[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 1418 Reported in Senate (RS)]
<DOC>
Calendar No. 288
118th CONGRESS
1st Session
S. 1418
To amend the Children's Online Privacy Protection Act of 1998 to
strengthen protections relating to the online collection, use, and
disclosure of personal information of children and teens, and for other
purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
May 3, 2023
Mr. Markey (for himself and Mr. Cassidy) introduced the following bill;
which was read twice and referred to the Committee on Commerce,
Science, and Transportation
December 13, 2023
Reported by Ms. Cantwell, with an amendment
[Strike out all after the enacting clause and insert the part printed
in italic]
_______________________________________________________________________
A BILL
To amend the Children's Online Privacy Protection Act of 1998 to
strengthen protections relating to the online collection, use, and
disclosure of personal information of children and teens, and for other
purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
<DELETED>SECTION 1. SHORT TITLE; TABLE OF CONTENTS.</DELETED>
<DELETED> (a) Short Title.--This Act may be cited as the ``Children
and Teens' Online Privacy Protection Act''.</DELETED>
<DELETED> (b) Table of Contents.--The table of contents for this Act
is as follows:</DELETED>
<DELETED>Sec. 1. Short title; table of contents.
<DELETED>Sec. 2. Definitions.
<DELETED>Sec. 3. Online collection, use, and disclosure of personal
information of children and teens.
<DELETED>Sec. 4. Fair Information Practices Principles.
<DELETED>Sec. 5. Digital Marketing Bill of Rights for Teens.
<DELETED>Sec. 6. Targeted marketing to children or teens.
<DELETED>Sec. 7. Removal of content.
<DELETED>Sec. 8. Rule for treatment of users of websites, services, and
applications directed to children or teens.
<DELETED>Sec. 9. Study of mobile and online application oversight.
<DELETED>Sec. 10. Youth Privacy and Marketing Division.
<DELETED>Sec. 11. Enforcement and applicability.
<DELETED>Sec. 12. GAO study.
<DELETED>SEC. 2. DEFINITIONS.</DELETED>
<DELETED> (a) In General.--In this Act:</DELETED>
<DELETED> (1) Commission.--The term ``Commission'' means the
Federal Trade Commission.</DELETED>
<DELETED> (2) Standards.--The term ``standards'' means
benchmarks, guidelines, best practices, methodologies,
procedures, and processes.</DELETED>
<DELETED> (b) Other Definitions.--The definitions set forth in
section 1302 of the Children's Online Privacy Protection Act of 1998
(15 U.S.C. 6501), as amended by section 3(a) of this Act, shall apply
in this Act, except to the extent the Commission provides otherwise by
regulations issued under section 553 of title 5, United States
Code.</DELETED>
<DELETED>SEC. 3. ONLINE COLLECTION, USE, AND DISCLOSURE OF PERSONAL
INFORMATION OF CHILDREN AND TEENS.</DELETED>
<DELETED> (a) Definitions.--Section 1302 of the Children's Online
Privacy Protection Act of 1998 (15 U.S.C. 6501) is amended--</DELETED>
<DELETED> (1) by amending paragraph (2) to read as
follows:</DELETED>
<DELETED> ``(2) Operator.--The term `operator'--</DELETED>
<DELETED> ``(A) means any person--</DELETED>
<DELETED> ``(i) who, for commercial
purposes, in interstate or foreign commerce
operates or provides a website on the internet,
an online service, an online application, a
mobile application, or a connected device;
and</DELETED>
<DELETED> ``(ii) who--</DELETED>
<DELETED> ``(I) collects or
maintains, either directly or through a
service provider, personal information
from or about the users of that
website, service, application, or
connected device;</DELETED>
<DELETED> ``(II) allows another
person to collect personal information
directly from users of that website,
service, application, or connected
device (in which case, the operator is
deemed to have collected the
information); or</DELETED>
<DELETED> ``(III) allows users of
that website, service, application, or
connected device to publicly disclose
personal information (in which case,
the operator is deemed to have
collected the information);
and</DELETED>
<DELETED> ``(B) does not include any nonprofit
entity that would otherwise be exempt from coverage
under section 5 of the Federal Trade Commission Act (15
U.S.C. 45).'';</DELETED>
<DELETED> (2) in paragraph (4)--</DELETED>
<DELETED> (A) by amending subparagraph (A) to read
as follows:</DELETED>
<DELETED> ``(A) the release of personal information
collected from a child or teen for any purpose, except
where the personal information is provided to a person
other than an operator who--</DELETED>
<DELETED> ``(i) provides support for the
internal operations of the website, online
service, online application, mobile
application, or connected device of the
operator, excluding any activity relating to
targeted marketing directed to children, teens,
or connected devices; and</DELETED>
<DELETED> ``(ii) does not disclose or use
that personal information for any other
purpose; and''; and</DELETED>
<DELETED> (B) in subparagraph (B)--</DELETED>
<DELETED> (i) by inserting ``or teen'' after
``child'' each place the term
appears;</DELETED>
<DELETED> (ii) by inserting ``or teens''
after ``children''; and</DELETED>
<DELETED> (iii) by striking ``website or
online service'' and inserting ``website,
online service, online application, mobile
application, or connected device'';</DELETED>
<DELETED> (3) in paragraph (8), by striking subparagraphs
(F) and (G) and inserting the following:</DELETED>
<DELETED> ``(F) geolocation information;</DELETED>
<DELETED> ``(G) information generated from the
measurement or technological processing of an
individual's biological, physical, or physiological
characteristics, including--</DELETED>
<DELETED> ``(i) fingerprints;</DELETED>
<DELETED> ``(ii) voice prints;</DELETED>
<DELETED> ``(iii) iris or retina imagery
scans;</DELETED>
<DELETED> ``(iv) facial imagery or
templates;</DELETED>
<DELETED> ``(v) deoxyribonucleic acid (DNA)
information; or</DELETED>
<DELETED> ``(vi) gait;</DELETED>
<DELETED> ``(H) information reasonably associated
with or attributed to a child or teen;</DELETED>
<DELETED> ``(I) information (including an internet
protocol address) that permits the identification of--
</DELETED>
<DELETED> ``(i) an individual; or</DELETED>
<DELETED> ``(ii) any device used by an
individual to directly or indirectly access the
internet or an online service, online
application, mobile application, or connected
device; or</DELETED>
<DELETED> ``(J) information concerning a child or
teen or the parents of that child or teen (including
any unique or substantially unique identifier, such as
a customer number) that an operator collects online
from the child or teen and combines with an identifier
described in this paragraph.'';</DELETED>
<DELETED> (4) by amending paragraph (9) to read as
follows:</DELETED>
<DELETED> ``(9) Verifiable consent.--The term `verifiable
consent' means any reasonable effort (taking into consideration
available technology), including a request for authorization
for future collection, use, and disclosure described in the
notice, to ensure that, in the case of a child, a parent of the
child, or, in the case of a teen, the teen--</DELETED>
<DELETED> ``(A) receives specific notice of the
personal information collection, use, and disclosure
practices of the operator; and</DELETED>
<DELETED> ``(B) before the personal information of
the child or teen is collected, freely and
unambiguously authorizes--</DELETED>
<DELETED> ``(i) the collection, use, and
disclosure, as applicable, of that personal
information; and</DELETED>
<DELETED> ``(ii) any subsequent use of that
personal information.'';</DELETED>
<DELETED> (5) by striking paragraph (10) and redesignating
paragraphs (11) and (12) as paragraphs (10) and (11),
respectively; and</DELETED>
<DELETED> (6) by adding at the end the following:</DELETED>
<DELETED> ``(12) Connected device.--The term `connected
device' means a device that is capable of connecting to the
internet, directly or indirectly, or to another connected
device.</DELETED>
<DELETED> ``(13) Online application.--The term `online
application'--</DELETED>
<DELETED> ``(A) means an internet-connected software
program; and</DELETED>
<DELETED> ``(B) includes a service or application
offered via a connected device.</DELETED>
<DELETED> ``(14) Online service.--</DELETED>
<DELETED> ``(A) In general.--The term `online
service' means a mass-market retail service by wire or
radio that provides the capability to transmit data and
receive data from all or substantially all Internet
endpoints, including any capabilities that are
incidental to and enable the operation of a
communications service, but excluding dial-up Internet
service.</DELETED>
<DELETED> ``(B) Scope.--Such term includes--
</DELETED>
<DELETED> ``(i) any service that the Federal
Communications Commission finds to be providing
a functionally equivalent service to a service
described in subparagraph (A); and</DELETED>
<DELETED> ``(ii) a service or application
offered via a connected device.</DELETED>
<DELETED> ``(15) Directed to children or teens.--</DELETED>
<DELETED> ``(A) In general.--The terms `directed to
children', `directed to teens', and `directed to
children or teens' mean, with respect to a website,
online service, online application, mobile application,
or connected device, that the website, online service,
online application, mobile application, or connected
device, or a portion thereof, is targeted to children
or teens, as the case may be, as demonstrated by--
</DELETED>
<DELETED> ``(i) the subject matter of the
website, online service, online application,
mobile application, or connected
device;</DELETED>
<DELETED> ``(ii) the visual content of the
website, online service, online application,
mobile application, or connected
device;</DELETED>
<DELETED> ``(iii) the use of animated
characters or child-oriented activities for
children, or the use of teen-oriented
characters or teen-oriented activities for
teens, and related incentives on the website,
online service, online application, mobile
application, or connected device;</DELETED>
<DELETED> ``(iv) the music or other audio
content on the website, online service, online
application, mobile application, or connected
device;</DELETED>
<DELETED> ``(v) the age of models on the
website, online service, online application,
mobile application, or connected
device;</DELETED>
<DELETED> ``(vi) the presence, on the
website, online service, online application,
mobile application, or connected device, of--
</DELETED>
<DELETED> ``(I) child
celebrities;</DELETED>
<DELETED> ``(II) celebrities who
appeal to children;</DELETED>
<DELETED> ``(III) teen celebrities;
or</DELETED>
<DELETED> ``(IV) celebrities who
appeal to teens;</DELETED>
<DELETED> ``(vii) the language used on the
website, online service, online application,
mobile application, or connected
device;</DELETED>
<DELETED> ``(viii) advertising content used
on, or used to advertise, the website, online
service, online application, mobile
application, or connected device; or</DELETED>
<DELETED> ``(ix) reliable empirical evidence
relating to--</DELETED>
<DELETED> ``(I) the composition of
the audience of the website, online
service, online application, mobile
application, or connected device;
and</DELETED>
<DELETED> ``(II) the intended
audience of the website, online
service, online application, mobile
application, or connected
device.</DELETED>
<DELETED> ``(B) Rules of construction.--</DELETED>
<DELETED> ``(i) Services deemed directed to
children or teens.--For the purposes of this
title, a website, online service, online
application, mobile application, or connected
device, or a portion thereof, shall be deemed
to be directed to children or teens if it
collects personal information directly from
users of any other website, online service,
online application, mobile application, or
connected device that is--</DELETED>
<DELETED> ``(I) directed to children
or teens under the criteria described
in subparagraph (A); or</DELETED>
<DELETED> ``(II) used or reasonably
likely to be used by children or
teens.</DELETED>
<DELETED> ``(ii) Services deemed directed to
mixed audiences.--</DELETED>
<DELETED> ``(I) In general.--A
website, online service, online
application, mobile application, or
connected device that is directed to
children or teens under the criteria
described in subparagraph (A), but that
does not target children or teens as
the primary audience of the website,
online service, online application,
mobile application, or connected device