II Calendar No. 288 118TH CONGRESS 1ST SESSION S. 1418 To amend the Children’s Online Privacy Protection Act of 1998 to strengthen protections relating to the online collection, use, and disclosure of per- sonal information of children and teens, and for other purposes. IN THE SENATE OF THE UNITED STATES MAY 3, 2023 Mr. MARKEY (for himself and Mr. CASSIDY) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation DECEMBER 13, 2023 Reported by Ms. CANTWELL, with an amendment [Strike out all after the enacting clause and insert the part printed in italic] A BILL To amend the Children’s Online Privacy Protection Act of 1998 to strengthen protections relating to the online collection, use, and disclosure of personal information of children and teens, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S1418.RS S1418 2 •S 1418 RS SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 1 (a) SHORT TITLE.—This Act may be cited as the 2 ‘‘Children and Teens’ Online Privacy Protection Act’’. 3 (b) TABLE OF CONTENTS.—The table of contents for 4 this Act is as follows: 5 Sec. 1. Short title; table of contents. Sec. 2. Definitions. Sec. 3. Online collection, use, and disclosure of personal information of children and teens. Sec. 4. Fair Information Practices Principles. Sec. 5. Digital Marketing Bill of Rights for Teens. Sec. 6. Targeted marketing to children or teens. Sec. 7. Removal of content. Sec. 8. Rule for treatment of users of websites, services, and applications di- rected to children or teens. Sec. 9. Study of mobile and online application oversight. Sec. 10. Youth Privacy and Marketing Division. Sec. 11. Enforcement and applicability. Sec. 12. GAO study. SEC. 2. DEFINITIONS. 6 (a) IN GENERAL.—In this Act: 7 (1) COMMISSION.—The term ‘‘Commission’’ 8 means the Federal Trade Commission. 9 (2) STANDARDS.—The term ‘‘standards’’ means 10 benchmarks, guidelines, best practices, methodolo- 11 gies, procedures, and processes. 12 (b) OTHER DEFINITIONS.—The definitions set forth 13 in section 1302 of the Children’s Online Privacy Protec- 14 tion Act of 1998 (15 U.S.C. 6501), as amended by section 15 3(a) of this Act, shall apply in this Act, except to the ex- 16 tent the Commission provides otherwise by regulations 17 issued under section 553 of title 5, United States Code. 18 VerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418 3 •S 1418 RS SEC. 3. ONLINE COLLECTION, USE, AND DISCLOSURE OF 1 PERSONAL INFORMATION OF CHILDREN AND 2 TEENS. 3 (a) DEFINITIONS.—Section 1302 of the Children’s 4 Online Privacy Protection Act of 1998 (15 U.S.C. 6501) 5 is amended— 6 (1) by amending paragraph (2) to read as fol- 7 lows: 8 ‘‘(2) OPERATOR.—The term ‘operator’— 9 ‘‘(A) means any person— 10 ‘‘(i) who, for commercial purposes, in 11 interstate or foreign commerce operates or 12 provides a website on the internet, an on- 13 line service, an online application, a mobile 14 application, or a connected device; and 15 ‘‘(ii) who— 16 ‘‘(I) collects or maintains, either 17 directly or through a service provider, 18 personal information from or about 19 the users of that website, service, ap- 20 plication, or connected device; 21 ‘‘(II) allows another person to 22 collect personal information directly 23 from users of that website, service, 24 application, or connected device (in 25 VerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418 4 •S 1418 RS which case, the operator is deemed to 1 have collected the information); or 2 ‘‘(III) allows users of that 3 website, service, application, or con- 4 nected device to publicly disclose per- 5 sonal information (in which case, the 6 operator is deemed to have collected 7 the information); and 8 ‘‘(B) does not include any nonprofit entity 9 that would otherwise be exempt from coverage 10 under section 5 of the Federal Trade Commis- 11 sion Act (15 U.S.C. 45).’’; 12 (2) in paragraph (4)— 13 (A) by amending subparagraph (A) to read 14 as follows: 15 ‘‘(A) the release of personal information 16 collected from a child or teen for any purpose, 17 except where the personal information is pro- 18 vided to a person other than an operator who— 19 ‘‘(i) provides support for the internal 20 operations of the website, online service, 21 online application, mobile application, or 22 connected device of the operator, excluding 23 any activity relating to targeted marketing 24 VerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418 5 •S 1418 RS directed to children, teens, or connected 1 devices; and 2 ‘‘(ii) does not disclose or use that per- 3 sonal information for any other purpose; 4 and’’; and 5 (B) in subparagraph (B)— 6 (i) by inserting ‘‘or teen’’ after 7 ‘‘child’’ each place the term appears; 8 (ii) by inserting ‘‘or teens’’ after 9 ‘‘children’’; and 10 (iii) by striking ‘‘website or online 11 service’’ and inserting ‘‘website, online 12 service, online application, mobile applica- 13 tion, or connected device’’; 14 (3) in paragraph (8), by striking subparagraphs 15 (F) and (G) and inserting the following: 16 ‘‘(F) geolocation information; 17 ‘‘(G) information generated from the meas- 18 urement or technological processing of an indi- 19 vidual’s biological, physical, or physiological 20 characteristics, including— 21 ‘‘(i) fingerprints; 22 ‘‘(ii) voice prints; 23 ‘‘(iii) iris or retina imagery scans; 24 ‘‘(iv) facial imagery or templates; 25 VerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418 6 •S 1418 RS ‘‘(v) deoxyribonucleic acid (DNA) in- 1 formation; or 2 ‘‘(vi) gait; 3 ‘‘(H) information reasonably associated 4 with or attributed to a child or teen; 5 ‘‘(I) information (including an internet 6 protocol address) that permits the identification 7 of— 8 ‘‘(i) an individual; or 9 ‘‘(ii) any device used by an individual 10 to directly or indirectly access the internet 11 or an online service, online application, mo- 12 bile application, or connected device; or 13 ‘‘(J) information concerning a child or teen 14 or the parents of that child or teen (including 15 any unique or substantially unique identifier, 16 such as a customer number) that an operator 17 collects online from the child or teen and com- 18 bines with an identifier described in this para- 19 graph.’’; 20 (4) by amending paragraph (9) to read as fol- 21 lows: 22 ‘‘(9) VERIFIABLE CONSENT.—The term 23 ‘verifiable consent’ means any reasonable effort (tak- 24 ing into consideration available technology), includ- 25 VerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418 7 •S 1418 RS ing a request for authorization for future collection, 1 use, and disclosure described in the notice, to ensure 2 that, in the case of a child, a parent of the child, 3 or, in the case of a teen, the teen— 4 ‘‘(A) receives specific notice of the personal 5 information collection, use, and disclosure prac- 6 tices of the operator; and 7 ‘‘(B) before the personal information of the 8 child or teen is collected, freely and unambig- 9 uously authorizes— 10 ‘‘(i) the collection, use, and disclosure, 11 as applicable, of that personal information; 12 and 13 ‘‘(ii) any subsequent use of that per- 14 sonal information.’’; 15 (5) by striking paragraph (10) and redesig- 16 nating paragraphs (11) and (12) as paragraphs (10) 17 and (11), respectively; and 18 (6) by adding at the end the following: 19 ‘‘(12) CONNECTED DEVICE.—The term ‘con- 20 nected device’ means a device that is capable of con- 21 necting to the internet, directly or indirectly, or to 22 another connected device. 23 ‘‘(13) ONLINE APPLICATION.—The term ‘online 24 application’— 25 VerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418 8 •S 1418 RS ‘‘(A) means an internet-connected software 1 program; and 2 ‘‘(B) includes a service or application of- 3 fered via a connected device. 4 ‘‘(14) ONLINE SERVICE.— 5 ‘‘(A) IN GENERAL.—The term ‘online serv- 6 ice’ means a mass-market retail service by wire 7 or radio that provides the capability to transmit 8 data and receive data from all or substantially 9 all Internet endpoints, including any capabilities 10 that are incidental to and enable the operation 11 of a communications service, but excluding dial- 12 up Internet service. 13 ‘‘(B) SCOPE.—Such term includes— 14 ‘‘(i) any service that the Federal Com- 15 munications Commission finds to be pro- 16 viding a functionally equivalent service to a 17 service described in subparagraph (A); and 18 ‘‘(ii) a service or application offered 19 via a connected device. 20 ‘‘(15) DIRECTED TO CHILDREN OR TEENS.— 21 ‘‘(A) IN GENERAL.—The terms ‘directed to 22 children’, ‘directed to teens’, and ‘directed to 23 children or teens’ mean, with respect to a 24 website, online service, online application, mo- 25 VerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418 9 •S 1418 RS bile application, or connected device, that the 1 website, online service, online application, mo- 2 bile application, or connected device, or a por- 3 tion thereof, is targeted to children or teens, as 4 the case may be, as demonstrated by— 5 ‘‘(i) the subject matter of the website, 6 online service, online application, mobile 7 application, or connected device; 8 ‘‘(ii) the visual content of the website, 9 online service, online application, mobile 10 application, or connected device; 11 ‘‘(iii) the use of animated characters 12 or child-oriented activities for children, or 13 the use of teen-oriented characters or teen- 14 oriented activities for teens, and related in- 15 centives on the website, online service, on- 16 line application, mobile application, or con- 17 nected device; 18 ‘‘(iv) the music or other audio content 19 on the website, online service, online appli- 20 cation, mobile application, or connected de- 21 vice; 22 ‘‘(v) the age of models on the website, 23 online service, online application, mobile 24 application, or connected device; 25 VerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418 10 •S 1418 RS ‘‘(vi) the presence, on the website, on- 1 line service, online application, mobile ap- 2 plication, or connected device, of— 3 ‘‘(I) child celebrities; 4 ‘‘(II) celebrities who appeal to 5 children; 6 ‘‘(III) teen celebrities; or 7 ‘‘(IV) celebrities who appeal to 8 teens; 9 ‘‘(vii) the language used on the 10 website, online service, online application, 11 mobile application, or connected device; 12 ‘‘(viii) advertising content used on, or 13 used to advertise, the website, online serv- 14 ice, online application, mobile application, 15 or connected device; or 16 ‘‘(ix) reliable empirical evidence relat- 17 ing to— 18 ‘‘(I) the composition of the audi- 19 ence of the website, online service, on- 20 line application, mobile application, or 21 connected device; and 22 ‘‘(II) the intended audience of 23 the website, online service, online ap- 24 VerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418 11 •S 1418 RS plication, mobile application, or con- 1 nected device. 2 ‘‘(B) RULES OF CONSTRUCTION.— 3 ‘‘(i) SERVICES DEEMED DIRECTED TO 4 CHILDREN OR TEENS.—For the purposes 5 of this title, a website, online service, on- 6 line application, mobile application, or con- 7 nected device, or a portion thereof, shall be 8 deemed to be directed to children or teens 9 if it collects personal information directly 10 from users of any other website, online 11 service, online application, mobile applica- 12 tion, or connected device that is— 13 ‘‘(I) directed to children or teens 14 under the criteria described in sub- 15 paragraph (A); or 16 ‘‘(II) used or reasonably likely to 17 be used by children or teens. 18 ‘‘(ii) SERVICES DEEMED DIRECTED TO 19 MIXED AUDIENCES.— 20 ‘‘(I) IN GENERAL.—A website, 21 online service, online application, mo- 22 bile application, or connected device 23 that is directed to children or teens 24 under the criteria described in sub- 25 VerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418 12 •S 1418 RS paragraph (A), but that does not tar- 1 get children or teens as the primary 2 audience of the website, online service, 3 online application, mobile application, 4 or connected device shall not be 5 deemed to be directed to children or 6 teens for purposes of this title if the 7 website, online service, online applica- 8 tion, mobile application, or connected 9 device— 10 ‘‘(aa) does not collect per- 11 sonal information from any user 12 of the website, online service, on- 13 line application, mobile applica- 14 tion, or connected device before 15 verifying age information of the 16 user; and 17 ‘‘(bb) does not, without first 18 complying with any relevant no- 19 tice and consent provision under 20 this title, collect, use, or disclose 21 personal information of any user 22 who identifies themselves to the 23 website, online service, online ap- 24 plication, mobile application, or 25 VerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418 13 •S 1418 RS connected device as an individual 1 who is age 16 or younger. 2 ‘‘(II) USE OF CERTAIN TOOLS.— 3 For purposes of this title, a website, 4 online service, online application, mo- 5 bile application, or connected device, 6 shall not be deemed directed to chil- 7 dren or teens solely because the 8 website, online service, online applica- 9 tion, mobile application, or connected 10 device refers or links to any other 11 website, online service, online applica- 12 tion, mobile application, or connected 13 device directed to children or teens by 14 using information location tools, in- 15 cluding— 16 ‘‘(aa) a directory; 17 ‘‘(bb) an index; 18 ‘‘(cc) a reference; 19 ‘‘(dd) a pointer; or 20 ‘‘(ee) a hypertext link. 21 ‘‘(16) MOBILE APPLICATION.—The term ‘mo- 22 bile application’— 23 ‘‘(A) means a software program that runs 24 on the operating system of— 25 VerDate Sep 11 2014 00:40 Dec 14, 2023 Jkt 049200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6401 E:\BILLS\S1418.RS S1418 14 •S 1418 RS ‘‘(i) a cellular telephone; 1 ‘‘(ii) a tablet computer; or 2 ‘‘(iii) a simi [Text truncated for display. Full text available on Congress.gov.]