What This Bill Does
This bill changes the Children's Online Privacy Protection Act of 1998 to let people over age 13 ask websites and online services to delete personal information that was collected about them when they were under age 13. Website operators must follow these deletion requests, even if a parent gave permission to collect that information when the person was a child.
Who It Affects
- People over age 13 who used websites or online services as children
- Legal guardians acting on behalf of people over age 13
- Website and online service operators that collect information from children or are directed to children
- The Federal Trade Commission (the agency that enforces these rules)
Key Provisions
- Website operators must provide a notice in a prominent place showing how someone over 13 or their legal guardian can request deletion of information collected when they were a child (Sec. 2(b)(2))
- Website operators must promptly delete all personal information collected from a person when they were a child if that person requests it after turning 13 (Sec. 2(b)(2))
- Website operators must send written confirmation after they delete the requested information (Sec. 2(b)(2))
- It is illegal for a website operator to fail to delete personal information when someone requests deletion under these new rules (Sec. 2(b)(1))
- Website operators can keep information only if it is needed to respond to court orders or to help law enforcement with public safety matters, and only for as long as necessary (Sec. 2(b)(2))
What Changes
The Federal Trade Commission has one year from when this law passes to write detailed rules explaining exactly how website operators must handle deletion requests. Website operators will be required by law to delete children's personal information when requested by that person after they turn 13.
Important Definitions
"Delete" means to remove personal information so completely that it cannot be found in normal business operations and cannot be retrieved.
Effective Date
Not specified in bill text
II
118TH CONGRESS
1ST SESSION
S. 395
To amend the Children’s Online Privacy Protection Act of 1998 to give
Americans the option to delete personal information collected by internet
operators as a result of the person’s internet activity prior to age 13.
IN THE SENATE OF THE UNITED STATES
FEBRUARY 13, 2023
Mr. DURBIN (for himself, Mr. BLUMENTHAL, and Ms. HIRONO) introduced
the following bill; which was read twice and referred to the Committee
on Commerce, Science, and Transportation
A BILL
To amend the Children’s Online Privacy Protection Act of
1998 to give Americans the option to delete personal
information collected by internet operators as a result
of the person’s internet activity prior to age 13.
Be it enacted by the Senate and House of Representa-
1
tives of the United States of America in Congress assembled,
2
SECTION 1. SHORT TITLE.
3
This Act may be cited as the ‘‘Clean Slate for Kids
4
Online Act of 2023’’.
5
VerDate Sep 11 2014
22:35 Feb 28, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\S395.IS
S395
kjohnson on DSK79L0C42PROD with BILLS
2
•S 395 IS
SEC. 2. ENHANCING THE CHILDREN’S ONLINE PRIVACY
1
PROTECTION ACT OF 1998.
2
(a) DEFINITIONS.—Section 1302 of the Children’s
3
Online Privacy Protection Act of 1998 (15 U.S.C. 6501)
4
is amended by adding at the end the following:
5
‘‘(13) DELETE.—The term ‘delete’ means to re-
6
move personal information such that the information
7
is not maintained in retrievable form and cannot be
8
retrieved in the normal course of business.’’.
9
(b) REGULATION OF UNFAIR AND DECEPTIVE ACTS
10
AND PRACTICES IN CONNECTION WITH THE COLLECTION
11
AND USE OF PERSONAL INFORMATION FROM AND ABOUT
12
CHILDREN ON THE INTERNET.—Section 1303 of the Chil-
13
dren’s Online Privacy Protection Act of 1998 (15 U.S.C.
14
6502) is amended—
15
(1) in subsection (a), by adding at the end the
16
following:
17
‘‘(3) FAILURE TO DELETE.—It is unlawful for
18
an operator of a website or online service directed to
19
children, or any operator that has actual knowledge
20
that it is collecting personal information from a
21
child, to fail to delete personal information collected
22
from or about a child if a request for deletion is
23
made pursuant to regulations prescribed under sub-
24
section (e).’’; and
25
(2) by adding at the end the following:
26
VerDate Sep 11 2014
22:35 Feb 28, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\S395.IS
S395
kjohnson on DSK79L0C42PROD with BILLS
3
•S 395 IS
‘‘(e) RIGHT OF AN INDIVIDUAL TO DELETE PER-
1
SONAL INFORMATION COLLECTED WHEN THE PERSON
2
WAS A CHILD.—
3
‘‘(1) IN GENERAL.—Not later than 1 year after
4
the date of enactment of this subsection, the Com-
5
mission shall promulgate under section 553 of title
6
5, United States Code, regulations that require the
7
operator of any website or online service directed to
8
children, or any operator that has actual knowledge
9
that it has collected personal information from a
10
child or maintains such personal information—
11
‘‘(A) to provide notice in a prominent place
12
on the website of how an individual over the age
13
of 13, or a legal guardian of an individual over
14
the age of 13 acting with the knowledge and
15
consent of the individual, can request that the
16
operator delete all personal information in the
17
possession of the operator that was collected
18
from or about the individual when the indi-
19
vidual was a child notwithstanding any parental
20
consent that may have been provided when the
21
individual was a child;
22
‘‘(B) to promptly delete all personal infor-
23
mation in the possession of the operator that
24
was collected from or about an individual when
25
VerDate Sep 11 2014
22:35 Feb 28, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\S395.IS
S395
kjohnson on DSK79L0C42PROD with BILLS
4
•S 395 IS
the individual was a child when such deletion is
1
requested by an individual over the age of 13
2
or by the legal guardian of such individual act-
3
ing with the knowledge and consent of the indi-
4
vidual, notwithstanding any parental consent
5
that may have been provided when the indi-
6
vidual was a child;
7
‘‘(C) to provide written confirmation of de-
8
letion, after the deletion has occurred, to an in-
9
dividual or legal guardian of such individual
10
who has requested such deletion pursuant to
11
this subsection; and
12
‘‘(D) to except from deletion personal in-
13
formation collected from or about a child—
14
‘‘(i) only to the extent that the per-
15
sonal information is necessary—
16
‘‘(I) to respond to judicial proc-
17
ess; or
18
‘‘(II) to the extent permitted
19
under any other provision of law, to
20
provide information to law enforce-
21
ment agencies or for an investigation
22
on a matter related to public safety;
23
and
24
VerDate Sep 11 2014
22:35 Feb 28, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\S395.IS
S395
kjohnson on DSK79L0C42PROD with BILLS
5
•S 395 IS
‘‘(ii) if the operator retain such ex-
1
cepted personal information for only as
2
long as reasonably necessary to fulfill the
3
purpose for which the information has
4
been excepted and that the excepted infor-
5
mation not be used, disseminated or main-
6
tained in a form retrievable to anyone ex-
7
cept for the purposes specified in this sub-
8
paragraph.’’.
9
(c) SAFE HARBORS.—Section 1304 of the Children’s
10
Online Privacy Protection Act of 1998 (15 U.S.C. 6503)
11
is amended—
12
(1) in subsection (a), by striking ‘‘section
13
1303(b)’’ and inserting ‘‘subsections (b) and (e) of
14
section 1303’’; and
15
(2) in subsection (b)(1), by striking ‘‘subsection
16
(b)’’ and inserting ‘‘subsections (b) and (e)’’.
17
(d) ACTIONS BY STATES.—Section 1305(a)(1) of the
18
Children’s Online Privacy Protection Act of 1998 (15
19
U.S.C. 6504(a)(1)) is amended by striking ‘‘1303(b)’’ and
20
inserting ‘‘subsection (b) or (e) of section 1303’’.
21
Æ
VerDate Sep 11 2014
22:35 Feb 28, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6301
E:\BILLS\S395.IS
S395
kjohnson on DSK79L0C42PROD with BILLS