[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[H.R. 7890 Introduced in House (IH)]
<DOC>
118th CONGRESS
2d Session
H. R. 7890
To amend the Children's Online Privacy Protection Act of 1998 to
strengthen protections relating to the online collection, use, and
disclosure of personal information of children and teens, and for other
purposes.
_______________________________________________________________________
IN THE HOUSE OF REPRESENTATIVES
April 9, 2024
Mr. Walberg (for himself, Ms. Castor of Florida, Mr. Bucshon, Ms.
Eshoo, Mr. Carter of Georgia, Mr. Moulton, Mr. Dunn of Florida, and Mr.
Auchincloss) introduced the following bill; which was referred to the
Committee on Energy and Commerce
_______________________________________________________________________
A BILL
To amend the Children's Online Privacy Protection Act of 1998 to
strengthen protections relating to the online collection, use, and
disclosure of personal information of children and teens, and for other
purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) Short Title.--This Act may be cited as the ``Children and
Teens' Online Privacy Protection Act''.
(b) Table of Contents.--The table of contents for this Act is as
follows:
Sec. 1. Short title; table of contents.
Sec. 2. Online collection, use, disclosure, and deletion of personal
information of children and teens.
Sec. 3. Study and reports of mobile and online application oversight
and enforcement.
Sec. 4. Severability.
SEC. 2. ONLINE COLLECTION, USE, DISCLOSURE, AND DELETION OF PERSONAL
INFORMATION OF CHILDREN AND TEENS.
(a) Definitions.--Section 1302 of the Children's Online Privacy
Protection Act of 1998 (15 U.S.C. 6501) is amended--
(1) by amending paragraph (2) to read as follows:
``(2) Operator.--The term `operator'--
``(A) means any person--
``(i) who, for commercial purposes, in
interstate or foreign commerce operates or
provides a website on the internet, an online
service, an online application, or a mobile
application; and
``(ii) who--
``(I) collects or maintains, either
directly or through a service provider,
personal information from or about the
users of that website, service, or
application;
``(II) allows another person to
collect personal information directly
from users of that website, service, or
application (in which case, the
operator is deemed to have collected
the information); or
``(III) allows users of that
website, service, or application to
publicly disclose personal information
(in which case, the operator is deemed
to have collected the information); and
``(B) does not include any nonprofit entity that
would otherwise be exempt from coverage under section 5
of the Federal Trade Commission Act (15 U.S.C. 45).'';
(2) in paragraph (4)--
(A) by amending subparagraph (A) to read as
follows:
``(A) the release of personal information collected
from a child or teen by an operator for any purpose,
except where the personal information is provided to a
person other than an operator who--
``(i) provides support for the internal
operations of the website, online service,
online application, or mobile application of
the operator, excluding any activity relating
to individual-specific advertising to children
or teens; and
``(ii) does not disclose or use that
personal information for any other purpose;
and''; and
(B) in subparagraph (B)--
(i) by inserting ``or teen'' after
``child'' each place the term appears;
(ii) by striking ``website or online
service'' and inserting ``website, online
service, online application, or mobile
application''; and
(iii) by striking ``actual knowledge'' and
inserting ``actual knowledge or knowledge
fairly implied on the basis of objective
circumstances'';
(3) by striking paragraph (8) and inserting the following:
``(8) Personal information.--
``(A) In general.--The term `personal information'
means individually identifiable information about an
individual collected online, including--
``(i) a first and last name;
``(ii) a home or other physical address
including street name and name of a city or
town;
``(iii) an e-mail address;
``(iv) a telephone number;
``(v) a Social Security number;
``(vi) any other identifier that the
Commission determines permits the physical or
online contacting of a specific individual;
``(vii) a persistent identifier that can be
used to recognize a specific child or teen over
time and across different websites, online
services, online applications, or mobile
applications, including but not limited to a
customer number held in a cookie, an Internet
Protocol (IP) address, a processor or device
serial number, or unique device identifier, but
excluding an identifier that is used by an
operator solely for providing support for the
internal operations of the website, online
service, online application, or mobile
application;
``(viii) a photograph, video, or audio file
where such file contains a specific child's or
teen's image or voice;
``(ix) geolocation information;
``(x) information generated from the
measurement or technological processing of an
individual's biological, physical, or
physiological characteristics that is used to
identify an individual, including--
``(I) fingerprints;
``(II) voice prints;
``(III) iris or retina imagery
scans;
``(IV) facial templates;
``(V) deoxyribonucleic acid (DNA)
information; or
``(VI) gait; or
``(xi) information linked or reasonably
linkable to a child or teen or the parents of
that child or teen (including any unique
identifier) that an operator collects online
from the child or teen and combines with an
identifier described in this subparagraph.
``(B) Exclusion.--The term `personal information'
shall not include an audio file that contains a child's
or teen's voice so long as the operator--
``(i) does not request information via
voice that would otherwise be considered
personal information under this paragraph;
``(ii) provides clear notice of its
collection and use of the audio file and its
deletion policy in its privacy policy;
``(iii) only uses the voice within the
audio file solely as a replacement for written
words, to perform a task, or engage with a
website, online service, online application, or
mobile application, such as to perform a search
or fulfill a verbal instruction or request; and
``(iv) only maintains the audio file long
enough to complete the stated purpose and then
immediately deletes the audio file and does not
make any other use of the audio file prior to
deletion.
``(C) Support for the internal operations of a
website, online service, online application, or mobile
application.--
``(i) In general.--For purposes of
subparagraph (A)(vii), the term `support for
the internal operations of a website, online
service, online application, or mobile
application' means those activities necessary
to--
``(I) maintain or analyze the
functioning of the website, online
service, online application, or mobile
application;
``(II) perform network
communications;
``(III) authenticate users of, or
personalize the content on, the
website, online service, online
application, or mobile application;
``(IV) cap the frequency of
advertising;
``(V) protect the security or
integrity of the user, website, online
service, online application, or mobile
application;
``(VI) ensure legal or regulatory
compliance, or
``(VII) fulfill a request of a
child or teen as permitted by
subparagraphs (A) through (C) of
section 1303(b)(2).
``(ii) Condition.--Except as specifically
permitted under clause (i), information
collected for the activities listed in clause
(i) cannot be used or disclosed to contact a
specific individual, including through
individual-specific advertising to children or
teens, to amass a profile on a specific
individual, in connection with processes that
encourage or prompt use of a website or online
service, or for any other purpose.'';
(4) by amending paragraph (9) to read as follows:
``(9) Verifiable consent.--The term `verifiable consent'
means any reasonable effort (taking into consideration
available technology), including a request for authorization
for future collection, use, and disclosure described in the
notice, to ensure that, in the case of a child, a parent of the
child, or, in the case of a teen, the teen--
``(A) receives direct notice of the personal
information collection, use, and disclosure practices
of the operator; and
``(B) before the personal information of the child
or teen is collected, freely and unambiguously
authorizes--
``(i) the collection, use, and disclosure,
as applicable, of that personal information;
and
``(ii) any subsequent use of that personal
information.'';
(5) in paragraph (10)--
(A) in the paragraph header, by striking ``Website
or online service directed to children'' and inserting
``Website, online service, online application, or
mobile application directed to children'';
(B) by striking ``website or online service'' each
place it appears and inserting ``website, online
service, online application, or mobile application'';
and
(C) by adding at the end the following new
subparagraph:
``(C) Rule of construction.--In considering whether
a website, online service, online application, or
mobile application, or portion thereof, is directed to
children, the Commission shall apply a totality of
circumstances test and will also consider competent and
reliable empirical evidence regarding audience
composition and evidence regarding the intended
audience of the website, online service, online
application, or mobile application.''; and
(6) by adding at the end the following:
``(13) Connected device.--The term `connected device' means
a device that is capable of connecting to the internet,
directly or indirectly, or to another connected device.
``(14) Online application.--The term `online application'--
``(A) means an internet-connected software program;
and
``(B) includes a service or application offered via
a connected device.
``(15) Mobile application.--The term `mobile application'--
``(A) means a software program that runs on the
operating system of--
``(i) a cellular telephone;
``(ii) a tablet computer; or
``(iii) a similar portable computing device
that transmits data over a wireless connection;
and
``(B) includes a service or application offered via
a connected device.
``(16) Geolocation information.--The term `geolocation
information' means information sufficient to identify a street
name and name of a city or town.
``(17) Teen.--The term `teen' means an individual over the
age of 12 and under the age of 17.
``(18) Individual-specific advertising to children or
teens.--
``(A) In general.--The term `individual-specific
advertising to children or teens' means advertising or
any other effort to market a product or service that is
directed to a specific child or teen or a connected
device that is linked or reasonably linkable to a child
or teen based on--
``(i) the personal information from--
``(I) the child or teen; or
``(II) a group of children or teens
who are similar in sex, age, household
income level, race, or ethnicity to the
specific child or teen to whom the
product or service is marketed;
``(ii) profiling of a child or teen or
group of children or teens; or
``(iii) a unique identifier of the
connected device.
``(B) Exclusions.--The term `individual-specific
advertising to children or teens' shall not include--
``(i) advertising or marketing to an
individual or the device of an individual in
response to the individual's specific request
for information or feedback, such as a child's
or teen's current search query;
``(ii) contextual advertising, such as when
an advertisement is displayed based on the
content of the website, online service, online
application, mobile application, or connected
device in which the advertisement appears and
does not vary based on personal information
related to the viewer; or
``(iii) processing personal information
solely for measuring or reporting advertising
or content performance, reach, or frequency,
including independent measurement.
``(C) Rule of construction.--Nothing in
subparagraph (A) shall be construed to prohibit an
operator with actual knowledge or knowledge fairly
implied on the basis of objective circumstances that a
user is under the age of 17 from delivering advertising
or marketing that is age-appropriate and intended for a
child or teen audience, so long as the operator does
not use any personal information other than whether the
user is under the age of 17.''.
(b) Online Collection, Use, Disclosure, and Deletion of Personal
Information of Children and Teens.--Section 1303 of the Children's
Online Privacy Protection Act of 1998 (15 U.S.C. 6502) is amended--
(1) by striking the heading and inserting the following:
``online collection, use, disclosure, and deletion of personal
information of children and teens.'';
(2) in subsection (a)--
(A) by amending paragraph (1) to read as follows: