Kids PRIVACY Act

I 118TH CONGRESS 1ST SESSION H. R. 2801 To amend the Children’s Online Privacy Protection Act of 1998 to update and expand the coverage of such Act, and for other purposes. IN THE HOUSE OF REPRESENTATIVES APRIL 24, 2023 Ms. CASTOR of Florida introduced the following bill; which was referred to the Committee on Energy and Commerce A BILL To amend the Children’s Online Privacy Protection Act of 1998 to update and expand the coverage of such Act, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 3 (a) SHORT TITLE.—This Act may be cited as the 4 ‘‘Protecting the Information of our Vulnerable Adoles- 5 cents, Children, and Youth Act’’ or the ‘‘Kids PRIVACY 6 Act’’. 7 (b) TABLE OF CONTENTS.—The table of contents for 8 this Act is as follows: 9 Sec. 1. Short title; table of contents. VerDate Sep 11 2014 06:01 Apr 28, 2023 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6211 E:\BILLS\H2801.IH H2801 pbinns on DSKJLVW7X2PROD with $$_JOB 2 •HR 2801 IH Sec. 2. Definitions. Sec. 3. Requirements for processing of covered information of children or teen- agers. Sec. 4. Repeal of safe harbors provision. Sec. 5. Administration and applicability of Act. Sec. 6. Review. Sec. 7. Private right of action. Sec. 8. Relationship to other law. Sec. 9. Additional conforming amendment. Sec. 10. Youth Privacy and Marketing Division. Sec. 11. Commission defined. Sec. 12. Effective date. SEC. 2. DEFINITIONS. 1 Section 1302 of the Children’s Online Privacy Protec- 2 tion Act of 1998 (15 U.S.C. 6501) is amended— 3 (1) by striking paragraphs (5) and (10); 4 (2) by redesignating paragraphs (2), (3), (4), 5 (6), (7), (8), and (9) as paragraphs (3), (5), (6), 6 (7), (8), (9), and (10), respectively; 7 (3) by inserting after paragraph (1) the fol- 8 lowing: 9 ‘‘(2) TEENAGER.—The term ‘teenager’ means 10 an individual over the age of 12 and under the age 11 of 18.’’; 12 (4) by striking paragraph (3) (as so redesig- 13 nated) and inserting the following: 14 ‘‘(3) COVERED ENTITY.—The term ‘covered en- 15 tity’ means— 16 ‘‘(A) any person over which the Commis- 17 sion has authority under section 5(a)(2) of the 18 Federal Trade Commission Act (15 U.S.C. 19 45(a)(2)); 20 VerDate Sep 11 2014 06:01 Apr 28, 2023 Jkt 039200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H2801.IH H2801 pbinns on DSKJLVW7X2PROD with $$_JOB 3 •HR 2801 IH ‘‘(B) any organization not organized to 1 carry on business for its own profit or that of 2 its members; and 3 ‘‘(C) any common carrier subject to the 4 Communications Act of 1934 (47 U.S.C. 151 et 5 seq.) and all Acts amendatory thereof and sup- 6 plementary thereto. 7 ‘‘(4) OPERATOR.—The term ‘operator’ means, 8 with respect to a digital service, the covered entity 9 that operates such service, to the extent the covered 10 entity is engaged in operating such service or in 11 processing covered information obtained in connec- 12 tion with such service.’’; 13 (5) by amending paragraph (6) (as so redesig- 14 nated) to read as follows: 15 ‘‘(6) DISCLOSE.—The term ‘disclose’ means, 16 with respect to covered information, to intentionally 17 or unintentionally release, transfer, sell, disseminate, 18 share, publish, lease, license, make available, allow 19 access to, fail to restrict access to, or otherwise com- 20 municate such information.’’; 21 (6) by amending paragraph (9) (as so redesig- 22 nated) to read as follows: 23 ‘‘(9) COVERED INFORMATION.—The term ‘cov- 24 ered information’— 25 VerDate Sep 11 2014 06:01 Apr 28, 2023 Jkt 039200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H2801.IH H2801 pbinns on DSKJLVW7X2PROD with $$_JOB 4 •HR 2801 IH ‘‘(A) means any information that is linked 1 or reasonably linkable to a specific teenager or 2 child or to a specific consumer device used 3 mainly by a teenager or child; 4 ‘‘(B) may include— 5 ‘‘(i) a name, alias, home or other 6 physical address, online identifier, Internet 7 Protocol address, email address, account 8 name, Social Security number, physical 9 characteristics or description, telephone 10 number, State identification card number, 11 driver’s license number, passport number, 12 or other similar identifier; 13 ‘‘(ii) actual or perceived race, religion, 14 sex, sexual orientation, sexual behavior, fa- 15 milial status, gender identity, disability, 16 age, political affiliation, or national origin; 17 ‘‘(iii) commercial information, includ- 18 ing records relating to personal property, 19 products or services purchased, obtained, 20 or considered, or other purchasing or con- 21 suming histories, interests, or tendencies; 22 ‘‘(iv) biometric information; 23 VerDate Sep 11 2014 06:01 Apr 28, 2023 Jkt 039200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H2801.IH H2801 pbinns on DSKJLVW7X2PROD with $$_JOB 5 •HR 2801 IH ‘‘(v) device identifiers, online identi- 1 fiers, persistent identifiers, or digital 2 fingerprinting information; 3 ‘‘(vi) internet or other electronic net- 4 work activity information, including brows- 5 ing history, search history, and informa- 6 tion regarding a teenager’s or child’s inter- 7 action with an internet website, applica- 8 tion, or advertisement; 9 ‘‘(vii) geolocation information; 10 ‘‘(viii) audio, electronic, visual, ther- 11 mal, olfactory, or similar information; 12 ‘‘(ix) education information; 13 ‘‘(x) health information; 14 ‘‘(xi) facial recognition information; 15 ‘‘(xii) contents of, attachments to, and 16 parties to information, including with re- 17 spect to electronic mail, text messages, pic- 18 ture messages, voicemails, audio conversa- 19 tions, and video conversations; 20 ‘‘(xiii) financial information, including 21 bank account numbers, credit card num- 22 bers, debit card numbers, or insurance pol- 23 icy numbers; and 24 VerDate Sep 11 2014 06:01 Apr 28, 2023 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H2801.IH H2801 pbinns on DSKJLVW7X2PROD with $$_JOB 6 •HR 2801 IH ‘‘(xiv) inferences drawn from any of 1 the information described in this para- 2 graph to create a profile about a teenager 3 or child reflecting the teenager’s or child’s 4 preferences, characteristics, psychological 5 trends, predispositions, behavior, attitudes, 6 intelligence, abilities, or aptitudes; and 7 ‘‘(C) does not include— 8 ‘‘(i) information that is processed 9 solely for the purpose of employment of a 10 teenager; or 11 ‘‘(ii) de-identified information.’’; 12 (7) by amending paragraph (10) (as so redesig- 13 nated) to read as follows: 14 ‘‘(10) VERIFIABLE CONSENT.—The term 15 ‘verifiable consent’ means express, affirmative con- 16 sent freely given by a teenager, or by the parent of 17 a child, to the processing of covered information of 18 that teenager or child, respectively— 19 ‘‘(A) that is specific, informed, and unam- 20 biguous, taking into account the age and the 21 developmental and cognitive needs and capabili- 22 ties of teenagers or parents of children, as ap- 23 plicable; 24 VerDate Sep 11 2014 06:01 Apr 28, 2023 Jkt 039200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H2801.IH H2801 pbinns on DSKJLVW7X2PROD with $$_JOB 7 •HR 2801 IH ‘‘(B) that is given separately for each un- 1 related processing activity; 2 ‘‘(C) where the teenager or parent of a 3 child, as applicable, has not received any finan- 4 cial or other incentive in exchange for such con- 5 sent; 6 ‘‘(D) that is given before any processing 7 occurs, at a time and in a context in which the 8 teenager or parent of a child, as applicable, 9 would reasonably expect to make choices con- 10 cerning such processing; 11 ‘‘(E) that is not obtained through the use 12 of a design, modification, or manipulation of a 13 user interface with the purpose or substantial 14 effect of obscuring, subverting, or impairing 15 user autonomy, decision making, or choice; and 16 ‘‘(F) that, in the case of consent to the 17 processing of covered information of a child, is 18 obtained in a manner that is reasonably cal- 19 culated to ensure that the individual giving con- 20 sent is the parent of the child.’’; and 21 (8) by adding at the end the following: 22 ‘‘(13) PROCESS.—The term ‘process’ means to 23 perform any operation or set of operations on cov- 24 ered information, whether or not by automated 25 VerDate Sep 11 2014 06:01 Apr 28, 2023 Jkt 039200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H2801.IH H2801 pbinns on DSKJLVW7X2PROD with $$_JOB 8 •HR 2801 IH means, including collecting, creating, acquiring, dis- 1 closing, sharing, classifying, sorting, recording, de- 2 riving, inferring, obtaining, assembling, organizing, 3 structuring, storing, retaining, adapting or altering, 4 using, or retrieving covered information. 5 ‘‘(14) DE-IDENTIFIED INFORMATION; RE-IDEN- 6 TIFY.— 7 ‘‘(A) DE-IDENTIFIED INFORMATION.—The 8 term ‘de-identified information’ means informa- 9 tion that cannot reasonably be used to infer in- 10 formation about, or otherwise be linked to, a 11 specific teenager or child or specific consumer 12 device of a teenager or child, if the covered enti- 13 ty that possesses the information— 14 ‘‘(i) takes reasonable measures to en- 15 sure that the information cannot be associ- 16 ated with a teenager or child; 17 ‘‘(ii) publicly commits to maintain and 18 use the information in de-identified form 19 and not to attempt to re-identify the infor- 20 mation, except for the purpose of testing 21 the sufficiency of the de-identification 22 measures; and 23 ‘‘(iii) contractually obligates any enti- 24 ty to which the covered entity discloses the 25 VerDate Sep 11 2014 06:01 Apr 28, 2023 Jkt 039200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H2801.IH H2801 pbinns on DSKJLVW7X2PROD with $$_JOB 9 •HR 2801 IH information to comply with clauses (i) and 1 (ii). 2 ‘‘(B) RE-IDENTIFY.—The term ‘re-identify’ 3 means to link information that has been de- 4 identified to a specific teenager or child or spe- 5 cific consumer device of a teenager or child. 6 ‘‘(15) STATE.—The term ‘State’ means each of 7 the several States, the District of Columbia, each 8 territory of the United States, and each federally 9 recognized Indian Tribe. 10 ‘‘(16) SERVICE PROVIDER.—The term ‘service 11 provider’ means a covered entity that— 12 ‘‘(A) processes covered information at the 13 direction of, and for the sole benefit of, another 14 covered entity; and 15 ‘‘(B) is contractually or legally prohibited 16 from processing such covered information for 17 any other purpose. 18 ‘‘(17) DIGITAL SERVICE.—The term ‘digital 19 service’ means a website, online service, online appli- 20 cation, mobile application, or any other service that 21 processes covered information digitally. 22 ‘‘(18) CHILDREN’S SERVICE.—The term ‘chil- 23 dren’s service’ means— 24 VerDate Sep 11 2014 06:01 Apr 28, 2023 Jkt 039200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H2801.IH H2801 pbinns on DSKJLVW7X2PROD with $$_JOB 10 •HR 2801 IH ‘‘(A) a digital service or portion thereof 1 that is directed to children; or 2 ‘‘(B) any other digital service or portion 3 thereof, if the operator of the service decides to 4 treat all users of the service or portion, as the 5 case may be, as children. 6 ‘‘(19) PRIVACY RISK.—The term ‘privacy risk’ 7 means potential adverse consequences to an indi- 8 vidual, group of individuals, or society arising from 9 the processing of covered information, including— 10 ‘‘(A) physical harm; 11 ‘‘(B) psychological or emotional harm; 12 ‘‘(C) negative or harmful outcomes or deci- 13 sions with respect to an individual’s eligibility 14 for rights, benefits, or opportunities; 15 ‘‘(D) reputational and dignity harm; 16 ‘‘(E) financial harm, including price dis- 17 crimination; 18 ‘‘(F) inconvenience or expenditure of time; 19 ‘‘(G) disruption and intrusion from un- 20 wanted communications or contacts; 21 ‘‘(H) other effects that limit an individ- 22 ual’s choices, influence an individual’s re- 23 sponses, or predetermine results or outcomes 24 for that individual; and 25 VerDate Sep 11 2014 06:01 Apr 28, 2023 Jkt 039200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H2801.IH H2801 pbinns on DSKJLVW7X2PROD with $$_JOB 11 •HR 2801 IH ‘‘(I) other demonstrable adverse con- 1 sequences that affect an individual’s private 2 life, including private family matters, actions, 3 and communications within an individual’s 4 home or similar physical, online, or digital loca- 5 tion. 6 ‘‘(20) PRIVACY AND SECURITY IMPACT ASSESS- 7 MENT AND MITIGATION (PSIAM).— 8 ‘‘(A) IN GENERAL.—The terms ‘privacy 9 and security impact assessment and mitigation’ 10 and ‘PSIAM’ mean, with respect to a digital 11 service, an assessment and mitigation by the 12 operator of the service of risks to the children 13 and teenagers who access the service that arise 14 from the processing of covered information, tak- 15 ing into account privacy risks, security risks, 16 the rights and best interests of children and 17 teenagers, differing ages, capacities, and devel- 18 opmental needs of children and teenagers, and 19 any significant internal or external emerging 20 risks, and ensuring that the PSIAM builds in 21 risk mitigation and compliance with the other 22 requirements of this title. 23 VerDate Sep 11 2014 06:01 Apr 28, 2023 Jkt 039200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H2801.IH H2801 pbinns on DSKJLVW7X2PROD with $$_JOB 12 •HR 2801 IH ‘‘(B) REQUIREMENTS.—In conducting a 1 PSIAM with respect to a digital service, the op- 2 erator of the service shall do the following: 3 ‘‘(i) Embed the PSIAM into the de- 4 sign process of the service and complete 5 the PSIAM before the launch of the service 6 and on an ongoing basis, and before mak- 7 ing significant changes to the processing of 8 covered information. 9 ‘‘(ii) Publicly disclose the nature, 10 scope, context, and purposes of the proc- 11 essing of covered information. 12 ‘‘(iii) Depending on the size of the 13 service and level of risks identified— 14 ‘‘(I) seek and document the views 15 of children, teenagers, and parents (or 16 their representatives), as well as ex- 17 perts in children’s and teenagers’ de- 18 velopmental needs; and 19 ‘‘(II) take such views into ac- 20 count in the design of the service. 21 ‘‘(iv) Publicly disclose an explanation 22 of why the operator’s processing of covered 23 information is necessary and proportionate 24 vis a vis the risks for the service, and how 25 VerDate Sep 11 2014 06:01 Apr 28, 2023 Jkt 039200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\H2801.IH H2801 pbinns on DSKJLVW7X2PROD with $$_JOB 13 •HR 2801 IH the operator complies with the require- 1 ments of this title. 2 ‘‘(v) Assess any processing of covered 3 information that is not in the best inter- 4 ests of chil [Text truncated for display. Full text available on Congress.gov.]