To amend the Children's Online Privacy Protection Act of 1998 to strengthen protections relating to the online collection, use, and disclosure of personal information of children and minors, and for other purposes.

I 116TH CONGRESS 1ST SESSION H. R. 3900 To amend the Children’s Online Privacy Protection Act of 1998 to strengthen protections relating to the online collection, use, and disclosure of per- sonal information of children and minors, and for other purposes. IN THE HOUSE OF REPRESENTATIVES JULY 23, 2019 Mr. RUSH introduced the following bill; which was referred to the Committee on Energy and Commerce A BILL To amend the Children’s Online Privacy Protection Act of 1998 to strengthen protections relating to the online collection, use, and disclosure of personal information of children and minors, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. TABLE OF CONTENTS. 3 The table of contents for this Act is as follows: 4 Sec. 1. Table of contents. Sec. 2. Definitions. Sec. 3. Online collection, use, and disclosure of personal information of children and minors. Sec. 4. Fair Information Practices Principles. Sec. 5. Digital Marketing Bill of Rights for Minors. Sec. 6. Targeted marketing to children or minors. Sec. 7. Removal of content. Sec. 8. Privacy dashboard for connected devices for children and minors. VerDate Sep 11 2014 22:08 Aug 06, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6211 E:\BILLS\H3900.IH H3900 kjohnson on DSK79L0C42 with BILLS 2 •HR 3900 IH Sec. 9. Prohibition on sale of connected devices for children and minors that fail to meet appropriate cybersecurity and data security stand- ards. Sec. 10. Rule for treatment of users of websites, services, and applications di- rected to children or minors. Sec. 11. Study of mobile and online application oversight. Sec. 12. Youth Privacy and Marketing Division. Sec. 13. Enforcement and applicability. SEC. 2. DEFINITIONS. 1 (a) IN GENERAL.—In this Act: 2 (1) COMMISSION.—The term ‘‘Commission’’ 3 means the Federal Trade Commission. 4 (2) STANDARDS.—The term ‘‘standards’’ means 5 benchmarks, guidelines, best practices, methodolo- 6 gies, procedures, and processes. 7 (b) OTHER DEFINITIONS.—The definitions set forth 8 in section 1302 of the Children’s Online Privacy Protec- 9 tion Act of 1998 (15 U.S.C. 6501), as amended by section 10 3(a) of this Act, shall apply in this Act, except to the ex- 11 tent the Commission provides otherwise by regulations 12 issued under section 553 of title 5, United States Code. 13 SEC. 3. ONLINE COLLECTION, USE, AND DISCLOSURE OF 14 PERSONAL INFORMATION OF CHILDREN AND 15 MINORS. 16 (a) DEFINITIONS.—Section 1302 of the Children’s 17 Online Privacy Protection Act of 1998 (15 U.S.C. 6501) 18 is amended— 19 (1) by amending paragraph (2) to read as fol- 20 lows: 21 VerDate Sep 11 2014 22:08 Aug 06, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H3900.IH H3900 kjohnson on DSK79L0C42 with BILLS 3 •HR 3900 IH ‘‘(2) OPERATOR.—The term ‘operator’— 1 ‘‘(A) means any person— 2 ‘‘(i) who, for commercial purposes, in 3 interstate or foreign commerce operates or 4 provides a website on the internet, an on- 5 line service, an online application, or a mo- 6 bile application; and 7 ‘‘(ii) who— 8 ‘‘(I) collects or maintains, either 9 directly or through a service provider, 10 personal information from or about 11 the users of that website, service, ap- 12 plication, or connected device; 13 ‘‘(II) allows another person to 14 collect personal information directly 15 from users of that website, service, 16 application, or connected device (in 17 which case, the operator is deemed to 18 have collected the information); or 19 ‘‘(III) allows users of that 20 website, service, application, or con- 21 nected device to publicly disclose per- 22 sonal information (in which case, the 23 operator is deemed to have collected 24 the information); and 25 VerDate Sep 11 2014 22:08 Aug 06, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H3900.IH H3900 kjohnson on DSK79L0C42 with BILLS 4 •HR 3900 IH ‘‘(B) does not include any nonprofit entity 1 that would otherwise be exempt from coverage 2 under section 5 of the Federal Trade Commis- 3 sion Act (15 U.S.C. 45).’’; 4 (2) in paragraph (4)— 5 (A) by amending subparagraph (A) to read 6 as follows: 7 ‘‘(A) the release of personal information 8 collected from a child or minor for any purpose, 9 except where the personal information is pro- 10 vided to a person other than an operator who— 11 ‘‘(i) provides support for the internal 12 operations of the website, online service, 13 online application, or mobile application of 14 the operator, excluding any activity relat- 15 ing to targeted marketing directed to chil- 16 dren, minors, or connected devices; and 17 ‘‘(ii) does not disclose or use that per- 18 sonal information for any other purpose; 19 and’’; and 20 (B) in subparagraph (B)— 21 (i) by inserting ‘‘or minor’’ after 22 ‘‘child’’ each place the term appears; 23 (ii) by inserting ‘‘or minors’’ after 24 ‘‘children’’; and 25 VerDate Sep 11 2014 22:08 Aug 06, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H3900.IH H3900 kjohnson on DSK79L0C42 with BILLS 5 •HR 3900 IH (iii) by striking ‘‘website or online 1 service’’ and inserting ‘‘website, online 2 service, online application, or mobile appli- 3 cation’’; 4 (3) in paragraph (8), by striking subparagraphs 5 (F) and (G) and inserting the following: 6 ‘‘(F) geolocation information; 7 ‘‘(G) information used for biometric identi- 8 fication, as defined in section 70123 of title 46, 9 United States Code, of an individual; 10 ‘‘(H) information reasonably associated 11 with or attributed to an individual; 12 ‘‘(I) information (including an internet 13 protocol address) that permits the identification 14 of— 15 ‘‘(i) an individual; or 16 ‘‘(ii) any device used by an individual 17 to directly or indirectly access the internet 18 or an online service, online application, or 19 mobile application; or 20 ‘‘(J) information concerning a child or 21 minor or the parents of that child or minor (in- 22 cluding any unique or substantially unique iden- 23 tifier, such as a customer number) that an op- 24 erator collects online from the child or minor 25 VerDate Sep 11 2014 22:08 Aug 06, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H3900.IH H3900 kjohnson on DSK79L0C42 with BILLS 6 •HR 3900 IH and combines with an identifier described in 1 this paragraph.’’; 2 (4) by amending paragraph (9) to read as fol- 3 lows: 4 ‘‘(9) VERIFIABLE CONSENT.—The term 5 ‘verifiable consent’ means any reasonable effort (tak- 6 ing into consideration available technology), includ- 7 ing a request for authorization for future collection, 8 use, and disclosure described in the notice, to ensure 9 that, in the case of a child, a parent of the child, 10 or, in the case of a minor, the minor— 11 ‘‘(A) receives specific notice of the personal 12 information collection, use, and disclosure prac- 13 tices of the operator; and 14 ‘‘(B) before the personal information of the 15 child or minor is collected, freely and unambig- 16 uously authorizes— 17 ‘‘(i) the collection, use, and disclosure, 18 as applicable, of that personal information; 19 and 20 ‘‘(ii) any subsequent use of that per- 21 sonal information.’’; 22 (5) by striking paragraph (10) and redesig- 23 nating paragraphs (11) and (12) as paragraphs (10) 24 and (11), respectively; and 25 VerDate Sep 11 2014 22:08 Aug 06, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H3900.IH H3900 kjohnson on DSK79L0C42 with BILLS 7 •HR 3900 IH (6) by adding at the end the following: 1 ‘‘(12) CONNECTED DEVICE.—The term ‘con- 2 nected device’ means a device that is capable of con- 3 necting to the internet, directly or indirectly, or to 4 another connected device. 5 ‘‘(13) ONLINE.—The term ‘online’ means— 6 ‘‘(A) connected to or compatible with the 7 internet; or 8 ‘‘(B) via the internet. 9 ‘‘(14) ONLINE APPLICATION.—The term ‘online 10 application’— 11 ‘‘(A) means an internet-connected software 12 program; and 13 ‘‘(B) includes a service or application of- 14 fered via a connected device. 15 ‘‘(15) ONLINE SERVICE.—The term ‘online 16 service’— 17 ‘‘(A) means broadband internet access 18 service, as defined in the Report and Order on 19 Remand, Declaratory Ruling, and Order in the 20 matter of protecting and promoting the open 21 internet, adopted by the Federal Communica- 22 tions Commission on February 26, 2015 (FCC 23 15–24); and 24 VerDate Sep 11 2014 22:08 Aug 06, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H3900.IH H3900 kjohnson on DSK79L0C42 with BILLS 8 •HR 3900 IH ‘‘(B) includes a service or application of- 1 fered via a connected device. 2 ‘‘(16) DIRECTED TO A CHILD OR MINOR.— 3 ‘‘(A) IN GENERAL.—The terms ‘directed to 4 a child’ or ‘directed to a minor’ means, with re- 5 spect to a website, online service, online applica- 6 tion, or mobile application, the website, online 7 service, online application, or mobile application 8 is targeted to children or minors, as the case 9 may be, as demonstrated by— 10 ‘‘(i) the subject matter of the website, 11 online service, online application, or mobile 12 application; 13 ‘‘(ii) the visual content of the website, 14 online service, online application, or mobile 15 application; 16 ‘‘(iii) the use of animated characters 17 or child-oriented activities for children, or 18 the use of minor-oriented characters or 19 minor-oriented activities for minors, and 20 related incentives on the website, online 21 service, online application, or mobile appli- 22 cation; 23 VerDate Sep 11 2014 22:08 Aug 06, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H3900.IH H3900 kjohnson on DSK79L0C42 with BILLS 9 •HR 3900 IH ‘‘(iv) the music or other audio content 1 on the website, online service, online appli- 2 cation, or mobile application; 3 ‘‘(v) the age of models on the website, 4 online service, online application, or mobile 5 application; 6 ‘‘(vi) the presence, on the website, on- 7 line service, online application, or mobile 8 application, of— 9 ‘‘(I) child celebrities; 10 ‘‘(II) celebrities who appeal to 11 children; 12 ‘‘(III) teen celebrities; or 13 ‘‘(IV) celebrities who appeal to 14 minors; 15 ‘‘(vii) the language used on the 16 website, online service, online application, 17 or mobile application; 18 ‘‘(viii) advertising content used on, or 19 used to advertise, the website, online serv- 20 ice, online application, or mobile applica- 21 tion; or 22 ‘‘(ix) reliable empirical evidence relat- 23 ing to— 24 VerDate Sep 11 2014 22:08 Aug 06, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H3900.IH H3900 kjohnson on DSK79L0C42 with BILLS 10 •HR 3900 IH ‘‘(I) the composition of the audi- 1 ence of the website, online service, on- 2 line application, or mobile application; 3 and 4 ‘‘(II) the intended audience of 5 the website, online service, online ap- 6 plication, or mobile application. 7 ‘‘(B) RULES OF CONSTRUCTION.— 8 ‘‘(i) SERVICES DEEMED DIRECTED TO 9 CHILDREN OR MINORS.—For the purposes 10 of this title, a website, online service, on- 11 line application, or mobile application shall 12 be deemed to be directed to children or mi- 13 nors if the operator of the website, online 14 service, online application, or mobile appli- 15 cation has actual knowledge that the 16 website, online service, online application, 17 or mobile application collects personal in- 18 formation directly from users of any other 19 website, online service, online application, 20 or mobile application that is directed to 21 children or minors under the criteria de- 22 scribed in subparagraph (A). 23 ‘‘(ii) SERVICES DEEMED DIRECTED TO 24 MIXED AUDIENCES.— 25 VerDate Sep 11 2014 22:08 Aug 06, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H3900.IH H3900 kjohnson on DSK79L0C42 with BILLS 11 •HR 3900 IH ‘‘(I) IN GENERAL.—A website, 1 online service, online application, or 2 mobile application that is directed to 3 children or minors under the criteria 4 described in subparagraph (A), but 5 that does not target children or mi- 6 nors as the primary audience of the 7 website, online service, online applica- 8 tion, or mobile application, shall not 9 be deemed to be directed to children 10 or minors for purposes of this title if 11 the website, online service, online ap- 12 plication, or mobile application— 13 ‘‘(aa) does not collect per- 14 sonal information from any user 15 of the website, online service, on- 16 line application, or mobile appli- 17 cation before verifying age infor- 18 mation of the user; and 19 ‘‘(bb) does not, without first 20 complying with any relevant no- 21 tice and consent provision under 22 this title, collect, use, or disclose 23 personal information of any user 24 who identifies themselves to the 25 VerDate Sep 11 2014 22:08 Aug 06, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H3900.IH H3900 kjohnson on DSK79L0C42 with BILLS 12 •HR 3900 IH website, online service, online ap- 1 plication, or mobile application as 2 an individual who is under the 3 age of 16. 4 ‘‘(II) USE OF CERTAIN TOOLS.— 5 For purposes of this title, a website, 6 online service, online application, or 7 mobile application, shall not be 8 deemed directed to children or minors 9 solely because the website, online serv- 10 ice, online application, or mobile appli- 11 cation refers or links to any other 12 website, online service, online applica- 13 tion, or mobile application directed to 14 children or minors by using informa- 15 tion location tools, including— 16 ‘‘(aa) a directory; 17 ‘‘(bb) an index; 18 ‘‘(cc) a reference; 19 ‘‘(dd) a pointer; or 20 ‘‘(ee) a hypertext link. 21 ‘‘(17) MOBILE APPLICATION.—The term ‘mo- 22 bile application’— 23 ‘‘(A) means a software program that runs 24 on the operating system of— 25 VerDate Sep 11 2014 22:08 Aug 06, 2019 Jkt 089200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\H3900.IH H3900 kjohnson on DSK79L0C42 with BILLS 13 •HR 3900 IH ‘‘(i) a cellular telephone; 1 ‘‘(ii) a tablet computer; or 2 ‘‘(iii) a similar portable computing de- 3 vice that transmits data over a wireless 4 connection; and 5 ‘‘(B) includes a service or application of- 6 fered via a connected device. 7 ‘‘(18) GEOLOCATION INFORMATION.—The term 8 ‘geolocation information’ means information suffi- 9 cient to identify a street name and name of a city 10 or town. 11 ‘‘(19) MINOR.—The term ‘minor’ means an in- 12 dividual over the age of 12 and under the age of 16. 13 ‘‘(20) TARGETED MARKETING.—The term ‘tar- 14 geted marketing’ means advertising or any other ef- 15 fort to market a product or service that is directed 16 to a specific individual or device— 17 ‘‘(A) based on— 18 ‘‘(i) the personal information of— 19 ‘‘(I) the individual [Text truncated for display. Full text available on Congress.gov.]