under the principle of data minimization, requiring 
the operator to process only the minimum amount 
necessary for each purpose for which the covered in-
formation is processed. 
‘‘(2) TRANSPARENCY.—An operator of a chil-
dren’s service shall develop and make publicly avail-
able, at all times and in a machine-readable format, 
a privacy policy, in a manner that is clear, easily un-
derstood, and written in plain and concise language, 
that includes, with respect to operating the chil-
dren’s service— 
‘‘(A) the categories of covered information 
that the operator processes about teenagers and 
children; 
‘‘(B) how and under what circumstances 
covered information is collected directly from a 
teenager or child; 
‘‘(C) the categories and the sources of any 
covered information processed by the operator 
that is not collected directly from a teenager or 
child; 
‘‘(D) a description of the purposes for 
which the operator processes covered informa-
tion, including— 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(i) a description of whether and how 
the operator customizes products or serv-
ices for teenagers or children, or adjusts 
the prices of products or services for teen-
agers or children, based in any part on 
processing of covered information; 
‘‘(ii) a description of whether and how 
the operator, or the operator’s affiliates or 
service providers, de-identify information, 
including the methods used to de-identify 
such information; and 
‘‘(iii) a description of whether and 
how the operator, or the operator’s affili-
ates or service providers, generate or use 
any consumer score to make decisions con-
cerning a teenager or child, and the source 
or sources of any such consumer score; 
‘‘(E) a description of how long and the cir-
cumstances under which the operator retains 
covered information; 
‘‘(F) a description of all of the purposes 
for which the operator discloses covered infor-
mation to service providers and, on a biennial 
basis, the categories of service providers; 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(G) a description of whether and for what 
purposes the operator discloses covered infor-
mation to third parties, and the categories of 
covered information disclosed; 
‘‘(H) a description of the categories of 
third parties to which covered information de-
scribed in subparagraph (G) is disclosed, by 
category or categories of covered information 
for each category of third party to which the 
covered information is disclosed; 
‘‘(I) whether the operator discloses covered 
information to third parties that sell or plan to 
sell such covered information; 
‘‘(J) whether the operator collects covered 
information about teenagers or children over 
time and across different digital services if a 
teenager or child uses the operator’s digital 
service; 
‘‘(K) how a teenager or a parent of a child 
can exercise their rights to access, correct, and 
delete such teenager’s or child’s covered infor-
mation as set forth in paragraph (6); 
‘‘(L) a listing of all possible consents that 
may be obtained by the operator for the proc-
essing of covered information, how a teenager 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
or the parent of a child can grant, withhold, 
withdraw, or modify any such consent, and the 
consequences of withholding, withdrawing, or 
modifying any such consent; 
‘‘(M) the effective date of the privacy pol-
icy; and 
‘‘(N) how the operator will communicate 
material changes to the privacy policy to the 
teenager or the parent of a child. 
‘‘(3) CONSENT REQUIRED.— 
‘‘(A) IN GENERAL.—An operator of a chil-
dren’s service shall— 
‘‘(i) provide clear and concise notice 
to a teenager or the parent of a child of 
the items of covered information about 
such teenager or child, respectively, that 
are processed by such operator and how 
such operator processes such covered infor-
mation; 
‘‘(ii) obtain verifiable consent for such 
processing; and 
‘‘(iii) if such operator determines, in-
cluding through actual or constructive 
knowledge, that such operator has not ob-
tained verifiable consent for any specific 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
processing of covered information about a 
teenager or child, not later than 48 hours 
after such determination— 
‘‘(I) obtain verifiable consent; or 
‘‘(II) delete all covered informa-
tion about such teenager or child. 
‘‘(B) WHEN CONSENT NOT REQUIRED.— 
Verifiable consent under this paragraph is not 
required in the case of— 
‘‘(i) online contact information col-
lected from a teenager or child that— 
‘‘(I) is used only to respond di-
rectly on a one-time basis to a specific 
request from the teenager or child; 
‘‘(II) is not used to re-contact the 
teenager or child; and 
‘‘(III) is not retained by the op-
erator after responding as described 
in subclause (I); 
‘‘(ii) a request for the name or online 
contact information of a teenager or the 
parent of a child that is used for the sole 
purpose of obtaining verifiable consent or 
providing 
notice 
under 
subparagraph 
(A)(i), where such information is not re-
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
tained by the operator if verifiable consent 
is not obtained within 48 hours; or 
‘‘(iii) the processing of covered infor-
mation that is necessary— 
‘‘(I) to respond to judicial proc-
ess; or 
‘‘(II) to the extent permitted 
under other provisions of law, to pro-
vide information to law enforcement 
agencies or for an investigation on a 
matter related to public safety. 
‘‘(C) WITHDRAWAL OF CONSENT.— 
‘‘(i) 
MECHANISM
FOR
WITH-
DRAWAL.—An operator of a children’s 
service shall provide a teenager or the par-
ent of a child, as applicable— 
‘‘(I) a mechanism to withdraw 
consent to the processing of covered 
information at any time in a manner 
that is as easy as the mechanism to 
give consent; and 
‘‘(II) clear and conspicuous no-
tice of the mechanism required by 
subclause (I). 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(ii) EFFECT
OF
WITHDRAWAL
ON 
PRIOR
PROCESSING.—Withdrawal of con-
sent to the processing of covered informa-
tion shall not be construed to affect the 
lawfulness of any processing of covered in-
formation based on verifiable consent that 
was in effect before such withdrawal. 
‘‘(D) PROHIBITION ON LIMITING OR DIS-
CONTINUING SERVICE.—An operator of a chil-
dren’s service may not refuse to provide a serv-
ice, or discontinue a service provided, to a teen-
ager or child, if the teenager or parent of the 
child, as applicable, refuses to consent, or with-
draws consent, to the processing of any covered 
information not technically required for the op-
erator to provide such service. 
‘‘(4) RETENTION OF DATA.— 
‘‘(A) RETENTION
LIMITATIONS.—Subject 
to the exceptions provided in subparagraph (B), 
an operator of a children’s service may not 
keep, retain, or otherwise store covered infor-
mation for longer than is reasonably necessary 
for the purposes for which the covered informa-
tion is processed. 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(B) EXCEPTIONS.—Further retention of 
covered information does not violate subpara-
graph (A) if the processing of the covered infor-
mation is necessary and done solely for the pur-
poses of— 
‘‘(i) compliance with— 
‘‘(I) requirements to document 
compliance under this title; or 
‘‘(II) other laws, regulations, or 
legal obligations; 
‘‘(ii) preventing risks to the health or 
safety of a child or teenager or groups of 
children or teenagers; or 
‘‘(iii) repairing errors that impair the 
existing (as of the time when the repairs 
are made) functionality of the children’s 
service. 
‘‘(5) LIMITATION ON DISCLOSING COVERED IN-
FORMATION TO THIRD PARTIES.— 
‘‘(A) DISCLOSURES.—Subject to the excep-
tions provided in subparagraph (C), an operator 
of a children’s service may not disclose covered 
information to a third party unless the operator 
has a written agreement with such third party 
that— 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(i) specifies all of the purposes for 
which the third party may process the cov-
ered information for which the operator 
has verifiable consent; 
‘‘(ii) prohibits the third party from 
processing covered information for any 
purpose other than the purposes specified 
under clause (i); and 
‘‘(iii) requires the third party to pro-
vide at least the same level of privacy and 
security protections as the operator. 
‘‘(B) RESPONSIBILITIES
OF
OPERATORS 
REGARDING THIRD PARTIES.—An operator of a 
children’s service— 
‘‘(i) shall perform reasonable due dili-
gence in selecting any third party with 
which to enter into an agreement described 
in subparagraph (A) and shall exercise rea-
sonable oversight over all such third par-
ties to assure compliance with the require-
ments of this title and the regulations pro-
mulgated under this title; and 
‘‘(ii) if the operator has actual or con-
structive knowledge that a third party has 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
violated an agreement described in sub-
paragraph (A), shall— 
‘‘(I) to the extent practicable, 
promptly take steps to ensure compli-
ance with such agreement; and 
‘‘(II) promptly report to the 
Commission that such a violation oc-
curred. 
‘‘(C) EXCEPTIONS.—An operator of a chil-
dren’s service may disclose covered information 
to a third party other than under an agreement 
described in subparagraph (A) if such disclo-
sure is necessary and done solely for the pur-
poses of— 
‘‘(i) compliance with— 
‘‘(I) requirements to document 
compliance under this title; or 
‘‘(II) other laws, regulations, or 
legal obligations; 
‘‘(ii) preventing risks to the health or 
safety of a child or teenager or groups of 
children or teenagers; or 
‘‘(iii) repairing errors that impair the 
existing (as of the time when the repairs 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
are made) functionality of the children’s 
service. 
‘‘(6) RIGHT TO ACCESS, CORRECT, AND DELETE 
COVERED INFORMATION.— 
‘‘(A) ACCESS.—An operator of a children’s 
service, subject to the exceptions in subpara-
graph (D), shall, upon request of a teenager or 
the parent of a child and after proper identi-
fication of such teenager or parent, promptly 
provide to such teenager or parent, as applica-
ble— 
‘‘(i) access to all covered information 
processed by the operator pertaining to 
such teenager or child, including a descrip-
tion of— 
‘‘(I) each type of covered infor-
mation processed by the operator per-
taining to the teenager or child, as ap-
plicable; 
‘‘(II) each purpose for which the 
operator processes each category of 
covered information pertaining to the 
teenager or child, as applicable; 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(III) the names of each third 
party to which the operator disclosed 
the covered information; 
‘‘(IV) each source other than the 
teenager or child, as applicable, from 
which the operator obtained covered 
information pertaining to that teen-
ager or child, as applicable; 
‘‘(V) how long the covered infor-
mation will be retained or stored by 
the operator and, if not known, the 
criteria the operator uses to determine 
how long the covered information will 
be retained or stored by the operator; 
and 
‘‘(VI) with respect to any con-
sumer score of the teenager or child, 
as applicable, processed by the oper-
ator— 
‘‘(aa) how such score is used 
by the operator to make decisions 
with respect to that teenager or 
child, as applicable; and 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(bb) the source that cre-
ated the score if not created by 
the operator; and 
‘‘(ii) a simple and reasonable mecha-
nism by which a teenager or parent of a 
child may request access to the informa-
tion described under clause (i), as applica-
ble. 
‘‘(B) DELETION.—An operator of a chil-
dren’s service, subject to the exceptions in sub-
paragraph (D), shall— 
‘‘(i) establish a simple, publicly and 
easily accessible, and reasonable mecha-
nism by which a teenager or parent of a 
child with respect to whom the operator 
processes covered information may request 
the operator to delete any such covered in-
formation (or any component thereof), in-
cluding publicly available covered informa-
tion submitted to the service by the child 
or teenager; and 
‘‘(ii) delete such covered information 
not later than 45 days after receiving such 
request. 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(C) CORRECTION.—An operator of a chil-
dren’s service, subject to the exceptions in sub-
paragraph (D), shall— 
‘‘(i) provide each teenager or parent 
of a child with respect to whom the oper-
ator processes covered information, as ap-
plicable, a simple, publicly and easily ac-
cessible, and reasonable mechanism by 
which that teenager or parent may submit 
a request to the operator— 
‘‘(I) to dispute the accuracy or 
completeness of that covered informa-
tion, or part or component thereof; 
and 
‘‘(II) to request that such cov-
ered information, or part or compo-
nent thereof, be corrected for accuracy 
or completeness; and 
‘‘(ii) not later than 45 days after re-
ceiving a request under clause (i)— 
‘‘(I) determine whether the cov-
ered information disputed or re-
quested to be corrected is inaccurate 
or incomplete; and 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(II) correct the accuracy or 
completeness of any covered informa-
tion determined by the operator to be 
inaccurate or incomplete. 
‘‘(D) EXCEPTIONS.—An operator of a chil-
dren’s service may deny a request made under 
subparagraph (A), (B), or (C) if— 
‘‘(i) the operator is unable to verify 
the identity of the teenager or parent of a 
child making the request after making a 
reasonable effort to verify the identity of 
such teenager or parent; 
‘‘(ii) with respect to the request made, 
the operator determines that— 
‘‘(I) the operator is limited from 
fulfilling the request by law, legally 
recognized privilege, or other legal ob-
ligation; or 
‘‘(II) fulfilling the request would 
create a legitimate risk to the privacy, 
security, or safety of someone other 
than the teenager or child, as applica-
ble; 
‘‘(iii) with respect to a request to de-
lete covered information made under sub-
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
paragraph (B) or a request to correct cov-
ered information made under subpara-
graph (C), the operator determines that 
the retention of the covered information is 
necessary to— 
‘‘(I) complete the transaction 
with the teenager or child, as applica-
ble, for which the covered information 
was collected; 
‘‘(II) provide a product or service 
affirmatively requested by the teen-
ager or parent of a child, as applica-
ble; 
‘‘(III) perform a contract with 
the teenager or a parent of a child, as 
applicable, including a contract for 
billing, financial reporting, or account-
ing; 
‘‘(IV) keep a record of the cov-
ered information for law enforcement 
purposes; or 
‘‘(V) repair errors that impair 
the existing (as of the time when the 
repairs are made) functionality of the 
children’s service; or 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(iv) the covered information is used 
in public or peer-reviewed scientific, med-
ical, or statistical research in the public in-
terest that adheres to commonly accepted 
ethical standards or laws, with informed 
consent consistent with section 50.20 of 
title 21, Code of Federal Regulations, if 
the research is already in progress at the 
time when the request to access, delete, or 
correct is made under subparagraph (A), 
(B), or (C). 
‘‘(E) PROHIBITION ON LIMITING OR DIS-
CONTINUING SERVICE.—An operator of a chil-
dren’s service may not refuse to provide a serv-
ice, or discontinue a service provided, to a teen-
ager or child on the basis of the exercise by the 
teenager or the parent of the child, as applica-
ble, of any of the rights set forth in this para-
graph. 
‘‘(7) 
ADDITIONAL
PROHIBITED
PRACTICES 
WITH RESPECT TO TEENAGERS AND CHILDREN.— 
‘‘(A) IN GENERAL.—An operator of a chil-
dren’s service may not— 
‘‘(i) process any covered information 
in a manner that is inconsistent with what 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
a reasonable teenager or parent of a child 
would expect in the context of a particular 
transaction or the teenager’s or parent’s 
relationship with such operator, or seek to 
obtain verifiable consent for such proc-
essing; 
‘‘(ii) process any covered information 
in a manner that is harmful or has been 
shown to be detrimental to the well-being 
of children or teenagers; 
‘‘(iii) process covered information for 
the purpose of providing for targeted per-
sonalized advertising or engage in other 
marketing to a specific child or teenager or 
group of children or teenagers based on— 
‘‘(I) using the covered informa-
tion, online behavior, or group identi-
fiers of such child or teenager or of 
the children or teenagers in such 
group; or 
‘‘(II) using the covered informa-
tion or online behavior of children or 
teenagers who share characteristics 
with such child or teenager or with 
the children or teenagers in such 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
group, including income level or pro-
tected characteristics or proxies there-
of; 
‘‘(iv) condition the participation of a 
child or teenager in a game, sweepstakes, 
or other contest on consenting to the proc-
essing of more covered information than is 
necessary for such child or teenager to par-
ticipate; 
‘‘(v) engage in cross-device tracking of 
a child or teenager unless the child or 
teenager is logged in to a specific service, 
for the sole purpose of facilitating the pri-
mary purpose of the service or a specific 
feature thereof; 
‘‘(vi) engage in algorithmic processes 
that harmfully discriminate on the basis of 
race, age, gender, ability, or other pro-
tected characteristics; 
‘‘(vii) disclose biometric information, 
except to a service provider of the oper-
ator; 
‘‘(viii) disclose geolocation informa-
tion, except to a service provider of the op-
erator; or 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB