I 
116TH CONGRESS 
2D SESSION 
H. R. 5703 
To amend the Children’s Online Privacy Protection Act of 1998 to update 
and expand the coverage of such Act, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JANUARY 29, 2020 
Ms. CASTOR of Florida introduced the following bill; which was referred to the 
Committee on Energy and Commerce 
A BILL 
To amend the Children’s Online Privacy Protection Act of 
1998 to update and expand the coverage of such Act, 
and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
This Act may be cited as the ‘‘Protecting the Infor-
mation of our Vulnerable Children and Youth Act’’ or the 
‘‘PRIVCY ACT’’. 
SEC. 2. DEFINITIONS. 
Section 1302 of the Children’s Online Privacy Protec-
tion Act of 1998 (15 U.S.C. 6501) is amended— 
(1) in paragraph (1)— 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
(A) by inserting ‘‘or ‘children’ ’’ after 
‘‘child’’; and 
(B) by inserting ‘‘or individuals, respec-
tively,’’ after ‘‘individual’’; 
(2) by striking paragraph (10); 
(3) by redesignating paragraphs (2) through 
(9) as paragraphs (3) through (10), respectively; 
(4) inserting after paragraph (1) the following: 
‘‘(2) YOUNG
CONSUMER.—The term ‘young 
consumer’ means an individual over the age of 12 
and under the age of 18.’’; 
(5) by amending paragraph (3) (as so redesig-
nated) to read as follows: 
‘‘(3) COVERED ENTITY.—The term ‘covered en-
tity’ means— 
‘‘(A) any organization, corporation, trust, 
partnership, sole proprietorship, unincorporated 
association, or venture over which the Commis-
sion has authority pursuant to section 5(a)(2) 
of the Federal Trade Commission Act (15 
U.S.C. 45(a)(2)); 
‘‘(B) notwithstanding section 5(a)(2) of 
the Federal Trade Commission Act (15 U.S.C. 
45(a)(2)), common carriers; and 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(C) 
notwithstanding 
sections 
and 
5(a)(2) of the Federal Trade Commission Act 
(15 U.S.C. 44 and 45(a)(2)), any nonprofit or-
ganization, including any organization described 
in section 501(c) of the Internal Revenue Code 
of 1986 that is exempt from taxation under sec-
tion 501(a) of the Internal Revenue Code of 
1986.’’; 
(6) by amending paragraph (5) (as so redesig-
nated) to read as follows: 
‘‘(5) DISCLOSE.—The term ‘disclose’ means to 
intentionally or unintentionally release, transfer, sell, 
disseminate, share, publish, lease, license, make 
available, allow access to, fail to restrict access to, 
or otherwise communicate covered information.’’; 
(7) by amending paragraph (9) (as so redesig-
nated) to read as follows: 
‘‘(9) COVERED INFORMATION.—The term ‘cov-
ered information’— 
‘‘(A) means any information, linked or rea-
sonably linkable to a specific young consumer 
or child, or consumer device of a young con-
sumer or child; 
‘‘(B) may include— 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(i) a name, alias, home or other 
physical address, online identifier, Internet 
Protocol address, email address, account 
name, Social Security number, physical 
characteristics or description, telephone 
number, State identification card number, 
driver’s license number, where applicable, 
passport number, or other similar identi-
fier; 
‘‘(ii) race, religion, sex, sexual orienta-
tion, sexual behavior, familial status, gen-
der identity, disability, age, political affili-
ation, or national origin; 
‘‘(iii) commercial information, includ-
ing records relating to personal property, 
products or services purchased, obtained, 
or considered, or other purchasing or con-
suming histories or tendencies; 
‘‘(iv) biometric information; 
‘‘(v) Internet or other electronic net-
work activity information, including brows-
ing history, search history, and informa-
tion regarding a young consumer’s or 
child’s 
interaction 
with 
an 
Internet 
website, application, or advertisement; 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(vi) geolocation information; 
‘‘(vii) audio, electronic, visual, ther-
mal, olfactory, or similar information; 
‘‘(viii) education information; 
‘‘(ix) health information; 
‘‘(x) facial recognition information; 
‘‘(xi) contents of and parties to infor-
mation, including with respect to electronic 
mail, text messages, picture messages, 
voicemails, audio conversations, and video 
conversations; 
‘‘(xii) financial information, including 
bank account numbers, credit card num-
bers, debit card numbers, or insurance pol-
icy numbers, where applicable; 
‘‘(xiii) inferences drawn from any of 
the information described in this para-
graph to create a profile about a young 
consumer or child reflecting the young con-
sumer’s or child’s preferences, characteris-
tics, psychological trends, predispositions, 
behavior, attitudes, intelligence, abilities, 
and aptitudes; and 
‘‘(C) does not include— 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(i) information that is processed 
solely for the purpose of employment of a 
young consumer; 
‘‘(ii) de-identified information.’’; 
(8) by amending paragraph (10) (as so redesig-
nated) to read as follows: 
‘‘(10) 
VERIFIABLE
CONSENT.—The 
term 
‘verifiable consent’ means express, affirmative con-
sent freely given by a young consumer, or by the 
parent of a child, to the processing of covered infor-
mation of that young consumer or child, respec-
tively— 
‘‘(A) that is specific, informed, and unam-
biguous; 
‘‘(B) that is given separately for each proc-
ess of specific types of covered information; 
‘‘(C) where the young consumer or parent 
of a child, as applicable, has not received any 
financial or other incentive in exchange for such 
consent; and 
‘‘(D) that is given before any processing 
occurs, at a time and in a context in which the 
young consumer or parent of a child, as appli-
cable, would reasonably expect to make choices 
concerning such processing.’’; 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
(9) by redesignating paragraphs (11) and (12) 
as paragraphs (12) and (13), respectively; and 
(10) by adding at the end the following: 
‘‘(14) PROCESS.—The term ‘process’ means 
any operation or set of operations which is per-
formed on covered information, whether or not by 
automated means, including collecting, creating, ac-
quiring, disclosing, recording, deriving, inferring, ob-
taining, assembling, organizing, structuring, storing, 
retaining, adapting or altering, using, or retrieving 
covered information. 
‘‘(15) DE-IDENTIFIED INFORMATION AND RE-
LATED TERMS.— 
‘‘(A) The term ‘de-identified information’ 
means information that has been de-identified 
by a covered entity, where the covered entity 
publicly discloses the methods it uses to de- 
identify information. 
‘‘(B) The term ‘de-identify’ means the re-
moval of identifying information from informa-
tion such that the information is not reasonably 
linkable to a specific young consumer or child 
or consumer device of a young consumer or 
child. 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(C) The term ‘re-identify’ means to link 
information that has been de-identified to a 
specific young consumer or child or consumer 
device of a young consumer or child. 
‘‘(16) STATE.—The term ‘State’ means each of 
the several States, the District of Columbia, each 
territory of the United States, and each federally 
recognized Indian Tribe. 
‘‘(17) SERVICE PROVIDER.—The term ‘service 
provider’ means a covered entity that processes cov-
ered information at the direction of, and for the sole 
benefit of, another covered entity, and— 
‘‘(A) is contractually or legally prohibited 
from processing such covered information for 
any other purpose; and 
‘‘(B) complies with all of the requirements 
of this Act.’’. 
SEC. 3. UNFAIR OR DECEPTIVE ACTS OR PRACTICES. 
Section 1303 of the Children’s Online Privacy Protec-
tion Act of 1998 (15 U.S.C. 6502) is amended— 
(1) in the section heading, by striking ‘‘COL-
LECTION
AND
USE
OF
PERSONAL
INFORMA-
TION
FROM
AND
ABOUT
CHILDREN
ON
THE 
INTERNET’’ and inserting ‘‘PROCESSING OF COV-
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
ERED INFORMATION FROM AND ABOUT YOUNG 
CONSUMERS OR CHILDREN’’; 
(2) by amending subsection (a) to read as fol-
lows: 
‘‘(a) ACTS PROHIBITED.—It is unlawful for a covered 
entity that has actual or constructive knowledge that such 
covered entity is processing covered information about a 
young consumer or child to process such information in 
a manner that violates the regulations prescribed under 
subsection (b).’’; 
(3) by amending subsection (b) to read as fol-
lows: 
‘‘(b) IN GENERAL.—Not later than 1 year after the 
date of enactment of the Protecting the Information of 
our Vulnerable Children and Youth Act, the Commission 
shall, under section 553 of title 5, United States Code, 
revise regulations issued under this Act prior to such date 
of enactment and issue additional regulations as necessary 
that implement the requirements and prohibitions set 
forth in paragraphs (1) through (7). The Commission 
shall have the authority to revise such regulations every 
7 years or as it determines necessary due to changes in 
or emerging technology. 
‘‘(1) TRANSPARENCY.—Such regulations shall 
require a covered entity to develop and make pub-
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
licly available at all times and in a machine-readable 
format, a privacy policy, in a manner that is clear, 
easily understood, and written in plain and concise 
language, that includes— 
‘‘(A) the categories of covered information 
that the covered entity processes about young 
consumers and children; 
‘‘(B) how and under what circumstances 
covered information is collected directly from a 
young consumer or child; 
‘‘(C) the categories and the sources of any 
covered information processed by a covered en-
tity that is not collected directly from a young 
consumer or child; 
‘‘(D) a description of the purposes for 
which the covered entity processes covered in-
formation, including— 
‘‘(i) a description of whether and how 
the covered entity customizes products or 
services, or adjusts the prices of products 
or services for young consumers or chil-
dren or based in any part on processing of 
covered information; 
‘‘(ii) a description of whether and how 
the covered entity, or the covered entity’s 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
affiliates or service providers, de-identifies 
information, including the methods used to 
de-identify such information; and 
‘‘(iii) a description of whether and 
how the covered entity, or the covered enti-
ty’s affiliates or service providers, gen-
erates or uses any consumer score to make 
decisions concerning a young consumer or 
child, and the source or sources of any 
such consumer score; 
‘‘(E) a description of how long and the cir-
cumstances under which the covered entity re-
tains covered information; 
‘‘(F) a description of all of the purposes 
for which the covered entity discloses covered 
information with service providers and, on a bi-
ennial basis, the categories of service providers; 
‘‘(G) a description of whether and for what 
purposes the covered entity discloses informa-
tion to third parties; 
‘‘(H) whether a covered entity sells or oth-
erwise shares covered information with data 
brokers or processes covered information for 
targeted advertising; 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(I) whether a covered entity collects cov-
ered information about young consumers or 
children over time and across different websites 
or mobile applications when a young consumer 
or child uses the covered entity’s website or mo-
bile application; 
‘‘(J) how a young consumer or a parent of 
a child can exercise their rights to access, cor-
rect, and delete such young consumer’s or 
child’s covered information as set forth under 
paragraph (5); 
‘‘(K) how a young consumer or a parent of 
a child can grant, withhold, or withdraw the 
consent required under paragraph (2), including 
how to modify consent for the processing of 
covered information, and the consequences of 
withholding, withdrawing, or modifying such 
consent; 
‘‘(L) the effective date of the notice; and 
‘‘(M) how the covered entity will commu-
nicate material changes of the privacy policy to 
the young consumer or the parent of a child. 
‘‘(2) CONSENT REQUIRED.— 
‘‘(A) IN GENERAL.—Such regulations shall 
require a covered entity that has actual or con-
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
structive knowledge that such covered entity is 
processing covered information about a young 
consumer or child— 
‘‘(i) to provide clear and concise no-
tice to a young consumer or the parent of 
a child of the items of covered information 
about such young consumer or child, re-
spectively, that is processed by such cov-
ered entity and how such covered entity 
processes such covered information and ob-
tain verifiable consent for such processing; 
and 
‘‘(ii) if such covered entity determines, 
including through constructive knowledge, 
that such covered entity has not obtained 
verifiable consent for the processing of cov-
ered information about a young consumer 
or child, to, not later than 48 hours after 
such determination— 
‘‘(I) obtain verifiable consent; or 
‘‘(II) delete all covered informa-
tion about such young consumer or 
child. 
‘‘(B) WHEN CONSENT NOT REQUIRED.— 
Such regulations shall provide that verifiable 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
consent under this paragraph is not required in 
the case of— 
‘‘(i) online contact information col-
lected from a young consumer or child 
that— 
‘‘(I) is used only to respond di-
rectly on a one-time basis to a specific 
request from the young consumer or 
child; 
‘‘(II) is not used to re-contact the 
young consumer or child; and 
‘‘(III) is not retained by the cov-
ered entity after responding as de-
scribed in subclause (I); 
‘‘(ii) a request for the name or online 
contact information of a young consumer 
or the parent of a child that is used for the 
sole purpose of obtaining verifiable consent 
or providing notice under subparagraph 
(A)(i) and where such information is not 
retained by the covered entity if verifiable 
consent is not obtained within 48 hours; or 
‘‘(iii) the processing of such informa-
tion by the covered entity is necessary— 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(I) to respond to judicial proc-
ess; or 
‘‘(II) to the extent permitted 
under other provisions of law, to pro-
vide information to law enforcement 
agencies or for an investigation on a 
matter related to public safety. 
‘‘(C) WITHDRAWAL
OF
CONSENT.—Such 
regulations shall further provide a young con-
sumer or the parent of a child, as applicable, a 
mechanism to withdraw his or her consent at 
any time in a manner that is as easy as the 
mechanism to give consent. Such withdrawal of 
consent shall not be construed to affect the law-
fulness of any processing based on verifiable 
consent before such withdrawal. 
‘‘(D) PROHIBITION ON LIMITING OR DIS-
CONTINUING SERVICE.—Such regulations shall 
prohibit a covered entity from refusing to pro-
vide a service, or discontinuing a service pro-
vided, to a young consumer or child, if the 
young consumer or parent of the child, as appli-
cable, refuses to consent, or withdraws consent, 
to the processing of any covered information 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
not essential to the covered entity to provide 
such service. 
‘‘(3) RETENTION OF DATA.— 
‘‘(A) RETENTION
LIMITATIONS.—Subject 
to the exceptions provided in subparagraph (B), 
such regulations shall prohibit a covered entity 
from keeping, retaining, or otherwise storing 
covered information for longer than is reason-
ably necessary for the purposes for which the 
covered information is processed. 
‘‘(B) EXCEPTIONS.—Further retention of 
covered information shall not be considered to 
be incompatible with the purposes of processing 
described in subparagraph (A) if such proc-
essing is necessary and done solely for the pur-
poses of— 
‘‘(i) compliance with laws, regulations, 
or other legal obligations; 
‘‘(ii) preventing risks to the health or 
safety of a child or young adults or groups 
of children or young adults; or 
‘‘(iii) repairing errors that impair ex-
isting functionality. 
‘‘(4) LIMITATION ON DISCLOSING COVERED IN-
FORMATION TO THIRD PARTIES.— 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(A) 
DISCLOSURES.—Such 
regulations 
shall prohibit a covered entity from disclosing 
covered information to a third party unless the 
covered entity has a written agreement with 
such third party that— 
‘‘(i) specifies all of the purposes for 
which the third party may process the cov-
ered information for which the covered en-
tity has verifiable consent; 
‘‘(ii) prohibits the third party from 
processing covered information for any 
purpose other than the purposes specified 
under clause (i); and 
‘‘(iii) requires the third party to pro-
vide at least the same privacy and security 
protections as the covered entity; or 
‘‘(B) RESPONSIBILITIES OF COVERED EN-
TITIES REGARDING THIRD PARTIES.—Such reg-
ulations shall require a covered entity— 
‘‘(i) to perform reasonable due dili-
gence in selecting any third party to enter 
into an agreement under subparagraph (A) 
and to exercise reasonable oversight over 
all such third parties to assure compliance 
with the requirements of this Act; and 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(ii) if the covered entity has actual 
or constructive knowledge that a third 
party has violated the agreement described 
in subparagraph (A) to— 
‘‘(I) to the extent practicable, 
promptly take steps to ensure compli-
ance with such agreement; and 
‘‘(II) promptly report to the 
Commission that such a violation oc-
curred. 
‘‘(5) RIGHT TO ACCESS, CORRECT, AND DELETE 
COVERED INFORMATION.— 
‘‘(A) ACCESS.—Such regulations shall re-
quire a covered entity, upon request of a young 
consumer or the parent of a child and after 
proper identification of such young consumer or 
parent, to promptly provide to such young con-
sumer or parent, as applicable— 
‘‘(i) access to all covered information 
pertaining to such young consumer or child 
including a description of— 
‘‘(I) each type of covered infor-
mation processed by the covered enti-
ty pertaining to the young consumer 
or child, as applicable; 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(II) each purpose for which the 
covered entity processes each category 
of covered information pertaining to 
the young consumer or child, as appli-
cable; 
‘‘(III) the names of each third 
party to which the covered entity dis-
closed the covered information; 
‘‘(IV) each source other than the 
young consumer or child, as applica-
ble, from which the covered entity ob-
tained covered information pertaining 
to that young consumer or child, as 
applicable; 
‘‘(V) how long the covered infor-
mation will be retained or stored by 
the covered entity and, if not known, 
the criteria the covered entity uses to 
determine how long the covered infor-
mation will be retained or stored by 
the covered entity; and 
‘‘(VI) with respect to any con-
sumer score of the young consumer or 
child, as applicable, processed by the 
covered entity, of— 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(aa) how such consumer 
score is used by the covered enti-
ty to make decisions with respect 
to that young consumer or child, 
as applicable; and 
‘‘(bb) the source that cre-
ated the consumer score if not 
created by the covered entity; 
and 
‘‘(ii) a simple and reasonable mecha-
nism by which a young consumer or parent 
of a child may request access to the infor-
mation described under clause (i), as appli-
cable. 
‘‘(B) DELETION.—Such regulations shall 
require a covered entity, subject to the excep-
tions established under subparagraph (D)— 
‘‘(i) to establish a simple and reason-
able mechanism by which a young con-
sumer or parent of a child with respect to 
whom the covered entity processes covered 
information may request the covered entity 
to delete any covered information (or any 
component thereof); and 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(ii) to delete such covered informa-
tion not later than 45 days after receiving 
such request. 
‘‘(C) CORRECTION.—Such regulations shall 
require a covered entity, subject to the excep-
tions established under subparagraph (D)— 
‘‘(i) to provide each young consumer 
or parent of a child with respect to whom 
the covered entity processes covered infor-
mation, as applicable, a simple and reason-
able mechanism by which that young con-
sumer or parent may submit a request to 
the entity— 
‘‘(I) to dispute the accuracy or 
completeness of that covered informa-
tion, or part or component thereof; 
and 
‘‘(II) to request that such cov-
ered information, or part or compo-
nent thereof, be corrected for accuracy 
or completeness; and 
‘‘(ii) not later than 45 days after re-
ceiving a request under clause (i)— 
‘‘(I) to determine whether the 
covered information disputed or re-
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
quested to be corrected is inaccurate 
or incomplete; and 
‘‘(II) to correct the accuracy or 
completeness of any covered informa-
tion determined by the covered entity 
to be inaccurate or incomplete. 
‘‘(D) 
EXCEPTIONS.—Such 
regulations 
shall permit a covered entity to deny a request 
made under subparagraphs (A), (B), or (C) if— 
‘‘(i) the covered entity is unable to 
verify the identity of the young consumer 
or parent of a child making the request 
after making a reasonable effort to verify 
the identity of such young consumer or 
parent; or 
‘‘(ii) with respect to the request made, 
the covered entity determines that— 
‘‘(I) the entity is limited from 
doing so by law, legally recognized 
privilege, or other legal obligation; or 
‘‘(II) fulfilling the request would 
create a legitimate risk to the privacy, 
security, or safety of someone other 
than the young consumer or child, as 
applicable; or 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(iii) with respect to a request to cor-
rect covered information made under sub-
paragraph (C) or a request to delete cov-
ered information made under subpara-
graph (D), the covered entity determines 
that the retention of the covered informa-
tion is necessary to— 
‘‘(I) complete the transaction 
with the young consumer or child, as 
applicable, for which the covered in-
formation was collected; 
‘‘(II) provide a product or service 
affirmatively requested by the young 
consumer or parent of a child, as ap-
plicable; 
‘‘(III) perform a contract with 
the young consumer or a parent of a 
child, as applicable, including a con-
tract for billing, financial reporting, or 
accounting; 
‘‘(IV) to keep a record of the cov-
ered information for law enforcement 
purposes; or 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(V) identify and repair errors 
that impair the functionality of the 
Internet website or online service; or 
‘‘(iv) the covered information is used 
in public or peer-reviewed scientific, med-
ical, or statistical research in the public in-
terest that adheres to commonly accepted 
ethical standards or laws, with informed 
consent consistent with section 50.20 of 
title 21, Code of Federal Regulations, pro-
vided that the research must already be in 
progress at the time of request to access, 
correct, or delete is made under subpara-
graphs (A), (B), or (C). 
‘‘(E) PROHIBITION ON LIMITING OR DIS-
CONTINUING SERVICE.—Such regulations shall 
prohibit a covered entity from refusing to pro-
vide a service, or discontinuing a service pro-
vided, to a young consumer or child, if the 
young consumer or parent of the child, as appli-
cable, exercises any of the rights set forth in 
regulations under this paragraph. 
‘‘(6) 
ADDITIONAL
PROHIBITED
PRACTICES 
WITH RESPECT TO YOUNG CONSUMERS AND CHIL-
DREN.— 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(A) IN GENERAL.—Such regulations shall 
prohibit a covered entity from— 
‘‘(i) processing any covered informa-
tion in a manner that is inconsistent with 
what a reasonable young consumer or par-
ent of a child would expect in the context 
of a particular transaction or the young 
consumer’s or parent’s relationship with 
such covered entity or seeking to obtain 
verifiable consent for such processing; 
‘‘(ii) providing targeting advertise-
ments or engaging in other marketing to a 
specific child, based on that child’s covered 
information or behavior, or based on the 
covered information or behavior of children 
who are similar to that child in gender, in-
come level, age, race, or ethnicity; and 
‘‘(iii) conditioning the participation of 
a child in a game, sweepstakes, or other 
contest on consenting to the processing of 
more covered information than is necessary 
for such child to participate. 
‘‘(B) EXCEPTIONS.—Nothing in subpara-
graph (A) shall prohibit a covered entity from 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
processing covered information if necessary 
solely for purposes of— 
‘‘(i) detecting and preventing security 
incidents; 
‘‘(ii) preventing imminent danger to 
the personal safety of an individual or 
group of individuals; 
‘‘(iii) identifying and repairing errors 
that impair the functionality of the Inter-
net website or online service; or 
‘‘(iv) complying with any Federal, 
State, or local law, rule, regulation, or 
other legal obligation, including civil, crimi-
nal, or regulatory inquiries, investigations, 
subpoenas, disclosures of information re-
quired by a court order or other properly 
executed compulsory process. 
‘‘(C) 
DE-IDENTIFIED
INFORMATION.— 
Such regulations shall prohibit a covered entity 
that de-identifies information, and any third 
party with which the covered entity discloses 
such de-identified information, from re-identi-
fying, or attempting to re-identify, any informa-
tion that the covered entity has de-identified. 
Such regulations shall also require a covered 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
entity to contractually prohibit any third party 
with which the covered entity discloses such de- 
identified information from re-identifying or at-
tempting to re-identify such information. 
‘‘(7) SECURITY REQUIREMENTS.— 
‘‘(A) IN GENERAL.—Such regulations shall 
require a covered entity to establish and imple-
ment reasonable security policies, practices, and 
procedures for the treatment and protection of 
covered information, taking into consider-
ation— 
‘‘(i) the size, nature, scope, and com-
plexity of the activities engaged in by such 
covered entity; 
‘‘(ii) the sensitivity of any covered in-
formation at issue; 
‘‘(iii) the state of the art in adminis-
trative, technical, and physical safeguards 
for protecting such information; and 
‘‘(iv) the cost of implementing such 
policies, practices, and procedures. 
‘‘(B) 
SPECIFIC
REQUIREMENTS.—Such 
regulations shall require the policies, practices, 
and procedures established pursuant to regula-
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
tions issued under subparagraph (A) to include 
the following: 
‘‘(i) A written security policy with re-
spect to the processing of such covered in-
formation. 
‘‘(ii) The identification of an officer or 
other individual as the point of contact 
with responsibility for the management of 
information security. 
‘‘(iii) A process for identifying and as-
sessing 
any 
reasonably 
foreseeable 
vulnerabilities in the system or systems 
maintained by such covered entity that 
contains such covered information, includ-
ing regular monitoring for a breach of se-
curity of such system or systems. 
‘‘(iv) A process for taking preventive 
and corrective action to mitigate against 
any vulnerabilities identified in the process 
required by clause (iii), which may in-
clude— 
‘‘(I) implementing any changes to 
the security practices, architecture, in-
stallation, or implementation of net-
work or operating software; and 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(II) regular testing or otherwise 
monitoring the effectiveness of the 
safeguards. 
‘‘(v) A process for determining if the 
covered information is no longer needed 
and deleting such covered information by 
shredding, permanently erasing, or other-
wise modifying the covered information 
contained in such data to make such cov-
ered information permanently unreadable 
or indecipherable. 
‘‘(vi) A process for overseeing persons 
who have access to covered information, in-
cluding through Internet-connected devices, 
by— 
‘‘(I) taking reasonable steps to 
select and retain persons that are ca-
pable of maintaining appropriate safe-
guards for the covered information or 
Internet-connected devices at issue; 
and 
‘‘(II) requiring all such persons 
to implement and maintain such secu-
rity measures. 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(vii) A process for employee training 
and supervision for implementation of the 
policies, practices, and procedures required 
by this subsection. 
‘‘(viii) A written plan or protocol for 
internal and public response in the event of 
a breach of security. 
‘‘(C) PERIODIC
ASSESSMENT
AND
CON-
SUME
PRIVACY
AND
DATA
SECURITY
MOD-
ERNIZATION.—Such regulations shall require a 
covered entity, not less frequently than every 12 
months, to monitor, evaluate, and adjust, as ap-
propriate, the policies, practices, and procedures 
of such covered entity in light of any relevant 
changes in— 
‘‘(i) technology; 
‘‘(ii) internal or external threats and 
vulnerabilities to covered information; and 
‘‘(iii) the changing business arrange-
ments of the covered entity. 
‘‘(D) SUBMISSION
OF
POLICIES
TO
THE 
FTC.—Such regulations shall require a covered 
entity to submit the policies, practices, and pro-
cedures of the covered entity to the Commission 
in conjunction with a notification of a breach of 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
security required by any Federal or State stat-
ute or regulation or upon request of the Com-
mission.’’; and 
(4) in subsection (c)— 
(A) by inserting ‘‘subsection (a)(2) or’’ 
after ‘‘violation of’’; and 
(B) by striking ‘‘under subsection (a)’’ and 
inserting ‘‘under subsection (b)’’. 
SEC. 4. REPEAL OF SAFE HARBORS PROVISION AND CON-
FORMING AMENDMENTS. 
(a) IN GENERAL.—Section 1304 of the Children’s 
Online Privacy Protection Act of 1998 (15 U.S.C. 6503) 
is repealed. 
(b) CONFORMING AMENDMENTS.—The Children’s 
Online Privacy Protection Act of 1998 (15 U.S.C. 6501 
et seq.) is amended— 
(1) by striking ‘‘operator’’ each place it appears 
and inserting ‘‘covered entity’’; 
(2) in section 1303(c), by striking ‘‘sections 
1304 and 1306’’ and inserting ‘‘section 1306’’; and 
(3) in section 1305(b), by striking paragraph 
(3). 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
SEC. 5. ADMINISTRATION AND APPLICABILITY OF ACT. 
(a) ENFORCEMENT BY FEDERAL TRADE COMMIS-
SION.—Section 1306(d) of the Children’s Online Privacy 
Protection Act of 1998 (15 U.S.C. 6505(d)) is amended— 
(1) in the first sentence, by striking ‘‘this title. 
Any entity’’ and inserting ‘‘this title, and any enti-
ty’’; 
(2) by striking ‘‘The Commission shall prevent’’ 
and inserting the following: 
‘‘(1) IN GENERAL.—Except as provided in para-
graphs (2) through (4), the Commission shall pre-
vent’’; and 
(3) by adding at the end the following: 
‘‘(2) INCREASED CIVIL PENALTY AMOUNT.—In 
the case of a civil penalty under subsection (l) or 
(m) of section 5 of the Federal Trade Commission 
Act (15 U.S.C. 45) relating to acts or practices in 
violation of any provision of this title or a regulation 
prescribed under this title, the maximum dollar 
amount per violation shall be $63,795. 
‘‘(3) NATURE OF RELIEF AVAILABLE.—In any 
action commenced by the Commission under section 
19(a) of the Federal Trade Commission Act (15 
U.S.C. 57a(a)) to enforce this title, the Commission 
shall seek all appropriate relief described in sub-
section (b) of such section, and may, notwith-
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
standing such subsection, seek any exemplary or pu-
nitive damages.’’. 
(b) ENFORCEMENT
BY CERTAIN OTHER AGEN-
CIES.—Section 1306 of the Children’s Online Privacy Pro-
tection Act of 1998 (15 U.S.C. 6505) is further amend-
ed— 
(1) in subsection (b)— 
(A) in paragraph (1), by striking ‘‘, in the 
case of’’ and all that follows and inserting the 
following: ‘‘by the appropriate Federal banking 
agency, with respect to any insured depository 
institution (as those terms are defined in sec-
tion 3 of that Act (12 U.S.C. 1813));’’; 
(B) in paragraph (6), by striking ‘‘Federal 
land bank, Federal land bank association, Fed-
eral intermediate credit bank, or production 
credit association’’ and inserting ‘‘Farm Credit 
Bank, Agricultural Credit Bank (to the extent 
exercising the authorities of a Farm Credit 
Bank), Federal Land Credit Association, or ag-
ricultural credit association’’; and 
(C) by striking paragraph (2) and redesig-
nating paragraphs (3) through (6) as para-
graphs (2) through (5), respectively; and 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
(1) by redesignating sections 1307 and 1308 as 
sections 1308 and 1309, respectively; and 
(2) by inserting after section 1306 the fol-
lowing: 
‘‘SEC. 1307. PRIVATE RIGHT OF ACTION. 
‘‘(a) RIGHT OF ACTION.—Any parent of a young con-
sumer or parent of a child alleging a violation of this title 
or a regulation prescribed under this title with respect to 
the covered information of such young consumer or child 
may bring a civil action in any court of competent jurisdic-
tion. 
‘‘(b) INJURY IN FACT.—A violation of this Act or a 
regulation promulgated under this Act with respect to the 
covered information of a young consumer or child con-
stitutes an injury in fact to that young consumer or child. 
‘‘(c) RELIEF.—In a civil action brought under sub-
section (a) in which the plaintiff prevails, the court may 
award— 
‘‘(1) injunctive relief; 
‘‘(2) actual damages; 
‘‘(3) punitive damages; 
‘‘(4) reasonable attorney’s fees and costs; and 
‘‘(5) any other relief that the court determines 
appropriate. 
‘‘(d) PRE-DISPUTE ARBITRATION AGREEMENTS.— 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
‘‘(1) IN GENERAL.—No pre-dispute arbitration 
agreement or pre-dispute joint-action waiver shall be 
valid or enforceable with respect to any claim arising 
out of this Act or the regulations issued under this 
Act. 
‘‘(2) DETERMINATION.—A determination as to 
whether and how this Act applies to an arbitration 
agreement shall be determined under Federal law by 
the court, rather than the arbitrator, irrespective of 
whether the party opposing arbitration challenges 
such agreement specifically or in conjunction with 
any other term of the contract containing such 
agreement. 
‘‘(3) DEFINITIONS.—As used in this sub-
section— 
‘‘(A) the term ‘pre-dispute arbitration 
agreement’ means any agreement to arbitrate a 
dispute that has not arisen at the time of the 
making of the agreement; and 
‘‘(B) the term ‘pre-dispute joint-action 
waiver’ means an agreement, whether or not 
part of a pre-dispute arbitration agreement, 
that would prohibit, or waive the right of, one 
of the parties to the agreement to participate in 
a joint, class, or collective action in a judicial, 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS
arbitral, administrative, or other forum, con-
cerning a dispute that has not yet arisen at the 
time of the making of the agreement. 
‘‘(e) NON-WAIVEABILITY.—The rights and remedies 
provided under this Act may not be waived or limited by 
contract or otherwise.’’. 
SEC. 8. RELATIONSHIP TO OTHER LAW. 
Section 1306 of the Children’s Online Privacy Protec-
tion Act of 1998 (15 U.S.C. 6505) is further amended 
by adding at the end the following: 
‘‘(f) RELATIONSHIP TO OTHER LAW.—Nothing in 
this Act may be construed to modify, limit, or supersede 
the operation of any privacy or security provision in any 
other Federal statute or regulation.’’. 
SEC. 9. ADDITIONAL CONFORMING AMENDMENT. 
The heading of title XIII of division C of the Omni-
bus Consolidated and Emergency Supplemental Appro-
priations Act, 1999 (Public Law 105–277; 112 Stat. 
2681–728) is amended by inserting ‘‘AND YOUNG 
CONSUMER’S’’ after ‘‘CHILDREN’S’’. 
Æ 
VerDate Sep 11 2014 
02:06 Jan 30, 2020
Jkt 099200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6301
E:\BILLS\H5703.IH
H5703
pamtmann on DSKBC07HB2PROD with BILLS