118 
(e) REQUIREMENTS.—In carrying out the pilot pro-
gram established under subsection (b), the Commission 
shall— 
(1) receive input from private, public, and aca-
demic stakeholders; and 
(2) develop ongoing public and private sector 
engagement, in consultation with the Secretary of 
Commerce, to disseminate voluntary, consensus- 
based resources to increase the integration of pri-
vacy-enhancing technologies in data collection, shar-
ing, and analytics by the public and private sectors. 
(f) CONCLUSION OF PILOT PROGRAM.—The Commis-
sion shall terminate the pilot program established under 
subsection (b) not later than 10 years after the commence-
ment of the program. 
(g) STUDY REQUIRED.— 
(1) IN GENERAL.—The Comptroller General of 
the United States shall conduct a study— 
(A) to assess the progress of the pilot pro-
gram established under subsection (b); 
(B) to determine the effectiveness of using 
privacy-enhancing technologies at the Commis-
sion to support oversight of the data security 
practices of covered entities; and 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00118
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
119 
(C) to develop recommendations to improve 
and advance privacy-enhancing technologies, in-
cluding by improving communication and co-
ordination between covered entities and the 
Commission to increase implementation of pri-
vacy-enhancing technologies by such entities 
and the Commission. 
(2) INITIAL BRIEFING.—Not later than 3 years 
after the date of the enactment of this Act, the 
Comptroller General shall brief the Committee on 
Energy and Commerce of the House of Representa-
tives and the Committee on Commerce, Science, and 
Transportation of the Senate on the initial results of 
the study conducted under paragraph (1). 
(3) FINAL REPORT.—Not later than 240 days 
after the date on which the briefing required by 
paragraph (2) is conducted, the Comptroller General 
shall submit to the Committee on Energy and Com-
merce of the House of Representatives and the Com-
mittee on Commerce, Science, and Transportation of 
the Senate a final report setting forth the results of 
the study conducted under paragraph (1), including 
the recommendations developed under subparagraph 
(C) of such paragraph. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00119
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
120 
(h) AUDIT OF COVERED ENTITIES.—The Commis-
sion shall, on an ongoing basis, audit covered entities who 
have been accepted to be part of the pilot program estab-
lished under subsection (b) to determine whether such a 
covered entity is maintaining the use and implementation 
of privacy-enhancing technologies to secure covered data. 
(i) WITHDRAWAL FROM THE PILOT PROGRAM.—If at 
any time the Commission determines that a covered entity 
accepted to be a part of the pilot program established 
under subsection (b) is no longer maintaining the use of 
privacy-enhancing technologies, the Commission shall no-
tify the covered entity of the determination of the Commis-
sion to withdraw approval for the covered entity to be a 
part of the pilot program and the basis for doing so. Not 
later than 180 days after the date on which a covered enti-
ty receives such notice, the covered entity may cure any 
alleged deficiency with the use of privacy-enhancing tech-
nologies and submit each proposed cure to the Commis-
sion. If the Commission determines that such cures elimi-
nate alleged deficiencies with the use of privacy-enhancing 
technologies, the Commission may not withdraw the ap-
proval of the covered entity to be a part of the pilot pro-
gram on the basis of such deficiencies. 
(j) LIMITATIONS ON LIABILITY.—Any covered entity 
that petitions, and is accepted, to be part of the pilot pro-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00120
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
121 
gram established under subsection (b), actively imple-
ments and maintains the use of privacy-enhancing tech-
nologies, and is determined by the Commission to be in 
compliance with the program shall— 
(1) for any action under section 115 or 116 for 
a violation of section 109, be deemed to be in com-
pliance with section 109 with respect to the covered 
data subject to the privacy-enhancing technologies; 
and 
(2) for any action under section 117 for a viola-
tion of section 109, be entitled to a rebuttable pre-
sumption that such entity is in compliance with sec-
tion 109 with respect to the covered data subject to 
the privacy-enhancing technologies. 
SEC. 115. ENFORCEMENT BY FEDERAL TRADE COMMIS-
SION. 
(a) NEW BUREAU.— 
(1) IN GENERAL.—Subject to the availability of 
appropriations, the Commission shall establish, with-
in the Commission, a new bureau comparable in 
structure, size, organization, and authority to the ex-
isting bureaus within the Commission related to con-
sumer protection and competition. 
(2) MISSION.—The mission of the bureau es-
tablished under this subsection shall be to assist the 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00121
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
122 
Commission in exercising the authority of the Com-
mission under this title and related authorities. 
(3) STAFF.— 
(A) IN GENERAL.—In staffing the bureau 
established under this subsection, the Commis-
sion shall ensure the allocation of full time em-
ployees or full time employee equivalents that 
include attorneys, economists, investigators, 
technologists, and mental health professionals 
with experience in the well-being of children 
and teens. 
(B) TECHNOLOGIST
DEFINED.—For the 
purposes of this paragraph, the term ‘‘tech-
nologist’’ means an individual with training and 
expertise with respect to technology, including 
state-of-the art information technology, network 
or data security, hardware or software develop-
ment, privacy-enhancing technologies, cryptog-
raphy, computer science, data science, adver-
tising technology, web tracking, machine learn-
ing, and other related fields and applications. 
(4) TIMELINE.—The bureau established under 
this subsection shall be established, staffed, and fully 
operational not later than 180 days after the date of 
the enactment of this Act. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00122
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
123 
(b) ENFORCEMENT BY COMMISSION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of this title or a regulation pro-
mulgated under this title shall be treated as a viola-
tion of a rule defining an unfair or deceptive act or 
practice prescribed under section 18(a)(1)(B) of the 
Federal 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)). 
(2) POWERS OF COMMISSION.— 
(A) IN GENERAL.—Except as provided in 
paragraph (3) or otherwise provided in this 
title, the Commission shall enforce this title and 
the regulations promulgated under this title in 
the same manner, by the same means, and with 
the same jurisdiction, powers, and duties as 
though all applicable terms and provisions of 
the Federal Trade Commission Act (15 U.S.C. 
41 et seq.) were incorporated into and made a 
part of this title. 
(B) PRIVILEGES
AND
IMMUNITIES.—Any 
entity that violates this title or a regulation 
promulgated under this title shall be subject to 
the penalties and entitled to the privileges and 
immunities provided in the Federal Trade Com-
mission Act (15 U.S.C. 41 et seq.). 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00123
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
124 
(3) COMMON
CARRIERS
AND
NONPROFITS.— 
Notwithstanding section 4, 5(a)(2), or 6 of the Fed-
eral Trade Commission Act (15 U.S.C. 44; 45(a)(2); 
46) or any jurisdictional limitation of the Commis-
sion, the Commission shall also enforce this title, 
and the regulations promulgated under this title, in 
the same manner provided in paragraphs (1) and (2) 
of this subsection with respect to— 
(A) common carriers subject to title II of 
the Communications Act of 1934 (47 U.S.C. 
201 et seq.); and 
(B) organizations not organized to carry 
on business for their own profit or that of their 
members. 
(4) PENALTY
OFFSET
FOR
STATE
OR
INDI-
VIDUAL ACTIONS.—Any amount that a court orders 
an entity to pay in an action brought under this sub-
section shall be offset by any amount a court has or-
dered the entity to pay in an action brought against 
the entity for the same violation under section 116 
or 117. 
(5) PRIVACY AND SECURITY VICTIMS RELIEF 
FUND.— 
(A) ESTABLISHMENT OF VICTIMS RELIEF 
FUND.—There is established in the Treasury of 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00124
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
125 
the United States a separate fund to be known 
as the ‘‘Privacy and Security Victims Relief 
Fund’’ (in this paragraph referred to as the 
‘‘Victims Relief Fund’’). 
(B) DEPOSITS.—The Commission or the 
Attorney General of the United States, as appli-
cable, shall deposit into the Victims Relief Fund 
the amount of any civil penalty obtained in any 
civil action the Commission, or the Attorney 
General on behalf of the Commission, com-
mences to enforce this title or a regulation pro-
mulgated under this title. 
(C) USE OF FUND AMOUNTS.— 
(i) AVAILABILITY
TO
THE
COMMIS-
SION.—Notwithstanding section 3302 of 
title 31, United States Code, amounts in 
the Victims Relief Fund shall be available 
to the Commission, without fiscal year lim-
itation, to provide redress, damages, pay-
ments or compensation, or other monetary 
relief to persons affected by an act or prac-
tice for which civil penalties, other mone-
tary relief, or any other forms of relief (in-
cluding injunctive relief) have been ordered 
in a civil action or administrative pro-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00125
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
126 
ceeding the Commission commences, or in 
any civil action the Attorney General of the 
United States commences on behalf of the 
Commission, to enforce this title or a regu-
lation promulgated under this title. 
(ii) OTHER PERMISSIBLE USES.—To 
the extent that individuals cannot be lo-
cated or such redress, damages, payments 
or compensation, or other monetary relief 
are otherwise not practicable, the Commis-
sion may use amounts in the Victims Re-
lief Fund for the purpose of— 
(I) consumer or business edu-
cation relating to data privacy or data 
security; or 
(II) engaging in technological re-
search that the Commission considers 
necessary to implement this title, in-
cluding promoting privacy-enhancing 
technologies that promote compliance 
with this title. 
(D) CALCULATION.—Any amount that the 
Commission provides to a person as redress, 
payments or compensation, or other monetary 
relief under subparagraph (C) with respect to a 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00126
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
127 
violation by an entity shall be offset by any 
amount the person received from an action 
brought against the entity for the same viola-
tion under section 116 or 117. 
(E) RULE
OF
CONSTRUCTION.—Amounts 
collected and deposited in the Victims Relief 
Fund may not be construed to be Government 
funds or appropriated monies and may not be 
subject to apportionment for the purpose of 
chapter 15 of title 31, United States Code, or 
under any other authority. 
(c) REPORT.— 
(1) IN GENERAL.—Not later than 4 years after 
the date of the enactment of this Act, and annually 
thereafter, the Commission shall submit to Congress 
a report describing investigations conducted during 
the prior year with respect to violations of this title, 
including— 
(A) the number of such investigations the 
Commission commenced; 
(B) the number of such investigations the 
Commission closed with no official agency ac-
tion; 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00127
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
128 
(C) the disposition of such investigations, 
if such investigations have concluded and re-
sulted in official agency action; and 
(D) for each investigation that was closed 
with no official agency action, the industry sec-
tors of the covered entities subject to each in-
vestigation. 
(2) PRIVACY PROTECTIONS.—A report required 
under paragraph (1) may not include the identity of 
any person who is the subject of an investigation or 
any other information that identifies such a person. 
(3) ANNUAL PLAN.—Not later than 540 days 
after the date of the enactment of this Act, and an-
nually thereafter, the Commission shall submit to 
Congress a plan for the next calendar year describ-
ing the projected activities of the Commission under 
this title, including— 
(A) the policy priorities of the Commission 
and any changes to the previous policy prior-
ities of the Commission; 
(B) any rulemaking proceedings projected 
to be commenced, including any such pro-
ceedings to amend or repeal a rule; 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00128
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
129 
(C) any plans to develop, update, or with-
draw guidelines or guidance required under this 
title; 
(D) any plans to restructure the Commis-
sion; and 
(E) projected dates and timelines, or 
changes to projected dates and timelines, asso-
ciated with any of the requirements under this 
title. 
SEC. 116. ENFORCEMENT BY STATES. 
(a) CIVIL ACTION.— 
(1) IN GENERAL.—In any case in which the at-
torney general of a State, the chief consumer protec-
tion officer of a State, or an officer or office of a 
State authorized to enforce privacy or data security 
laws applicable to covered entities or service pro-
viders has reason to believe that an interest of the 
residents of the State has been or is adversely af-
fected by the engagement of any entity in an act or 
practice that violates this title or a regulation pro-
mulgated under this title, the attorney general, chief 
consumer protection officer, or other authorized offi-
cer or office of the State may bring a civil action in 
the name of the State, or as parens patriae on be-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00129
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
130 
half of the residents of the State, in an appropriate 
Federal district court of the United States to— 
(A) enjoin such act or practice; 
(B) enforce compliance with this title or 
the regulations promulgated under this title; 
(C) obtain civil penalties; 
(D) obtain damages, restitution, or other 
compensation on behalf of the residents of the 
State; 
(E) obtain reasonable attorney’s fees and 
other litigation costs reasonably incurred; or 
(F) obtain such other relief as the court 
may consider to be appropriate. 
(2) LIMITATION.—In any case with respect to 
which the attorney general of a State, the chief con-
sumer protection officer of a State, or an officer or 
office of a State authorized to enforce privacy or 
data security laws applicable to covered entities or 
service providers brings an action under paragraph 
(1), no other officer or office of the same State may 
institute a civil action under paragraph (1) against 
the same defendant for the same violation of this 
title or regulation promulgated under this title. 
(b) RIGHTS OF THE COMMISSION.— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00130
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
131 
(1) IN
GENERAL.—Except if not feasible, a 
State officer shall notify the Commission in writing 
prior to initiating a civil action under subsection (a). 
Such notice shall include a copy of the complaint to 
be filed to initiate such action. Upon receiving such 
notice, the Commission may intervene in such action 
and, upon intervening— 
(A) be heard on all matters arising in such 
action; and 
(B) file petitions for appeal of a decision in 
such action. 
(2) NOTIFICATION TIMELINE.—If not feasible 
for a State officer to provide the notification re-
quired by paragraph (1) before initiating a civil ac-
tion under subsection (a), the State officer shall no-
tify the Commission immediately after initiating the 
civil action. 
(c) ACTIONS BY THE COMMISSION.—In any case in 
which a civil action is instituted by or on behalf of the 
Commission for a violation of this title or a regulation pro-
mulgated under this title, no attorney general of a State, 
chief consumer protection officer of a State, or officer or 
office of a State authorized to enforce privacy or data se-
curity laws may, during the pendency of such action, insti-
tute a civil action against any defendant named in the 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00131
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
132 
complaint in the action instituted by or on behalf of the 
Commission for a violation of this title or a regulation pro-
mulgated under this title that is alleged in such complaint. 
(d) INVESTIGATORY POWERS.—Nothing in this title 
may be construed to prevent the attorney general of a 
State, the chief consumer protection officer of a State, or 
an officer or office of a State authorized to enforce privacy 
or data security laws applicable to covered entities or serv-
ice providers from exercising the powers conferred on such 
officer or office to conduct investigations, to administer 
oaths or affirmations, or to compel the attendance of wit-
nesses or the production of documentary or other evidence. 
(e) VENUE; SERVICE OF PROCESS.— 
(1) VENUE.—Any action brought under sub-
section (a) may be brought in any Federal district 
court of the United States that meets applicable re-
quirements relating to venue under section 1391 of 
title 28, United States Code. 
(2) SERVICE
OF
PROCESS.—In an action 
brought under subsection (a), process may be served 
in any district in which the defendant— 
(A) is an inhabitant; or 
(B) may be found. 
(f) GAO STUDY.— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00132
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
133 
(1) IN GENERAL.—The Comptroller General of 
the United States shall conduct a study of the prac-
tice of State attorneys general hiring, or otherwise 
contracting with, outside firms to assist in enforce-
ment efforts pursuant to this title, which shall in-
clude the study of— 
(A) the frequency with which each State 
attorney general hires or contracts with outside 
firms to assist in such enforcement efforts; 
(B) the contingency fees, hourly rates, and 
other costs of hiring or contracting with outside 
firms; 
(C) the types of matters for which outside 
firms are hired or contracted; 
(D) the bid and selection process for such 
outside firms, including reviews of conflicts of 
interest; 
(E) the practices State attorneys general 
set in place to protect sensitive information that 
would become accessible by outside firms while 
the outside firms are assisting in such enforce-
ment efforts; 
(F) the percentage of monetary recovery 
that is returned to victims and the percentage 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00133
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
134 
of such recovery that is retained by outside 
firms; and 
(G) the market average for the hourly rate 
of hired or contracted attorneys in each market. 
(2) REPORT.—Not later than 1 year after the 
date of the enactment of this Act, the Comptroller 
General shall submit to the Committee on Energy 
and Commerce of the House of Representatives and 
the Committee on Commerce, Science, and Trans-
portation of the Senate a report on the results of the 
study conducted under paragraph (1). 
(g) PRESERVATION OF STATE POWERS.—Except as 
provided in subsections (a)(2) and (c), no provision of this 
section may be construed as altering, limiting, or affecting 
the authority of a State attorney general, the chief con-
sumer protection officer of a State, or an officer or office 
of a State authorized to enforce laws applicable to covered 
entities or service providers to— 
(1) bring an action or other regulatory pro-
ceeding arising solely under the laws in effect in 
such State; or 
(2) exercise the powers conferred on the attor-
ney general, chief consumer protection officer, or of-
ficer or office by the laws of such State, including 
the ability to conduct investigations, to administer 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00134
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
135 
oaths or affirmations, or to compel the attendance of 
witnesses or the production of documentary or other 
evidence. 
(h) CALCULATION.—Any amount that a court orders 
an entity to pay to a person under this section shall be 
offset by any amount the person received from an action 
brought against the entity for the same violation under 
section 115 or 117. 
SEC. 117. ENFORCEMENT BY PERSONS. 
(a) CIVIL ACTION.— 
(1) IN GENERAL.—Subject to subsections (b) 
and (c), a person may bring a civil action against a 
covered entity or service provider for a violation of 
subsection (b) or (c) of section 102, subsection (a) 
or (e) of section 104, section 105, subsection (a) or 
(b)(2) of section 106, section 107, section 108, sec-
tion 109 to the extent such action alleges a data 
breach arising from a violation of subsection (a) of 
such section, subsection (d) of section 111, or sub-
section (c)(4) of section 112, or a regulation promul-
gated thereunder, in an appropriate Federal district 
court of the United States. 
(2) RELIEF.— 
(A) IN
GENERAL.—In a civil action 
brought under paragraph (1) in which the 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00135
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
136 
plaintiff prevails, the court may award the 
plaintiff— 
(i) an amount equal to the sum of any 
actual damages; 
(ii) injunctive relief, including an 
order that an entity retrieve any covered 
data transferred in violation of this title; 
(iii) declaratory relief; and 
(iv) reasonable attorney fees and liti-
gation costs. 
(B) BIOMETRIC
AND
GENETIC
INFORMA-
TION.—In a civil action brought under para-
graph (1) for a violation of this title with re-
spect to section 102(c), in which the plaintiff 
prevails, if the conduct underlying the violation 
occurred primarily and substantially in Illinois, 
the court may award the plaintiff— 
(i) for a violation involving biometric 
information, the same relief as set forth in 
section 20 of the Biometric Information 
Privacy Act (740 ILCS 14/20), as such 
statute reads on December 31, 2024; or 
(ii) for a violation involving genetic in-
formation, the same relief as set forth in 
section 40 of the Genetic Information Pri-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00136
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
137 
vacy Act (410 ILCS 513/40), as such stat-
ute reads on December 31, 2024. 
(C) DATA SECURITY.— 
(i) IN
GENERAL.—In a civil action 
brought under paragraph (1) for a viola-
tion of this title alleging unauthorized ac-
cess of covered information as a result of 
a violation of section 109(a), in which the 
plaintiff prevails, the court may award a 
plaintiff who is a resident of California the 
same relief as set forth in section 
1798.150 of the California Civil Code, as 
such statute read on January 1, 2024. 
(ii) 
COVERED
INFORMATION
DE-
FINED.—For purposes of this subpara-
graph, the term ‘‘covered information’’ 
means the following: 
(I) A username, email address, or 
telephone number of an individual in 
combination with a password or secu-
rity question or answer that would 
permit access to an account held by 
the individual that contains or pro-
vides access to sensitive covered data. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00137
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
138 
(II) The first name or first initial 
of an individual and the last name of 
the individual in combination with 1 
or more of the following categories of 
sensitive covered data, if either the 
name or the sensitive covered data are 
not encrypted or redacted: 
(aa) A government-issued 
identifier described in section 
101(49)(A)(i). 
(bb) A financial account 
number 
described 
in 
section 
101(49)(A)(iv). 
(cc) Health information, but 
only to the extent such informa-
tion reveals the history of med-
ical treatment or diagnosis by a 
health care professional of the in-
dividual. 
(dd) Biometric information. 
(ee) Genetic information. 
(D) LIMITATIONS
ON
DUAL
ACTIONS.— 
Any amount that a court orders an entity to 
pay to a person under subparagraph (A)(i), 
(B), or (C) shall be offset by any amount the 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00138
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
139 
person received from an action brought against 
the entity for the same violation under section 
115 or 116. 
(b) OPPORTUNITY TO CURE IN ACTIONS FOR IN-
JUNCTIVE RELIEF.— 
(1) NOTICE.—Subject to paragraph (3), an ac-
tion for injunctive relief may be brought by a person 
under this section only if, prior to initiating such ac-
tion against an entity, the person provides to the en-
tity written notice identifying the specific provisions 
of this title the person alleges have been or are being 
violated. 
(2) EFFECT OF CURE.—In the event a cure is 
possible with respect to a violation alleged in a no-
tice described in paragraph (1) and, not later than 
60 days after the date of receipt of such notice, the 
entity cures such violation and provides the person 
an express written statement that the violation has 
been cured and that no further such violations shall 
occur, an action for injunctive relief may not be per-
mitted with respect to the noticed violation. 
(3) INJUNCTIVE RELIEF FOR A SUBSTANTIAL 
PRIVACY HARM.—Notice is not required under para-
graph (1) prior to bringing an action for injunctive 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00139
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
140 
relief for a violation that resulted in a substantial 
privacy harm. 
(c) NOTICE OF ACTIONS SEEKING ACTUAL DAM-
AGES.— 
(1) NOTICE.—Subject to paragraph (4), an ac-
tion under this section for actual damages may be 
brought by a person only if, 60 days prior to initi-
ating such action against an entity, the person pro-
vides the entity written notice identifying the specific 
provisions of this title the person alleges have been 
or are being violated. 
(2) SETTLEMENT.—An entity that receives a 
written notice from a person under paragraph (1) 
may settle with the person who sent the written no-
tice. 
(3) EFFECT OF SETTLEMENT.—In the event of 
a settlement under paragraph (2), the terms of such 
settlement shall govern any future action under this 
section for actual damages between the parties to 
the settlement that relates to the underlying facts 
that resulted in the settlement. 
(4) NO NOTICE REQUIRED FOR A SUBSTANTIAL 
PRIVACY HARM.—Notice is not required under para-
graph (1) prior to bringing an action for actual 
damages for a violation of this title that resulted in 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00140
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
141 
a substantial privacy harm, if such action includes a 
claim for a preliminary injunction or temporary re-
straining order. 
(d) PRE-DISPUTE ARBITRATION AGREEMENTS.— 
(1) IN GENERAL.—Notwithstanding any other 
provision of law, at the election of the person alleg-
ing a violation of this title, no pre-dispute arbitra-
tion agreement shall be valid or enforceable with re-
spect to— 
(A) a claim alleging a violation involving 
an individual under the age of 18; or 
(B) a claim alleging a violation that re-
sulted in a substantial privacy harm. 
(2) DETERMINATION OF APPLICABILITY.—Any 
issue as to whether this subsection applies to a dis-
pute shall be determined under Federal law. The ap-
plicability of this subsection to an agreement to arbi-
trate and the validity and enforceability of an agree-
ment to which this subsection applies shall be deter-
mined by a Federal court, rather than an arbitrator, 
irrespective of whether the party resisting arbitra-
tion challenges the arbitration agreement specifically 
or in conjunction with other terms of the contract 
containing the agreement, and irrespective of wheth-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00141
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
142 
er the agreement purports to delegate the deter-
mination to an arbitrator. 
(3) PRE-DISPUTE
ARBITRATION
AGREEMENT 
DEFINED.—For purposes of this subsection, the 
term ‘‘pre-dispute arbitration agreement’’ means any 
agreement to arbitrate a dispute that has not arisen 
at the time of the making of the agreement. 
(e) COMBINED NOTICES.—A person may combine the 
notices required by subsections (b)(1) and (c)(1) into a 
single notice, if the single notice complies with the require-
ments of each such subsection. 
(f) BAD FAITH.—If a person represented by counsel 
brings a civil action under this section against a covered 
entity or service provider requesting actual damages from 
the covered entity or service provider, and fails to provide 
notice to the covered entity or service provider in accord-
ance with this section, the action may be dismissed with-
out prejudice and may not be reinstated until the person 
has complied with the notice requirements of this section. 
SEC. 118. RELATION TO OTHER LAWS. 
(a) PREEMPTION OF STATE LAWS.— 
(1) CONGRESSIONAL INTENT.—The purposes of 
this section are to— 
(A) establish a uniform national privacy 
and data security standard in the United States 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00142
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
143 
to prevent administrative costs and burdens 
from being placed on interstate commerce; and 
(B) expressly preempt the laws of a State 
or political subdivision of a State as provided in 
this subsection. 
(2) PREEMPTION.—Except as provided in para-
graphs (3) and (4), no State or political subdivision 
of a State may adopt, maintain, enforce, impose, or 
continue in effect any law, regulation, rule, require-
ment, prohibition, standard, or other provision cov-
ered by the provisions of this title or a rule, regula-
tion, or requirement promulgated under this title. 
(3) STATE
LAW
PRESERVATION.—Paragraph 
(2) may not be construed to preempt, displace, or 
supplant the following State laws, rules, regulations, 
or requirements: 
(A) Consumer protection laws of general 
applicability, such as laws regulating deceptive, 
unfair, or unconscionable practices. 
(B) Civil rights laws. 
(C) Provisions of laws that address the pri-
vacy rights or other protections of employees or 
employee information. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00143
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
144 
(D) Provisions of laws that address the 
privacy rights or other protections of students 
or student information. 
(E) Provisions of laws, insofar as such pro-
visions address notification requirements in the 
event of a data breach. 
(F) Contract or tort law. 
(G) Criminal laws. 
(H) Civil laws regarding— 
(i) blackmail; 
(ii) stalking (including cyberstalking); 
(iii) cyberbullying; 
(iv) intimate images (whether authen-
tic or computer-generated) known to be 
nonconsensual; 
(v) child abuse; 
(vi) child sexual abuse material; 
(vii) child abduction or attempted 
child abduction; 
(viii) child trafficking; or 
(ix) sexual harassment. 
(I) Public safety or sector-specific laws un-
related to privacy or data security, but only to 
the extent such laws do not directly conflict 
with the provisions of this title. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00144
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
145 
(J) Provisions of laws that address public 
records, criminal justice information systems, 
arrest records, mug shots, conviction records, or 
non-conviction records. 
(K) Provisions of laws that address bank-
ing records, financial records, tax records, So-
cial Security numbers, credit cards, identity 
theft, credit reporting and investigations, credit 
repair, credit clinics, or check-cashing services. 
(L) Provisions of laws that address elec-
tronic surveillance, wiretapping, or telephone 
monitoring. 
(M) Provisions of laws that address unso-
licited email messages, telephone solicitation, or 
caller identification. 
(N) Provisions of laws that protect the pri-
vacy of health information, healthcare informa-
tion, medical information, medical records, HIV 
status, or HIV testing. 
(O) Provisions of laws that address the 
confidentiality of library records. 
(P) Provisions of laws that address the use 
of encryption as a means of providing data se-
curity. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00145
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
146 
(4) ADDITIONAL PREEMPTION LIMITATIONS.— 
Notwithstanding paragraph (2), the provisions of 
this title shall preempt any State law, rule, or regu-
lation that provides protections for children or teens 
only to the extent that such State law, rule, or regu-
lation conflicts with a provision of this title. Nothing 
in this title shall be construed to prohibit any State 
from enacting a law, rule, or regulation that pro-
vides greater protection to children or teens than the 
provisions of this title. 
(b) FEDERAL LAW PRESERVATION.— 
(1) IN GENERAL.—Nothing in this title or a 
regulation promulgated under this title may be con-
strued to limit— 
(A) the authority of the Commission, or 
any other Executive agency, under any other 
provision of law; 
(B) any requirement for a common carrier 
subject to section 64.2011 of title 47, Code of 
Federal Regulations (or any successor regula-
tion), regarding information security breaches; 
or 
(C) any other provision of Federal law, ex-
cept as otherwise provided in this title. 
(2) ANTITRUST SAVINGS CLAUSE.— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00146
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
147 
(A) ANTITRUST LAWS DEFINED.—For pur-
poses of this paragraph, the term ‘‘antitrust 
laws’’— 
(i) has the meaning given such term 
in subsection (a) of the first section of the 
Clayton Act (15 U.S.C. 12(a)); and 
(ii) includes section 5 of the Federal 
Trade Commission Act (15 U.S.C. 45), to 
the extent such section applies to unfair 
methods of competition. 
(B) FULL
APPLICATION
OF
THE
ANTI-
TRUST LAWS.—Nothing in this title or a regula-
tion promulgated under this title may be con-
strued to modify, impair, supersede the oper-
ation of, or preclude the application of the anti-
trust laws. 
(3) APPLICATION OF OTHER FEDERAL PRIVACY 
AND DATA SECURITY REQUIREMENTS.— 
(A) IN GENERAL.—To the extent that a 
covered entity or service provider is required to 
comply with any Federal law or regulation de-
scribed in subparagraph (B), such covered enti-
ty or service provider is not subject to this title 
with respect to the activities governed by the re-
quirements of such law or regulation. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00147
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
148 
(B) 
LAWS
AND
REGULATIONS
DE-
SCRIBED.—The Federal laws and regulations 
described in this subparagraph are the fol-
lowing: 
(i) Title V of the Gramm-Leach-Bliley 
Act (15 U.S.C. 6801 et seq.). 
(ii) Part C of title XI of the Social 
Security Act (42 U.S.C. 1320d et seq.). 
(iii) Subtitle D of the Health Informa-
tion Technology for Economic and Clinical 
Health Act (42 U.S.C. 17921 et seq.). 
(iv) The regulations promulgated pur-
suant to section 264(c) of the Health In-
surance Portability and Accountability Act 
of 1996 (42 U.S.C. 1320d–2 note). 
(v) The requirements regarding the 
confidentiality of substance use disorder 
information under section 543 of the Pub-
lic Health Service Act (42 U.S.C. 290dd– 
2) or any regulation promulgated under 
such section. 
(vi) The Fair Credit Reporting Act 
(15 U.S.C. 1681 et seq.). 
(vii) Section 444 of the General Edu-
cation Provisions Act (commonly known as 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00148
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
149 
the ‘‘Family Educational Rights and Pri-
vacy Act of 1974’’) (20 U.S.C. 1232g) and 
part 99 of title 34, Code of Federal Regu-
lations (or any successor regulation), to 
the extent a covered entity or service pro-
vider is an educational agency or institu-
tion (as defined in such section or section 
99.3 of title 34, Code of Federal Regula-
tions (or any successor regulation)). 
(viii) The regulations related to the 
protection of human subjects under part 
46 of title 45, Code of Federal Regula-
tions. 
(x) The Health Care Quality Improve-
ment Act of 1986 (42 U.S.C. 11101 et 
seq.). 
(xi) Part C of title IX of the Public 
Health Service Act (42 U.S.C. 299b–21 et 
seq.). 
(xii) Chapter 123 of title 18, United 
States Code. 
(C) IMPLEMENTATION
GUIDANCE.—Not 
later than 1 year after the date of the enact-
ment of this Act, the Commission shall issue 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00149
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
150 
guidance with respect to the implementation of 
this paragraph. 
(c) PRESERVATION OF COMMON LAW OR STATUTORY 
CAUSES OF ACTION FOR CIVIL RELIEF.—Nothing in this 
title, nor any amendment, standard, rule, requirement, as-
sessment, or regulation promulgated under this title, may 
be construed to preempt, displace, or supplant any Federal 
or State common law rights or remedies, or any State stat-
ute creating a remedy for civil relief, including any cause 
of action for personal injury, wrongful death, property 
damage, or other financial, physical, reputational, or psy-
chological injury based in negligence, strict liability, prod-
ucts liability, failure to warn, an objectively offensive in-
trusion into the private affairs or concerns of an indi-
vidual, or any other legal theory of liability under any Fed-
eral or State common law, or any State statutory law, ex-
cept that the fact of a violation of this title or a regulation 
promulgated under this title may not be pleaded as an 
element of any violation of such law. 
(d) NONAPPLICATION OF CERTAIN PROVISIONS OF 
COMMUNICATIONS ACT
OF 1934 AND TELECOMMUNI-
CATIONS ACT OF 1996 RELATED TO FCC PRIVACY AND 
DATA SECURITY LAWS AND REGULATIONS.— 
(1) IN GENERAL.—Except as provided in para-
graph (2), sections 201, 202, 222, 338(i), and 631 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00150
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
151 
of the Communications Act of 1934 (47 U.S.C. 201; 
202; 222; 338(i); 551) and section 706 of the Tele-
communications Act of 1996 (47 U.S.C. 1302), and 
any regulation or order issued by the Federal Com-
munications Commission under any such section, do 
not apply to any covered entity or service provider 
with respect to the collection, processing, retention, 
transfer, or security of covered data (or the equiva-
lent of such data), to the extent that such sections 
or any regulation or order issued under such sec-
tions would otherwise cover the collection, proc-
essing, retention, transfer, or security of covered 
data (or the equivalent of such data) in order to pro-
tect consumer privacy or the security of such data, 
and a covered entity or service provider shall instead 
be covered by the requirements of this title with re-
spect to the collection, processing, retention, trans-
fer, and security of covered data. 
(2) EXCEPTIONS.—Paragraph (1) does not su-
persede any authority of the Federal Communica-
tions Commission with respect to the following: 
(A) Emergency services (as defined in sec-
tion 7 of the Wireless Communications and 
Public Safety Act of 1999 (47 U.S.C. 615b)). 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00151
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
152 
(B) Proceedings to implement section 227 
of the Communications Act of 1934 (47 U.S.C. 
227) or the Pallone-Thune Telephone Robocall 
Abuse Criminal Enforcement and Deterrence 
Act (Public Law 116–105; 133 Stat. 3274), or 
any other authority used by the Federal Com-
munications Commission to prevent or reduce 
unwanted telephone calls or text messages. 
(C) An enforcement action alleging or find-
ing a violation of a section of the Communica-
tions Act of 1934 specified in paragraph (1), if 
such action was adopted by the Federal Com-
munications Commission prior to the date of 
the enactment of this Act. 
(D) Subsection (a) of section 222 of the 
Communications Act of 1934 (47 U.S.C. 222), 
to the extent such subsection imposes a duty on 
every telecommunications carrier to protect the 
confidentiality of proprietary information of, 
and relating to, other telecommunications car-
riers and equipment manufacturers. 
(E) Subsections (b), (d), and (g) of section 
222 of the Communications Act of 1934 (47 
U.S.C. 222). 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00152
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
153 
(F) Any obligation of an international 
treaty related to the exchange of traffic imple-
mented and enforced by the Federal Commu-
nications Commission. 
SEC. 119. CHILDREN’S ONLINE PRIVACY PROTECTION ACT 
OF 1998. 
Nothing in this title may be construed to relieve or 
change any obligation that a covered entity or other per-
son may have under the Children’s Online Privacy Protec-
tion Act of 1998 (15 U.S.C. 6501 et seq.). 
SEC. 120. DATA PROTECTIONS FOR COVERED MINORS. 
(a) PROHIBITION ON TARGETED AND FIRST-PARTY 
ADVERTISING TO COVERED MINORS.—A covered entity or 
service provider acting on behalf of a covered entity may 
not engage in targeted advertising or first-party adver-
tising to an individual if the covered entity has knowledge 
that the individual is a covered minor, except that a cov-
ered entity or service provider may present or display to 
a covered minor age-appropriate advertisements intended 
for an audience of covered minors, if the covered entity 
or service provider does not use any covered data in rela-
tion to such advertisements, other than data relating to 
the status of the individual as a covered minor. 
(b) DATA TRANSFER REQUIREMENTS RELATED TO 
COVERED MINORS.— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00153
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
154 
(1) IN GENERAL.—Except as provided in para-
graph (2), and notwithstanding section 102(b), a 
covered entity or a service provider acting on behalf 
of a covered entity may not transfer or direct a serv-
ice provider to transfer the covered data of an indi-
vidual to a third party if the covered entity— 
(A) has knowledge that the individual is a 
covered minor; and 
(B) has not obtained affirmative express 
consent, unless the transfer is necessary, pro-
portionate, and limited to a purpose expressly 
permitted by paragraph (2), (3), (4), (8), (9), 
(11), (12), or (13) of section 102(d). 
(2) EXCEPTION.—A covered entity or service 
provider may collect, process, retain, or transfer cov-
ered data of an individual that the covered entity or 
service provider knows is a covered minor in order 
to submit information relating to child victimization 
to law enforcement or to the nonprofit, national re-
source center and clearinghouse congressionally des-
ignated to provide assistance to victims, families, 
child-serving professionals, and the general public on 
missing and exploited children issues. 
(c) RULEMAKING.—The Commission may conduct a 
rulemaking pursuant to section 553 of title 5, United 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00154
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
155 
States Code, to establish processes for parents and teens 
to exercise the rights provided in this title with respect 
to covered entities and data brokers. Any such rulemaking 
shall take into account— 
(1) the specific needs of parents, children, and 
teens; 
(2) how best to harmonize the processes pro-
vided for under this title with the processes and 
guidance provided for under the Children’s Online 
Privacy Protection Act of 1998 (15 U.S.C. 6501 et 
seq.), as amended by title II of this Act, and any 
regulations promulgated by the Commission there-
under; and 
(3) options for reducing undue burdens on par-
ents, children, teens, covered entities, and data bro-
kers. 
SEC. 121. TERMINATION OF FTC RULEMAKING ON COM-
MERCIAL SURVEILLANCE AND DATA SECU-
RITY. 
Beginning on the date of the enactment of this Act, 
the rulemaking proposed in the advance notice of proposed 
rulemaking titled ‘‘Trade Regulation Rule on Commercial 
Surveillance and Data Security’’ and published on August 
22, 2022 (87 Fed. Reg. 51273) shall be terminated. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00155
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
156 
SEC. 122. SEVERABILITY. 
If any provision of this title, or the application thereof 
to any person or circumstance, is held invalid, the remain-
der of this title, and the application of such provision to 
other persons not similarly situated or to other cir-
cumstances, may not be affected by the invalidation. 
SEC. 123. INNOVATION RULEMAKINGS. 
The Commission may conduct a rulemaking pursuant 
to section 553 of title 5, United States Code— 
(1) to include other covered data in the defini-
tion of the term ‘‘sensitive covered data’’, except 
that the Commission may not expand the category 
of information described in section 101(49)(A)(ii); 
and 
(2) to include in the list of permitted purposes 
in section 102(d) other permitted purposes for col-
lecting, processing, retaining, or transferring covered 
data. 
SEC. 124. EFFECTIVE DATE. 
Unless otherwise specified in this title, this title shall 
take effect on the date that is 180 days after the date 
of the enactment of this Act. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00156
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
157 
TITLE II—CHILDREN’S ONLINE 
PRIVACY PROTECTION ACT 2.0 
SEC. 201. SHORT TITLE. 
This title may be cited as the ‘‘Children’s Online Pri-
vacy Protection Act 2.0’’. 
SEC. 202. ONLINE COLLECTION, USE, DISCLOSURE, AND DE-
LETION OF PERSONAL INFORMATION OF 
CHILDREN. 
(a) DEFINITIONS.—Section 1302 of the Children’s 
Online Privacy Protection Act of 1998 (15 U.S.C. 6501) 
is amended— 
(1) by amending paragraph (2) to read as fol-
lows: 
‘‘(2) OPERATOR.—The term ‘operator’— 
‘‘(A) means any person— 
‘‘(i) who, for commercial purposes, in 
interstate or foreign commerce, operates or 
provides a website on the internet, an on-
line service, an online application, or a mo-
bile application; and 
‘‘(ii) who— 
‘‘(I) collects or maintains, either 
directly or through a service provider, 
personal information from or about 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00157
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
158 
the users of that website, service, or 
application; 
‘‘(II) allows another person to 
collect personal information directly 
from users of that website, service, or 
application (in which case, the oper-
ator is deemed to have collected the 
information); or 
‘‘(III) 
allows 
users 
of 
that 
website, service, or application to pub-
licly disclose personal information (in 
which case, the operator is deemed to 
have collected the information); and 
‘‘(B) does not include any nonprofit entity 
that would otherwise be exempt from coverage 
under section 5 of the Federal Trade Commis-
sion Act (15 U.S.C. 45).’’; 
(2) in paragraph (4)— 
(A) by amending subparagraph (A) to read 
as follows: 
‘‘(A) the release of personal information 
collected from a child by an operator for any 
purpose, except where the personal information 
is provided to a person other than an operator 
who— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00158
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
159 
‘‘(i) provides support for the internal 
operations of a website, online service, on-
line application, or mobile application (as 
defined in paragraph (8)(C)) of the oper-
ator, excluding any activity relating to tar-
geted advertising or first-party advertising 
(as such terms are defined in section 101 
of the American Privacy Rights Act of 
2024) to children; and 
‘‘(ii) does not disclose or use that per-
sonal information for any other purpose; 
and’’; and 
(B) in subparagraph (B)— 
(i) by striking ‘‘website or online serv-
ice’’ and inserting ‘‘website, online service, 
online application, or mobile application’’; 
and 
(ii) by striking ‘‘actual knowledge’’ 
and inserting ‘‘actual knowledge or knowl-
edge fairly implied on the basis of objective 
circumstances’’; 
(3) by striking paragraph (8) and inserting the 
following: 
‘‘(8) PERSONAL INFORMATION.— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00159
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
160 
‘‘(A) IN GENERAL.—The term ‘personal in-
formation’ means individually identifiable infor-
mation about an individual collected online, in-
cluding— 
‘‘(i) a first and last name; 
‘‘(ii) a home or other physical address 
including street name and name of a city 
or town; 
‘‘(iii) an e-mail address; 
‘‘(iv) a telephone number; 
‘‘(v) a Social Security number; 
‘‘(vi) any other identifier that the 
Commission determines permits the phys-
ical or online contacting of a specific indi-
vidual; 
‘‘(vii) a persistent identifier that can 
be used to recognize a specific child over 
time and across different websites, online 
services, online applications, or mobile ap-
plications, including a customer number 
held in a cookie, an Internet Protocol (IP) 
address, a processor or device serial num-
ber, or a unique device identifier, but ex-
cluding an identifier that is used by an op-
erator solely for providing support for the 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00160
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
161 
internal operations of a website, online 
service, online application, or mobile appli-
cation; 
‘‘(viii) a photograph, video, or audio 
file, if such file contains the image or voice 
of a specific child; 
‘‘(ix) geolocation information; 
‘‘(x) information generated from the 
measurement or technological processing of 
the biological, physical, or physiological 
characteristics of an individual that is used 
to identify an individual, including— 
‘‘(I) fingerprints; 
‘‘(II) voice prints; 
‘‘(III) iris or retina imagery 
scans; 
‘‘(IV) facial templates; 
‘‘(V) 
deoxyribonucleic 
acid 
(DNA) information; or 
‘‘(VI) gait; or 
‘‘(xi) information linked or reasonably 
linkable to a child or the parents of that 
child (including any unique identifier) that 
an operator collects online from the child 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00161
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
162 
and combines with an identifier described 
in this subparagraph. 
‘‘(B) EXCLUSION.—The term ‘personal in-
formation’ does not include an audio file that 
contains the voice of a child, if the operator— 
‘‘(i) does not request information via 
voice that would otherwise be considered 
personal information under this paragraph; 
‘‘(ii) provides, in the privacy policy of 
the operator, clear notice of the collection 
and use of the audio file by the operator 
and the deletion policy of the operator; 
‘‘(iii) uses the voice within the audio 
file solely as a replacement for written 
words, to perform a task, or to engage 
with a website, online service, online appli-
cation, or mobile application, such as to 
perform a search or fulfill a verbal instruc-
tion or request; and 
‘‘(iv) only maintains the audio file 
long enough to complete the stated purpose 
and then immediately deletes the audio file 
and does not make any other use of the 
audio file prior to deletion. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00162
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
163 
‘‘(C) SUPPORT FOR THE INTERNAL OPER-
ATIONS OF A WEBSITE, ONLINE SERVICE, ON-
LINE APPLICATION, OR MOBILE APPLICATION.— 
‘‘(i) IN
GENERAL.—For purposes of 
subparagraph (A)(vii), the term ‘support 
for the internal operations of a website, on-
line service, online application, or mobile 
application’ means those activities nec-
essary to— 
‘‘(I) maintain or analyze the 
functioning of the website, online serv-
ice, online application, or mobile appli-
cation; 
‘‘(II) perform network commu-
nications; 
‘‘(III) authenticate users of, or 
personalize 
the 
content 
on, 
the 
website, online service, online applica-
tion, or mobile application; 
‘‘(IV) cap the frequency of adver-
tising; 
‘‘(V) protect the security or in-
tegrity of the user, website, online 
service, online application, or mobile 
application; 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00163
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
164 
‘‘(VI) ensure legal or regulatory 
compliance; or 
‘‘(VII) fulfill a request of a child 
as permitted by subparagraphs (A) 
through (C) of section 1303(b)(2). 
‘‘(ii) CONDITION.—Except as specifi-
cally permitted under clause (i), informa-
tion collected for the activities listed in 
clause (i) may not be used or disclosed to 
contact a specific individual, including 
through targeted advertising or first-party 
advertising (as such terms are defined in 
section 101 of the American Privacy 
Rights Act of 2024) to children, to amass 
a profile on a specific individual, in connec-
tion with processes that encourage or 
prompt use of a website, online service, on-
line application, or mobile application, or 
for any other purpose.’’; 
(4) by amending paragraph (9) to read as fol-
lows: 
‘‘(9) 
VERIFIABLE
CONSENT.—The 
term 
‘verifiable consent’ means any reasonable effort (tak-
ing into consideration available technology), includ-
ing a request for authorization for future collection, 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00164
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
165 
use, and disclosure described in the notice, to ensure 
that a parent of the child— 
‘‘(A) receives direct notice of the personal 
information collection, use, and disclosure prac-
tices of the operator; and 
‘‘(B) before the personal information of the 
child is collected, freely and unambiguously au-
thorizes— 
‘‘(i) the collection, use, and disclosure, 
as applicable, of that personal information; 
and 
‘‘(ii) any subsequent use of that per-
sonal information.’’; 
(5) in paragraph (10)— 
(A) in the paragraph heading, by striking 
‘‘WEBSITE OR ONLINE SERVICE DIRECTED TO 
CHILDREN’’ and inserting ‘‘WEBSITE, ONLINE 
SERVICE, ONLINE APPLICATION, OR MOBILE AP-
PLICATION DIRECTED TO CHILDREN’’; 
(B) by striking ‘‘website or online service’’ 
each place it appears and inserting ‘‘website, 
online service, online application, or mobile ap-
plication’’; and 
(C) by adding at the end the following new 
subparagraph: 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00165
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
166 
‘‘(C) RULE
OF
CONSTRUCTION.—In con-
sidering whether a website, online service, on-
line application, or mobile application, or por-
tion thereof, is directed to children, the Com-
mission shall apply a totality of circumstances 
test and shall also consider competent and reli-
able empirical evidence regarding audience com-
position and evidence regarding the intended 
audience of the website, online service, online 
application, or mobile application.’’; and 
(6) by adding at the end the following: 
‘‘(13) CONNECTED
DEVICE.—The term ‘con-
nected device’ has the meaning given such term in 
section 101 of the American Privacy Rights Act of 
2024. 
‘‘(14) EDUCATIONAL
AGENCY
OR
INSTITU-
TION.—The term ‘educational agency or institution’ 
means a State educational agency or local edu-
cational agency as defined under Federal law, as 
well as an institutional day or residential school, in-
cluding a public school, charter school, or private 
school, that provides elementary or secondary edu-
cation, as determined under State law. 
‘‘(15) MOBILE APPLICATION.—The term ‘mo-
bile application’ has the meaning given such term in 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00166
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
167 
section 101 of the American Privacy Rights Act of 
2024. 
‘‘(16) ONLINE APPLICATION.—The term ‘online 
application’ has the meaning given such term in sec-
tion 101 of the American Privacy Rights Act of 
2024. 
‘‘(17) PRECISE GEOLOCATION INFORMATION.— 
The term ‘precise geolocation information’ has the 
meaning given such term in section 101 of the 
American Privacy Rights Act of 2024.’’. 
(b) ONLINE COLLECTION, USE, DISCLOSURE, AND 
DELETION OF PERSONAL INFORMATION OF CHILDREN.— 
Section 1303 of the Children’s Online Privacy Protection 
Act of 1998 (15 U.S.C. 6502) is amended— 
(1) by striking the heading and inserting the 
following: ‘‘ONLINE COLLECTION, USE, DISCLO-
SURE, AND DELETION OF PERSONAL INFORMA-
TION OF CHILDREN.’’; 
(2) by amending subsection (a) to read as fol-
lows: 
‘‘(a) ACTS PROHIBITED.—It is unlawful for an oper-
ator of a website, online service, online application, or mo-
bile application directed to children or for any operator 
of a website, online service, online application, or mobile 
application with actual knowledge or knowledge fairly im-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00167
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
168 
plied on the basis of objective circumstances that a user 
is a child— 
‘‘(1) to collect personal information from a child 
in a manner that violates the American Privacy 
Rights Act of 2024 or the regulations prescribed 
under subsection (b); or 
‘‘(2) to store or transfer the personal informa-
tion of a child outside of the United States, unless— 
‘‘(A) the operator provides direct notice to 
the parent of the child that the personal infor-
mation of the child is being stored or trans-
ferred outside of the United States; and 
‘‘(B) with respect to transfer, the operator 
meets the requirements of section 102(b) of the 
American Privacy Rights Act of 2024.’’; 
(3) in subsection (b)— 
(A) in paragraph (1)— 
(i) in subparagraph (A)— 
(I) in the matter preceding clause 
(i), by striking ‘‘operator of any 
website’’ and all that follows through 
‘‘from a child’’ and inserting ‘‘oper-
ator of a website, online service, on-
line application, or mobile application 
directed to children or that has actual 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00168
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
169 
knowledge or knowledge fairly implied 
on the basis of objective circumstances 
that a user is a child’’; 
(II) in clause (i)— 
(aa) by striking ‘‘notice on 
the website’’ and inserting ‘‘clear 
and conspicuous notice on the 
website, service, or application’’; 
and 
(bb) by striking ‘‘; and’’ and 
inserting a semicolon; 
(III) in clause (ii)— 
(aa) by striking ‘‘verifiable 
parental consent’’ and inserting 
‘‘verifiable consent’’; and 
(bb) by striking the semi-
colon at the end and inserting ‘‘; 
and’’; and 
(IV) by inserting after clause (ii) 
the following new clause: 
‘‘(iii) to obtain verifiable consent from 
a parent of a child before using or dis-
closing personal information of the child 
for any purpose that is a material change 
from the original purposes and disclosure 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00169
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
170 
practices specified to the parent of the 
child under clause (i);’’; 
(ii) by striking subparagraph (B); 
(iii) in subparagraph (C)— 
(I) by striking ‘‘reasonably’’; and 
(II) by inserting ‘‘, proportionate, 
and limited’’ after ‘‘necessary’’; 
(iv) in subparagraph (D), by striking 
‘‘website or online service’’ and inserting 
‘‘website, online service, online application, 
or mobile application’’; and 
(v) by redesignating subparagraphs 
(C) and (D) as subparagraphs (B) and 
(C), respectively; 
(B) in paragraph (2)— 
(i) in the matter preceding subpara-
graph (A)— 
(I) by striking ‘‘verifiable paren-
tal consent’’ and inserting ‘‘verifiable 
consent’’; and 
(II) 
by 
striking 
‘‘paragraph 
(1)(A)(ii)’’ and inserting ‘‘clause (ii) 
or (iii) of paragraph (1)(A)’’; 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00170
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
171 
(ii) in subparagraph (A), by inserting 
‘‘or to contact another child’’ after ‘‘to re-
contact the child’’; 
(iii) in subparagraph (B)— 
(I) by striking ‘‘or child’’; and 
(II) by striking ‘‘parental con-
sent’’ each place the term appears and 
inserting ‘‘verifiable consent’’; 
(iv) in subparagraph (D), in the mat-
ter preceding clause (i)— 
(I) by striking ‘‘reasonably’’; and 
(II) by inserting ‘‘, proportionate, 
and limited’’ after ‘‘necessary’’; and 
(v) in subparagraph (E)— 
(I) in the matter preceding clause 
(i), by striking ‘‘website or online 
service’’ and inserting ‘‘website, online 
service, online application, or mobile 
application’’; and 
(II) in clause (i), by striking 
‘‘website’’ and inserting ‘‘website, 
service, or application’’; 
(C) by redesignating paragraph (3) as 
paragraph (4) and inserting after paragraph 
(2) the following new paragraph: 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00171
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
172 
‘‘(3) APPLICATION
TO
OPERATORS
ACTING 
UNDER AGREEMENTS WITH EDUCATIONAL AGENCIES 
OR
INSTITUTIONS.—The regulations may provide 
that verifiable consent under clause (ii) or (iii) of 
paragraph (1)(A) is not required for an operator 
that is acting under a written agreement with an 
educational agency or institution that, at a min-
imum, requires— 
‘‘(A) the operator to— 
‘‘(i) limit its collection, use, and dis-
closure of the personal information from a 
child to solely educational purposes and for 
no other commercial purposes; 
‘‘(ii) provide the educational agency or 
institution with a notice of the specific 
types of personal information the operator 
will collect from the child, the method by 
which the operator will obtain the personal 
information, and the purposes for which 
the operator will collect, use, disclose, and 
retain the personal information; 
‘‘(iii) provide the educational agency 
or institution with a link to the online no-
tice of information practices of the oper-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00172
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
173 
ator 
as 
required 
under 
paragraph 
(1)(A)(i); and 
‘‘(iv) provide the educational agency 
or institution, upon request, with a means 
to review the personal information collected 
from a child, to prevent further use or 
maintenance or future collection of per-
sonal information from a child, and to de-
lete personal information collected from a 
child or content or information submitted 
by a child to the website, online service, 
online application, or mobile application of 
the operator; 
‘‘(B) a representative of the educational 
agency or institution to— 
‘‘(i) acknowledge and agree that the 
representative has authority to authorize 
the collection, use, and disclosure of per-
sonal information from children on behalf 
of the educational agency or institution; 
and 
‘‘(ii) provide the name of the rep-
resentative and the title of the representa-
tive at the educational agency or institu-
tion; and 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00173
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
174 
‘‘(C) the educational agency or institution 
to— 
‘‘(i) provide on the website of the edu-
cational agency or institution a notice that 
identifies the operator with which the edu-
cational agency or institution has entered 
into a written agreement under this para-
graph and a link to the online notice of in-
formation practices of the operator as re-
quired under paragraph (1)(A)(i); 
‘‘(ii) provide the notice of the operator 
regarding the information practices of the 
operator, as required under subparagraph 
(A)(ii), upon request, to a parent; and 
‘‘(iii) upon the request of a parent, re-
quest the operator provide a means to re-
view the personal information collected 
from the child of the parent and provide 
the parent a means to review the personal 
information.’’; 
(D) by amending paragraph (4), as so re-
designated, to read as follows: 
‘‘(4) TERMINATION OF SERVICE.—The regula-
tions shall permit the operator of a website, online 
service, online application, or mobile application to 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00174
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
175 
terminate service provided to a child whose parent 
has requested to delete covered data of the child 
pursuant to section 105 of the American Privacy 
Rights Act of 2024.’’; and 
(E) by adding at the end the following new 
paragraphs: 
‘‘(5) CONTINUATION OF SERVICE.—The regula-
tions shall prohibit an operator from discontinuing 
service provided to a child on the basis of a request 
by the parent of the child to delete personal informa-
tion collected from the child, to the extent that the 
operator is capable of providing such service without 
such information. 
‘‘(6) COMMON
VERIFIABLE
CONSENT
MECHA-
NISM.— 
‘‘(A) IN GENERAL.— 
‘‘(i) FEASIBILITY
OF
MECHANISM.— 
The Commission shall conduct an assess-
ment, with notice and public comment, of 
the feasibility of allowing operators the op-
tion to use a common verifiable consent 
mechanism that fully meets the require-
ments of this title. 
‘‘(ii) REQUIREMENTS.—The feasibility 
assessment described in clause (i) shall 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00175
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
176 
consider whether a single operator could 
use a common verifiable consent mecha-
nism to obtain verifiable consent, as re-
quired under this title, from a parent of a 
child on behalf of multiple, listed operators 
that provide a joint or related service. 
‘‘(B) REPORT.—Not later than 1 year 
after the date of the enactment of this para-
graph, the Commission shall submit to the 
Committee on Commerce, Science, and Trans-
portation of the Senate and the Committee on 
Energy and Commerce of the House of Rep-
resentatives a report with the findings of the 
assessment required by subparagraph (A). 
‘‘(C) REGULATIONS.—If the Commission 
finds, in the assessment required by subpara-
graph (A), that the use of a common verifiable 
consent mechanism is feasible and would meet 
the requirements of this title, the Commission 
shall issue regulations, pursuant to section 553 
of title 5, United States Code, to permit the use 
of a common verifiable consent mechanism in 
accordance with the findings outlined in the re-
port submitted under subparagraph (B).’’; 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00176
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
177 
(4) in subsection (c), by striking ‘‘a regulation 
prescribed under subsection (a)’’ and inserting 
‘‘paragraph (2) of subsection (a), or of a regulation 
prescribed under subsection (b),’’; and 
(5) by striking subsection (d) and inserting the 
following: 
‘‘(d) RELATIONSHIP TO STATE LAW.—The provisions 
of this title shall preempt any State law, rule, or regula-
tion only to the extent that such State law, rule, or regula-
tion conflicts with a provision of this title. Nothing in this 
title may be construed to prohibit any State from enacting 
a law, rule, or regulation that provides greater protection 
to children than the provisions of this title.’’. 
(c) SAFE HARBORS.—Section 1304 of the Children’s 
Online Privacy Protection Act of 1998 (15 U.S.C. 6503) 
is amended by adding at the end the following: 
‘‘(d) PUBLICATION.— 
‘‘(1) IN GENERAL.—Subject to the restrictions 
described in paragraph (2), the Commission shall 
publish on the website of the Commission any report 
or documentation required by regulation to be sub-
mitted to the Commission to carry out this section. 
‘‘(2) RESTRICTIONS ON PUBLICATION.—The re-
strictions described in sections 6(f) and 21 of the 
Federal Trade Commission Act (15 U.S.C. 46(f); 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00177
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
178 
57b–2) applicable to the disclosure of information 
obtained by the Commission shall apply in the same 
manner to the disclosure under this subsection of in-
formation obtained by the Commission from a report 
or documentation described in paragraph (1).’’. 
(d) ACTIONS BY STATES.—Section 1305 of the Chil-
dren’s Online Privacy Protection Act of 1998 (15 U.S.C. 
6504) is amended— 
(1) in subsection (a)(1)— 
(A) in the matter preceding subparagraph 
(A), by inserting ‘‘section 1303(a) or’’ before 
‘‘any regulation’’; and 
(B) in subparagraph (B), by striking ‘‘the 
regulation’’ and inserting ‘‘such section or regu-
lation’’; and 
(2) in subsection (d)— 
(A) by inserting ‘‘section 1303(a) or’’ be-
fore ‘‘any regulation’’; and 
(B) by striking ‘‘that regulation’’ and in-
serting ‘‘such section or regulation’’. 
(e) ADMINISTRATION AND APPLICABILITY OF ACT.— 
Section 1306 of the Children’s Online Privacy Protection 
Act of 1998 (15 U.S.C. 6505) is amended— 
(1) in subsection (d)— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00178
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
179 
(A) by inserting ‘‘section 1303(a) or’’ be-
fore ‘‘a rule’’; and 
(B) by striking ‘‘such rule’’ and inserting 
‘‘section 1303(a) or a rule of the Commission 
under section 1303’’; and 
(2) by adding at the end the following new sub-
sections: 
‘‘(f) DETERMINATION OF WHETHER AN OPERATOR 
HAS KNOWLEDGE FAIRLY IMPLIED ON THE BASIS OF 
OBJECTIVE CIRCUMSTANCES.— 
‘‘(1) RULE OF CONSTRUCTION.—For purposes 
of enforcing this title or a regulation promulgated 
under this title, in making a determination as to 
whether an operator has knowledge fairly implied on 
the basis of objective circumstances that a specific 
user is a child, the Commission or a State attorney 
general shall rely on competent and reliable evi-
dence, taking into account the totality of the cir-
cumstances, including whether a reasonable and pru-
dent person under the circumstances would have 
known that the user is a child. Nothing in this title, 
including a determination described in the preceding 
sentence, may be construed to require an operator 
to— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00179
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
180 
‘‘(A) affirmatively collect any personal in-
formation with respect to the age of a child that 
an operator is not already collecting in the nor-
mal course of business; or 
‘‘(B) implement an age gating or age 
verification functionality. 
‘‘(2) COMMISSION GUIDANCE.— 
‘‘(A) IN
GENERAL.—Not later than 180 
days after the date of the enactment of this 
subsection, the Commission shall issue guidance 
to provide information, including best practices 
and examples, for operators to understand the 
process of the Commission for determining 
whether an operator has knowledge fairly im-
plied on the basis of objective circumstances 
that a user is a child. 
‘‘(B) LIMITATION.—No guidance issued by 
the Commission under subparagraph (A) con-
fers any rights on any person, State, or locality, 
or operates to bind the Commission or any per-
son, State, or locality to the approach rec-
ommended in such guidance. In any enforce-
ment action brought pursuant to this title, the 
Commission or State attorney general, as appli-
cable, shall allege a specific violation of a provi-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00180
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
181 
sion of this title, and the Commission or State 
attorney general, as applicable, may not base an 
enforcement action on, or execute a consent 
order based on, practices that are alleged to be 
inconsistent with any such guidance, unless the 
practices allegedly violate this title. 
‘‘(g) ADDITIONAL REQUIREMENT.—Any regulations 
issued under this title shall include a description and anal-
ysis of the impact of proposed and final rules on small 
entities per chapter 6 of title 5, United States Code.’’. 
SEC. 203. STUDY AND REPORTS ON MOBILE AND ONLINE 
APPLICATION OVERSIGHT AND ENFORCE-
MENT. 
(a) OVERSIGHT REPORT.—Not later than 3 years 
after the date of the enactment of this Act, the Federal 
Trade Commission shall submit to the Committee on Com-
merce, Science, and Transportation of the Senate and the 
Committee on Energy and Commerce of the House of 
Representatives a report on the processes of platforms 
that offer mobile and online applications for ensuring that, 
for those applications that are websites, online services, 
online applications, or mobile applications directed to chil-
dren, the applications operate in accordance with— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00181
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
182 
(1) this title, the amendments made by this 
title, and any rules promulgated under this title or 
the amendments made by this title; and 
(2) rules promulgated by the Commission under 
section 18 of the Federal Trade Commission Act (15 
U.S.C. 57a) relating to unfair or deceptive acts or 
practices in marketing. 
(b) ENFORCEMENT REPORT.—Not later than 1 year 
after the date of the enactment of this Act, and annually 
thereafter, the Federal Trade Commission shall submit to 
the Committee on Commerce, Science, and Transportation 
of the Senate and the Committee on Energy and Com-
merce of the House of Representatives a report that ad-
dresses, at a minimum— 
(1) the number of actions brought by the Com-
mission during the reporting year to enforce the 
Children’s Online Privacy Protection Act of 1998 
(15 U.S.C. 6501 et seq.) and the outcome of each 
such action; 
(2) the total number of investigations or inquir-
ies into potential violations of such Act commenced 
during the reporting year; 
(3) the total number of open investigations or 
inquiries into potential violations of such Act as of 
the time the report is submitted; 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00182
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
183 
(4) the number and nature of complaints re-
ceived by the Commission relating to an allegation 
of a violation of such Act during the reporting year; 
and 
(5) policy or legislative recommendations to 
strengthen online protections for children. 
(c) REPORT BY THE INSPECTOR GENERAL.— 
(1) IN GENERAL.—Not later than 2 years after 
the date of the enactment of this Act, the Inspector 
General of the Federal Trade Commission shall sub-
mit to the Federal Trade Commission and to the 
Committee on Commerce, Science, and Transpor-
tation of the Senate and the Committee on Energy 
and Commerce of the House of Representatives a re-
port regarding the safe harbor provisions in section 
1304 of the Children’s Online Privacy Protection 
Act of 1998 (15 U.S.C. 6503), which shall include— 
(A) an analysis of whether the safe harbor 
provisions are— 
(i) operating fairly and effectively; 
and 
(ii) effectively protecting the interests 
of children; and 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00183
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
184 
(B) any proposal or recommendation for 
policy changes that would improve the effective-
ness of the safe harbor provisions. 
(2) PUBLICATION.—Not later than 10 days 
after the date on which a report is submitted under 
paragraph (1), the Commission shall publish the re-
port on the website of the Commission. 
SEC. 204. SEVERABILITY. 
If any provision of this title or the amendments made 
by this title, or the application thereof to any person or 
circumstance, is held invalid, the remainder of this title 
and the amendments made by this title, and the applica-
tion of such provision to other persons not similarly situ-
ated or to other circumstances, may not be affected by 
the invalidation. 
Æ 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00184
Fmt 6652
Sfmt 6301
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS