[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[H.R. 6291 Introduced in House (IH)]
<DOC>
119th CONGRESS
1st Session
H. R. 6291
To amend the Children's Online Privacy Protection Act of 1998 to
strengthen protections relating to the online collection, use, and
disclosure of personal information of children and teens, and for other
purposes.
_______________________________________________________________________
IN THE HOUSE OF REPRESENTATIVES
November 25, 2025
Mr. Walberg (for himself and Ms. Lee of Florida) introduced the
following bill; which was referred to the Committee on Energy and
Commerce
_______________________________________________________________________
A BILL
To amend the Children's Online Privacy Protection Act of 1998 to
strengthen protections relating to the online collection, use, and
disclosure of personal information of children and teens, and for other
purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) Short Title.--This Act may be cited as the ``Children and
Teens' Online Privacy Protection Act''.
(b) Table of Contents.--The table of contents for this Act is as
follows:
Sec. 1. Short title; table of contents.
Sec. 2. Amendments to Children's Online Privacy Protection Act of 1998.
Sec. 3. Reports.
Sec. 4. Severability.
SEC. 2. AMENDMENTS TO CHILDREN'S ONLINE PRIVACY PROTECTION ACT OF 1998.
(a) Definitions.--Section 1302 of the Children's Online Privacy
Protection Act of 1998 (15 U.S.C. 6501) is amended--
(1) by amending paragraph (2) to read as follows:
``(2) Operator.--The term `operator'--
``(A) means any person--
``(i) who, for commercial purposes,
operates or provides a website, an online
service, an online application, or a mobile
application; and
``(ii) who--
``(I) collects or maintains, either
directly or through a service provider,
personal information of users of the
website, service, or application;
``(II) allows another person to
collect personal information directly
from users of the website, service, or
application (in which case, the
operator is deemed to have collected
the information); or
``(III) allows users of the
website, service, or application to
publicly disclose personal information
(in which case, the operator is deemed
to have collected the information); and
``(B) does not include any organization described
in section 501(c)(3) of the Internal Revenue Code of
1986 and exempt from taxation under section 501(a) of
such Code.'';
(2) in paragraph (4)--
(A) by amending subparagraph (A) to read as
follows:
``(A) the release of personal information collected
from a child or teen by an operator for any purpose,
except if the personal information is provided to a
person other than an operator who--
``(i) provides support for the internal
operations of the website, online service,
online application, or mobile application of
the operator, excluding any activity relating
to individual-specific advertising provided to
children or teens; and
``(ii) does not disclose or use the
personal information for any other purpose;
and''; and
(B) in subparagraph (B)--
(i) in the matter preceding clause (i)--
(I) by inserting ``or teen'' after
``child'' each place the term appears;
(II) by striking ``website or
online service'' and inserting
``website, online service, online
application, or mobile application'';
and
(III) by striking ``actual
knowledge'' and inserting
``knowledge''; and
(ii) in clause (i), by striking ``a
website'' and inserting ``such a website,
service, or application'';
(3) by amending paragraph (8) to read as follows:
``(8) Personal information.--
``(A) In general.--The term `personal information'
means individually identifiable information about an
individual collected online, including--
``(i) a first and last name;
``(ii) a home or other physical address,
including a street name and a name of a city or
town;
``(iii) an e-mail address;
``(iv) a telephone number;
``(v) a Social Security number;
``(vi) a persistent identifier that can be
used to recognize a specific child or teen over
time and across different websites, online
services, online applications, or mobile
applications, that--
``(I) includes--
``(aa) a customer number
held in a cookie;
``(bb) an Internet Protocol
(IP) address;
``(cc) a processor or
device serial number; and
``(dd) a unique device
identifier; and
``(II) excludes an identifier that
is used by an operator solely for
providing support for the internal
operations of a website, online
service, online application, or mobile
application of the operator;
``(vii) a photograph, video, or audio file
that contains the image or voice of a child or
teen;
``(viii) geolocation information;
``(ix) information generated from the
measurement or technological processing of the
biological, physical, or physiological
characteristics of an individual, including--
``(I) fingerprints;
``(II) voice prints;
``(III) iris or retina imagery
scans;
``(IV) facial templates;
``(V) deoxyribonucleic acid (DNA)
information; and
``(VI) gait;
``(x) information linked or reasonably
linkable to a child or teen or a parent of a
child or teen (including any unique identifier)
that an operator collects online from the child
or teen and combines with an identifier
described in this subparagraph; and
``(xi) any other identifier that the
Commission determines permits the physical or
online contacting of an individual.
``(B) Exclusion.--The term `personal information'
does not include an audio file that contains the voice
of a child or teen if the operator--
``(i) does not request information via
voice that would otherwise be considered
personal information under this paragraph;
``(ii) provides clear notice in the privacy
policy of a website, online service, online
application, or mobile application of the
operator regarding--
``(I) the collection and use of
such an audio file; and
``(II) the deletion policy relating
to such an audio file;
``(iii) only uses the voice contained in
the audio file as a replacement for written
words to perform a task or otherwise engage
with such website, service, or application,
including by conducting a search or fulfilling
a verbal instruction or request;
``(iv) only maintains the audio file during
the period necessary to complete the relevant
task or engagement;
``(v) does not make any other use of the
audio file during such period; and
``(vi) deletes the audio file at the end of
such period.
``(C) Support for the internal operations of a
website, online service, online application, or mobile
application.--
``(i) In general.--For purposes of
subparagraph (A)(vi)(II), the term `support for
the internal operations of a website, online
service, online application, or mobile
application' means the activities necessary to
such website, service, or application to--
``(I) maintain or analyze
functioning;
``(II) perform network
communications;
``(III) authenticate users;
``(IV) personalize content;
``(V) serve contextual advertising
to users (if any persistent identifier
is only used as necessary for technical
purposes to serve the contextual
advertisement or cap the frequency of
contextual advertising);
``(VI) protect--
``(aa) the integrity of the
website, service, or
application; or
``(bb) the personal
information or security of
users;
``(VII) ensure compliance with
Federal or State law; and
``(VIII) fulfill a request of a
child or teen under subparagraph (A),
(B), or (C) of section 1303(b)(2).
``(ii) Condition.--Except as permitted
under clause (i), information collected through
the activities described in clause (i) may not
be used or disclosed to contact an individual
(including through individual-specific
advertising provided to children or teens), to
amass a profile on an individual, in connection
with processes that encourage or prompt use of
a website or online service, or for any other
purpose.'';
(4) by amending paragraph (9) to read as follows:
``(9) Verifiable consent.--The term `verifiable consent'
means any reasonable effort (taking into consideration
available technology) by an operator, including a request for
authorization for future collection, use, and disclosure of
personal information, to ensure that a parent of a child (in
the case of a child) or a teen (in the case of a teen)--
``(A) receives direct notice of the collection,
use, and disclosure practices of the operator with
respect to personal information; and
``(B) before the personal information of the child
or teen is collected, freely and unambiguously
authorizes--
``(i) the collection, use, and disclosure,
as applicable, of the personal information; and
``(ii) any subsequent use of the personal
information.'';
(5) in paragraph (10)--
(A) in the heading, by striking ``Website or online
service directed to children'' and inserting ``Website,
online service, online application, or mobile
application directed to children'';
(B) by striking ``website or online service
directed to children'' each place it appears and
inserting ``website, online service, online
application, or mobile application directed to
children'';
(C) by striking ``commercial website or online
service'' each place it appears and inserting
``website, online service, online application, or
mobile application''; and
(D) by adding at the end the following new
subparagraph:
``(C) Rule of construction.--In considering whether
a website, online service, online application, or
mobile application, or a portion thereof, is directed
to children, the Commission shall apply a totality of
circumstances test considering competent and reliable
evidence regarding the intended audience of the
website, service, or application.''; and
(6) by adding at the end the following:
``(13) Online application.--The term `online application'
means an internet-connected software program.
``(14) Mobile application.--The term `mobile application'
means a software program that runs on the operating system of--
``(A) a cellular telephone;
``(B) a tablet computer; or
``(C) a similar portable computing device that
transmits data over a wireless connection.
``(15) Geolocation information.--The term `geolocation
information' means information sufficient to identify a street
name and name of a city or town.
``(16) Teen.--The term `teen' means an individual over the
age of 12 and under the age of 17.
``(17) High-impact social media company.--The term `high-
impact social media company' means a website, online service,
online application, or mobile application of an operator that--
``(A) generates $3,000,000,000 or more in annual
revenue, including any revenue generated by any
affiliate of such operator;
``(B) has 300,000,000 or more monthly active users
for not fewer than 3 of the preceding 12 months on the
website, online service, online application, or mobile
application of such operator; and
``(C) constitutes an online product or service that
is primarily used by users to access or share user-
generated content.
``(18) Knowledge.--The term `knowledge' means--
``(A) with respect to a high-impact social media
company, the operator has actual knowledge, or
willfully disregarded information that would lead a
reasonable and prudent person to determine, that a user
is a child or teen; and
``(B) with respect to an operator that does not
meet the requirements of subparagraph (A), actual
knowledge.
``(19) Individual-specific advertising to children or
teens.--
``(A) In general.--The term `individual-specific
advertising to children or teens' means advertising or
any other effort to market a product or service that is
directed to a child or teen based on--
``(i) personal information of--
``(I) the child or teen; or
``(II) a group of children or teens
who are similar in sex, age, household
income level, race, or ethnicity to the
child or teen to whom the product or
service is marketed; or
``(ii) profiling of such child or teen or
group of children or teens.
``(B) Exclusions.--The term `individual-specific
advertising to children or teens' does not include--
``(i) advertising or marketing to an
individual or to a device of an individual in
response to a request by the individual for
information or feedback, such as a search query
by a child or teen;
``(ii) contextual advertising, including if
an advertisement is displayed based on the
content of the website, online service, online
application, or mobile application on which the
advertisement appears and does not vary based