covered information for the 
purpose of providing for targeted personalized advertising 
or engage in other marketing to a specific child or teen-
ager or group of children or teenagers based on— 
‘‘(1) using the covered information, online be-
havior, or group identifiers of such child or teenager 
or of the children or teenagers in such group; or 
‘‘(2) using the covered information or online be-
havior of children or teenagers who share character-
istics with such child or teenager or with the chil-
dren or teenagers in such group, including income 
level or protected characteristics or proxies thereof. 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
SEC. 4. REPEAL OF SAFE HARBORS PROVISION. 
(a) IN GENERAL.—Section 1304 of the Children’s 
Online Privacy Protection Act of 1998 (15 U.S.C. 6503) 
is repealed. 
(b) CONFORMING AMENDMENT.—Section 1305(b) of 
the Children’s Online Privacy Protection Act of 1998 (15 
U.S.C. 6504(b)) is amended by striking paragraph (3). 
SEC. 5. ADMINISTRATION AND APPLICABILITY OF ACT. 
(a) ENFORCEMENT BY FEDERAL TRADE COMMIS-
SION.—Section 1306(d) of the Children’s Online Privacy 
Protection Act of 1998 (15 U.S.C. 6505(d)) is amended 
to read as follows: 
‘‘(d) ACTIONS BY THE COMMISSION.— 
‘‘(1) IN GENERAL.—Except as provided in para-
graphs (2) and (3), the Commission shall prevent 
any person from violating section 1303 or a regula-
tion promulgated under such section in the same 
manner, by the same means, and with the same ju-
risdiction, powers, and duties as though all applica-
ble terms and provisions of the Federal Trade Com-
mission Act (15 U.S.C. 41 et seq.) were incor-
porated into and made a part of this title, and any 
entity that violates such section or such regulation 
shall be subject to the penalties and entitled to the 
privileges and immunities provided in the Federal 
Trade Commission Act in the same manner, by the 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
same means, and with the same jurisdiction, power, 
and duties as though all applicable terms and provi-
sions of the Federal Trade Commission Act were in-
corporated into and made a part of this title. 
‘‘(2) INCREASED CIVIL PENALTY AMOUNT.—In 
the case of a civil penalty under subsection (l) or 
(m) of section 5 of the Federal Trade Commission 
Act (15 U.S.C. 45) relating to acts or practices in 
violation of section 1303 or a regulation promul-
gated under such section, the maximum dollar 
amount per violation shall be $63,795. 
‘‘(3) NATURE OF RELIEF AVAILABLE.—In any 
action commenced by the Commission under sub-
section (a) of section 19 of the Federal Trade Com-
mission Act (15 U.S.C. 57b) to enforce section 1303 
of this title or a regulation promulgated under such 
section, the Commission shall seek all appropriate 
relief described in subsection (b) of such section 19, 
and may, notwithstanding such subsection, seek any 
exemplary or punitive damages.’’. 
(b) ENFORCEMENT
BY CERTAIN OTHER AGEN-
CIES.—Section 1306 of the Children’s Online Privacy Pro-
tection Act of 1998 (15 U.S.C. 6505) is amended— 
(1) in subsection (b)— 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
(A) in paragraph (1), by striking ‘‘, in the 
case of’’ and all that follows and inserting the 
following: ‘‘by the appropriate Federal banking 
agency, with respect to any insured depository 
institution (as those terms are defined in sec-
tion 3 of that Act (12 U.S.C. 1813));’’; 
(B) in paragraph (6), by striking ‘‘Federal 
land bank, Federal land bank association, Fed-
eral intermediate credit bank, or production 
credit association’’ and inserting ‘‘Farm Credit 
Bank, Agricultural Credit Bank (to the extent 
exercising the authorities of a Farm Credit 
Bank), Federal Land Credit Association, or ag-
ricultural credit association’’; and 
(C) by striking paragraph (2) and redesig-
nating paragraphs (3) through (6) as para-
graphs (2) through (5), respectively; and 
(2) in subsection (c), by striking ‘‘subsection 
(a)’’ each place it appears and inserting ‘‘subsection 
(b)’’. 
SEC. 6. REVIEW. 
Section 1307 of the Children’s Online Privacy Protec-
tion Act of 1998 (15 U.S.C. 6506) is amended— 
(1) in the matter preceding paragraph (1), by 
striking ‘‘the regulations initially issued under sec-
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
tion 1303’’ and inserting ‘‘the regulations issued 
under section 10(a) of the Protecting the Informa-
tion of our Vulnerable Children and Youth Act (re-
lating to the implementation of the amendments 
made by such Act to this title)’’; and 
(2) by amending paragraph (1) to read as fol-
lows: 
‘‘(1) review the implementation of this title, in-
cluding the effect of the implementation of this title 
on practices relating to the processing of covered in-
formation about teenagers or children and teenager’s 
and children’s ability to obtain access to information 
of their choice online; and’’. 
SEC. 7. PRIVATE RIGHT OF ACTION. 
The Children’s Online Privacy Protection Act of 1998 
(15 U.S.C. 6501 et seq.) is amended— 
(1) by redesignating sections 1307 and 1308 as 
sections 1308 and 1309, respectively; and 
(2) by inserting after section 1306 the fol-
lowing: 
‘‘SEC. 1307. PRIVATE RIGHT OF ACTION. 
‘‘(a) RIGHT OF ACTION.—Any parent of a teenager 
or parent of a child alleging a violation of section 1303 
or a regulation promulgated under such section with re-
spect to the covered information of such teenager or child 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
may bring a civil action in any court of competent jurisdic-
tion. 
‘‘(b) INJURY IN FACT.—A violation of section 1303 
or a regulation promulgated under such section with re-
spect to the covered information of a teenager or child con-
stitutes an injury in fact to that teenager or child. 
‘‘(c) RELIEF.—In a civil action brought under sub-
section (a) in which the plaintiff prevails, the court may 
award— 
‘‘(1) injunctive relief; 
‘‘(2) actual damages; 
‘‘(3) punitive damages; 
‘‘(4) reasonable attorney’s fees and costs; and 
‘‘(5) any other relief that the court determines 
appropriate. 
‘‘(d) PRE-DISPUTE ARBITRATION AGREEMENTS.— 
‘‘(1) IN GENERAL.—No pre-dispute arbitration 
agreement or pre-dispute joint-action waiver shall be 
valid or enforceable with respect to any claim arising 
under section 1303 or a regulation promulgated 
under such section. 
‘‘(2) DETERMINATION.—A determination as to 
whether and how this title or a regulation promul-
gated under this title applies to an arbitration agree-
ment shall be determined under Federal law by the 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS
court, rather than the arbitrator, irrespective of 
whether the party opposing arbitration challenges 
such agreement specifically or in conjunction with 
any other term of the contract containing such 
agreement. 
‘‘(3) DEFINITIONS.—As used in this sub-
section— 
‘‘(A) the term ‘pre-dispute arbitration 
agreement’ means any agreement to arbitrate a 
dispute that has not arisen at the time of the 
making of the agreement; and 
‘‘(B) the term ‘pre-dispute joint-action 
waiver’ means an agreement, whether or not 
part of a pre-dispute arbitration agreement, 
that would prohibit, or waive the right of, one 
of the parties to the agreement to participate in 
a joint, class, or collective action in a judicial, 
arbitral, administrative, or other forum, con-
cerning a dispute that has not yet arisen at the 
time of the making of the agreement. 
‘‘(e) NON-WAIVEABILITY.—The rights and remedies 
provided under this title may not be waived or limited by 
contract or otherwise.’’. 
VerDate Sep 11 2014 
22:53 Aug 07, 2021
Jkt 019200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H4801.IH
H4801
pbinns on DSKJLVW7X2PROD with BILLS