Children and Teens’ Online Privacy Protection Act

II Calendar No. 658 117TH CONGRESS 2D SESSION S. 1628 To amend the Children’s Online Privacy Protection Act of 1998 to strengthen protections relating to the online collection, use, and disclosure of per- sonal information of children and minors, and for other purposes. IN THE SENATE OF THE UNITED STATES MAY 13, 2021 Mr. MARKEY (for himself, Mr. CASSIDY, Mr. BLUMENTHAL, and Ms. LUMMIS) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation DECEMBER 15, 2022 Reported by Ms. CANTWELL, with an amendment [Strike out all after the enacting clause and insert the part printed in italic] A BILL To amend the Children’s Online Privacy Protection Act of 1998 to strengthen protections relating to the online collection, use, and disclosure of personal information of children and minors, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 03:39 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S1628.RS S1628 kjohnson on DSK79L0C42PROD with BILLS 2 •S 1628 RS SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 1 (a) SHORT TITLE.—This Act may be cited as the 2 ‘‘Children and Teens’ Online Privacy Protection Act’’. 3 (b) TABLE OF CONTENTS.—The table of contents for 4 this Act is as follows: 5 Sec. 1. Table of contents. Sec. 2. Definitions. Sec. 3. Online collection, use, and disclosure of personal information of children and minors. Sec. 4. Fair Information Practices Principles. Sec. 5. Digital Marketing Bill of Rights for Minors. Sec. 6. Targeted marketing to children or minors. Sec. 7. Removal of content. Sec. 8. Privacy dashboard for connected devices for children and minors. Sec. 9. Prohibition on sale of connected devices for children and minors that fail to meet appropriate cybersecurity and data security stand- ards. Sec. 10. Rule for treatment of users of websites, services, and applications di- rected to children or minors. Sec. 11. Study of mobile and online application oversight. Sec. 12. Youth Privacy and Marketing Division. Sec. 13. Enforcement and applicability. SEC. 2. DEFINITIONS. 6 (a) IN GENERAL.—In this Act: 7 (1) COMMISSION.—The term ‘‘Commission’’ 8 means the Federal Trade Commission. 9 (2) CONSTRUCTIVE KNOWLEDGE.— 10 (A) IN GENERAL.—The term ‘‘constructive 11 knowledge’’ means that knowledge that a minor 12 is a minor under section 5(a)(1)(A)(i)(II) shall 13 be imputed, at a minimum, to an operator if— 14 (i) the operator directly or indirectly 15 collects, uses, profiles, buys, sells, classi- 16 fies, or analyzes (using an algorithm or 17 VerDate Sep 11 2014 03:39 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6401 E:\BILLS\S1628.RS S1628 kjohnson on DSK79L0C42PROD with BILLS 3 •S 1628 RS other form of data analytics) data about a 1 user or groups of users to estimate, iden- 2 tify, or classify the age, age range, or 3 proxy thereof; 4 (ii) the operator directly or indirectly 5 collects, uses, profiles, buys, sells, classifies 6 or analyzes (using an algorithm or other 7 form of data analytics) data about the na- 8 ture of the content of the website, online 9 service, online application, or mobile appli- 10 cation that estimates, identifies, or classi- 11 fies the content as directed to users of a 12 particular age range or similarly estimates, 13 identifies, or classifies the intended or like- 14 ly audience for the content; 15 (iii) the operator has or receives data 16 or reporting related to the age of users on 17 the website, online service, online applica- 18 tion, or mobile application under the self- 19 regulatory guidelines described in section 20 1304 of the Children’s Online Privacy Pro- 21 tection Act of 1998 (15 U.S.C. 6503) that 22 documents risks and controls, including the 23 existence of operator-controlled data ana- 24 VerDate Sep 11 2014 03:39 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6401 E:\BILLS\S1628.RS S1628 kjohnson on DSK79L0C42PROD with BILLS 4 •S 1628 RS lytics and content analytics capabilities and 1 functions or outputs; 2 (iv) the operator has or receives com- 3 plaints from parents or other third parties 4 about the age of users using its service, 5 whether through the operators’ complaint 6 mechanism, by email, or other means con- 7 veniently accessible by the user; 8 (v) the operator has or receives data 9 or reporting or information from the oper- 10 ator’s internal communications, including 11 documentation about its advertising prac- 12 tices, such as an advertisement insertion 13 order, or other promotional material to 14 marketers, that indicates that data is being 15 collected from users of a particular age 16 range that are using the product or serv- 17 ice; 18 (vi) the operator has publicly available 19 data or reporting regarding the operator’s 20 product or service indicating that users of 21 a particular age range are using the prod- 22 uct or service; or 23 (vii) a content provider on the opera- 24 tor’s website, online service, online applica- 25 VerDate Sep 11 2014 03:39 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6401 E:\BILLS\S1628.RS S1628 kjohnson on DSK79L0C42PROD with BILLS 5 •S 1628 RS tion, or mobile application communicates 1 to an ad-network that the content is in- 2 tended for users of a particular age range 3 or likely to appeal to users of a particular 4 age range, whether directly or indirectly. 5 (B) ADDITIONAL FACTORS.—The Commis- 6 sion may issue guidance or promulgate rules 7 that indicate factors, in addition to those de- 8 scribed in subparagraph (A), that should be 9 considered to be constructive knowledge for 10 purposes of this Act. 11 (3) STANDARDS.—The term ‘‘standards’’ means 12 benchmarks, guidelines, best practices, methodolo- 13 gies, procedures, and processes. 14 (b) OTHER DEFINITIONS.—The definitions set forth 15 in section 1302 of the Children’s Online Privacy Protec- 16 tion Act of 1998 (15 U.S.C. 6501), as amended by section 17 3(a) of this Act, shall apply in this Act, except to the ex- 18 tent the Commission provides otherwise by regulations 19 issued under section 553 of title 5, United States Code. 20 VerDate Sep 11 2014 03:39 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6401 E:\BILLS\S1628.RS S1628 kjohnson on DSK79L0C42PROD with BILLS 6 •S 1628 RS SEC. 3. ONLINE COLLECTION, USE, AND DISCLOSURE OF 1 PERSONAL INFORMATION OF CHILDREN AND 2 MINORS. 3 (a) DEFINITIONS.—Section 1302 of the Children’s 4 Online Privacy Protection Act of 1998 (15 U.S.C. 6501) 5 is amended— 6 (1) by amending paragraph (2) to read as fol- 7 lows: 8 ‘‘(2) OPERATOR.—The term ‘operator’— 9 ‘‘(A) means any person— 10 ‘‘(i) who, for commercial purposes, in 11 interstate or foreign commerce operates or 12 provides a website on the internet, an on- 13 line service, an online application, or a mo- 14 bile application; and 15 ‘‘(ii) who— 16 ‘‘(I) collects or maintains, either 17 directly or through a service provider, 18 personal information from or about 19 the users of that website, service, ap- 20 plication, or connected device; 21 ‘‘(II) allows another person to 22 collect personal information directly 23 from users of that website, service, 24 application, or connected device (in 25 VerDate Sep 11 2014 03:39 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6401 E:\BILLS\S1628.RS S1628 kjohnson on DSK79L0C42PROD with BILLS 7 •S 1628 RS which case, the operator is deemed to 1 have collected the information); or 2 ‘‘(III) allows users of that 3 website, service, application, or con- 4 nected device to publicly disclose per- 5 sonal information (in which case, the 6 operator is deemed to have collected 7 the information); and 8 ‘‘(B) does not include any nonprofit entity 9 that would otherwise be exempt from coverage 10 under section 5 of the Federal Trade Commis- 11 sion Act (15 U.S.C. 45).’’; 12 (2) in paragraph (4)— 13 (A) by amending subparagraph (A) to read 14 as follows: 15 ‘‘(A) the release of personal information 16 collected from a child or minor for any purpose, 17 except where the personal information is pro- 18 vided to a person other than an operator who— 19 ‘‘(i) provides support for the internal 20 operations of the website, online service, 21 online application, or mobile application of 22 the operator, excluding any activity relat- 23 ing to targeted marketing directed to chil- 24 dren, minors, or connected devices; and 25 VerDate Sep 11 2014 03:39 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6401 E:\BILLS\S1628.RS S1628 kjohnson on DSK79L0C42PROD with BILLS 8 •S 1628 RS ‘‘(ii) does not disclose or use that per- 1 sonal information for any other purpose; 2 and’’; and 3 (B) in subparagraph (B)— 4 (i) by inserting ‘‘or minor’’ after 5 ‘‘child’’ each place the term appears; 6 (ii) by inserting ‘‘or minors’’ after 7 ‘‘children’’; and 8 (iii) by striking ‘‘website or online 9 service’’ and inserting ‘‘website, online 10 service, online application, or mobile appli- 11 cation’’; 12 (3) in paragraph (8), by striking subparagraphs 13 (F) and (G) and inserting the following: 14 ‘‘(F) geolocation information; 15 ‘‘(G) information used for biometric identi- 16 fication, as defined in section 70123 of title 46, 17 United States Code, of an individual; 18 ‘‘(H) information reasonably associated 19 with or attributed to an individual; 20 ‘‘(I) information (including an internet 21 protocol address) that permits the identification 22 of— 23 ‘‘(i) an individual; or 24 VerDate Sep 11 2014 03:39 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6401 E:\BILLS\S1628.RS S1628 kjohnson on DSK79L0C42PROD with BILLS 9 •S 1628 RS ‘‘(ii) any device used by an individual 1 to directly or indirectly access the internet 2 or an online service, online application, or 3 mobile application; or 4 ‘‘(J) information concerning a child or 5 minor or the parents of that child or minor (in- 6 cluding any unique or substantially unique iden- 7 tifier, such as a customer number) that an op- 8 erator collects online from the child or minor 9 and combines with an identifier described in 10 this paragraph.’’; 11 (4) by amending paragraph (9) to read as fol- 12 lows: 13 ‘‘(9) VERIFIABLE CONSENT.—The term ‘verifi- 14 able consent’ means any reasonable effort (taking 15 into consideration available technology), including a 16 request for authorization for future collection, use, 17 and disclosure described in the notice, to ensure 18 that, in the case of a child, a parent of the child, 19 or, in the case of a minor, the minor— 20 ‘‘(A) receives specific notice of the personal 21 information collection, use, and disclosure prac- 22 tices of the operator; and 23 VerDate Sep 11 2014 03:39 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6401 E:\BILLS\S1628.RS S1628 kjohnson on DSK79L0C42PROD with BILLS 10 •S 1628 RS ‘‘(B) before the personal information of the 1 child or minor is collected, freely and unambig- 2 uously authorizes— 3 ‘‘(i) the collection, use, and disclosure, 4 as applicable, of that personal information; 5 and 6 ‘‘(ii) any subsequent use of that per- 7 sonal information.’’; 8 (5) by striking paragraph (10) and redesig- 9 nating paragraphs (11) and (12) as paragraphs (10) 10 and (11), respectively; and 11 (6) by adding at the end the following: 12 ‘‘(12) CONNECTED DEVICE.—The term ‘con- 13 nected device’ means a device that is capable of con- 14 necting to the internet, directly or indirectly, or to 15 another connected device. 16 ‘‘(13) ONLINE.—The term ‘online’ means— 17 ‘‘(A) connected to or compatible with the 18 internet; or 19 ‘‘(B) via the internet. 20 ‘‘(14) ONLINE APPLICATION.—The term ‘online 21 application’— 22 ‘‘(A) means an internet-connected software 23 program; and 24 VerDate Sep 11 2014 03:39 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6401 E:\BILLS\S1628.RS S1628 kjohnson on DSK79L0C42PROD with BILLS 11 •S 1628 RS ‘‘(B) includes a service or application of- 1 fered via a connected device. 2 ‘‘(15) ONLINE SERVICE.—The term ‘online 3 service’— 4 ‘‘(A) means broadband internet access 5 service, as defined in the Report and Order on 6 Remand, Declaratory Ruling, and Order in the 7 matter of protecting and promoting the open 8 internet, adopted by the Federal Communica- 9 tions Commission on February 26, 2015 (FCC 10 15–24); and 11 ‘‘(B) includes a service or application of- 12 fered via a connected device. 13 ‘‘(16) DIRECTED TO A CHILD OR MINOR.— 14 ‘‘(A) IN GENERAL.—The terms ‘directed to 15 a child’ or ‘directed to a minor’ means, with re- 16 spect to a website, online service, online applica- 17 tion, or mobile application, the website, online 18 service, online application, or mobile application 19 is targeted to children or minors, as the case 20 may be, as demonstrated by— 21 ‘‘(i) the subject matter of the website, 22 online service, online application, or mobile 23 application; 24 VerDate Sep 11 2014 03:39 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6401 E:\BILLS\S1628.RS S1628 kjohnson on DSK79L0C42PROD with BILLS 12 •S 1628 RS ‘‘(ii) the visual content of the website, 1 online service, online application, or mobile 2 application; 3 ‘‘(iii) the use of animated characters 4 or child-oriented activities for children, or 5 the use of minor-oriented characters or 6 minor-oriented activities for minors, and 7 related incentives on the website, online 8 service, online application, or mobile appli- 9 cation; 10 ‘‘(iv) the music or other audio content 11 on the website, online service, online appli- 12 cation, or mobile application; 13 ‘‘(v) the age of models on the website, 14 online service, online application, or mobile 15 application; 16 ‘‘(vi) the presence, on the website, on- 17 line service, online application, or mobile 18 application, of— 19 ‘‘(I) child celebrities; 20 ‘‘(II) celebrities who appeal to 21 children; 22 ‘‘(III) teen celebrities; or 23 ‘‘(IV) celebrities who appeal to 24 minors; 25 VerDate Sep 11 2014 03:39 Dec 16, 2022 Jkt 039200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6401 E:\BILLS\S1628.RS S1628 kjohnson on DSK79L0C42PROD with BILLS 13 •S 1628 RS ‘‘(vii) the language used on the 1 website, online service, online application, 2 or mobile application; 3 ‘‘(viii) advertising content used on, or 4 used to advertise, the website, online serv- 5 ice, online application, or mobile applica- 6 tion; or 7 ‘‘(ix) reliable empirical evidence relat- 8 ing to— 9 ‘‘(I) the composition of the audi- 10 ence of the website, online service, on- 11 line application, or mobile application; 12 and 13 ‘‘(II) the intended audience of 14 the website, online service, online ap- 15 plication, or mobile app [Text truncated for display. Full text available on Congress.gov.]