Sec. 202. Online collection, use, disclosure, and deletion of personal information of children

3,208 words·~15 min read·/bill/118/hr/8818/ih/section-202

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

Section 1302 of the Children’s Online Privacy Protection Act of 1998 ( 15 U.S.C. 6501 ) is amended— by amending paragraph

(2)to read as follows: The term operator — means any person— who, for commercial purposes, in interstate or foreign commerce, operates or provides a website on the internet, an online service, an online application, or a mobile application; and who— collects or maintains, either directly or through a service provider, personal information from or about the users of that website, service, or application; allows another person to collect personal information directly from users of that website, service, or application (in which case, the operator is deemed to have collected the information); or allows users of that website, service, or application to publicly disclose personal information (in which case, the operator is deemed to have collected the information); and does not include any nonprofit entity that would otherwise be exempt from coverage under section 5 of the Federal Trade Commission Act ( 15 U.S.C. 45 ). ; in paragraph (4)— by amending subparagraph

(A)to read as follows: the release of personal information collected from a child by an operator for any purpose, except where the personal information is provided to a person other than an operator who— provides support for the internal operations of a website, online service, online application, or mobile application (as defined in paragraph (8)(C)) of the operator, excluding any activity relating to targeted advertising or first-party advertising (as such terms are defined in section 101 of the American Privacy Rights Act of 2024) to children; and does not disclose or use that personal information for any other purpose; and ; and in subparagraph (B)— by striking website or online service and inserting website, online service, online application, or mobile application ; and by striking actual knowledge and inserting actual knowledge or knowledge fairly implied on the basis of objective circumstances ; by striking paragraph

(8)and inserting the following: The term personal information means individually identifiable information about an individual collected online, including— a first and last name; a home or other physical address including street name and name of a city or town; an e-mail address; a telephone number; a Social Security number; any other identifier that the Commission determines permits the physical or online contacting of a specific individual; a persistent identifier that can be used to recognize a specific child over time and across different websites, online services, online applications, or mobile applications, including a customer number held in a cookie, an Internet Protocol

(IP)address, a processor or device serial number, or a unique device identifier, but excluding an identifier that is used by an operator solely for providing support for the internal operations of a website, online service, online application, or mobile application; a photograph, video, or audio file, if such file contains the image or voice of a specific child; geolocation information; information generated from the measurement or technological processing of the biological, physical, or physiological characteristics of an individual that is used to identify an individual, including— fingerprints; voice prints; iris or retina imagery scans; facial templates; deoxyribonucleic acid

(DNA)information; or gait; or information linked or reasonably linkable to a child or the parents of that child (including any unique identifier) that an operator collects online from the child and combines with an identifier described in this subparagraph. The term personal information does not include an audio file that contains the voice of a child, if the operator— does not request information via voice that would otherwise be considered personal information under this paragraph; provides, in the privacy policy of the operator, clear notice of the collection and use of the audio file by the operator and the deletion policy of the operator; uses the voice within the audio file solely as a replacement for written words, to perform a task, or to engage with a website, online service, online application, or mobile application, such as to perform a search or fulfill a verbal instruction or request; and only maintains the audio file long enough to complete the stated purpose and then immediately deletes the audio file and does not make any other use of the audio file prior to deletion. For purposes of subparagraph (A)(vii), the term support for the internal operations of a website, online service, online application, or mobile application means those activities necessary to— maintain or analyze the functioning of the website, online service, online application, or mobile application; perform network communications; authenticate users of, or personalize the content on, the website, online service, online application, or mobile application; cap the frequency of advertising; protect the security or integrity of the user, website, online service, online application, or mobile application; ensure legal or regulatory compliance; or fulfill a request of a child as permitted by subparagraphs

(A)through

(C)of section 1303(b)(2). Except as specifically permitted under clause (i), information collected for the activities listed in clause

(i)may not be used or disclosed to contact a specific individual, including through targeted advertising or first-party advertising (as such terms are defined in section 101 of the American Privacy Rights Act of 2024) to children, to amass a profile on a specific individual, in connection with processes that encourage or prompt use of a website, online service, online application, or mobile application, or for any other purpose. ; by amending paragraph

(9)to read as follows: The term verifiable consent means any reasonable effort (taking into consideration available technology), including a request for authorization for future collection, use, and disclosure described in the notice, to ensure that a parent of the child— receives direct notice of the personal information collection, use, and disclosure practices of the operator; and before the personal information of the child is collected, freely and unambiguously authorizes— the collection, use, and disclosure, as applicable, of that personal information; and any subsequent use of that personal information. ; in paragraph (10)— in the paragraph heading, by striking and inserting Website or online service directed to children ; Website, online service, online application, or mobile application directed to children by striking website or online service each place it appears and inserting website, online service, online application, or mobile application ; and by adding at the end the following new subparagraph: In considering whether a website, online service, online application, or mobile application, or portion thereof, is directed to children, the Commission shall apply a totality of circumstances test and shall also consider competent and reliable empirical evidence regarding audience composition and evidence regarding the intended audience of the website, online service, online application, or mobile application. ; and by adding at the end the following: The term connected device has the meaning given such term in section 101 of the American Privacy Rights Act of 2024. The term educational agency or institution means a State educational agency or local educational agency as defined under Federal law, as well as an institutional day or residential school, including a public school, charter school, or private school, that provides elementary or secondary education, as determined under State law. The term mobile application has the meaning given such term in section 101 of the American Privacy Rights Act of 2024. The term online application has the meaning given such term in section 101 of the American Privacy Rights Act of 2024. The term precise geolocation information has the meaning given such term in section 101 of the American Privacy Rights Act of 2024. . Section 1303 of the Children’s Online Privacy Protection Act of 1998 ( 15 U.S.C. 6502 ) is amended— by striking the heading and inserting the following: ; Online collection, use, disclosure, and deletion of personal information of children . by amending subsection

(a)to read as follows: It is unlawful for an operator of a website, online service, online application, or mobile application directed to children or for any operator of a website, online service, online application, or mobile application with actual knowledge or knowledge fairly implied on the basis of objective circumstances that a user is a child— to collect personal information from a child in a manner that violates the American Privacy Rights Act of 2024 or the regulations prescribed under subsection (b); or to store or transfer the personal information of a child outside of the United States, unless— the operator provides direct notice to the parent of the child that the personal information of the child is being stored or transferred outside of the United States; and with respect to transfer, the operator meets the requirements of section 102(b) of the American Privacy Rights Act of 2024. ; in subsection (b)— in paragraph (1)— in subparagraph (A)— in the matter preceding clause (i), by striking operator of any website and all that follows through from a child and inserting operator of a website, online service, online application, or mobile application directed to children or that has actual knowledge or knowledge fairly implied on the basis of objective circumstances that a user is a child ; in clause (i)— by striking notice on the website and inserting clear and conspicuous notice on the website, service, or application ; and by striking ; and and inserting a semicolon; in clause (ii)— by striking verifiable parental consent and inserting verifiable consent ; and by striking the semicolon at the end and inserting ; and ; and by inserting after clause

(ii)the following new clause: to obtain verifiable consent from a parent of a child before using or disclosing personal information of the child for any purpose that is a material change from the original purposes and disclosure practices specified to the parent of the child under clause (i); ; by striking subparagraph (B); in subparagraph (C)— by striking reasonably ; and by inserting , proportionate, and limited after necessary ; in subparagraph (D), by striking website or online service and inserting website, online service, online application, or mobile application ; and by redesignating subparagraphs

(C)and

(D)as subparagraphs

(B)and (C), respectively; in paragraph (2)— in the matter preceding subparagraph (A)— by striking verifiable parental consent and inserting verifiable consent ; and by striking paragraph (1)(A)(ii) and inserting clause

(ii)or

(iii)of paragraph (1)(A) ; in subparagraph (A), by inserting or to contact another child after to recontact the child ; in subparagraph (B)— by striking or child ; and by striking parental consent each place the term appears and inserting verifiable consent ; in subparagraph (D), in the matter preceding clause (i)— by striking reasonably ; and by inserting , proportionate, and limited after necessary ; and in subparagraph (E)— in the matter preceding clause (i), by striking website or online service and inserting website, online service, online application, or mobile application ; and in clause (i), by striking website and inserting website, service, or application ; by redesignating paragraph

(3)as paragraph

(4)and inserting after paragraph

(2)the following new paragraph: The regulations may provide that verifiable consent under clause

(ii)or

(iii)of paragraph (1)(A) is not required for an operator that is acting under a written agreement with an educational agency or institution that, at a minimum, requires— the operator to— limit its collection, use, and disclosure of the personal information from a child to solely educational purposes and for no other commercial purposes; provide the educational agency or institution with a notice of the specific types of personal information the operator will collect from the child, the method by which the operator will obtain the personal information, and the purposes for which the operator will collect, use, disclose, and retain the personal information; provide the educational agency or institution with a link to the online notice of information practices of the operator as required under paragraph (1)(A)(i); and provide the educational agency or institution, upon request, with a means to review the personal information collected from a child, to prevent further use or maintenance or future collection of personal information from a child, and to delete personal information collected from a child or content or information submitted by a child to the website, online service, online application, or mobile application of the operator; a representative of the educational agency or institution to— acknowledge and agree that the representative has authority to authorize the collection, use, and disclosure of personal information from children on behalf of the educational agency or institution; and provide the name of the representative and the title of the representative at the educational agency or institution; and the educational agency or institution to— provide on the website of the educational agency or institution a notice that identifies the operator with which the educational agency or institution has entered into a written agreement under this paragraph and a link to the online notice of information practices of the operator as required under paragraph (1)(A)(i); provide the notice of the operator regarding the information practices of the operator, as required under subparagraph (A)(ii), upon request, to a parent; and upon the request of a parent, request the operator provide a means to review the personal information collected from the child of the parent and provide the parent a means to review the personal information. ; by amending paragraph (4), as so redesignated, to read as follows: The regulations shall permit the operator of a website, online service, online application, or mobile application to terminate service provided to a child whose parent has requested to delete covered data of the child pursuant to section 105 of the American Privacy Rights Act of 2024. ; and by adding at the end the following new paragraphs: The regulations shall prohibit an operator from discontinuing service provided to a child on the basis of a request by the parent of the child to delete personal information collected from the child, to the extent that the operator is capable of providing such service without such information. The Commission shall conduct an assessment, with notice and public comment, of the feasibility of allowing operators the option to use a common verifiable consent mechanism that fully meets the requirements of this title. The feasibility assessment described in clause

(i)shall consider whether a single operator could use a common verifiable consent mechanism to obtain verifiable consent, as required under this title, from a parent of a child on behalf of multiple, listed operators that provide a joint or related service. Not later than 1 year after the date of the enactment of this paragraph, the Commission shall submit to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Energy and Commerce of the House of Representatives a report with the findings of the assessment required by subparagraph (A). If the Commission finds, in the assessment required by subparagraph (A), that the use of a common verifiable consent mechanism is feasible and would meet the requirements of this title, the Commission shall issue regulations, pursuant to section 553 of title 5, United States Code, to permit the use of a common verifiable consent mechanism in accordance with the findings outlined in the report submitted under subparagraph (B). ; in subsection (c), by striking a regulation prescribed under subsection

(a)and inserting paragraph

(2)of subsection (a), or of a regulation prescribed under subsection (b), ; and by striking subsection

(d)and inserting the following: The provisions of this title shall preempt any State law, rule, or regulation only to the extent that such State law, rule, or regulation conflicts with a provision of this title. Nothing in this title may be construed to prohibit any State from enacting a law, rule, or regulation that provides greater protection to children than the provisions of this title. . Section 1304 of the Children’s Online Privacy Protection Act of 1998 ( 15 U.S.C. 6503 ) is amended by adding at the end the following: Subject to the restrictions described in paragraph (2), the Commission shall publish on the website of the Commission any report or documentation required by regulation to be submitted to the Commission to carry out this section. The restrictions described in sections 6(f) and 21 of the Federal Trade Commission Act ( 15 U.S.C. 46(f) ; 57b–2) applicable to the disclosure of information obtained by the Commission shall apply in the same manner to the disclosure under this subsection of information obtained by the Commission from a report or documentation described in paragraph (1). . Section 1305 of the Children’s Online Privacy Protection Act of 1998 ( 15 U.S.C. 6504 ) is amended— in subsection (a)(1)— in the matter preceding subparagraph (A), by inserting section 1303(a) or before any regulation ; and in subparagraph (B), by striking the regulation and inserting such section or regulation ; and in subsection (d)— by inserting section 1303(a) or before any regulation ; and by striking that regulation and inserting such section or regulation . Section 1306 of the Children’s Online Privacy Protection Act of 1998 ( 15 U.S.C. 6505 ) is amended— in subsection (d)— by inserting section 1303(a) or before a rule ; and by striking such rule and inserting section 1303(a) or a rule of the Commission under section 1303 ; and by adding at the end the following new subsections: For purposes of enforcing this title or a regulation promulgated under this title, in making a determination as to whether an operator has knowledge fairly implied on the basis of objective circumstances that a specific user is a child, the Commission or a State attorney general shall rely on competent and reliable evidence, taking into account the totality of the circumstances, including whether a reasonable and prudent person under the circumstances would have known that the user is a child. Nothing in this title, including a determination described in the preceding sentence, may be construed to require an operator to— affirmatively collect any personal information with respect to the age of a child that an operator is not already collecting in the normal course of business; or implement an age gating or age verification functionality. Not later than 180 days after the date of the enactment of this subsection, the Commission shall issue guidance to provide information, including best practices and examples, for operators to understand the process of the Commission for determining whether an operator has knowledge fairly implied on the basis of objective circumstances that a user is a child. No guidance issued by the Commission under subparagraph

(A)confers any rights on any person, State, or locality, or operates to bind the Commission or any person, State, or locality to the approach recommended in such guidance. In any enforcement action brought pursuant to this title, the Commission or State attorney general, as applicable, shall allege a specific violation of a provision of this title, and the Commission or State attorney general, as applicable, may not base an enforcement action on, or execute a consent order based on, practices that are alleged to be inconsistent with any such guidance, unless the practices allegedly violate this title. Any regulations issued under this title shall include a description and analysis of the impact of proposed and final rules on small entities per chapter 6 of title 5, United States Code. .

Connectionstraces to 7

Traces to 7 documents

U.S. Code

Citation graph

cites case law

Sec. 202

Online collection, use, disclosure, and deletion of personal information of children

Cites 7Cited by 0 across 0 sources