119-s836

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 836 Introduced in Senate

    (IS) ]

<DOC>

119th CONGRESS
 1st Session
 S. 836

 To amend the Children's Online Privacy Protection Act of 1998 to 
 strengthen protections relating to the online collection, use, and 
disclosure of personal information of children and teens, and for other 
 purposes.

_______________________________________________________________________

 IN THE SENATE OF THE UNITED STATES

 March 4, 2025

 Mr. Markey (for himself, Mr. Cassidy, Ms. Cantwell, Mr. Schatz, Mrs. 
 Capito, Ms. Klobuchar, Mr. Crapo, Mr. Wyden, Mr. Grassley, Mr. Lujan, 
 Mr. Blumenthal, Mr. Merkley, Mr. Welch, Mr. King, Mr. Kelly, Mrs. 
Britt, and Mr. Heinrich) introduced the following bill; which was read 
 twice and referred to the Committee on Commerce, Science, and 
 Transportation

_______________________________________________________________________

 A BILL

 To amend the Children's Online Privacy Protection Act of 1998 to 
 strengthen protections relating to the online collection, use, and 
disclosure of personal information of children and teens, and for other 
 purposes.

 Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

    (a) Short Title.--This Act may be cited as the ``Children and 
Teens' Online Privacy Protection Act''.

    (b) Table of Contents.--The table of contents for this Act is as 
follows:

Sec. 1. Short title; table of contents.

Sec. 2. Online collection, use, disclosure, and deletion of personal 
 information of children and teens.

Sec. 3. Study and reports of mobile and online application oversight 
 and enforcement.

Sec. 4. GAO study.

Sec. 5. Severability.

SEC. 2. ONLINE COLLECTION, USE, DISCLOSURE, AND DELETION OF PERSONAL 
 INFORMATION OF CHILDREN AND TEENS.

    (a) 

=== Definitions. ===
-

Section 1302 of the Children's Online Privacy 
Protection Act of 1998 (15 U.S.C. 6501) is amended--

    (1) by amending paragraph

    (2) to read as follows:
 ``

    (2) Operator.--The term `operator'--
 ``
        (A) means any person--
 ``
            (i) who, for commercial purposes, in 
 interstate or foreign commerce operates or 
 provides a website on the internet, an online 
 service, an online application, or a mobile 
 application; and
 ``
            (ii) who--
 ``
            (I) collects or maintains, either 
 directly or through a service provider, 
 personal information from or about the 
 users of that website, service, or 
 application;
 ``
            (II) allows another person to 
 collect personal information directly 
 from users of that website, service, or 
 application (in which case, the 
 operator is deemed to have collected 
 the information); or
 ``
            (III) allows users of that 
 website, service, or application to 
 publicly disclose personal information 
 (in which case, the operator is deemed 
 to have collected the information); and
 ``
        (B) does not include any nonprofit entity that 
 would otherwise be exempt from coverage under 

section 5 
 of the Federal Trade Commission Act (15 U.S.C. 45).'';

    (2) in paragraph

    (4) --
        (A) by amending subparagraph
        (A) to read as 
 follows:
 ``
        (A) the release of personal information collected 
 from a child or teen by an operator for any purpose, 
 except where the personal information is provided to a 
 person other than an operator who--
 ``
            (i) provides support for the internal 
 operations of the website, online service, 
 online application, or mobile application of 
 the operator, excluding any activity relating 
 to individual-specific advertising to children 
 or teens; and
 ``
            (ii) does not disclose or use that 
 personal information for any other purpose; 
 and''; and
        (B) in subparagraph
        (B) --
            (i) by inserting ``or teen'' after 
 ``child'' each place the term appears;
            (ii) by striking ``website or online 
 service'' and inserting ``website, online 
 service, online application, or mobile 
 application''; and
            (iii) by striking ``actual knowledge'' and 
 inserting ``actual knowledge or knowledge 
 fairly implied on the basis of objective 
 circumstances'';

    (3) by striking paragraph

    (8) and inserting the following:
 ``

    (8) Personal information.--
 ``
        (A) In general.--The term `personal information' 
 means individually identifiable information about an 
 individual collected online, including--
 ``
            (i) a first and last name;
 ``
            (ii) a home or other physical address 
 including street name and name of a city or 
 town;
 ``
            (iii) an e-mail address;
 ``
            (iv) a telephone number;
 ``
            (v) a Social Security number;
 ``
            (vi) any other identifier that the 
 Commission determines permits the physical or 
 online contacting of a specific individual;
 ``
            (vii) a persistent identifier that can be 
 used to recognize a specific child or teen over 
 time and across different websites, online 
 services, online applications, or mobile 
 applications, including but not limited to a 
 customer number held in a cookie, an Internet 
 Protocol

    (IP) address, a processor or device 
 serial number, or unique device identifier, but 
 excluding an identifier that is used by an 
 operator solely for providing support for the 
 internal operations of the website, online 
 service, online application, or mobile 
 application;
 ``
            (viii) a photograph, video, or audio file 
 where such file contains a specific child's or 
 teen's image or voice;
 ``
            (ix) geolocation information;
 ``
            (x) information generated from the 
 measurement or technological processing of an 
 individual's biological, physical, or 
 physiological characteristics that is used to 
 identify an individual, including--
 ``
            (I) fingerprints;
 ``
            (II) voice prints;
 ``
            (III) iris or retina imagery 
 scans;
 ``
            (IV) facial templates;
 ``
            (V) deoxyribonucleic acid

    (DNA) information; or
 ``
            (VI) gait; or
 ``
            (xi) information linked or reasonably 
 linkable to a child or teen or the parents of 
 that child or teen (including any unique 
 identifier) that an operator collects online 
 from the child or teen and combines with an 
 identifier described in this subparagraph.
 ``
        (B) Exclusion.--The term `personal information' 
 shall not include an audio file that contains a child's 
 or teen's voice so long as the operator--
 ``
            (i) does not request information via 
 voice that would otherwise be considered 
 personal information under this paragraph;
 ``
            (ii) provides clear notice of its 
 collection and use of the audio file and its 
 deletion policy in its privacy policy;
 ``
            (iii) only uses the voice within the 
 audio file solely as a replacement for written 
 words, to perform a task, or engage with a 
 website, online service, online application, or 
 mobile application, such as to perform a search 
 or fulfill a verbal instruction or request; and
 ``
            (iv) only maintains the audio file long 
 enough to complete the stated purpose and then 
 immediately deletes the audio file and does not 
 make any other use of the audio file prior to 
 deletion.
 ``
            (C) Support for the internal operations of a 
 website, online service, online application, or mobile 
 application.--
 ``
            (i) In general.--For purposes of 
 subparagraph
        (A)
            (vii) , the term `support for 
 the internal operations of a website, online 
 service, online application, or mobile 
 application' means those activities necessary 
 to--
 ``
            (I) maintain or analyze the 
 functioning of the website, online 
 service, online application, or mobile 
 application;
 ``
            (II) perform network 
 communications;
 ``
            (III) authenticate users of, or 
 personalize the content on, the 
 website, online service, online 
 application, or mobile application;
 ``
            (IV) serve contextual 
 advertising, provided that any 
 persistent identifier is only used as 
 necessary for technical purposes to 
 serve the contextual advertisement, or 
 cap the frequency of advertising;
 ``
            (V) protect the security or 
 integrity of the user, website, online 
 service, online application, or mobile 
 application;
 ``
            (VI) ensure legal or regulatory 
 compliance, or
 ``
            (VII) fulfill a request of a 
 child or teen as permitted by 
 subparagraphs
        (A) through
            (C) of 
 

section 1303

    (b)

    (2) .
 ``
            (ii) Condition.--Except as specifically 
 permitted under clause
            (i) , information 
 collected for the activities listed in clause
            (i) cannot be used or disclosed to contact a 
 specific individual, including through 
 individual-specific advertising to children or 
 teens, to amass a profile on a specific 
 individual, in connection with processes that 
 encourage or prompt use of a website or online 
 service, or for any other purpose.'';

    (4) by amending paragraph

    (9) to read as follows:
 ``

    (9) Verifiable consent.--The term `verifiable consent' 
 means any reasonable effort (taking into consideration 
 available technology), including a request for authorization 
 for future collection, use, and disclosure described in the 
 notice, to ensure that, in the case of a child, a parent of the 
 child, or, in the case of a teen, the teen--
 ``
        (A) receives direct notice of the personal 
 information collection, use, and disclosure practices 
 of the operator; and
 ``
        (B) before the personal information of the child 
 or teen is collected, freely and unambiguously 
 authorizes--
 ``
            (i) the collection, use, and disclosure, 
 as applicable, of that personal information; 
 and
 ``
            (ii) any subsequent use of that personal 
 information.'';

    (5) in paragraph

    (10) --
        (A) in the paragraph header, by striking ``Website 
 or online service directed to children'' and inserting 
 ``Website, online service, online application, or 
 mobile application directed to children'';
        (B) by striking ``website or online service'' each 
 place it appears and inserting ``website, online 
 service, online application, or mobile application''; 
 and
            (C) by adding at the end the following new 
 subparagraph:
 ``
            (C) Rule of construction.--In considering whether 
 a website, online service, online application, or 
 mobile application, or portion thereof, is directed to 
 children, the Commission shall apply a totality of 
 circumstances test and will also consider competent and 
 reliable empirical evidence regarding audience 
 composition and evidence regarding the intended 
 audience of the website, online service, online 
 application, or mobile application.''; and

    (6) by adding at the end the following:
 ``

    (13) Connected device.--The term `connected device' means 
 a device that is capable of connecting to the internet, 
 directly or indirectly, or to another connected device.
 ``

    (14) Online application.--The term `online application'--
 ``
        (A) means an internet-connected software program; 
 and
 ``
        (B) includes a service or application offered via 
 a connected device.
 ``

    (15) Mobile application.--The term `mobile application'--
 ``
        (A) means a software program that runs on the 
 operating system of--
 ``
            (i) a cellular telephone;
 ``
            (ii) a tablet computer; or
 ``
            (iii) a similar portable computing device 
 that transmits data over a wireless connection; 
 and
 ``
        (B) includes a service or application offered via 
 a connected device.
 ``

    (16) Geolocation information.--The term `geolocation 
 information' means information sufficient to identify a street 
 name and name of a city or town.
 ``

    (17) Teen.--The term `teen' means an individual who has 
 attained age 13 and is under the age of 17.
 ``

    (18) Individual-specific advertising to children or 
 teens.--
 ``
        (A) In general.--The term `individual-specific 
 advertising to children or teens' means advertising or 
 any other effort to market a product or service that is 
 directed to a specific child or teen or a connected 
 device that is linked or reasonably linkable to a child 
 or teen based on--
 ``
            (i) the personal information from--
 ``
            (I) the child or teen; or
 ``
            (II) a group of children or teens 
 who are similar in sex, age, household 
 income level, race, or ethnicity to the 
 specific child or teen to whom the 
 product or service is marketed;
 ``
            (ii) profiling of a child or teen or 
 group of children or teens; or
 ``
            (iii) a unique identifier of the 
 connected device.
 ``
        (B) Exclusions.--The term `individual-specific 
 advertising to children or teens' shall not include--
 ``
            (i) advertising or marketing to an 
 individual or the device of an individual in 
 response to the individual's specific request 
 for information or feedback, such as a child's 
 or teen's current search query;
 ``
            (ii) contextual advertising, such as when 
 an advertisement is displayed based on the 
 content of the website, online service, online 
 application, mobile application, or connected 
 device in which the advertisement appears and 
 does not vary based on personal information 
 related to the viewer; or
 ``
            (iii) processing personal information 
 solely for measuring or reporting advertising 
 or content performance, reach, or frequency, 
 including independent measurement.
 ``
            (C) Rule of construction.--Nothing in 
 subparagraph
        (A) shall be construed to prohibit an 
 operator with actual knowledge or knowledge fairly 
 implied on the basis of objective circumstances that a 
 user is under the age of 17 from delivering advertising 
 or marketing that is age-appropriate and intended for a 
 child or teen audience, so long as the operator does 
 not use any personal information other than whether the 
 user is under the age of 17.
 ``

    (19) Educational agency or institution.--The term 
 `educational agency or institution' means--
 ``
        (A) a State educational agency or local 
 educational agency, as such terms are defined in 
 

section 8101 of the Elementary and Secondary Education 
 Act of 1965 (20 U.S.C. 7801); or
 ``
        (B) an institutional day or residential school, 
 including a public school (including a charter school) 
 or private school, that provides elementary or 
 secondary education, as determined under State law.''.

    (b) Online Collection, Use, Disclosure, and Deletion of Personal 
Information of Children and Teens.--

Section 1303 of the Children's 
Online Privacy Protection Act of 1998 (15 U.S.C. 6502) is amended--

    (1) by striking the heading and inserting the following: 
 ``online collection, use, disclosure, and deletion of personal 
 information of children and teens.'';

    (2) in subsection

    (a) --
        (A) by amending paragraph

    (1) to read as follows:
 ``

    (1) In general.--It is unlawful for an operator of a 
 website, online service, online application, or mobile 
 application directed to children or for any operator of a 
 website, online service, online application, or mobile 
 application with actual knowledge or knowledge fairly implied 
 on the basis of objective circumstances that a user is a child 
 or teen--
 ``
        (A) to collect personal information from a child 
 or teen in a manner that violates the regulations 
 prescribed under subsection

    (b) ;
 ``
        (B) except as provided in subparagraphs
        (B) and
            (C) of 

section 1302

    (18) , to collect, use, disclose to 
 third parties, or maintain personal information of a 
 child or teen for purposes of individual-specific 
 advertising to children or teens (or to allow another 
 person to collect, use, disclose, or maintain such 
 information for such purpose);
 ``
            (C) to collect the personal information of a 
 child or teen except when the collection of the 
 personal information is--
 ``
            (i) consistent with the context of a 
 particular transaction or service or the 
 relationship of the child or teen with the 
 operator, including collection necessary to 
 fulfill a transaction or provide a product or 
 service requested by the child or teen; or
 ``
            (ii) required or specifically authorized 
 by Federal or State law; or
 ``
            (D) to store or transfer the personal information 
 of a child or teen outside of the United States unless 
 the operator provides direct notice to the parent of 
 the child, in the case of a child, or to the teen, in 
 the case of a teen, that the child's or teen's personal 
 information is being stored or transferred outside of 
 the United States; or
 ``
        (E) to retain the personal information of a child 
 or teen for longer than is reasonably necessary to 
 fulfill a transaction or provide a service requested by 
 the child or teen except as required or specifically 
 authorized by Federal or State law.''; and
        (B) in paragraph

    (2) --
            (i) in the header, by striking ``parent'' 
 and inserting ```parent or teen''';
            (ii) by striking ``Notwithstanding 
 paragraph

    (1) '' and inserting ``Notwithstanding 
 paragraph

    (1)
        (A) '';
            (iii) by striking ``of such a website or 
 online service''; and
            (iv) by striking ``subsection

    (b)

    (1)
        (B)
            (iii) to the parent of a child'' and 
 inserting ``subsection

    (b)

    (1)
        (B)
            (iv) to the 
 parent of a child or under subsection

    (b)

    (1)
            (C) 
            (iv) to a teen'';

    (3) in subsection

    (b) --
        (A) in paragraph

    (1) --
            (i) in subparagraph
        (A) --
            (I) by striking ``operator of any 
 website'' and all that follows through 
 ``from a child'' and inserting 
 ``operator of a website, online 
 service, online application, or mobile 
 application directed to children or 
 that has actual knowledge or knowledge 
 fairly implied on the basis of 
 objective circumstances that a user is 
 a child or teen'';
            (II) in clause
            (i) --

    (aa) by striking ``notice 
 on the website'' and inserting 
 ``clear and conspicuous notice 
 on the website'';

    (bb) by inserting ``or 
 teens'' after ``children'';
            (cc) by striking ``, and 
 the operator's'' and inserting 
 ``, the operator's''; and
            (dd) by striking ``; and'' 
 and inserting ``, the rights 
 and opportunities available to 
 the parent of the child or teen 
 under subparagraphs
        (B) and
            (C) , and the procedures or 
 mechanisms the operator uses to 
 ensure that personal 
 information is not collected 
 from children or teens except 
 in accordance with the 
 regulations promulgated under 
 this paragraph;'';
            (III) in clause
            (ii) --

    (aa) by striking 
 ``parental'';

    (bb) by inserting ``or 
 teens'' after ``children'';
            (cc) by striking the 
 semicolon at the end and 
 inserting ``; and''; and
            (IV) by inserting after clause
            (ii) the following new clause:
 ``
            (iii) to obtain verifiable consent from a 
 parent of a child or from a teen before using 
 or disclosing personal information of the child 
 or teen for any purpose that is a material 
 change from the original purposes and 
 disclosure practices specified to the parent of 
 the child or the teen under clause
            (i) ;'';
            (ii) in subparagraph
        (B) --
            (I) in the matter preceding clause
            (i) , by striking ``website or online 
 service'' and inserting ``operator'';
            (II) in clause
            (i) , by inserting 
 ``and the method by which the operator 
 obtained the personal information, and 
 the purposes for which the operator 
 collects, uses, discloses, and retains 
 the personal information'' before the 
 semicolon;
            (III) in clause
            (ii) --

    (aa) by inserting ``to 
 delete personal information 
 collected from the child or 
 content or information 
 submitted by the child to a 
 website, online service, online 
 application, or mobile 
 application and'' after ``the 
 opportunity at any time''; and

    (bb) by striking ``; and'' 
 and inserting a semicolon;
            (IV) by redesignating clause
            (iii) as clause
            (iv) and inserting after 
 clause
            (ii) the following new clause:
 ``
            (iii) the opportunity to challenge the 
 accuracy of the personal information and, if 
 the parent of the child establishes the 
 inaccuracy of the personal information, to have 
 the inaccurate personal information 
 corrected;''; and
            (V) in clause
            (iv) , as so 
 redesignated, by inserting ``, if such 
 information is available to the 
 operator at the time the parent makes 
 the request'' before the semicolon;
            (iii) by redesignating subparagraphs
            (C) and
            (D) as subparagraphs
            (D) and
        (E) , 
 respectively;
            (iv) by inserting after subparagraph
        (B) the following new subparagraph:
 ``
            (C) require the operator to provide, upon the 
 request of a teen under this subparagraph who has 
 provided personal information to the operator, upon 
 proper identification of that teen--
 ``
            (i) a description of the specific types 
 of personal information collected from the teen 
 by the operator, the method by which the 
 operator obtained the personal information, and 
 the purposes for which the operator collects, 
 uses, discloses, and retains the personal 
 information;
 ``
            (ii) the opportunity at any time to 
 delete personal information collected from the 
 teen or content or information submitted by the 
 teen to a website, online service, online 
 application, or mobile application and to 
 refuse to permit the operator's further use or 
 maintenance in retrievable form, or online 
 collection, of personal information from the 
 teen;
 ``
            (iii) the opportunity to challenge the 
 accuracy of the personal information and, if 
 the teen establishes the inaccuracy of the 
 personal information, to have the inaccurate 
 personal information corrected; and
 ``
            (iv) a means that is reasonable under the 
 circumstances for the teen to obtain any 
 personal information collected from the teen, 
 if such information is available to the 
 operator at the time the teen makes the 
 request;'';
            (v) in subparagraph
            (D) , as so 
 redesignated--
            (I) by striking ``a child's'' and 
 inserting ``a child's or teen's''; and
            (II) by inserting ``or teen'' after 
 ``the child''; and
            (vi) by amending subparagraph
        (E) , as so 
 redesignated, to read as follows:
 ``
        (E) require the operator to establish, implement, 
 and maintain reasonable security practices to protect 
 the confidentiality, integrity, and accessibility of 
 personal information of children or teens collected by 
 the operator, and to protect such personal information 
 against unauthorized access.'';
        (B) in paragraph

    (2) --
            (i) in the matter preceding subparagraph
        (A) , by striking ``verifiable parental 
 consent'' and inserting ``verifiable consent'';
            (ii) in subparagraph
        (A) --
            (I) by inserting ``or teen'' after 
 ``collected from a child'';
            (II) by inserting ``or teen'' after 
 ``request from the child''; and
            (III) by inserting ``or teen or to 
 contact another child or teen'' after 
 ``to recontact the child'';
            (iii) in subparagraph
        (B) --
            (I) by striking ``parent or child'' 
 and inserting ``parent or teen''; and
            (II) by striking ``parental 
 consent'' each place the term appears 
 and inserting ``verifiable consent'';
            (iv) in subparagraph
            (C) --
            (I) in the matter preceding clause
            (i) , by inserting ``or teen'' after 
 ``child'' each place the term appears;
            (II) in clause
            (i) --

    (aa) by inserting ``or 
 teen'' after ``child'' each 
 place the term appears; and

    (bb) by inserting ``or 
 teen, as applicable,'' after 
 ``parent'' each place the term 
 appears; and
            (III) in clause
            (ii) --

    (aa) by striking ``without 
 notice to the parent'' and 
 inserting ``without notice to 
 the parent or teen, as 
 applicable,''; and

    (bb) by inserting ``or 
 teen'' after ``child'' each 
 place the term appears; and
            (v) in subparagraph
            (D) --
            (I) in the matter preceding clause
            (i) , by inserting ``or teen'' after 
 ``child'' each place the term appears;
            (II) in clause
            (ii) , by inserting 
 ``or teen'' after ``child''; and
            (III) in the flush text following 
 clause
            (iii) --

    (aa) by inserting ``or 
 teen, as applicable,'' after 
 ``parent'' each place the term 
 appears; and

    (bb) by inserting ``or 
 teen'' after ``child'';
            (C) by redesignating paragraph

    (3) as paragraph

    (4) and inserting after paragraph

    (2) the following new 
 paragraph:
 ``

    (3) Application to operators acting under agreements with 
 educational agencies or institutions.--The regulations may 
 provide that verifiable consent under paragraph

    (1)
        (A)
            (ii) is 
 not required for an operator that is acting under a written 
 agreement with an educational agency or institution that, at a 
 minimum, requires the--
 ``
        (A) operator to--
 ``
            (i) limit its collection, use, and 
 disclosure of the personal information from a 
 child or teen to solely educational purposes 
 and for no other commercial purposes;
 ``
            (ii) provide the educational agency or 
 institution with a notice of the specific types 
 of personal information the operator will 
 collect from the child or teen, the method by 
 which the operator will obtain the personal 
 information, and the purposes for which the 
 operator will collect, use, disclose, and 
 retain the personal information;
 ``
            (iii) provide the educational agency or 
 institution with a link to the operator's 
 online notice of information practices as 
 required under subsection

    (b)

    (1)
        (A)
            (i) ; and
 ``
            (iv) provide the educational agency or 
 institution, upon request, with a means to 
 review the personal information collected from 
 a child or teen, to prevent further use or 
 maintenance or future collection of personal 
 information from a child or teen, and to delete 
 personal information collected from a child or 
 teen or content or information submitted by a 
 child or teen to the operator's website, online 
 service, online application, or mobile 
 application;
 ``
        (B) representative of the educational agency or 
 institution to acknowledge and agree that they have 
 authority to authorize the collection, use, and 
 disclosure of personal information from children or 
 teens on behalf of the educational agency or 
 institution, along with such authorization, their name, 
 and title at the educational agency or institution; and
 ``
            (C) educational agency or institution to--
 ``
            (i) provide on its website a notice that 
 identifies the operator with which it has 
 entered into a written agreement under this 
 subsection and provides a link to the 
 operator's online notice of information 
 practices as required under paragraph

    (1)
        (A)
            (i) ;
 ``
            (ii) provide the operator's notice 
 regarding its information practices, as 
 required under subparagraph
        (A)
            (ii) , upon 
 request, to a parent, in the case of a child, 
 or a parent or teen, in the case of a teen; and
 ``
            (iii) upon the request of a parent, in 
 the case of a child, or a parent or teen, in 
 the case of a teen, request the operator 
 provide a means to review the personal 
 information from the child or teen and provide 
 the parent, in the case of a child, or parent 
 or teen, in the case of the teen, a means to 
 review the personal information.'';
            (D) by amending paragraph

    (4) , as so redesignated, 
 to read as follows:
 ``

    (4) Termination of service.--The regulations shall permit 
 the operator of a website, online service, online application, 
 or mobile application to terminate service provided to a child 
 whose parent has refused, or a teen who has refused, under the 
 regulations prescribed under paragraphs

    (1)
        (B)
            (ii) and

    (1)
            (C) 
            (ii) , to permit the operator's further use or maintenance 
 in retrievable form, or future online collection of, personal 
 information from that child or teen.''; and
        (E) by adding at the end the following new 
 paragraphs:
 ``

    (5) Continuation of service.--The regulations shall 
 prohibit an operator from discontinuing service provided to a 
 child or teen on the basis of a request by the parent of the 
 child or by the teen, under the regulations prescribed under 
 subparagraph
        (B) or
            (C) of paragraph

    (1) , respectively, to 
 delete personal information collected from the child or teen, 
 to the extent that the operator is capable of providing such 
 service without such information.
 ``

    (6) Rule of construction.--A request made pursuant to 
 subparagraph
        (B) or
            (C) of paragraph

    (1) to delete or correct 
 personal information of a child or teen shall not be 
 construed--
 ``
        (A) to limit the authority of a law enforcement 
 agency to obtain any content or information from an 
 operator pursuant to a lawfully executed warrant or an 
 order of a court of competent jurisdiction;
 ``
        (B) to require an operator or third party delete 
 or correct information that--
 ``
            (i) any other provision of Federal or 
 State law requires the operator or third party 
 to maintain; or
 ``
            (ii) was submitted to the website, online 
 service, online application, or mobile 
 application of the operator by any person other 
 than the user who is attempting to erase or 
 otherwise eliminate the content or information, 
 including content or information submitted by 
 the user that was republished or resubmitted by 
 another person; or
 ``
            (C) to prohibit an operator from--
 ``
            (i) retaining a record of the deletion 
 request and the minimum information necessary 
 for the purposes of ensuring compliance with a 
 request made pursuant to subparagraph
        (B) or
            (C) ;
 ``
            (ii) preventing, detecting, protecting 
 against, or responding to security incidents, 
 identity theft, or fraud, or reporting those 
 responsible for such actions;
 ``
            (iii) protecting the integrity or 
 security of a website, online service, online 
 application or mobile application; or
 ``
            (iv) ensuring that the child's or teen's 
 information remains deleted.
 ``

    (7) Common verifiable consent mechanism.--
 ``
        (A) In general.--
 ``
            (i) Feasibility of mechanism.--The 
 Commission shall assess the feasibility, with 
 notice and public comment, of allowing 
 operators the option to use a common verifiable 
 consent mechanism that fully meets the 
 requirements of this title.
 ``
            (ii) Requirements.--The feasibility 
 assessment described in clause
            (i) shall 
 consider whether a single operator could use a 
 common verifiable consent mechanism to obtain 
 verifiable consent, as required under this 
 title, from a parent of a child or from a teen 
 on behalf of multiple, listed operators that 
 provide a joint or related service.
 ``
        (B) Report.--Not later than 1 year after the date 
 of enactment of this paragraph, the Commission shall 
 submit a report to the Committee on Commerce, Science, 
 and Transportation of the Senate and the Committee on 
 Energy and Commerce of the House of Representatives 
 with the findings of the assessment required by 
 subparagraph
        (A) .
 ``
            (C) Regulations.--If the Commission finds that 
 the use of a common verifiable consent mechanism is 
 feasible and would meet the requirements of this title, 
 the Commission shall issue regulations to permit the 
 use of a common verifiable consent mechanism in 
 accordance with the findings outlined in such 
 report.'';

    (4) in subsection
            (c) , by striking ``a regulation 
 prescribed under subsection

    (a) '' and inserting ``subparagraph
        (B) ,
            (C) ,
            (D) , or
        (E) of subsection

    (a)

    (1) , or of a regulation 
 prescribed under subsection

    (b) ,''; and

    (5) by striking subsection
            (d) and inserting the following:
 ``
            (d) Relationship to State Law.--The provisions of this title 
shall preempt any State law, rule, or regulation only to the extent 
that such State law, rule, or regulation conflicts with a provision of 
this title. Nothing in this title shall be construed to prohibit any 
State from enacting a law, rule, or regulation that provides greater 
protection to children or teens than the provisions of this title.''.
            (c) Safe Harbors.--

Section 1304 of the Children's Online Privacy 
Protection Act of 1998 (15 U.S.C. 6503) is amended--

    (1) in subsection

    (b)

    (1) , by inserting ``and teens'' after 
 ``children''; and

    (2) by adding at the end the following:
 ``
            (d) Publication.--
 ``

    (1) In general.--Subject to the restrictions described in 
 paragraph

    (2) , the Commission shall publish on the internet 
 website of the Commission any report or documentation required 
 by regulation to be submitted to the Commission to carry out 
 this section.
 ``

    (2) Restrictions on publication.--The restrictions 
 described in 

section 6

    (f) and 

section 21 of the Federal Trade 
 Commission Act (15 U.S.C. 46

    (f) , 57b-2) applicable to the 
 disclosure of information obtained by the Commission shall 
 apply in same manner to the disclosure under this subsection of 
 information obtained by the Commission from a report or 
 documentation described in paragraph

    (1) .''.
            (d) Actions by States.--

Section 1305 of the Children's Online 
Privacy Protection Act of 1998 (15 U.S.C. 6504) is amended--

    (1) in subsection

    (a)

    (1) --
        (A) in the matter preceding subparagraph
        (A) , by 
 inserting ``

section 1303

    (a)

    (1) or'' before ``any 
 regulation''; and
        (B) in subparagraph
        (B) , by inserting ``

section 1303

    (a)

    (1) or'' before ``the regulation''; and

    (2) in subsection
            (d) --
        (A) by inserting ``

section 1303

    (a)

    (1) or'' before 
 ``any regulation''; and
        (B) by inserting ``

section 1303

    (a)

    (1) or'' before 
 ``that regulation''.

    (e) Administration and Applicability of Act.--

Section 1306 of the 
Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6505) is 
amended--

    (1) in subsection

    (b) --
        (A) in paragraph

    (1) , by striking ``, in the case 
 of'' and all that follows through ``the Board of 
 Directors of the Federal Deposit Insurance 
 Corporation;'' and inserting the following: ``by the 
 appropriate Federal banking agency, with respect to any 
 insured depository institution (as those terms are 
 defined in 

section 3 of that Act (12 U.S.C. 1813));''; 
 and
        (B) by striking paragraph

    (2) and redesignating 
 paragraphs

    (3) through

    (6) as paragraphs

    (2) through

    (5) , respectively;

    (2) in subsection
            (d) --
        (A) by inserting ``

section 1303

    (a)

    (1) or'' before 
 ``a rule''; and
        (B) by striking ``such rule'' and inserting 
 ``

section 1303

    (a)

    (1) or a rule of the Commission under 
 

section 1303''; and

    (3) by adding at the end the following new subsections:
 ``

    (f) Determination of Whether an Operator Has Knowledge Fairly 
Implied on the Basis of Objective Circumstances.--
 ``

    (1) Rule of construction.--For purposes of enforcing this 
 title or a regulation promulgated under this title, in making a 
 determination as to whether an operator has knowledge fairly 
 implied on the basis of objective circumstances that a specific 
 user is a child or teen, the Commission or State attorneys 
 general shall rely on competent and reliable evidence, taking 
 into account the totality of the circumstances, including 
 whether a reasonable and prudent person under the circumstances 
 would have known that the user is a child or teen. Nothing in 
 this title, including a determination described in the 
 preceding sentence, shall be construed to require an operator 
 to--
 ``
        (A) affirmatively collect any personal 
 information with respect to the age of a child or teen 
 that an operator is not already collecting in the 
 normal course of business; or
 ``
        (B) implement an age gating or age verification 
 functionality.
 ``

    (2) Commission guidance.--
 ``
        (A) In general.--Within 180 days of enactment, 
 the Commission shall issue guidance to provide 
 information, including best practices and examples for 
 operators to understand the Commission's determination 
 of whether an operator has knowledge fairly implied on 
 the basis of objective circumstances that a user is a 
 child or teen.
 ``
        (B) Limitation.--No guidance issued by the 
 Commission with respect to this title shall confer any 
 rights on any person, State, or locality, nor shall 
 operate to bind the Commission or any person to the 
 approach recommended in such guidance. In any 
 enforcement action brought pursuant to this title, the 
 Commission or State attorney general, as applicable, 
 shall allege a specific violation of a provision of 
 this title. The Commission or State attorney general, 
 as applicable, may not base an enforcement action on, 
 or execute a consent order based on, practices that are 
 alleged to be inconsistent with any such guidance, 
 unless the practices allegedly violate this title. For 
 purposes of enforcing this title or a regulation 
 promulgated under this title, State attorneys general 
 shall take into account any guidance issued by the 
 Commission under subparagraph
        (A) .
 ``

    (g) Additional Requirement.--Any regulations issued under this 
title shall include a description and analysis of the impact of 
proposed and final Rules on small entities per the Regulatory 
Flexibility Act of 1980 (5 U.S.C. 601 et seq.).''.

SEC. 3. STUDY AND REPORTS OF MOBILE AND ONLINE APPLICATION OVERSIGHT 
 AND ENFORCEMENT.

    (a) Oversight Report.--Not later than 3 years after the date of 
enactment of this Act, the Federal Trade Commission shall submit to the 
Committee on Commerce, Science, and Transportation of the Senate and 
the Committee on Energy and Commerce of the House of Representatives a 
report on the processes of platforms that offer mobile and online 
applications for ensuring that, of those applications that are 
websites, online services, online applications, or mobile applications 
directed to children, the applications operate in accordance with--

    (1) this Act, the amendments made by this Act, and rules 
 promulgated under this Act; and

    (2) rules promulgated by the Commission under 

section 18 of 
 the Federal Trade Commission Act (15 U.S.C. 57a) relating to 
 unfair or deceptive acts or practices in marketing.

    (b) Enforcement Report.--Not later than 1 year after the date of 
enactment of this Act, and each year thereafter, the Federal Trade 
Commission shall submit to the Committee on Commerce, Science, and 
Transportation of the Senate and the Committee on Energy and Commerce 
of the House of Representatives a report that addresses, at a minimum--

    (1) the number of actions brought by the Commission during 
 the reporting year to enforce the Children's Online Privacy 
 Protection Act of 1998 (15 U.S.C. 6501) (referred to in this 
 subsection as the ``Act'') and the outcome of each such action;

    (2) the total number of investigations or inquiries into 
 potential violations of the Act; during the reporting year;

    (3) the total number of open investigations or inquiries 
 into potential violations of the Act as of the time the report 
 is submitted;

    (4) the number and nature of complaints received by the 
 Commission relating to an allegation of a violation of the Act 
 during the reporting year; and

    (5) policy or legislative recommendations to strengthen 
 online protections for children and teens.

SEC. 4. GAO STUDY.

    (a) Study.--The Comptroller General of the United States (in this 
section referred to as the ``Comptroller General'') shall conduct a 
study on the privacy of teens who use financial technology products. 
Such study shall--

    (1) identify the type of financial technology products that 
 teens are using;

    (2) identify the potential risks to teens' privacy from 
 using such financial technology products; and

    (3) determine whether existing laws are sufficient to 
 address such risks to teens' privacy.

    (b) Report.--Not later than 1 year after the date of enactment of 
this section, the Comptroller General shall submit to Congress a report 
containing the results of the study conducted under subsection

    (a) , 
together with recommendations for such legislation and administrative 
action as the Comptroller General determines appropriate.

SEC. 5. SEVERABILITY.

 If any provision of this Act, or an amendment made by this Act, is 
determined to be unenforceable or invalid, the remaining provisions of 
this Act and the amendments made by this Act shall not be affected.
 <all>