Sec. 2. Definitions. 
Sec. 3. Requirements for processing of covered information of children or teen-
agers. 
Sec. 4. Repeal of safe harbors provision. 
Sec. 5. Administration and applicability of Act. 
Sec. 6. Review. 
Sec. 7. Private right of action. 
Sec. 8. Relationship to other law. 
Sec. 9. Additional conforming amendment. 
Sec. 10. Youth Privacy and Marketing Division. 
Sec. 11. Commission defined. 
Sec. 12. Effective date. 
SEC. 2. DEFINITIONS. 
Section 1302 of the Children’s Online Privacy Protec-
tion Act of 1998 (15 U.S.C. 6501) is amended— 
(1) by striking paragraphs (5) and (10); 
(2) by redesignating paragraphs (2), (3), (4), 
(6), (7), (8), and (9) as paragraphs (3), (5), (6), 
(7), (8), (9), and (10), respectively; 
(3) by inserting after paragraph (1) the fol-
lowing: 
‘‘(2) TEENAGER.—The term ‘teenager’ means 
an individual over the age of 12 and under the age 
of 18.’’; 
(4) by striking paragraph (3) (as so redesig-
nated) and inserting the following: 
‘‘(3) COVERED ENTITY.—The term ‘covered en-
tity’ means— 
‘‘(A) any person over which the Commis-
sion has authority under section 5(a)(2) of the 
Federal Trade Commission Act (15 U.S.C. 
45(a)(2)); 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(B) any organization not organized to 
carry on business for its own profit or that of 
its members; and 
‘‘(C) any common carrier subject to the 
Communications Act of 1934 (47 U.S.C. 151 et 
seq.) and all Acts amendatory thereof and sup-
plementary thereto. 
‘‘(4) OPERATOR.—The term ‘operator’ means, 
with respect to a digital service, the covered entity 
that operates such service, to the extent the covered 
entity is engaged in operating such service or in 
processing covered information obtained in connec-
tion with such service.’’; 
(5) by amending paragraph (6) (as so redesig-
nated) to read as follows: 
‘‘(6) DISCLOSE.—The term ‘disclose’ means, 
with respect to covered information, to intentionally 
or unintentionally release, transfer, sell, disseminate, 
share, publish, lease, license, make available, allow 
access to, fail to restrict access to, or otherwise com-
municate such information.’’; 
(6) by amending paragraph (9) (as so redesig-
nated) to read as follows: 
‘‘(9) COVERED INFORMATION.—The term ‘cov-
ered information’— 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(A) means any information that is linked 
or reasonably linkable to a specific teenager or 
child or to a specific consumer device used 
mainly by a teenager or child; 
‘‘(B) may include— 
‘‘(i) a name, alias, home or other 
physical address, online identifier, Internet 
Protocol address, email address, account 
name, Social Security number, physical 
characteristics or description, telephone 
number, State identification card number, 
driver’s license number, passport number, 
or other similar identifier; 
‘‘(ii) actual or perceived race, religion, 
sex, sexual orientation, sexual behavior, fa-
milial status, gender identity, disability, 
age, political affiliation, or national origin; 
‘‘(iii) commercial information, includ-
ing records relating to personal property, 
products or services purchased, obtained, 
or considered, or other purchasing or con-
suming histories, interests, or tendencies; 
‘‘(iv) biometric information; 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(v) device identifiers, online identi-
fiers, persistent identifiers, or digital 
fingerprinting information; 
‘‘(vi) internet or other electronic net-
work activity information, including brows-
ing history, search history, and informa-
tion regarding a teenager’s or child’s inter-
action with an internet website, applica-
tion, or advertisement; 
‘‘(vii) geolocation information; 
‘‘(viii) audio, electronic, visual, ther-
mal, olfactory, or similar information; 
‘‘(ix) education information; 
‘‘(x) health information; 
‘‘(xi) facial recognition information; 
‘‘(xii) contents of, attachments to, and 
parties to information, including with re-
spect to electronic mail, text messages, pic-
ture messages, voicemails, audio conversa-
tions, and video conversations; 
‘‘(xiii) financial information, including 
bank account numbers, credit card num-
bers, debit card numbers, or insurance pol-
icy numbers; and 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(xiv) inferences drawn from any of 
the information described in this para-
graph to create a profile about a teenager 
or child reflecting the teenager’s or child’s 
preferences, characteristics, psychological 
trends, predispositions, behavior, attitudes, 
intelligence, abilities, or aptitudes; and 
‘‘(C) does not include— 
‘‘(i) information that is processed 
solely for the purpose of employment of a 
teenager; or 
‘‘(ii) de-identified information.’’; 
(7) by amending paragraph (10) (as so redesig-
nated) to read as follows: 
‘‘(10) 
VERIFIABLE
CONSENT.—The 
term 
‘verifiable consent’ means express, affirmative con-
sent freely given by a teenager, or by the parent of 
a child, to the processing of covered information of 
that teenager or child, respectively— 
‘‘(A) that is specific, informed, and unam-
biguous, taking into account the age and the 
developmental and cognitive needs and capabili-
ties of teenagers or parents of children, as ap-
plicable; 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(B) that is given separately for each un-
related processing activity; 
‘‘(C) where the teenager or parent of a 
child, as applicable, has not received any finan-
cial or other incentive in exchange for such con-
sent; 
‘‘(D) that is given before any processing 
occurs, at a time and in a context in which the 
teenager or parent of a child, as applicable, 
would reasonably expect to make choices con-
cerning such processing; 
‘‘(E) that is not obtained through the use 
of a design, modification, or manipulation of a 
user interface with the purpose or substantial 
effect of obscuring, subverting, or impairing 
user autonomy, decision making, or choice; and 
‘‘(F) that, in the case of consent to the 
processing of covered information of a child, is 
obtained in a manner that is reasonably cal-
culated to ensure that the individual giving con-
sent is the parent of the child.’’; and 
(8) by adding at the end the following: 
‘‘(13) PROCESS.—The term ‘process’ means to 
perform any operation or set of operations on cov-
ered information, whether or not by automated 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
means, including collecting, creating, acquiring, dis-
closing, sharing, classifying, sorting, recording, de-
riving, inferring, obtaining, assembling, organizing, 
structuring, storing, retaining, adapting or altering, 
using, or retrieving covered information. 
‘‘(14) DE-IDENTIFIED INFORMATION; RE-IDEN-
TIFY.— 
‘‘(A) DE-IDENTIFIED INFORMATION.—The 
term ‘de-identified information’ means informa-
tion that cannot reasonably be used to infer in-
formation about, or otherwise be linked to, a 
specific teenager or child or specific consumer 
device of a teenager or child, if the covered enti-
ty that possesses the information— 
‘‘(i) takes reasonable measures to en-
sure that the information cannot be associ-
ated with a teenager or child; 
‘‘(ii) publicly commits to maintain and 
use the information in de-identified form 
and not to attempt to re-identify the infor-
mation, except for the purpose of testing 
the sufficiency of the de-identification 
measures; and 
‘‘(iii) contractually obligates any enti-
ty to which the covered entity discloses the 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
information to comply with clauses (i) and 
(ii). 
‘‘(B) RE-IDENTIFY.—The term ‘re-identify’ 
means to link information that has been de- 
identified to a specific teenager or child or spe-
cific consumer device of a teenager or child. 
‘‘(15) STATE.—The term ‘State’ means each of 
the several States, the District of Columbia, each 
territory of the United States, and each federally 
recognized Indian Tribe. 
‘‘(16) SERVICE PROVIDER.—The term ‘service 
provider’ means a covered entity that— 
‘‘(A) processes covered information at the 
direction of, and for the sole benefit of, another 
covered entity; and 
‘‘(B) is contractually or legally prohibited 
from processing such covered information for 
any other purpose. 
‘‘(17) DIGITAL
SERVICE.—The term ‘digital 
service’ means a website, online service, online appli-
cation, mobile application, or any other service that 
processes covered information digitally. 
‘‘(18) CHILDREN’S SERVICE.—The term ‘chil-
dren’s service’ means— 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(A) a digital service or portion thereof 
that is directed to children; or 
‘‘(B) any other digital service or portion 
thereof, if the operator of the service decides to 
treat all users of the service or portion, as the 
case may be, as children. 
‘‘(19) PRIVACY RISK.—The term ‘privacy risk’ 
means potential adverse consequences to an indi-
vidual, group of individuals, or society arising from 
the processing of covered information, including— 
‘‘(A) physical harm; 
‘‘(B) psychological or emotional harm; 
‘‘(C) negative or harmful outcomes or deci-
sions with respect to an individual’s eligibility 
for rights, benefits, or opportunities; 
‘‘(D) reputational and dignity harm; 
‘‘(E) financial harm, including price dis-
crimination; 
‘‘(F) inconvenience or expenditure of time; 
‘‘(G) disruption and intrusion from un-
wanted communications or contacts; 
‘‘(H) other effects that limit an individ-
ual’s choices, influence an individual’s re-
sponses, or predetermine results or outcomes 
for that individual; and 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(I) other demonstrable adverse con-
sequences that affect an individual’s private 
life, including private family matters, actions, 
and communications within an individual’s 
home or similar physical, online, or digital loca-
tion. 
‘‘(20) PRIVACY AND SECURITY IMPACT ASSESS-
MENT AND MITIGATION (PSIAM).— 
‘‘(A) IN
GENERAL.—The terms ‘privacy 
and security impact assessment and mitigation’ 
and ‘PSIAM’ mean, with respect to a digital 
service, an assessment and mitigation by the 
operator of the service of risks to the children 
and teenagers who access the service that arise 
from the processing of covered information, tak-
ing into account privacy risks, security risks, 
the rights and best interests of children and 
teenagers, differing ages, capacities, and devel-
opmental needs of children and teenagers, and 
any significant internal or external emerging 
risks, and ensuring that the PSIAM builds in 
risk mitigation and compliance with the other 
requirements of this title. 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(B) REQUIREMENTS.—In conducting a 
PSIAM with respect to a digital service, the op-
erator of the service shall do the following: 
‘‘(i) Embed the PSIAM into the de-
sign process of the service and complete 
the PSIAM before the launch of the service 
and on an ongoing basis, and before mak-
ing significant changes to the processing of 
covered information. 
‘‘(ii) Publicly disclose the nature, 
scope, context, and purposes of the proc-
essing of covered information. 
‘‘(iii) Depending on the size of the 
service and level of risks identified— 
‘‘(I) seek and document the views 
of children, teenagers, and parents (or 
their representatives), as well as ex-
perts in children’s and teenagers’ de-
velopmental needs; and 
‘‘(II) take such views into ac-
count in the design of the service. 
‘‘(iv) Publicly disclose an explanation 
of why the operator’s processing of covered 
information is necessary and proportionate 
vis a vis the risks for the service, and how 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
the operator complies with the require-
ments of this title. 
‘‘(v) Assess any processing of covered 
information that is not in the best inter-
ests of children or teenagers or that can be 
detrimental to their well-being and safety, 
whether 
physical, 
emotional, 
develop-
mental, or material. 
‘‘(vi) Identify, assess, and mitigate 
high-risk processing of covered informa-
tion. 
‘‘(vii) Identify measures taken to miti-
gate the risks identified under clause (vi) 
and comply with the other requirements of 
this title. 
‘‘(viii) Provide for regular internal re-
porting on the effectiveness of controls and 
residual risks of the operator. 
‘‘(C) AUDITABLE
BY
COMMISSION.—The 
Commission may audit a PSIAM conducted by 
an operator as the Commission considers nec-
essary. 
‘‘(21) DIRECTED TO CHILDREN.— 
‘‘(A) IN GENERAL.—The term ‘directed to 
children’ means, with respect to a digital serv-
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(I) the composition of the audi-
ence of the digital service, including— 
‘‘(aa) data the operator of 
the digital service may directly or 
indirectly collect, use, profile, 
buy, sell, classify, or analyze (via 
algorithms or other forms of data 
analytics, 
including 
look-alike 
modeling) about a user or groups 
of users to estimate, identify, or 
classify the age or age range (or 
a proxy thereof) of such user or 
groups of users; 
‘‘(bb) advertising informa-
tion or results, such as data, re-
porting, or information from the 
internal communications of the 
operator of the digital service, in-
cluding documentation about its 
advertising practices, such as an 
advertisement insertion order, or 
other promotional material to 
marketers, that indicates that 
covered information is being col-
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
lected from children that are 
using the digital service; 
‘‘(cc) data or reporting from 
the general or trade press of the 
digital service indicating that 
children are using the digital 
service; 
‘‘(dd) complaints from par-
ents or other third parties about 
child users using the digital serv-
ice, whether through the com-
plaint mechanism of the digital 
service, by email, or by other 
means; and 
‘‘(ee) data or reporting from 
a privacy and security impact as-
sessment and mitigation, compli-
ance program, or other compli-
ance, risk management, or inter-
nal process that documents pri-
vacy risks and controls related to 
children’s privacy, including the 
existence of data analytics con-
trolled by the operator of the dig-
ital service, including those of 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
service providers, and content 
analytics capabilities and func-
tions or outputs; and 
‘‘(II) the intended audience of 
the digital service, including data the 
operator of the digital service directly 
or indirectly collects, uses, profiles, 
buys, sells, classifies, or analyzes (via 
algorithms or other forms of data 
analytics, including look-alike mod-
eling) about the nature of the content 
of the digital service that estimates, 
identifies, or classifies the content as 
child-directed or similarly estimates, 
identifies, or classifies the intended or 
likely audience for the content; 
‘‘(x) representations to third parties 
relating to the composition of the audience 
or the intended audience of the digital 
service; 
‘‘(xi) actual knowledge that the digital 
service is processing the covered informa-
tion of children; or 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(xii) any other evidence or cir-
cumstances the Commission determines ap-
propriate. 
‘‘(B) 
COVERED
INFORMATION
FROM 
OTHER
SERVICES.—A digital service shall be 
deemed to be directed to children if the oper-
ator of the digital service has actual or con-
structive knowledge that the digital service col-
lects covered information from users of any 
other digital service that is directed to children 
under the criteria described in subparagraph 
(A). 
‘‘(C) SIGNALS FROM THIRD PARTIES.—A 
digital service shall be deemed directed to chil-
dren if the digital service receives a signal, such 
as a flag or other formal industry standard or 
convention, from another digital service on 
which the digital service receiving the signal is 
embedded, indicating that the digital service 
sending the signal is intended for children or 
likely to appeal to children. 
‘‘(D) LIMITATION.—A digital service that 
does not target children as its primary audience 
shall not be deemed directed to children if the 
digital service— 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(i) does not collect covered informa-
tion from any visitor prior to collecting age 
information; and 
‘‘(ii) prevents the collection, use, or 
disclosure of covered information from visi-
tors who identify themselves as under age 
13 without first complying with the notice 
and parental consent provisions of this title 
and the regulations promulgated under 
this title. 
‘‘(E) FURTHER
LIMITATION.—A digital 
service shall not be deemed directed to children 
solely because the digital service refers or links 
to another digital service that is directed to 
children by using information location tools, in-
cluding a directory, index, reference, pointer, or 
hypertext link. 
‘‘(F) DETERMINATION REGARDING A POR-
TION OF A DIGITAL SERVICE.—For purposes of 
determining whether a portion of a digital serv-
ice is directed to children, any reference in this 
paragraph to a digital service shall be consid-
ered to refer to such portion. 
‘‘(22) LIKELY TO BE ACCESSED BY CHILDREN 
OR TEENAGERS.—The term ‘likely to be accessed by 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB
children or teenagers’ means, with respect to a dig-
ital service, that the possibility of more than a de 
minimis number of children or teenagers accessing 
the digital service is more probable than not. In de-
termining whether a digital service is likely to be 
accessed by children or teenagers, the operator of 
the service shall consider whether the service has 
particular appeal to children or teenagers and 
whether effective measures are in place that prevent 
children or teenagers from gaining access to the 
service. 
‘‘(23) AGE ASSURANCE.—The term ‘age assur-
ance’ means a verifiable process to estimate or de-
termine the age of a user of a digital service with 
a given and documented degree of certainty.’’. 
SEC. 3. REQUIREMENTS FOR PROCESSING OF COVERED IN-
FORMATION OF CHILDREN OR TEENAGERS. 
(a) IN GENERAL.—Section 1303 of the Children’s 
Online Privacy Protection Act of 1998 (15 U.S.C. 6502) 
is amended to read as follows: 
‘‘SEC. 1303. REQUIREMENTS FOR PROCESSING OF COVERED 
INFORMATION OF CHILDREN OR TEENAGERS. 
‘‘(a) REQUIREMENTS FOR CHILDREN’S SERVICES.— 
‘‘(1) DATA MINIMIZATION.—An operator of a 
children’s service shall process covered information 
VerDate Sep 11 2014 
06:01 Apr 28, 2023
Jkt 039200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H2801.IH
H2801
pbinns on DSKJLVW7X2PROD with $$_JOB