Clean Slate for Kids Online Act of 2019

II 116TH CONGRESS 1ST SESSION S. 783 To amend the Children’s Online Privacy Protection Act of 1998 to give Americans the option to delete personal information collected by internet operators as a result of the person’s internet activity prior to age 13. IN THE SENATE OF THE UNITED STATES MARCH 13, 2019 Mr. DURBIN (for himself, Mr. MARKEY, Ms. HIRONO, Mr. BLUMENTHAL, and Mrs. GILLIBRAND) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transpor- tation A BILL To amend the Children’s Online Privacy Protection Act of 1998 to give Americans the option to delete personal information collected by internet operators as a result of the person’s internet activity prior to age 13. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Clean Slate for Kids 4 Online Act of 2019’’. 5 VerDate Sep 11 2014 03:47 Mar 23, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S783.IS S783 kjohnson on DSK79L0C42 with BILLS 2 •S 783 IS SEC. 2. ENHANCING THE CHILDREN’S ONLINE PRIVACY 1 PROTECTION ACT OF 1998. 2 (a) DEFINITIONS.—Section 1302 of the Children’s 3 Online Privacy Protection Act of 1998 (15 U.S.C. 6501) 4 is amended by adding at the end the following: 5 ‘‘(13) DELETE.—The term ‘delete’ means to re- 6 move personal information such that the information 7 is not maintained in retrievable form and cannot be 8 retrieved in the normal course of business.’’. 9 (b) REGULATION OF UNFAIR AND DECEPTIVE ACTS 10 AND PRACTICES IN CONNECTION WITH THE COLLECTION 11 AND USE OF PERSONAL INFORMATION FROM AND ABOUT 12 CHILDREN ON THE INTERNET.—Section 1303 of the Chil- 13 dren’s Online Privacy Protection Act of 1998 (15 U.S.C. 14 6502) is amended— 15 (1) in subsection (a), by adding at the end the 16 following: 17 ‘‘(3) FAILURE TO DELETE.—It is unlawful for 18 an operator of a website or online service directed to 19 children, or any operator that has actual knowledge 20 that it is collecting personal information from a 21 child, to fail to delete personal information collected 22 from or about a child if a request for deletion is 23 made pursuant to regulations prescribed under sub- 24 section (e).’’; and 25 (2) by adding at the end the following: 26 VerDate Sep 11 2014 03:47 Mar 23, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S783.IS S783 kjohnson on DSK79L0C42 with BILLS 3 •S 783 IS ‘‘(e) RIGHT OF AN INDIVIDUAL TO DELETE PER- 1 SONAL INFORMATION COLLECTED WHEN THE PERSON 2 WAS A CHILD.— 3 ‘‘(1) IN GENERAL.—Not later than 1 year after 4 the date of enactment of this subsection, the Com- 5 mission shall promulgate under section 553 of title 6 5, United States Code, regulations that require the 7 operator of any website or online service directed to 8 children, or any operator that has actual knowledge 9 that it has collected personal information from a 10 child or maintains such personal information— 11 ‘‘(A) to provide notice in a prominent place 12 on the website of how an individual over the age 13 of 13, or a legal guardian of an individual over 14 the age of 13 acting with the knowledge and 15 consent of the individual, can request that the 16 operator delete all personal information in the 17 possession of the operator that was collected 18 from or about the individual when the indi- 19 vidual was a child notwithstanding any parental 20 consent that may have been provided when the 21 individual was a child; 22 ‘‘(B) to promptly delete all personal infor- 23 mation in the possession of the operator that 24 was collected from or about an individual when 25 VerDate Sep 11 2014 03:47 Mar 23, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S783.IS S783 kjohnson on DSK79L0C42 with BILLS 4 •S 783 IS the individual was a child when such deletion is 1 requested by an individual over the age of 13 2 or by the legal guardian of such individual act- 3 ing with the knowledge and consent of the indi- 4 vidual, notwithstanding any parental consent 5 that may have been provided when the indi- 6 vidual was a child; 7 ‘‘(C) to provide written confirmation of de- 8 letion, after the deletion has occurred, to an in- 9 dividual or legal guardian of such individual 10 who has requested such deletion pursuant to 11 this subsection; and 12 ‘‘(D) to except from deletion personal in- 13 formation collected from or about a child— 14 ‘‘(i) only to the extent that the per- 15 sonal information is necessary— 16 ‘‘(I) to respond to judicial proc- 17 ess; or 18 ‘‘(II) to the extent permitted 19 under any other provision of law, to 20 provide information to law enforce- 21 ment agencies or for an investigation 22 on a matter related to public safety; 23 and 24 VerDate Sep 11 2014 03:47 Mar 23, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S783.IS S783 kjohnson on DSK79L0C42 with BILLS 5 •S 783 IS ‘‘(ii) if the operator retain such ex- 1 cepted personal information for only as 2 long as reasonably necessary to fulfill the 3 purpose for which the information has 4 been excepted and that the excepted infor- 5 mation not be used, disseminated or main- 6 tained in a form retrievable to anyone ex- 7 cept for the purposes specified in this sub- 8 paragraph.’’. 9 (c) SAFE HARBORS.—Section 1304 of the Children’s 10 Online Privacy Protection Act of 1998 (15 U.S.C. 6503) 11 is amended— 12 (1) in subsection (a), by striking ‘‘section 13 1303(b)’’ and inserting ‘‘subsections (b) and (e) of 14 section 1303’’; and 15 (2) in subsection (b)(1), by striking ‘‘subsection 16 (b)’’ and inserting ‘‘subsections (b) and (e)’’. 17 (d) ACTIONS BY STATES.—Section 1305(a)(1) of the 18 Children’s Online Privacy Protection Act of 1998 (15 19 U.S.C. 6504(a)(1)) is amended by striking ‘‘1303(b)’’ and 20 inserting ‘‘subsection (b) or (e) of section 1303’’. 21 Æ VerDate Sep 11 2014 03:47 Mar 23, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6301 E:\BILLS\S783.IS S783 kjohnson on DSK79L0C42 with BILLS