Sec. 3. Online collection, use, and disclosure of personal information of children and teens

3,004 words·~14 min read·/bill/118/s/1418/is/section-3

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

Section 1302 of the Children’s Online Privacy Protection Act of 1998 ( 15 U.S.C. 6501 ) is amended— by amending paragraph

(2)to read as follows: The term operator — means any person— who, for commercial purposes, in interstate or foreign commerce operates or provides a website on the internet, an online service, an online application, a mobile application, or a connected device; and who— collects or maintains, either directly or through a service provider, personal information from or about the users of that website, service, application, or connected device; allows another person to collect personal information directly from users of that website, service, application, or connected device (in which case, the operator is deemed to have collected the information); or allows users of that website, service, application, or connected device to publicly disclose personal information (in which case, the operator is deemed to have collected the information); and does not include any nonprofit entity that would otherwise be exempt from coverage under section 5 of the Federal Trade Commission Act ( 15 U.S.C. 45 ). ; in paragraph (4)— by amending subparagraph

(A)to read as follows: the release of personal information collected from a child or teen for any purpose, except where the personal information is provided to a person other than an operator who— provides support for the internal operations of the website, online service, online application, mobile application, or connected device of the operator, excluding any activity relating to targeted marketing directed to children, teens, or connected devices; and does not disclose or use that personal information for any other purpose; and ; and in subparagraph (B)— by inserting or teen after child each place the term appears; by inserting or teens after children ; and by striking website or online service and inserting website, online service, online application, mobile application, or connected device ; in paragraph (8), by striking subparagraphs

(F)and

(G)and inserting the following: geolocation information; information generated from the measurement or technological processing of an individual's biological, physical, or physiological characteristics, including— fingerprints; voice prints; iris or retina imagery scans; facial imagery or templates; deoxyribonucleic acid

(DNA)information; or gait; information reasonably associated with or attributed to a child or teen; information (including an internet protocol address) that permits the identification of— an individual; or any device used by an individual to directly or indirectly access the internet or an online service, online application, mobile application, or connected device; or information concerning a child or teen or the parents of that child or teen (including any unique or substantially unique identifier, such as a customer number) that an operator collects online from the child or teen and combines with an identifier described in this paragraph. ; by amending paragraph

(9)to read as follows: The term verifiable consent means any reasonable effort (taking into consideration available technology), including a request for authorization for future collection, use, and disclosure described in the notice, to ensure that, in the case of a child, a parent of the child, or, in the case of a teen, the teen— receives specific notice of the personal information collection, use, and disclosure practices of the operator; and before the personal information of the child or teen is collected, freely and unambiguously authorizes— the collection, use, and disclosure, as applicable, of that personal information; and any subsequent use of that personal information. ; by striking paragraph

(10)and redesignating paragraphs

(11)and

(12)as paragraphs

(10)and (11), respectively; and by adding at the end the following: The term connected device means a device that is capable of connecting to the internet, directly or indirectly, or to another connected device. The term online application — means an internet-connected software program; and includes a service or application offered via a connected device. The term online service means a mass-market retail service by wire or radio that provides the capability to transmit data and receive data from all or substantially all Internet endpoints, including any capabilities that are incidental to and enable the operation of a communications service, but excluding dial-up Internet service. Such term includes— any service that the Federal Communications Commission finds to be providing a functionally equivalent service to a service described in subparagraph (A); and a service or application offered via a connected device. The terms directed to children , directed to teens , and directed to children or teens mean, with respect to a website, online service, online application, mobile application, or connected device, that the website, online service, online application, mobile application, or connected device, or a portion thereof, is targeted to children or teens, as the case may be, as demonstrated by— the subject matter of the website, online service, online application, mobile application, or connected device; the visual content of the website, online service, online application, mobile application, or connected device; the use of animated characters or child-oriented activities for children, or the use of teen-oriented characters or teen-oriented activities for teens, and related incentives on the website, online service, online application, mobile application, or connected device; the music or other audio content on the website, online service, online application, mobile application, or connected device; the age of models on the website, online service, online application, mobile application, or connected device; the presence, on the website, online service, online application, mobile application, or connected device, of— child celebrities; celebrities who appeal to children; teen celebrities; or celebrities who appeal to teens; the language used on the website, online service, online application, mobile application, or connected device; advertising content used on, or used to advertise, the website, online service, online application, mobile application, or connected device; or reliable empirical evidence relating to— the composition of the audience of the website, online service, online application, mobile application, or connected device; and the intended audience of the website, online service, online application, mobile application, or connected device. For the purposes of this title, a website, online service, online application, mobile application, or connected device, or a portion thereof, shall be deemed to be directed to children or teens if it collects personal information directly from users of any other website, online service, online application, mobile application, or connected device that is— directed to children or teens under the criteria described in subparagraph (A); or used or reasonably likely to be used by children or teens. A website, online service, online application, mobile application, or connected device that is directed to children or teens under the criteria described in subparagraph (A), but that does not target children or teens as the primary audience of the website, online service, online application, mobile application, or connected device shall not be deemed to be directed to children or teens for purposes of this title if the website, online service, online application, mobile application, or connected device— does not collect personal information from any user of the website, online service, online application, mobile application, or connected device before verifying age information of the user; and does not, without first complying with any relevant notice and consent provision under this title, collect, use, or disclose personal information of any user who identifies themselves to the website, online service, online application, mobile application, or connected device as an individual who is age 16 or younger. For purposes of this title, a website, online service, online application, mobile application, or connected device, shall not be deemed directed to children or teens solely because the website, online service, online application, mobile application, or connected device refers or links to any other website, online service, online application, mobile application, or connected device directed to children or teens by using information location tools, including— a directory; an index; a reference; a pointer; or a hypertext link. The term mobile application — means a software program that runs on the operating system of— a cellular telephone; a tablet computer; or a similar portable computing device that transmits data over a wireless connection; and includes a service or application offered via a connected device. The term geolocation information means information sufficient to identify a street name and name of a city or town. The term teen means an individual over the age of 12 and under the age of 17. The term targeted marketing means advertising or any other effort to market a product or service that is directed to a specific individual or device— based on— the personal information of— the individual; or a group of individuals who are similar in gender, age, income level, race, or ethnicity to the specific individual to whom the product or service is marketed; psychological profiling of an individual or group of individuals; or a unique identifier of the device; or as a result of use by the individual, access by any device of the individual, or use by a group of individuals who are similar to the specific individual, of more than a single— website; online service; online application; mobile application; connected device; or operating system. The term targeted marketing shall not include— advertising or marketing to an individual or the device of an individual in response to the individual’s specific request for information or feedback; contextual advertising, such as when an advertisement is displayed based on the context in which the advertisement appears and does not vary based on who is viewing the advertisement; or processing personal information solely for measuring or reporting advertising or content performance, reach, or frequency, including independent measurement. The Commission may promulgate rules under section 553 of title 5, United State Code, to further define the term targeted marketing but only as necessary to address changes to or innovations of technology, changes in how personal information is used or transferred, changes to the means and manners by which children or teens interact with a website, online service, online application, mobile application, or connected device, or evolving concerns regarding the privacy of children or teens. The Commission may promulgate rules under section 553 of title 5, United States Code, or issue guidance to establish factors that should be considered in applying the term reasonably likely to be used for the purposes of this title. The Commission may promulgate rules under section 553 of title 5, United States Code, or issue guidance to establish factors that should be considered in applying the term reasonably likely to be a child or teen for the purposes of this title. . Section 1303 of the Children’s Online Privacy Protection Act of 1998 ( 15 U.S.C. 6502 ) is amended— by striking the heading and inserting the following: ; Online collection, use, and disclosure of personal information of children and teens. in subsection (a)— by amending paragraph

(1)to read as follows: It is unlawful for an operator of a website, online service, online application, mobile application, or connected device that is directed to children or teens or is used or reasonably likely to be used by children or teens in a manner that involves the collection of personal information, to collect personal information from a child or teen in a manner that violates the regulations prescribed under subsection (b). ; and in paragraph (2)— by striking of such a website or online service ; and by striking subsection (b)(1)(B)(iii) to the parent of a child and inserting subsection (b)(1)(A)(iii) to the parent of a child or under subsection (b)(1)(A)(iv) to a teen ; and in subsection (b)— in paragraph (1)— by striking this Act and inserting the ; Children and Teens’ Online Privacy Protection Act in subparagraph (A)— by striking operator of any website and all that follows through from a child and inserting operator of a website, online service, online application, mobile application, or connected device that is directed to children or teens or is used or is reasonably likely to be used by children or teens in a manner that involves the collection of their personal information ; in clause (i)— by striking notice on the website and inserting clear and conspicuous notice ; by inserting or teens after children ; by striking , and the operator's and inserting , the operator's ; and by striking ; and and inserting , and the procedures or mechanisms the operator uses to ensure that personal information is not collected from children or teens except in accordance with the regulations promulgated under this paragraph; ; and in clause (ii)— by striking parental ; and by inserting or teens after children ; in subparagraph (B)— in the matter preceding clause (i), by striking website or online service and inserting operator ; in clause (ii), by inserting to delete personal information collected from the child or after the opportunity at any time ; and in clause (iii), by inserting , if such information is available to the operator at the time the parent makes the request before the semicolon; by redesignating subparagraphs

(C)and

(D)as subparagraphs

(D)and (E), respectively; by inserting after subparagraph

(B)the following new subparagraph: require the operator to provide, upon the request of a teen under this subparagraph who has provided personal information to the operator, upon proper identification of that teen— a description of the specific types of personal information collected from the teen by the operator; the opportunity at any time to delete personal information collected from the teen and refuse further use or collection of personal information from the teen; and a means that is reasonable under the circumstances for the teen to obtain any personal information collected from the teen, if such information is available to the operator at the time the teen makes the request; ; in subparagraph (D), as so redesignated, by striking conditioning and all that follows through such activity and inserting the following: the collection from a child or teen of more personal information that is reasonably required to use the website, online service, online application, mobile application, or connected device ; in subparagraph (E), as so redesignated— by striking of such a website or online service ; and by inserting and teens after children ; and by adding at the end the following flush text: The Commission shall review and update the regulations promulgated under this paragraph as necessary. ; in paragraph (2)— in the matter preceding subparagraph (A), by striking verifiable parental consent and inserting verifiable consent ; in subparagraph (A)— by inserting or teen after collected from a child ; by inserting or teen after request from the child ; and by inserting or teen or to contact another child or teen after to recontact the child ; in subparagraph (B)— by striking parent or child and inserting parent or teen ; and by striking parental consent each place the term appears and inserting verifiable consent ; in subparagraph (C)— in the matter preceding clause (i), by inserting or teen after child each place the term appears; in clause (i)— by inserting or teen after child each place the term appears; and by inserting or teen, as applicable, after parent each place the term appears; and in clause (ii)— by inserting or teen, as applicable, after parent ; and by inserting or teen after child each place the term appears; and in subparagraph (D)— in the matter preceding clause (i), by inserting or teen after child each place the term appears; in clause (ii), by inserting or teen after child ; and in the flush text following clause (iii)— by inserting or teen, as applicable, after parent each place the term appears; and by inserting or teen after child ; and by amending paragraph

(3)to read as follows: The regulations shall prohibit an operator from discontinuing service provided to a child or teen on the basis of a request by the parent of the child or by the teen, under the regulations prescribed under subparagraph

(B)or

(C)of paragraph (1), respectively, to delete personal information collected from the child or teen, to the extent that the operator is capable of providing such service without such information. . Section 1304 of the Children’s Online Privacy Protection Act of 1998 ( 15 U.S.C. 6503 ) is amended— in subsection (b)(1), by inserting and teens after children ; and by adding at the end the following: The Commission shall publish on the internet website of the Commission any report or documentation required by regulation to be submitted to the Commission to carry out this section. The restrictions described in subsection

(f)of section 6 of the Federal Trade Commission Act ( 15 U.S.C. 46(f) ) applicable to the publication of information obtained by the Commission through investigations conducted under such section shall apply in same manner to the publication under this subsection of information obtained by the Commission from a report or documentation described in paragraph (1). . Section 1306 of the Children’s Online Privacy Protection Act of 1998 ( 15 U.S.C. 6505 ) is amended— in subsection (b)— in paragraph (1), by striking , in the case of and all that follows through the Board of Directors of the Federal Deposit Insurance Corporation; and inserting the following: by the appropriate Federal banking agency, with respect to any insured depository institution (as those terms are defined in section 3 of that Act ( ; and 12 U.S.C. 1813 )); by striking paragraph

(2)and redesignating paragraphs

(3)through

(6)as paragraphs

(2)through (5), respectively; and by adding at the end the following new subsection: Notwithstanding section 4, 5(a)(2), or 6 of the Federal Trade Commission Act ( 15 U.S.C. 44 , 45(a)(2), 46), or any jurisdictional limitation of the Commission, the Commission shall also enforce this Act and the regulations promulgated under this Act, in the same manner provided in subsection (d), with respect to common carriers subject to the Communications Act of 1934 ( 47 U.S.C. 151 et seq. ) and Acts amendatory thereof and supplementary thereto. To the extent that section 222, 338(i), or 631 of the Communications Act of 1934 ( 47 U.S.C. 222 , 338(i), 551) is inconsistent with this title, this title controls. .

Connectionstraces to 10

Traces to 10 documents

U.S. Code