(B) by striking paragraph (2) and redesig-
nating paragraphs (3) through (6) as para-
graphs (2) through (5), respectively; and 
(2) by adding at the end the following new sub-
section: 
‘‘(f) TELECOMMUNICATIONS CARRIERS AND CABLE 
OPERATORS.— 
‘‘(1) ENFORCEMENT
BY
COMMISSION.—Not-
withstanding section 5(a)(2) of the Federal Trade 
Commission Act (15 U.S.C. 45(a)(2)), compliance 
with the requirements imposed under this title shall 
be enforced by the Commission with respect to any 
telecommunications carrier (as defined in section 3 
of the Communications Act of 1934 (47 U.S.C. 
153)). 
‘‘(2) RELATIONSHIP TO OTHER LAW.—To the 
extent that section 222, 338(i), or 631 of the Com-
munications Act of 1934 (47 U.S.C. 222; 338(i); 
551) is inconsistent with this title, this title con-
trols.’’. 
SEC. 4. FAIR INFORMATION PRACTICES PRINCIPLES. 
The Fair Information Practices Principles described 
in this section are the following: 
(1) COLLECTION LIMITATION PRINCIPLE.—Ex-
cept as provided in paragraph (3), personal informa-
VerDate Sep 11 2014 
18:36 Jun 04, 2018
Jkt 079200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H5930.IH
H5930
pbinns on DSK79D2C42PROD with BILLS
tion should be collected from a minor only when col-
lection of the personal information is— 
(A) consistent with the context of a par-
ticular transaction or service or the relationship 
of the minor with the operator, including collec-
tion necessary to fulfill a transaction or provide 
a service requested by the minor; or 
(B) required or specifically authorized by 
law. 
(2) DATA QUALITY PRINCIPLE.—The personal 
information of a minor should be accurate, complete, 
and kept up-to-date to the extent necessary to fulfill 
the purposes described in subparagraphs (A) 
through (D) of paragraph (3). 
(3) PURPOSE SPECIFICATION PRINCIPLE.—The 
purposes for which personal information is collected 
should be specified to the minor not later than at 
the time of the collection of the information. The 
subsequent use or disclosure of the information 
should be limited to— 
(A) fulfillment of the transaction or service 
requested by the minor; 
(B) support for the internal operations of 
the website, service, or application, as described 
in section 312.2 of title 16, Code of Federal 
VerDate Sep 11 2014 
18:36 Jun 04, 2018
Jkt 079200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H5930.IH
H5930
pbinns on DSK79D2C42PROD with BILLS
Regulations, excluding any activity relating to 
targeted marketing directed to children, minors, 
or connected devices; 
(C) compliance with legal process or other 
purposes expressly authorized under specific 
legal authority; or 
(D) other purposes— 
(i) that are specified in a notice to the 
minor; and 
(ii) to which the minor has consented 
under paragraph (7) before the informa-
tion is used or disclosed for such other 
purposes. 
(4) RETENTION LIMITATION PRINCIPLE.—The 
personal information of a minor should not be re-
tained for longer than is necessary to fulfill a trans-
action or provide a service requested by the minor 
or such other purposes specified in subparagraphs 
(A) through (D) of paragraph (3). The operator 
should implement a reasonable and appropriate data 
disposal policy based on the nature and sensitivity of 
such personal information. 
(5) SECURITY
SAFEGUARDS
PRINCIPLE.—The 
personal information of a minor should be protected 
by reasonable and appropriate security safeguards 
VerDate Sep 11 2014 
18:36 Jun 04, 2018
Jkt 079200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H5930.IH
H5930
pbinns on DSK79D2C42PROD with BILLS
against risks such as loss or unauthorized access, 
destruction, use, modification, or disclosure. 
(6) OPENNESS PRINCIPLE.— 
(A) IN
GENERAL.—The operator should 
maintain a general policy of openness about de-
velopments, practices, and policies with respect 
to the personal information of a minor. The op-
erator should provide each minor using the 
website, online service, online application, or 
mobile application of the operator with a clear 
and prominent means— 
(i) to identify and contact the oper-
ator, by, at a minimum, disclosing, clearly 
and prominently, the identity of the oper-
ator and— 
(I) in the case of an operator 
who is an individual, the address of 
the principal residence of the operator 
and an email address and telephone 
number for the operator; or 
(II) in the case of any other op-
erator, the address of the principal 
place of business of the operator and 
an email address and telephone num-
ber for the operator; 
VerDate Sep 11 2014 
18:36 Jun 04, 2018
Jkt 079200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H5930.IH
H5930
pbinns on DSK79D2C42PROD with BILLS
(ii) to determine whether the operator 
possesses any personal information of the 
minor, the nature of any such information, 
and the purposes for which the information 
was collected and is being retained; 
(iii) to obtain any personal informa-
tion of the minor that is in the possession 
of the operator from the operator, or from 
a person specified by the operator, within 
a reasonable time after making a request, 
at a charge (if any) that is not excessive, 
in a reasonable manner, and in a form that 
is readily intelligible to the minor; 
(iv) to challenge the accuracy of per-
sonal information of the minor that is in 
the possession of the operator; and 
(v) if the minor establishes the inaccu-
racy of personal information in a challenge 
under clause (iv), to have such information 
erased, corrected, completed, or otherwise 
amended. 
(B) LIMITATION.—Nothing in this para-
graph shall be construed to permit an operator 
to erase or otherwise modify personal informa-
VerDate Sep 11 2014 
18:36 Jun 04, 2018
Jkt 079200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H5930.IH
H5930
pbinns on DSK79D2C42PROD with BILLS
tion requested by a law enforcement agency 
pursuant to legal authority. 
(7) INDIVIDUAL
PARTICIPATION
PRINCIPLE.— 
The operator should— 
(A) obtain consent from a minor before 
using or disclosing the personal information of 
the minor for any purpose other than the pur-
poses described in subparagraphs (A) through 
(C) of paragraph (3); and 
(B) obtain affirmative express consent 
from a minor before using or disclosing pre-
viously collected personal information of the 
minor for purposes that constitute a material 
change in practice from the original purposes 
specified to the minor under paragraph (3). 
SEC. 5. DIGITAL MARKETING BILL OF RIGHTS FOR MINORS. 
(a) ACTS PROHIBITED.—It is unlawful for an oper-
ator of a website, online service, online application, or mo-
bile application directed to minors, or an operator having 
actual knowledge that personal information being collected 
is from a minor, to collect personal information from a 
minor unless such operator has adopted and complies with 
a Digital Marketing Bill of Rights for Minors that is con-
sistent with the Fair Information Practices Principles de-
scribed in section 4. 
VerDate Sep 11 2014 
18:36 Jun 04, 2018
Jkt 079200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H5930.IH
H5930
pbinns on DSK79D2C42PROD with BILLS
(b) REGULATIONS.—Not later than 1 year after the 
date of enactment of this Act, the Commission shall pro-
mulgate, under section 553 of title 5, United States Code, 
regulations to implement this section, including regula-
tions further defining the Fair Information Practices 
Principles described in section 4. 
SEC. 6. TARGETED MARKETING TO CHILDREN OR MINORS. 
(a) ACTS PROHIBITED.—It is unlawful for— 
(1) an operator of a website, online service, on-
line application, mobile application, or connected de-
vice directed to children, or an operator having ac-
tual knowledge that personal information being col-
lected is from a child or a connected device of a 
child, to use, disclose to third parties, or compile 
personal information for purposes of targeted mar-
keting; or 
(2) an operator of a website, online service, on-
line application, mobile application, or connected de-
vice directed to minors, or an operator having actual 
knowledge that personal information being collected 
is from a minor or a connected device of a minor, 
to use, disclose to third parties, or compile personal 
information for purposes of targeted marketing with-
out the verifiable consent of the minor. 
VerDate Sep 11 2014 
18:36 Jun 04, 2018
Jkt 079200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H5930.IH
H5930
pbinns on DSK79D2C42PROD with BILLS
(b) REGULATIONS.—Not later than 1 year after the 
date of enactment of this Act, the Commission shall pro-
mulgate, under section 553 of title 5, United States Code, 
regulations to implement this section. 
SEC. 7. REMOVAL OF CONTENT. 
(a) ACTS PROHIBITED.—It is unlawful for an oper-
ator to make publicly available through a website, online 
service, online application, or mobile application content 
or information that contains or displays personal informa-
tion of children or minors in a manner that violates a reg-
ulation prescribed under subsection (b). 
(b) REGULATIONS.— 
(1) IN GENERAL.—Not later than 1 year after 
the date of enactment of this Act, the Commission 
shall promulgate, under section 553 of title 5, 
United States Code, regulations that require an op-
erator— 
(A) to the extent technologically feasible, 
to implement mechanisms that permit a user of 
the website, online service, online application, or 
mobile application of the operator to erase or 
otherwise eliminate content or information that 
is— 
VerDate Sep 11 2014 
18:36 Jun 04, 2018
Jkt 079200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H5930.IH
H5930
pbinns on DSK79D2C42PROD with BILLS
(i) submitted to the website, online 
service, online application, or mobile appli-
cation by that user; 
(ii) publicly available through the 
website, online service, online application, 
or mobile application; and 
(iii) contains or displays personal in-
formation of children or minors; and 
(B) to take appropriate steps to make 
users aware of the mechanisms described in 
subparagraph (A) and to provide notice to users 
that the mechanisms do not necessarily provide 
comprehensive removal of the content or infor-
mation submitted by users. 
(2) EXCEPTION.—The regulations promulgated 
under paragraph (1) may not require an operator or 
third party to erase or otherwise eliminate content 
or information that— 
(A) any other provision of Federal or State 
law requires the operator or third party to 
maintain; or 
(B) was submitted to the website, online 
service, online application, or mobile application 
of the operator by any person other than the 
user who is attempting to erase or otherwise 
VerDate Sep 11 2014 
18:36 Jun 04, 2018
Jkt 079200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H5930.IH
H5930
pbinns on DSK79D2C42PROD with BILLS
eliminate the content or information, including 
content or information submitted by the user 
that was republished or resubmitted by another 
person. 
(3) LIMITATION.—Nothing in this section shall 
be construed to limit the authority of a law enforce-
ment agency to obtain any content or information 
from an operator as authorized by law or pursuant 
to an order of a court of competent jurisdiction. 
SEC. 8. PRIVACY DASHBOARD FOR CONNECTED DEVICES 
FOR CHILDREN AND MINORS. 
(a) IN GENERAL.—A manufacturer of a connected 
device shall prominently display on the packaging for the 
connected device a standardized and easy-to-understand 
privacy dashboard, detailing whether, what, and how per-
sonal information of a child or minor is— 
(1) collected from the connected device; 
(2) transmitted from the connected device; 
(3) retained on the connected device; 
(4) retained by the manufacturer or affiliated 
person; 
(5) used by the manufacturer or affiliated per-
son; and 
(6) protected. 
VerDate Sep 11 2014 
18:36 Jun 04, 2018
Jkt 079200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H5930.IH
H5930
pbinns on DSK79D2C42PROD with BILLS
(b) FEATURES.—A privacy dashboard under sub-
section (a) shall inform a consumer of— 
(1) the extent to which the connected device 
meets the highest cybersecurity and data security 
standards, including if and how to obtain security 
patches; 
(2) the extent to which the connected device 
gives— 
(A) a parent meaningful control over the 
information of a child of the parent; and 
(B) a minor meaningful control over the 
information of the minor; 
(3) the extent to which the device minimizes the 
collection, retention, and use of information from a 
child or minor; 
(4) the location of privacy policies; 
(5) the type of personal information the con-
nected device may collect; and 
(6) any other information as the Commission 
considers appropriate. 
(c) REGULATIONS.—Not later than 1 year after the 
date of enactment of this Act, the Commission shall pro-
mulgate, under section 553 of title 5, United States Code, 
regulations to implement this section. 
VerDate Sep 11 2014 
18:36 Jun 04, 2018
Jkt 079200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H5930.IH
H5930
pbinns on DSK79D2C42PROD with BILLS
SEC. 9. PROHIBITION ON SALE OF CONNECTED DEVICES 
FOR CHILDREN AND MINORS THAT FAIL TO 
MEET APPROPRIATE CYBERSECURITY AND 
DATA SECURITY STANDARDS. 
(a) PROHIBITION.—Beginning 1 year after the date 
of enactment of this Act, or such earlier date as the Com-
mission considers appropriate, no person may sell a con-
nected device unless the connected device meets appro-
priate cybersecurity and data security standards estab-
lished by the Commission. 
(b) CYBERSECURITY AND DATA SECURITY STAND-
ARDS.— 
(1) IN GENERAL.—The Commission shall pro-
mulgate, under section 553 of title 5, United States 
Code, cybersecurity and data security standards de-
scribed in subsection (a). 
(2) CONSIDERATIONS.—In promulgating cyber-
security and data security standards under para-
graph (1), the Commission shall— 
(A) create cybersecurity and data security 
standards for different subsets of connected de-
vices based on the varying degrees of— 
(i) cybersecurity and data security 
risk associated with each subset of con-
nected device; 
VerDate Sep 11 2014 
18:36 Jun 04, 2018
Jkt 079200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H5930.IH
H5930
pbinns on DSK79D2C42PROD with BILLS