ered entity believes in good faith that the indi-
vidual is at risk of death, serious physical in-
jury, or serious health risk; 
(D) with respect to covered data collected in 
accordance with this Act, notwithstanding this 
exception, a service provider acting at the direc-
tion of a government entity, or a service pro-
vided to a government entity by a covered entity, 
and only insofar as authorized by statute, the 
transfer is necessary to prevent, detect, protect 
against or respond to a public safety incident in-
cluding trespass, natural disaster, or national se-
curity incident. This paragraph does not permit, 
however, the transfer of covered data for payment 
or other valuable consideration to a government 
entity; 
(E) in the case of the transfer of a pass-
word, the transfer is necessary to use a des-
ignated password manager or is to a covered en-
tity for the exclusive purpose of identifying pass-
words that are being re-used across sites or ac-
counts; 
(F) in the case of the transfer of genetic in-
formation, the transfer is necessary to perform a 
medical diagnosis or medical treatment specifi-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
cally requested by an individual, or to conduct 
medical research in accordance with conditions 
of section 101(b)(10); or 
(G) to transfer assets in the manner de-
scribed in paragraph (13) of section 101(b); or 
(4) in the case of a provider of broadcast tele-
vision service, cable service, satellite service, stream-
ing media service, or other video programming service 
described in section 713(h)(2) of the Communications 
Act of 1934 (47 U.S.C. 613(h)(2)), transfer to an un-
affiliated third party covered data that reveals the 
video content or services requested or selected by an 
individual from such service, except with the affirma-
tive express consent of the individual or pursuant to 
one of the permissible purposes enumerated in para-
graphs (1) through (15) of section 101(b). 
SEC. 103. PRIVACY BY DESIGN. 
(a) POLICIES, PRACTICES, AND PROCEDURES.—A cov-
ered entity and a service provider shall establish, imple-
ment, and maintain reasonable policies, practices, and pro-
cedures that reflect the role of the covered entity or service 
provider in the collection, processing, and transferring of 
covered data and that— 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(1) consider applicable Federal laws, rules, or 
regulations related to covered data the covered entity 
or service provider collects, processes, or transfers; 
(2) identify, assess, and mitigate privacy risks 
related to covered minors (including, if applicable, 
with respect to a covered entity that is not an entity 
meeting the requirements of section 209, in a manner 
that considers the developmental needs of different age 
ranges of covered minors) to result in reasonably nec-
essary and proportionate residual risk to covered mi-
nors; 
(3) mitigate privacy risks, including substantial 
privacy risks, related to the products and services of 
the covered entity or the service provider, including in 
the design, development, and implementation of such 
products and services, taking into account the role of 
the covered entity or service provider and the infor-
mation available to it; and 
(4) implement reasonable training and safe-
guards within the covered entity and service provider 
to promote compliance with all privacy laws applica-
ble to covered data the covered entity collects, proc-
esses, or transfers or covered data the service provider 
collects, processes, or transfers on behalf of the covered 
entity and mitigate privacy risks, including substan-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
tial privacy risks, taking into account the role of the 
covered entity or service provider and the information 
available to it. 
(b) FACTORS TO CONSIDER.—The policies, practices, 
and procedures established by a covered entity and a service 
provider under subsection (a), shall correspond with, as ap-
plicable— 
(1) the size of the covered entity or the service 
provider and the nature, scope, and complexity of the 
activities engaged in by the covered entity or service 
provider, including whether the covered entity or serv-
ice provider is a large data holder, nonprofit organi-
zation, entity meeting the requirements of section 209, 
third party, or third-party collecting entity, taking 
into account the role of the covered entity or service 
provider and the information available to it; 
(2) the sensitivity of the covered data collected, 
processed, or transferred by the covered entity or serv-
ice provider; 
(3) the volume of covered data collected, proc-
essed, or transferred by the covered entity or service 
provider; 
(4) the number of individuals and devices to 
which the covered data collected, processed, or trans-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
ferred by the covered entity or service provider relates; 
and 
(5) the cost of implementing such policies, prac-
tices, and procedures in relation to the risks and na-
ture of the covered data. 
(c) COMMISSION GUIDANCE.—Not later than 1 year 
after the date of enactment of this Act, the Commission shall 
issue guidance as to what constitutes reasonable policies, 
practices, and procedures as required by this section. The 
Commission shall consider unique circumstances applicable 
to nonprofit organizations, to entities meeting the require-
ments of section 209, and to service providers. 
SEC. 104. LOYALTY TO INDIVIDUALS WITH RESPECT TO 
PRICING. 
(a) RETALIATION THROUGH SERVICE
OR PRICING 
PROHIBITED.—A covered entity may not retaliate against 
an individual for exercising any of the rights guaranteed 
by the Act, or any regulations promulgated under this Act, 
including denying goods or services, charging different 
prices or rates for goods or services, or providing a different 
level of quality of goods or services. 
(b) RULES OF CONSTRUCTION.—Nothing in subsection 
(a) may be construed to— 
(1) prohibit the relation of the price of a service 
or the level of service provided to an individual to the 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
provision, by the individual, of financial information 
that is necessarily collected and processed only for the 
purpose of initiating, rendering, billing for, or col-
lecting payment for a service or product requested by 
the individual; 
(2) prohibit a covered entity from offering a dif-
ferent price, rate, level, quality or selection of goods 
or services to an individual, including offering goods 
or services for no fee, if the offering is in connection 
with an individual’s voluntary participation in a 
bona fide loyalty program; 
(3) require a covered entity to provide a bona 
fide loyalty program that would require the covered 
entity to collect, process, or transfer covered data that 
the covered entity otherwise would not collect, process, 
or transfer; 
(4) prohibit a covered entity from offering a fi-
nancial incentive or other consideration to an indi-
vidual for participation in market research; 
(5) prohibit a covered entity from offering dif-
ferent types of pricing or functionalities with respect 
to a product or service based on an individual’s exer-
cise of a right under section 203(a)(3); or 
(6) prohibit a covered entity from declining to 
provide a product or service insofar as the collection 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
and processing of covered data is strictly necessary 
for such product or service. 
(c) BONA FIDE LOYALTY PROGRAM DEFINED.—For 
purposes of this section, the term ‘‘bona fide loyalty pro-
gram’’ includes rewards, premium features, discount or club 
card programs. 
TITLE II—CONSUMER DATA 
RIGHTS 
SEC. 201. CONSUMER AWARENESS. 
(a) IN GENERAL.—Not later than 90 days after the 
date of enactment of this Act, the Commission shall publish, 
on the public website of the Commission, a webpage that 
describes each provision, right, obligation, and requirement 
of this Act, listed separately for individuals and for covered 
entities and service providers, and the remedies, exemp-
tions, and protections associated with this Act, in plain and 
concise language and in an easy-to-understand manner. 
(b) UPDATES.—The Commission shall update the in-
formation published under subsection (a) on a quarterly 
basis as necessitated by any change in law, regulation, 
guidance, or judicial decisions. 
(c) ACCESSIBILITY.—The Commission shall publish 
the information required to be published under subsection 
(a) in the ten languages with the most users in the United 
States, according to the most recent United States Census. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
SEC. 202. TRANSPARENCY. 
(a) IN GENERAL.—Each covered entity shall make 
publicly available, in a clear, conspicuous, not misleading, 
and easy-to-read and readily accessible manner, a privacy 
policy that provides a detailed and accurate representation 
of the data collection, processing, and transfer activities of 
the covered entity. 
(b) CONTENT OF PRIVACY POLICY.—A covered entity 
or service provider shall have a privacy policy that in-
cludes, at a minimum, the following: 
(1) The identity and the contact information 
of— 
(A) the covered entity or service provider to 
which the privacy policy applies (including the 
covered entity’s or service provider’s points of 
contact and generic electronic mail addresses, as 
applicable for privacy and data security inquir-
ies); and 
(B) any other entity within the same cor-
porate structure as the covered entity or service 
provider to which covered data is transferred by 
the covered entity. 
(2) The categories of covered data the covered en-
tity or service provider collects or processes. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(3) The processing purposes for each category of 
covered data the covered entity or service provider col-
lects or processes. 
(4) Whether the covered entity or service provider 
transfers covered data and, if so, each category of 
service provider and third party to which the covered 
entity or service provider transfers covered data, the 
name of each third-party collecting entity to which 
the covered entity or service provider transfers covered 
data, and the purposes for which such data is trans-
ferred to such categories of service providers and third 
parties or third-party collecting entities, except for a 
transfer to a governmental entity pursuant to a court 
order or law that prohibits the covered entity or serv-
ice provider from disclosing such transfer, except for 
transfers to governmental entities pursuant to a court 
order or law that prohibits the covered entity from 
disclosing the transfer. 
(5) The length of time the covered entity or serv-
ice provider intends to retain each category of covered 
data, including sensitive covered data, or, if it is not 
possible to identify that timeframe, the criteria used 
to determine the length of time the covered entity or 
service provider intends to retain categories of covered 
data. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(6) A prominent description of how an indi-
vidual can exercise the rights described in this Act. 
(7) A general description of the covered entity’s 
or service provider’s data security practices. 
(8) The effective date of the privacy policy. 
(9) Whether or not any covered data collected by 
the covered entity or service provider is transferred to, 
processed in, stored in, or otherwise accessible to the 
People’s Republic of China, Russia, Iran, or North 
Korea. 
(c) LANGUAGES.—The privacy policy required under 
subsection (a) shall be made available to the public in each 
covered language in which the covered entity or service pro-
vider— 
(1) provides a product or service that is subject 
to the privacy policy; or 
(2) carries out activities related to such product 
or service. 
(d) ACCESSIBILITY.—The covered entity or service pro-
vider shall also provide the disclosures under this section 
in a manner that is reasonably accessible to and usable by 
individuals with disabilities. 
(e) MATERIAL CHANGES.— 
(1) AFFIRMATIVE EXPRESS CONSENT.—If a cov-
ered entity makes a material change to its privacy 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
policy or practices, the covered entity shall notify 
each individual affected by such material change be-
fore implementing the material change with respect to 
any prospectively collected covered data and, except 
as provided in paragraphs (1) through (15) of section 
101(b), provide a reasonable opportunity for each in-
dividual to withdraw consent to any further materi-
ally different collection, processing, or transfer of pre-
viously collected covered data under the changed pol-
icy. 
(2) NOTIFICATION.—The covered entity shall take 
all reasonable electronic measures to provide direct 
notification regarding material changes to the pri-
vacy policy to each affected individual, in each cov-
ered language in which the privacy policy is made 
available, and taking into account available tech-
nology and the nature of the relationship. 
(3) CLARIFICATION.—Nothing in this section 
may be construed to affect the requirements for cov-
ered entities under section 102 or 204. 
(4) LOG OF MATERIAL CHANGES.—Each large 
data holder shall retain copies of previous versions of 
its privacy policy for at least 10 years beginning 
after the date of enactment of this Act and publish 
them on its website. Such large data holder shall 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
make publicly available, in a clear, conspicuous, and 
readily accessible manner, a log describing the date 
and nature of each material change to its privacy 
policy over the past 10 years. The descriptions shall 
be sufficient for a reasonable individual to under-
stand the material effect of each material change. The 
obligations in this paragraph shall not apply to any 
previous versions of a large data holder’s privacy pol-
icy, or any material changes to such policy, that pre-
cede the date of enactment of this Act. 
(f) SHORT-FORM NOTICE TO CONSUMERS BY LARGE 
DATA HOLDERS.— 
(1) IN GENERAL.—In addition to the privacy 
policy required under subsection (a), a large data 
holder that is a covered entity shall provide a short- 
form notice of its covered data practices in a manner 
that is— 
(A) concise, clear, conspicuous, and not 
misleading; 
(B) readily accessible to the individual, 
based on what is reasonably anticipated within 
the context of the relationship between the indi-
vidual and the large data holder; 
(C) inclusive of an overview of individual 
rights and disclosures to reasonably draw atten-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
tion to data practices that may reasonably be 
unexpected to a reasonable person or that involve 
sensitive covered data; and 
(D) no more than 500 words in length. 
(2) RULEMAKING.—The Commission shall issue 
a rule pursuant to section 553 of title 5, United 
States Code, establishing the minimum data disclo-
sures necessary for the short-form notice required 
under paragraph (1), which shall not exceed the con-
tent requirements in subsection (b) and shall include 
templates or models of short-form notices. 
SEC. 203. INDIVIDUAL DATA OWNERSHIP AND CONTROL. 
(a) ACCESS TO, AND CORRECTION, DELETION, AND 
PORTABILITY OF, COVERED DATA.—In accordance with 
subsections (b) and (c), a covered entity shall provide an 
individual, after receiving a verified request from the indi-
vidual, with the right to— 
(1) access— 
(A) in a human-readable format that a rea-
sonable 
individual 
can 
understand 
and 
download from the internet, the covered data (ex-
cept covered data in a back-up or archival sys-
tem) of the individual making the request that is 
collected, processed, or transferred by the covered 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
entity or any service provider of the covered enti-
ty within the 24 months preceding the request; 
(B) the categories of any third party, if ap-
plicable, and an option for consumers to obtain 
the names of any such third party as well as and 
the categories of any service providers to whom 
the covered entity has transferred for consider-
ation the covered data of the individual, as well 
as the categories of sources from which the cov-
ered data was collected; and 
(C) a description of the purpose for which 
the covered entity transferred the covered data of 
the individual to a third party or service pro-
vider; 
(2) correct any verifiable substantial inaccuracy 
or substantially incomplete information with respect 
to the covered data of the individual that is processed 
by the covered entity and instruct the covered entity 
to make reasonable efforts to notify all third parties 
or service providers to which the covered entity trans-
ferred such covered data of the corrected information; 
(3) delete covered data of the individual that is 
processed by the covered entity and instruct the cov-
ered entity to make reasonable efforts to notify all 
third parties or service provider to which the covered 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
entity transferred such covered data of the individ-
ual’s deletion request; and 
(4) to the extent technically feasible, export to the 
individual or directly to another entity the covered 
data of the individual that is processed by the covered 
entity, including inferences linked or reasonably 
linkable to the individual but not including other de-
rived data, without licensing restrictions that limit 
such transfers in— 
(A) a human-readable format that a reason-
able individual can understand and download 
from the internet; and 
(B) a portable, structured, interoperable, 
and machine-readable format. 
(b) INDIVIDUAL AUTONOMY.—A covered entity may 
not condition, effectively condition, attempt to condition, 
or attempt to effectively condition the exercise of a right 
described in subsection (a) through— 
(1) the use of any false, fictitious, fraudulent, or 
materially misleading statement or representation; or 
(2) the design, modification, or manipulation of 
any user interface with the purpose or substantial ef-
fect of obscuring, subverting, or impairing a reason-
able individual’s autonomy, decision making, or 
choice to exercise such right. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(c) TIMING.— 
(1) IN GENERAL.—Subject to subsections (d) and 
(e), each request under subsection (a) shall be com-
pleted by any— 
(A) large data holder within 45 days of 
such request from an individual, unless it is de-
monstrably impracticable or impracticably costly 
to verify such individual; 
(B) covered entity that is not a large data 
holder or a covered entity meeting the require-
ments of section 209 within 60 days of such re-
quest from an individual, unless it is demon-
strably impracticable or impracticably costly to 
verify such individual; or 
(C) covered entity meeting the requirements 
of section 209 within 90 days of such request 
from an individual, unless it is demonstrably 
impracticable or impracticably costly to verify 
such individual. 
(2) EXTENSION.—A response period set forth in 
this subsection may be extended once by 45 additional 
days when reasonably necessary, considering the com-
plexity and number of the individual’s requests, so 
long as the covered entity informs the individual of 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
any such extension within the initial 45-day response 
period, together with the reason for the extension. 
(d) FREQUENCY AND COST OF ACCESS.—A covered en-
tity— 
(1) shall provide an individual with the oppor-
tunity to exercise each of the rights described in sub-
section (a); and 
(2) with respect to— 
(A) the first 2 times that an individual ex-
ercises any right described in subsection (a) in 
any 12-month period, shall allow the individual 
to exercise such right free of charge; and 
(B) any time beyond the initial 2 times de-
scribed in subparagraph (A), may allow the in-
dividual to exercise such right for a reasonable 
fee for each request. 
(e) VERIFICATION AND EXCEPTIONS.— 
(1) REQUIRED EXCEPTIONS.—A covered entity 
may not permit an individual to exercise a right de-
scribed in subsection (a), in whole or in part, if the 
covered entity— 
(A) cannot reasonably verify that the indi-
vidual making the request to exercise the right is 
the individual whose covered data is the subject 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
ditional information necessary for the sole pur-
pose of verifying the identity of the individual; 
and 
(B) may not process or transfer such addi-
tional information for any other purpose. 
(3) PERMISSIVE EXCEPTIONS.— 
(A) IN GENERAL.—A covered entity may de-
cline, with adequate explanation to the indi-
vidual, to comply with a request to exercise a 
right described in subsection (a), in whole or in 
part, that would— 
(i) require the covered entity to retain 
any covered data collected for a single, one- 
time transaction, if such covered data is not 
processed or transferred by the covered enti-
ty for any purpose other than completing 
such transaction; 
(ii) be demonstrably impracticable or 
prohibitively costly to comply with, and the 
covered entity shall provide a description to 
the requestor detailing the inability to com-
ply with the request; 
(iii) require the covered entity to at-
tempt to re-identify de-identified data; 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(iv) require the covered entity to main-
tain covered data in an identifiable form or 
collect, retain, or access any data in order 
to be capable of associating a verified indi-
vidual request with covered data of such in-
dividual; 
(v) result in the release of trade secrets 
or other privileged or confidential business 
information; 
(vi) require the covered entity to cor-
rect any covered data that cannot be reason-
ably verified as being inaccurate or incom-
plete; 
(vii) interfere with law enforcement, 
judicial proceedings, investigations, or rea-
sonable efforts to guard against, detect, pre-
vent, or investigate fraudulent, malicious, 
or unlawful activity, or enforce valid con-
tracts; 
(viii) violate Federal or State law or 
the rights and freedoms of another indi-
vidual, including under the Constitution of 
the United States; 
(ix) prevent a covered entity from 
being able to maintain a confidential record 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00062
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
of deletion requests, maintained solely for 
the purpose of preventing covered data of an 
individual from being recollected after the 
individual submitted a deletion request and 
requested that the covered entity no longer 
collect, process, or transfer such data; 
(x) fall within an exception enumer-
ated in the regulations promulgated by the 
Commission pursuant to subparagraph (D); 
or 
(xi) with respect to requests for dele-
tion— 
(I) unreasonably interfere with 
the provision of products or services by 
the covered entity to another person it 
currently serves; 
(II) delete covered data that re-
lates to a public figure and for which 
the requesting individual has no rea-
sonable expectation of privacy; 
(III) delete covered data reason-
ably necessary to perform a contract 
between the covered entity and the in-
dividual; 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00063
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(IV) delete covered data that the 
covered entity needs to retain in order 
to comply with professional ethical ob-
ligations; 
(V) delete covered data that the 
covered entity reasonably believes may 
be evidence of unlawful activity or an 
abuse of the covered entity’s products 
or services; or 
(VI) for private elementary and 
secondary schools as defined by State 
law and private institutions of higher 
education as defined by title I of the 
Higher Education Act of 1965, delete 
covered data that would unreasonably 
interfere with the provision of edu-
cation services by or the ordinary oper-
ation of the school or institution. 
(B) PARTIAL
COMPLIANCE.—In a cir-
cumstance that would allow a denial pursuant to 
subparagraph (A), a covered entity shall par-
tially comply with the remainder of the request 
if it is possible and not unduly burdensome to do 
so. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00064
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(C) NUMBER OF REQUESTS.—For purposes 
of subparagraph (A)(ii), the receipt of a large 
number of verified requests, on its own, may not 
be considered to render compliance with a re-
quest demonstrably impracticable. 
(D) FURTHER EXCEPTIONS.—The Commis-
sion may, by regulation as described in sub-
section (g), establish additional permissive excep-
tions necessary to protect the rights of individ-
uals, alleviate undue burdens on covered entities, 
prevent unjust or unreasonable outcomes from 
the exercise of access, correction, deletion, or 
portability rights, or as otherwise necessary to 
fulfill the purposes of this section. In establishing 
such exceptions, the Commission should consider 
any relevant changes in technology, means for 
protecting privacy and other rights, and bene-
ficial uses of covered data by covered entities. 
(f) LARGE DATA HOLDER METRICS REPORTING.—A 
large data holder that is a covered entity shall, for each 
calendar year in which it was a large data holder, do the 
following: 
(1) Compile the following metrics for the prior 
calendar year: 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(A) The number of verified access requests 
under subsection (a)(1). 
(B) The number of verified deletion requests 
under subsection (a)(3). 
(C) The number of requests to opt-out of 
covered data transfers under section 204(b). 
(D) The number of requests to opt-out of 
targeted advertising under section 204(c). 
(E) The number of requests in each of sub-
paragraphs (A) through (D) that such large data 
holder (i) complied with in whole or in part and 
(ii) denied. 
(F) The median or mean number of days 
within which such large data holder sub-
stantively responded to the requests in each of 
subparagraphs (A) through (D). 
(2) Disclose by July 1 of each applicable cal-
endar year the information compiled in paragraph 
(1) within such large data holder’s privacy policy re-
quired under section 202 or on the publicly accessible 
website of such large data holder that is accessible 
from a hyperlink included in the privacy policy. 
(g) REGULATIONS.—Not later than 2 years after the 
date of enactment of this Act, the Commission shall promul-
gate regulations, pursuant to section 553 of title 5, United 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00066
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
subsection (a) shall be readily accessible and usable by with 
individuals with disabilities. 
SEC. 204. RIGHT TO CONSENT AND OBJECT. 
(a) WITHDRAWAL
OF CONSENT.—A covered entity 
shall provide an individual with a clear and conspicuous, 
easy-to-execute means to withdraw any affirmative express 
consent previously provided by the individual that is as 
easy to execute by a reasonable individual as the means 
to provide consent, with respect to the processing or transfer 
of the covered data of the individual. 
(b) RIGHT TO OPT OUT OF COVERED DATA TRANS-
FERS.— 
(1) IN GENERAL.—A covered entity— 
(A) may not transfer or direct the transfer 
of the covered data of an individual to a third 
party if the individual objects to the transfer; 
and 
(B) shall allow an individual to object to 
such a transfer through an opt-out mechanism, 
as described in section 210. 
(2) EXCEPTION.—Except as provided in section 
206(b)(3)(C), a covered entity need not allow an indi-
vidual to opt out of the collection, processing, or 
transfer of covered data made pursuant to the excep-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
tions in paragraphs (1) through (15) of section 
101(b). 
(c) RIGHT
TO OPT OUT
OF TARGETED ADVER-
TISING.— 
(1) A covered entity or service provider that di-
rectly delivers a targeted advertisement shall— 
(A) prior to engaging in targeted adver-
tising to an individual or device and at all times 
thereafter, provide such individual with a clear 
and conspicuous means to opt out of targeted ad-
vertising; 
(B) abide by any opt-out designation by an 
individual with respect to targeted advertising 
and notify the covered entity that directed the 
service provider to deliver the targeted advertise-
ment of the opt-out decision; and 
(C) allow an individual to make an opt-out 
designation with respect to targeted advertising 
through an opt-out mechanism, as described in 
section 210. 
(2) A covered entity or service provider that re-
ceives an opt-out notification pursuant to paragraph 
(1)(B) or this paragraph shall abide by such opt-out 
designations by an individual and notify any other 
person that directed the covered entity or service pro-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
vider to serve, deliver, or otherwise handle the adver-
tisement of the opt-out decision. 
(d) INDIVIDUAL AUTONOMY.—A covered entity may 
not condition, effectively condition, attempt to condition, 
or attempt to effectively condition the exercise of any indi-
vidual right under this section through— 
(1) the use of any false, fictitious, fraudulent, or 
materially misleading statement or representation; or 
(2) the design, modification, or manipulation of 
any user interface with the purpose or substantial ef-
fect of obscuring, subverting, or impairing a reason-
able individual’s autonomy, decision making, or 
choice to exercise any such right. 
SEC. 205. DATA PROTECTIONS FOR CHILDREN AND MINORS. 
(a) PROHIBITION
ON TARGETED ADVERTISING
TO 
CHILDREN AND MINORS.—A covered entity may not engage 
in targeted advertising to any individual if the covered en-
tity has knowledge that the individual is a covered minor. 
(b) DATA TRANSFER REQUIREMENTS RELATED TO 
COVERED MINORS.— 
(1) IN
GENERAL.—A covered entity may not 
transfer or direct the transfer of the covered data of 
a covered minor to a third party if the covered enti-
ty— 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00070
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(A) has knowledge that the individual is a 
covered minor; and 
(B) has not obtained affirmative express 
consent from the covered minor or the covered 
minor’s parent or guardian. 
(2) EXCEPTION.—A covered entity or service pro-
vider may collect, process, or transfer covered data of 
an individual the covered entity or service provider 
knows is under the age of 18 solely in order to submit 
information relating to child victimization to law en-
forcement or to the nonprofit, national resource center 
and clearinghouse congressionally designated to pro-
vide assistance to victims, families, child-serving pro-
fessionals, and the general public on missing and ex-
ploited children issues. 
(c) YOUTH PRIVACY AND MARKETING DIVISION.— 
(1) ESTABLISHMENT.—There is established with-
in the Commission in the privacy bureau established 
in this Act, a division to be known as the ‘‘Youth Pri-
vacy and Marketing Division’’ (in this section re-
ferred to as the ‘‘Division’’). 
(2) DIRECTOR.—The Division shall be headed by 
a Director, who shall be appointed by the Chair of the 
Commission. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(3) DUTIES.—The Division shall be responsible 
for assisting the Commission in addressing, as it re-
lates to this Act— 
(A) the privacy of children and minors; and 
(B) marketing directed at children and mi-
nors. 
(4) STAFF.—The Director of the Division shall 
hire adequate staff to carry out the duties described 
in paragraph (3), including by hiring individuals 
who are experts in data protection, digital adver-
tising, data analytics, and youth development. 
(5) REPORTS.—Not later than 2 years after the 
date of enactment of this Act, and annually there-
after, the Commission shall submit to the Committee 
on Commerce, Science, and Transportation of the 
Senate and the Committee on Energy and Commerce 
of the House of Representatives a report that in-
cludes— 
(A) a description of the work of the Divi-
sion regarding emerging concerns relating to 
youth privacy and marketing practices; and 
(B) an assessment of how effectively the Di-
vision has, during the period for which the re-
port is submitted, assisted the Commission to ad-
dress youth privacy and marketing practices. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(6) PUBLICATION.—Not later than 10 days after 
the date on which a report is submitted under para-
graph (5), the Commission shall publish the report on 
its website. 
(d) REPORT BY THE INSPECTOR GENERAL.— 
(1) IN GENERAL.—Not later than 2 years after 
the date of enactment of this Act, and biennially 
thereafter, the Inspector General of the Commission 
shall submit to the Commission and to the Committee 
on Commerce, Science, and Transportation of the 
Senate and the Committee on Energy and Commerce 
of the House of Representatives a report regarding the 
safe harbor provisions in section 1304 of the Chil-
dren’s Online Privacy Protection Act of 1998 (15 
U.S.C. 6503), which shall include— 
(A) an analysis of whether the safe harbor 
provisions are— 
(i) operating fairly and effectively; and 
(ii) effectively protecting the interests 
of children and minors; and 
(B) any proposal or recommendation for 
policy changes that would improve the effective-
ness of the safe harbor provisions. 
(2) PUBLICATION.—Not later than 10 days after 
the date on which a report is submitted under para-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
graph (1), the Commission shall publish the report on 
the website of the Commission. 
SEC. 206. THIRD-PARTY COLLECTING ENTITIES. 
(a) NOTICE.—Each third-party collecting entity shall 
place a clear, conspicuous, not misleading, and readily ac-
cessible notice on the website or mobile application of the 
third-party collecting entity (if the third-party collecting 
entity maintains such a website or mobile application) 
that— 
(1) notifies individuals that the entity is a third- 
party collecting entity using specific language that 
the Commission shall develop through rulemaking 
under section 553 of title 5, United States Code; 
(2) includes a link to the website established 
under subsection (b)(3); and 
(3) is reasonably accessible to and usable by in-
dividuals with disabilities. 
(b) THIRD-PARTY COLLECTING ENTITY REGISTRA-
TION.— 
(1) IN GENERAL.—Not later than January 31 of 
each calendar year that follows a calendar year dur-
ing which a covered entity acted as a third-party col-
lecting entity and processed covered data pertaining 
to more than 5,000 individuals or devices that iden-
tify or are linked or reasonably linkable to an indi-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00074
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
vidual, such covered entity shall register with the 
Commission in accordance with this subsection. 
(2) REGISTRATION
REQUIREMENTS.—In reg-
istering with the Commission as required under para-
graph (1), a third-party collecting entity shall do the 
following: 
(A) Pay to the Commission a registration 
fee of $100. 
(B) Provide the Commission with the fol-
lowing information: 
(i) The legal name and primary phys-
ical, email, and internet addresses of the 
third-party collecting entity. 
(ii) A description of the categories of 
covered data the third-party collecting enti-
ty processes and transfers. 
(iii) The contact information of the 
third-party collecting entity, including a 
contact person, a telephone number, an e- 
mail address, a website, and a physical 
mailing address. 
(iv) A link to a website through which 
an individual may easily exercise the rights 
provided under this subsection. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00075
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
(3) THIRD-PARTY
COLLECTING
ENTITY
REG-
ISTRY.—The Commission shall establish and main-
tain on a website a searchable, publicly available, 
central registry of third-party collecting entities that 
are registered with the Commission under this sub-
section that includes the following: 
(A) A listing of all registered third-party 
collecting entities and a search feature that al-
lows members of the public to identify individual 
third-party collecting entities. 
(B) For each registered third-party col-
lecting entity, the information provided under 
paragraph (2)(B). 
(C)(i) A ‘‘Do Not Collect’’ registry link and 
mechanism by which an individual may, easily 
submit a request to all registered third-party col-
lecting entities that are not consumer reporting 
agencies (as defined in section 603(f) of the Fair 
Credit Reporting Act (15 U.S.C. 1681a(f))), and 
to the extent such third-party collecting entities 
are not acting as consumer reporting agencies 
(as so defined), to— 
(I) delete all covered data related to 
such individual that the third-party col-
lecting entity did not collect from such indi-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00076
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
vidual directly or when acting as a service 
provider; and 
(II) ensure that the third-party col-
lecting entity no longer collects covered data 
related to such individual without the af-
firmative express consent of such indi-
vidual, except insofar as the third-party col-
lecting entity is acting as a service pro-
vider. 
(ii) Each third-party collecting entity that 
receives such a request from an individual shall 
delete all the covered data of the individual not 
later than 30 days after the request is received 
by the third-party collecting entity. 
(iii) Notwithstanding the provisions of 
clauses (i) and (ii), a third-party collecting enti-
ty may decline to fulfill a ‘‘Do Not Collect’’ re-
quest from an individual who it has actual 
knowledge has been convicted of a crime related 
to the abduction or sexual exploitation of a child, 
and the data the entity is collecting is necessary 
to effectuate the purposes of a national or State- 
run sex offender registry or the congressionally 
designated entity that serves as the nonprofit na-
tional resource center and clearinghouse to pro-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00077
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
vide assistance to victims, families, child-serving 
professionals, and the general public on missing 
and exploited children issues. 
(c) PENALTIES.— 
(1) IN GENERAL.—A third-party collecting entity 
that fails to register or provide the notice as required 
under this section shall be liable for— 
(A) a civil penalty of $100 for each day the 
third-party collecting entity fails to register or 
provide notice as required under this section, not 
to exceed a total of $10,000 for any year; and 
(B) an amount equal to the registration fees 
due under paragraph (2)(A) of subsection (b) for 
each year that the third-party collecting entity 
failed to register as required under paragraph 
(1) of such subsection. 
(2) RULE OF CONSTRUCTION.—Nothing in this 
subsection shall be construed as altering, limiting, or 
affecting any enforcement authorities or remedies 
under this Act. 
SEC. 207. CIVIL RIGHTS AND ALGORITHMS. 
(a) CIVIL RIGHTS PROTECTIONS.— 
(1) IN GENERAL.—A covered entity or a service 
provider may not collect, process, or transfer covered 
data in a manner that discriminates in or otherwise 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
102 
(3) shall assist a covered entity in responding to 
a request made by an individual under section 203 
or 204, by either— 
(A) providing appropriate technical and or-
ganizational measures, taking into account the 
nature of the processing and the information rea-
sonably available to the service provider, for the 
covered entity to comply with such request for 
service provider data; or 
(B) fulfilling a request by a covered entity 
to execute an individual rights request that the 
covered entity has determined should be complied 
with, by either— 
(i) complying with the request pursu-
ant to the covered entity’s instructions; or 
(ii) providing written verification to 
the covered entity that it does not hold cov-
ered data related to the request, that com-
plying with the request would be incon-
sistent with its legal obligations, or that the 
request falls within an exception to section 
203 or 204; 
(4) may engage another service provider for pur-
poses of processing service provider data on behalf of 
a covered entity only after providing that covered en-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00102
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS