Bill Summary – FastDemocracy

WEST VIRGINIA LEGISLATURE
REGULAR SESSION
              Introduced House Bill 4718
              By Delegate Clark [Introduced January 15, 2024; Referred to the Committee on the Judiciary ]
     Intr HB                                     2024R1037
  A BILL to amend the Code of West Virginia, 1931, as amended, by adding thereto a new article,
         designated §46A-9-1, §46A-9-2, §46A-9-3, §46A-9-4, and §46A-9-5, all relating to online
         privacy protection for children; defining terms; establishing actions prohibited; creating
         rulemaking authority; providing safe harbor for operators; and providing for enforcement by
         the Attorney General.
     Be it enacted by the Legislature of West Virginia:
     ARTICLE         9.        ONLINE      PRIVACY         PROTECTION             FOR       CHILDREN.
     §46A-9-1.         Legislative Findings and Statutory Construction.
         The Legislature hereby declares that the purpose of this article is to complement the body
  of federal law governing online privacy protections for children. It is the intent of the Legislature
  that, in construing this article, the courts be guided by the policies of the Federal Trade
  Commission and interpretations given by the Federal Trade Commission and the federal courts to
  the Children’s Online Privacy Protection Act (15 USC 6501), as from time to time amended, and to
  the various other federal statutes dealing with the same or similar matters. To this end, this article
  shall be liberally construed so that its beneficial purposes may be served.
     §46A-9-2.                                                                               Definitions.
         In this article:
         (1) Child. The term "child" means an individual under the age of 18.
         (2) Operator. The term "operator" means any person who operates a website located on
  the Internet or an online service and who collects or maintains personal information from or about
  the users of or visitors to such website or online service, or on whose behalf such information is
  collected or maintained, where such website or online service is operated for commercial
  purposes, including any person offering products or services for sale through that website or
  online service, involving commerce in the State of West Virginia;
         (3) Disclosure. The term "disclosure" means, with respect to personal information:
        (A) The release of personal information collected from a child in identifiable form by an
                                                       1
     Intr HB                                    2024R1037
 operator for any purpose, except where such information is provided to a person other than the
 operator who provides support for the internal operations of the website and does not disclose or
 use that information for any other purpose; and
        (B) Making personal information collected from a child by a website or online service
 directed to children or with actual knowledge that such information was collected from a child,
 publicly available in identifiable form, by any means including by a public posting, through the
 Internet, or through:
        (i) A home page of a website;
        (ii) A pen pal service;
        (iii) An electronic mail service;
        (iv) A message board; or
        (v) A chat room.
        (4) Internet. The term "Internet" means collectively the myriad of computer and
 telecommunications facilities, including equipment and operating software, which comprise the
 interconnected world-wide network of networks that employ the Transmission Control
 Protocol/Internet Protocol, or any predecessor or successor protocols to such protocol, to
 communicate information of all kinds by wire or radio.
        (5) Parent. The term "parent" includes a legal guardian.
        (6) Personal information. The term "personal information" means individually identifiable
 information about an individual collected online, including—
        (A) A first and last name;
        (B) A home or other physical address including street name and name of a city or town;
        (C) An e-mail address;
        (D) A telephone number;
        (E) A Social Security number;
        (F) Any other identifier that the Attorney general determines permits the physical or online
                                                       2
     Intr HB                                      2024R1037
 contacting of a specific individual; or
         (G) Information concerning the child or the parents of that child that the website collects
 online from the child and combines with an identifier described in this paragraph.
         (7) Verifiable parental consent. The term "verifiable parental consent" means any
 reasonable effort (taking into consideration available technology), including a request for
 authorization for future collection, use, and disclosure described in the notice, to ensure that a
 parent of a child receives notice of the operator’s personal information collection, use, and
 disclosure practices, and authorizes the collection, use, and disclosure, as applicable, of personal
 information and the subsequent use of that information before that information is collected from
 that child.
         (8) Website or online service directed to children.
         (A) In general. The term "website or online service directed to children" means—
         (i) a commercial website or online service that is targeted to children; or
         (ii) that portion of a commercial website or online service that is targeted to children.
         (B) Limitation. A commercial website or online service, or a portion of a commercial
 website or online service, shall not be deemed directed to children solely for referring or linking to a
 commercial website or online service directed to children by using information location tools,
 including a directory, index, reference, pointer, or hypertext link.
         (9) Person. The term "person" means any individual, partnership, corporation, trust, estate,
 cooperative, association, or other entity.
         (10) Online contact information. The term "online contact information" means an e-mail
 address or another substantially similar identifier that permits direct contact with a person online.
     §46A-9-3.                                                     Prohibited Acts.
          (a) Acts prohibited
          (1) In general — It is unlawful for an operator of a website or online service directed to
  children, or any operator that has actual knowledge that it is collecting personal information from a
                                                        3
     Intr HB                                      2024R1037
  child, to collect personal information from a child in a manner that violates the regulations
  prescribed under subsection (b).
         (2) Disclosure to parent protected — Notwithstanding subdivision (1), neither an operator
  of such a website or online service nor the operator’s agent shall be held to be liable for any
  disclosure made in good faith and following reasonable procedures in responding to a request for
  disclosure of personal information under subsection (b)(1)(B)(iii) to the parent of a child.
        (b) Rules.
        (1) In general — Not later than July 1, 2024, the Attorney General shall propose rules for
 legislative approval in accordance with the provisions of §29A-3-1 et seq. of this code —
        (A) Require the operator of any website or online service directed to children that collects
 personal information from children or the operator of a website or online service that has actual
 knowledge that it is collecting personal information from a child:
        (i) To provide notice on the website of what information is collected from children by the
 operator, how the operator uses such information, and the operator’s disclosure practices for such
 information; and
        (ii) To obtain verifiable parental consent for the collection, use, or disclosure of personal
 information from children;
        (B) Require the operator to provide, upon request of a parent under this subparagraph
 whose child has provided personal information to that website or online service, upon proper
 identification of that parent, to such parent:
        (i) A description of the specific types of personal information collected from the child by that
 operator;
        (ii) The opportunity at any time to refuse to permit the operator’s further use or
 maintenance in retrievable form, or future online collection, of personal information from that child;
 and
        (iii) Notwithstanding any other provision of law, a means that is reasonable under the
                                                       4
     Intr HB                                      2024R1037
 circumstances for the parent to obtain any personal information collected from that child;
        (C) Prohibit conditioning a child’s participation in a game, the offering of a prize, or another
 activity on the child disclosing more personal information than is reasonably necessary to
 participate in such activity; and
        (D) Require the operator of such a website or online service to establish and maintain
 reasonable procedures to protect the confidentiality, security, and integrity of personal information
 collected from children.
        (2) When consent not required — The regulations shall provide that verifiable parental
 consent under subdivision (1)(A)(ii) is not required in the case of:
        (A) Online contact information collected from a child that is used only to respond directly on
 a one-time basis to a specific request from the child and is not used to recontact the child and is not
 maintained in retrievable form by the operator;
        (B) A request for the name or online contact information of a parent or child that is used for
 the sole purpose of obtaining parental consent or providing notice under this section and where
 such information is not maintained in retrievable form by the operator if parental consent is not
 obtained after a reasonable time;
        (C) Online contact information collected from a child that is used only to respond more than
 once directly to a specific request from the child and is not used to recontact the child beyond the
 scope of that request:
        (i) If, before any additional response after the initial response to the child, the operator uses
 reasonable efforts to provide a parent notice of the online contact information collected from the
 child, the purposes for which it is to be used, and an opportunity for the parent to request that the
 operator make no further use of the information and that it not be maintained in retrievable form; or
        (ii) Without notice to the parent in such circumstances as the attorney general may
 determine are appropriate, taking into consideration the benefits to the child of access to
 information and services, and risks to the security and privacy of the child, in rules promulgated
                                                       5
     Intr HB                                      2024R1037
 under this subsection;
        (D) The name of the child and online contact information (to the extent reasonably
 necessary to protect the safety of a child participant on the site):
        (i) Used only for the purpose of protecting such safety;
        (ii) Not used to recontact the child or for any other purpose; and
        (iii) Not disclosed on the site, if the operator uses reasonable efforts to provide a parent
 notice of the name and online contact information collected from the child, the purposes for which
 it is to be used, and an opportunity for the parent to request that the operator make no further use
 of the information and that it not be maintained in retrievable form; or
        (E) The collection, use, or dissemination of such information by the operator of such a
 website or online service is necessary:
        (i) To protect the security or integrity of its website;
        (ii) To take precautions against liability;
        (iii) To respond to judicial process; or
        (iv) To the extent permitted under other provisions of law, to provide information to law-
 enforcement agencies or for an investigation on a matter related to public safety.
        (3) Termination of service. The regulations shall permit the operator of a website or an
 online service to terminate service provided to a child whose parent has refused, under the rules
 prescribed under subdivision (1)(B)(ii), to permit the operator’s further use or maintenance in
 retrievable form, or future online collection, of personal information from that child.
        (c) Enforcement. Subject to §46A-9-4 and §46A-9-5 of this code, a violation of a rule
 prescribed under subsection (b) shall be treated as a violation of subsection (a) of this section.
        (d) Inconsistent State law — No local government may impose any liability for commercial
 activities or actions by operators in interstate or foreign commerce in connection with an activity or
 action described in this chapter that is inconsistent with the treatment of those activities or actions
 under this section.
                                                          6
     Intr HB                                     2024R1037
     §46A-9-4.                                       Safe Harbor.
         (a) Guidelines.-- An operator may satisfy the requirements of the rules issued under §46A-
  9-2 of this code describing prohibited acts by following a set of self-regulatory guidelines, issued
  by representatives of the marketing or online industries, or by other persons, approved under
  subsection (b).
         (b) Incentives.
         (1) Self-regulatory incentives. In prescribing rules under the Attorney General shall provide
  incentives for self-regulation by operators to implement the protections afforded children under the
  requirements described in subsection (b) of that section.
         (2) Deemed compliance. Such incentives shall include provisions for ensuring that a
 person will be deemed to be in compliance with the requirements of the rules promulgated under
 §46A-9-2 of this code if that person complies with guidelines that, after notice and comment, are
 approved by the Attorney General upon making a determination that the guidelines meet the
 requirements of the rules issued under §46A-9-2 of this code.
        (3) Expedited response to requests. The Attorney General shall act upon requests for safe
 harbor treatment within 180 days of the filing of the request, and shall set forth in writing its
 conclusions with regard to such requests.
        (c) Appeals.-- Final action by the Attorney General on a request for approval of guidelines,
 or the failure to act within 180 days on a request for approval of guidelines, submitted under
 subsection (b) may be appealed to a circuit court in Kanawha County.
     §46A-9-5.                                                                           Enforcement.
         (a) In general.-- Except as otherwise provided, this chapter shall be enforced by the
  Attorney General under the West Virginia Consumer Credit and Protection Act, §46A-1-1 et seq. of
  this code.
         (b) Actions by Attorney General.-- The Attorney General shall prevent any person from
  violating a rule of the Attorney General promulgated under §46A-9-2 of this code in the same
                                                      7
     Intr HB                                         2024R1037
  manner, by the same means, and with the same jurisdiction, powers, and duties as though all
  applicable terms and provisions of the West Virginia Consumer Credit and Protection Act, as
  though §46A-1-1 et seq. of this code was incorporated and made a part of this chapter. Any entity
  that violates such rule shall be subject to the penalties and entitled to the privileges and immunities
 provided in the West Virginia Consumer Credit Protection Act in the same manner, by the same
 means, and with the same jurisdiction, power, and duties as though all applicable terms and
 provisions of the West Virginia Consumer Credit Protection Act were incorporated into and made a
 part of this article.
         (c) Effect on other laws.-- Nothing contained in this chapter shall be construed to limit the
 authority of the Attorney General under any other provisions of law.
             NOTE: The purpose of this bill is to provide online privacy protections for children under the age of 18.
             Strike-throughs indicate language that would be stricken from a heading or the present law and underscoring indicates new language that would be added.
                                                           8
Statutes affected: 
Introduced Version: 46A-9-1, 46A-9-2, 46A-9-3, 46A-9-4, 46A-9-5