,,ii #aaeth ,,congress #b;d ,session ,s4 #bicb ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,may #bc1 #bjah ,mr4 ,markey 7for himself and ,mr4 ,blumenthal7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to strengthen protections relating to the online collection1 use1 and disclosure of personal information of children and minors1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,do ,not ,track ,kids ,act of #bjah4 7b7 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4 ,sec4 #b4 ,definitions4 ,sec4 #c4 ,online collection1 use1 and disclosure of personal information of children and minors4 ,sec4 #d4 ,fair ,information ,practices ,principles4 ,sec4 #e4 ,digital ,marketing ,bill of ,rights for ,minors4 ,sec4 #f4 ,targeted marketing to children or minors4 ,sec4 #g4 ,removal of content4 ,sec4 #h4 ,privacy dashboard for connected devices for children and minors4 ,sec4 #i4 ,prohibition on sale of connected devices for children and minors that fail to meet appropriate cybersecurity and data security standards4 ,sec4 #aj4 ,rule for treatment of users of websites1 services1 and applications directed to children or minors4 ,sec4 #aa4 ,enforcement and applicability4 ,sec4 #ab4 ,effective dates4 #b4 ,definitions 7a7 ,in general ,in this ,act3 7#a7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#b7 ,standards ,the term standards means benchmarks1 guidelines1 best practices1 methodologies1 procedures1 and processes4 7b7 ,other definitions ,the definitions set forth in section #acjb of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja71 as amended by section #c7;a7 of this ,act1 shall apply in this ,act1 except to the extent the ,commission provides otherwise by regulations issued under section #eec of title #e1 ,united ,states ,code4 #c4 ,online collection1 use1 and disclosure of personal information of children and minors 7a7 ,definitions ,section #acjb of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja7 is amended-- 7#a7 by amending paragraph 7#b7 to read as follows3 7#b7 ,operator ,the term operator-- 7,a7 means any person-- 7i7 who1 for commercial purposes1 in interstate or foreign commerce-- 7,i7 operates or provides a website on the ,internet1 an online service1 an online application1 or a mobile application2 or 7,,ii7 manufactures a connected device2 and 7ii7 who-- 7,i7 collects or maintains1 either directly or through a service provider1 personal information from or about the users of that website1 service1 application1 or connected device2 7,,ii7 allows another person to collect personal information directly from users of that website1 service1 application1 or connected device 7in which case1 the operator is deemed to have collected the information72 or 7,,iii7 allows users of that website1 service1 application1 or connected device to publicly disclose personal information 7in which case1 the operator is deemed to have collected the information72 and 7,b7 does not include any nonprofit entity that would otherwise be exempt from coverage under section #e of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de74 2 7#b7 in paragraph 7#d7-- 7,a7 by amending subparagraph 7,a7 to read as follows3 7,a7 the release of personal information collected from a child or minor for any purpose1 except where the personal information is provided to a person other than an operator who-- 7i7 provides support for the internal operations of the website1 online service1 online application1 or mobile application of the operator1 excluding any activity relating to targeted marketing directed to children1 minors1 or connected devices2 and 7ii7 does not disclose or use that personal information for any other purpose2 and 2 and 7,b7 in subparagraph 7,b7-- 7i7 by inserting or minor after child each place the term appears2 7ii7 by inserting or minors after children2 and 7iii7 by striking website or online service and inserting website1 online service1 online application1 or mobile application2 7#c7 in paragraph 7#h7-- 7,a7 by amending subparagraph 7,g7 to read as follows3 7,g7 information concerning a child or minor or the parents of that child or minor 7including any unique or substantially unique identifier1 such as a customer number7 that an operator collects online from the child or minor and combines with an identifier described in subparagraphs 7,a7 through 7,g74 2 7,b7 by redesignating subparagraphs 7,f7 and 7,g7 as subparagraphs 7,h7 and 7,i71 respectively2 and 7,c7 by inserting after subparagraph 7,e7 the following3 7,f7 information 7including an ,internet protocol address7 that permits the identification of-- 7i7 an individual2 7ii7 a computer of an individual2 or 7iii7 any other device used by an individual to access the ,internet or an online service1 online application1 or mobile application2 7,g7 geolocation information2 2 7#d7 by amending paragraph 7#i7 to read as follows3 7#i7 ,verifiable consent ,the term verifiable consent means any reasonable effort 7taking into consideration available technology71 including a request for authorization for future collection1 use1 and disclosure described in the notice1 to ensure that1 in the case of a child1 a parent of the child1 or1 in the case of a minor1 the minor-- 7,a7 receives notice of the personal information collection1 use1 and disclosure practices of the operator2 and 7,b7 before the personal information of the child or minor is collected1 authorizes-- 7i7 the collection1 use1 and disclosure1 as applicable1 of that personal information2 and 7ii7 any subsequent use of that personal information4 2 7#e7 by striking paragraph 7#aj7 and redesignating paragraphs 7#aa7 and 7#ab7 as paragraphs 7#aj7 and 7#aa71 respectively2 and 7#f7 by adding at the end the following3 7#ab7 ,connected device ,the term connected device means a device that is-- 7,a7 capable of connecting to the ,internet1 directly or indirectly1 or to another connected device2 and 7,b7 directed towards a child or minor4 7#ac7 ,online2 online application2 online service2 directed to a child2 directed to a minor2 mobile application 7,a7 ,in general ,subject to subparagraphs 7,c7 and 7,d71 the terms online1 online application1 online service1 directed to a child1 directed to a minor1 and mobile application shall have the meanings given those terms by regulation promulgated by the ,commission under subparagraph 7,b74 7,b7 ,promulgation of regulations ,not later than #a year after the date of the enactment of the ,do ,not ,track ,kids ,act of #bjah1 the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations that define the terms described in subparagraph 7,a7 broadly enough to ensure that the terms are not limited to current technology1 consistent with-- 7i7 the principles articulated by the ,commission regarding the definition of the term ,internet in the statement of basis and purpose on the final rule under this title promulgated on ,november #c1 #aiii 7#fd ,fed4 ,reg4 #eihia72 and 7ii7 the principles articulated by the ,commission regarding the definition of the term directed to children in the statement of basis and purpose on the final rule under this title promulgated on ,january #ag1 #bjac 7#gh ,fed4 ,reg4 #cigb74 7,c7 ,online service ,the definition of the term online service in the regulations promulgated under subparagraph 7,b7 shall include broadband ,internet access service 7as defined in the ,report and ,order on ,remand1 ,declaratory ,ruling1 and ,order in the matter of protecting and promoting the open ,internet1 adopted by the ,federal ,communications ,commission on ,february #bf1 #bjae 7,,fcc #ae-bd774 7,d7 ,online application2 online service2 mobile application ,the terms online service1 online application1 and mobile application include a service or application offered via a connected device4 7#ad7 ,geolocation information ,the term geolocation information means information sufficient to identify a street name and name of a city or town4 7#ae7 ,minor ,the term minor means an individual over the age of #ab and under the age of #af4 7#af7 ,targeted marketing ,the term targeted marketing means advertising or any other effort to market a product or service that is directed to a specific individual or device-- 7,a7 based on the personal information of the individual or a unique identifier of the device2 and 7,b7 as a result of use by the individual1 or access by the device1 of-- 7i7 a website2 7ii7 an online service2 7iii7 an online application2 or 7iv7 a mobile application4 4 7b7 ,online collection1 use1 and disclosure of personal information of children and minors ,section #acjc of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #fejb7 is amended-- 7#a7 by striking the heading and inserting the following3 ,online collection1 use1 and disclosure of personal information of children and minors42 7#b7 in subsection 7a7-- 7,a7 by amending paragraph 7#a7 to read as follows3 7#a7 ,in general ,it is unlawful for an operator of a website1 online service1 online application1 or mobile application directed to a child or minor1 or an operator having actual knowledge that personal information being collected is from a child or minor1 to collect personal information from a child or minor in a manner that violates the regulations prescribed under subsection 7b74 2 and 7,b7 in paragraph 7#b7-- 7i7 by striking of such a website or online service2 and 7ii7 by striking subsection 7b77#a77;,b77iii7 to the parent of a child and inserting subsection 7b77#a77;,c77iii7 to the parent of a child or under subsection 7b77#a77;,d77iii7 to a minor2 and 7#c7 in subsection 7b7-- 7,a7 by amending paragraph 7#a7 to read as follows3 7#a7 ,in general ,not later than #a year after the date of the enactment of the ,do ,not ,track ,kids ,act of #bjah1 the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations to require an operator of a website1 online service1 online application1 or mobile application directed to children or minors1 or an operator having actual knowledge that personal information being collected is from a child or minor-- 7,a7 to provide clear and conspicuous notice in clear and plain language of-- 7i7 the types of personal information the operator collects2 7ii7 how the operator uses the information2 7iii7 whether the operator discloses the information2 and 7iv7 the procedures or mechanisms the operator uses to ensure that personal information is not collected from children or minors except in accordance with the regulations promulgated under this paragraph2 7,b7 to obtain verifiable consent for the collection1 use1 or disclosure of personal information of a child or minor2 7,c7 to provide to a parent whose child has provided personal information to the operator1 upon request by and proper identification of the parent-- 7i7 a description of the specific types of personal information collected from the child by the operator2 7ii7 the opportunity at any time to refuse to permit the further use or maintenance in retrievable form1 or future collection1 by the operator of personal information collected from the child2 and 7iii7 a means that is reasonable under the circumstances for the parent to obtain any personal information collected from the child1 if such information is available to the operator at the time the parent makes the request2 7,d7 to provide to a minor who has provided personal information to the operator1 upon request by and proper identification of the minor-- 7i7 a description of the specific types of personal information collected from the minor by the operator2 7ii7 the opportunity at any time to refuse to permit the further use or maintenance in retrievable form1 or future collection1 by the operator of personal information collected from the minor2 and 7iii7 a means that is reasonable under the circumstances for the minor to obtain any personal information collected from the minor1 if such information is available to the operator at the time the minor makes the request2 7,e7 not to condition participation in a game1 or use of a website1 service1 or application1 by a child or minor on the provision by the child or minor of more personal information than is reasonably required to participate in the game or use the website1 service1 or application2 and 7,f7 to establish and maintain reasonable procedures to protect the confidentiality1 security1 and integrity of personal information collected from children and minors4 2 7,b7 in paragraph 7#b7-- 7i7 in the matter preceding subparagraph 7,a71 by striking verifiable parental consent under paragraph 7#a77;,a77ii7 and inserting verifiable consent under paragraph 7#a77;,b72 and 7ii7 in subparagraph 7,a7-- 7,i7 by inserting or minor after collected from a child2 7,,ii7 by inserting or minor after request from the child2 and 7,,iii7 by inserting or minor or to contact a different child or minor after to recontact the child2 7iii7 in subparagraph 7,b7-- 7,i7 by striking parent or child and inserting parent1 child1 or minor2 and 7,,ii7 by striking parental consent each place the term appears and inserting verifiable consent2 7iv7 in subparagraph 7,c7-- 7,i7 in the matter preceding clause 7i71 by inserting or minor after child each place the term appears2 7,,ii7 in clause 7i7-- 7aa7 by inserting or minor after child each place the term appears2 and 7bb7 by inserting or minor1 as applicable1 after parent each place the term appears2 and 7,,iii7 in clause 7ii7-- 7aa7 by inserting or minor1 as applicable1 after parent2 and 7bb7 by inserting or minor after child each place the term appears2 and 7v7 in subparagraph 7,d7-- 7,i7 in the matter preceding clause 7i71 by inserting or minor after child each place the term appears2 7,,ii7 in clause 7ii71 by inserting or minor after child2 and 7,,iii7 in the flush text following clause 7iii7-- 7aa7 by inserting or minor1 as applicable1 after parent each place the term appears2 and 7bb7 by inserting or minor after child2 and 7,c7 by amending paragraph 7#c7 to read as follows3 7#c7 ,continuation of service ,the regulations shall prohibit an operator from discontinuing service provided to a child or minor on the basis of refusal by the parent of the child or by the minor1 under the regulations prescribed under subparagraphs 7,c77ii7 and 7,d77ii7 of paragraph 7#a71 respectively1 to permit the further use or maintenance in retrievable form1 or future collection1 by the operator of personal information collected from the child or minor1 to the extent that the operator is capable of providing such service without such information4 4 7c7 ,safe harbors ,section #acjd of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #fejc7 is amended-- 7#a7 in subsection 7b77#a71 by inserting and minors after children2 and 7#b7 by adding at the end the following3 7d7 ,publication ,the ,commission shall publish on the internet website of the ,commission any report or documentation required by regulation to be submitted to the ,commission to carry out this section1 except to the extent that the report or documentation contains proprietary information1 which the ,commission may in its discretion redact4 4 7d7 ,administration and applicability of act ,section #acjf of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feje7 is amended-- 7#a7 in subsection 7b7-- 7,a7 in paragraph 7#a71 by striking 1 in the case of and all that follows and inserting the following3 by the appropriate ,federal banking agency1 with respect to any insured depository institution 7as those terms are defined in section #c of that ,act 7#ab ,u4,s4,c4 #ahac7722 and 7,b7 by striking paragraph 7#b7 and redesignating paragraphs 7#c7 through 7#f7 as paragraphs 7#b7 through 7#e71 respectively2 and 7#b7 by adding at the end the following new subsection3 7f7 ,telecommunications carriers and cable operators 7#a7 ,enforcement by ,commission ,notwithstanding section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b771 compliance with the requirements imposed under this title shall be enforced by the ,commission with respect to any telecommunications carrier 7as defined in section #c of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aec774 7#b7 ,relationship to other law ,to the extent that section #bbb1 #cch7;i71 or #fca of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbb2 #cch7;i72 #eea7 is inconsistent with this title1 this title controls4 4 #d4 ,fair ,information ,practices ,principles ,the ,fair ,information ,practices ,principles described in this section are the following3 7#a7 ,collection limitation principle ,except as provided in paragraph 7#c71 personal information should be collected from a minor only when collection of the personal information is-- 7,a7 consistent with the context of a particular transaction or service or the relationship of the minor with the operator1 including collection necessary to fulfill a transaction or provide a service requested by the minor2 or 7,b7 required or specifically authorized by law4 7#b7 ,data quality principle ,the personal information of a minor should be accurate1 complete1 and kept up-to-date to the extent necessary to fulfill the purposes described in subparagraphs 7,a7 through 7,d7 of paragraph 7#c74 7#c7 ,purpose specification principle ,the purposes for which personal information is collected should be specified to the minor not later than at the time of the collection of the information4 ,the subsequent use or disclosure of the information should be limited to-- 7,a7 fulfillment of the transaction or service requested by the minor2 7,b7 support for the internal operations of the website1 service1 or application1 as described in section #cab4b of title #af1 ,code of ,federal ,regulations1 excluding any activity relating to targeted marketing directed to children1 minors1 or connected devices2 7,c7 compliance with legal process or other purposes expressly authorized under specific legal authority2 or 7,d7 other purposes-- 7i7 that are specified in a notice to the minor2 and 7ii7 to which the minor has consented under paragraph 7#g7 before the information is used or disclosed for such other purposes4 7#d7 ,retention limitation principle ,the personal information of a minor should not be retained for longer than is necessary to fulfill a transaction or provide a service requested by the minor or such other purposes specified in subparagraphs 7,a7 through 7,d7 of paragraph 7#c74 ,the operator should implement a reasonable and appropriate data disposal policy based on the nature and sensitivity of such personal information4 7#e7 ,security safeguards principle ,the personal information of a minor should be protected by reasonable and appropriate security safeguards against risks such as loss or unauthorized access1 destruction1 use1 modification1 or disclosure4 7#f7 ,openness principle 7,a7 ,in general ,the operator should maintain a general policy of openness about developments1 practices1 and policies with respect to the personal information of a minor4 ,the operator should provide each minor using the website1 online service1 online application1 or mobile application of the operator with a clear and prominent means-- 7i7 to identify and contact the operator1 by1 at a minimum1 disclosing1 clearly and prominently1 the identity of the operator and-- 7,i7 in the case of an operator who is an individual1 the address of the principal residence of the operator and an email address and telephone number for the operator2 or 7,,ii7 in the case of any other operator1 the address of the principal place of business of the operator and an email address and telephone number for the operator2 7ii7 to determine whether the operator possesses any personal information of the minor1 the nature of any such information1 and the purposes for which the information was collected and is being retained2 7iii7 to obtain any personal information of the minor that is in the possession of the operator from the operator1 or from a person specified by the operator1 within a reasonable time after making a request1 at a charge 7if any7 that is not excessive1 in a reasonable manner1 and in a form that is readily intelligible to the minor2 7iv7 to challenge the accuracy of personal information of the minor that is in the possession of the operator2 and 7v7 if the minor establishes the inaccuracy of personal information in a challenge under clause 7iv71 to have such information erased1 corrected1 completed1 or otherwise amended4 7,b7 ,limitation ,nothing in this paragraph shall be construed to permit an operator to erase or otherwise modify personal information requested by a law enforcement agency pursuant to legal authority4 7#g7 ,individual participation principle ,the operator should-- 7,a7 obtain consent from a minor before using or disclosing the personal information of the minor for any purpose other than the purposes described in subparagraphs 7,a7 through 7,c7 of paragraph 7#c72 and 7,b7 obtain affirmative express consent from a minor before using or disclosing previously collected personal information of the minor for purposes that constitute a material change in practice from the original purposes specified to the minor under paragraph 7#c74 #e4 ,digital ,marketing ,bill of ,rights for ,minors 7a7 ,acts prohibited ,it is unlawful for an operator of a website1 online service1 online application1 or mobile application directed to minors1 or an operator having actual knowledge that personal information being collected is from a minor1 to collect personal information from a minor unless such operator has adopted and complies with a ,digital ,marketing ,bill of ,rights for ,minors that is consistent with the ,fair ,information ,practices ,principles described in section #d4 7b7 ,regulations ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations to implement this section1 including regulations further defining the ,fair ,information ,practices ,principles described in section #d4 #f4 ,targeted marketing to children or minors 7a7 ,acts prohibited ,it is unlawful for-- 7#a7 an operator of a website1 online service1 online application1 mobile application1 or connected device directed to children1 or an operator having actual knowledge that personal information being collected is from a child or a connected device of a child1 to use1 disclose to third parties1 or compile personal information for purposes of targeted marketing2 or 7#b7 an operator of a website1 online service1 online application1 mobile application1 or connected device directed to minors1 or an operator having actual knowledge that personal information being collected is from a minor or a connected device of a minor1 to use1 disclose to third parties1 or compile personal information for purposes of targeted marketing without the verifiable consent of the minor4 7b7 ,regulations ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations to implement this section4 #g4 ,removal of content 7a7 ,acts prohibited ,it is unlawful for an operator to make publicly available through a website1 online service1 online application1 or mobile application content or information that contains or displays personal information of children or minors in a manner that violates a regulation prescribed under subsection 7b74 7b7 ,regulations 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations that require an operator-- 7,a7 to the extent technologically feasible1 to implement mechanisms that permit a user of the website1 online service1 online application1 or mobile application of the operator to erase or otherwise eliminate content or information that is-- 7i7 submitted to the website1 online service1 online application1 or mobile application by that user2 7ii7 publicly available through the website1 online service1 online application1 or mobile application2 and 7iii7 contains or displays personal information of children or minors2 and 7,b7 to take appropriate steps to make users aware of the mechanisms described in subparagraph 7,a7 and to provide notice to users that the mechanisms do not necessarily provide comprehensive removal of the content or information submitted by users4 7#b7 ,exception ,the regulations promulgated under paragraph 7#a7 may not require an operator or third party to erase or otherwise eliminate content or information that-- 7,a7 any other provision of ,federal or ,state law requires the operator or third party to maintain2 or 7,b7 was submitted to the website1 online service1 online application1 or mobile application of the operator by any person other than the user who is attempting to erase or otherwise eliminate the content or information1 including content or information submitted by the user that was republished or resubmitted by another person4 7#c7 ,limitation ,nothing in this section shall be construed to limit the authority of a law enforcement agency to obtain any content or information from an operator as authorized by law or pursuant to an order of a court of competent jurisdiction4 #h4 ,privacy dashboard for connected devices for children and minors 7a7 ,in general ,a manufacturer of a connected device shall prominently display on the packaging for the connected device a standardized and easy-to-understand privacy dashboard1 detailing whether1 what1 and how personal information of a child or minor is-- 7#a7 collected from the connected device2 7#b7 transmitted from the connected device2 7#c7 retained on the connected device2 7#d7 retained by the manufacturer or affiliated person2 7#e7 used by the manufacturer or affiliated person2 and 7#f7 protected4 7b7 ,features ,a privacy dashboard under subsection 7a7 shall inform a consumer of-- 7#a7 the extent to which the connected device meets the highest cybersecurity and data security standards1 including if and how to obtain security patches2 7#b7 the extent to which the connected device gives-- 7,a7 a parent meaningful control over the information of a child of the parent2 and 7,b7 a minor meaningful control over the information of the minor2 7#c7 the extent to which the device minimizes the collection1 retention1 and use of information from a child or minor2 7#d7 the location of privacy policies2 7#e7 the type of personal information the connected device may collect2 and 7#f7 any other information as the ,commission considers appropriate4 7c7 ,regulations ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations to implement this section4 #i4 ,prohibition on sale of connected devices for children and minors that fail to meet appropriate cybersecurity and data security standards 7a7 ,prohibition ,beginning #a year after the date of enactment of this ,act1 or such earlier date as the ,commission considers appropriate1 no person may sell a connected device unless the connected device meets appropriate cybersecurity and data security standards established by the ,commission4 7b7 ,cybersecurity and data security standards 7#a7 ,in general ,the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 cybersecurity and data security standards described in subsection 7a74 7#b7 ,considerations ,in promulgating cybersecurity and data security standards under paragraph 7#a71 the ,commission shall-- 7,a7 create cybersecurity and data security standards for different subsets of connected devices based on the varying degrees of-- 7i7 cybersecurity and data security risk associated with each subset of connected device2 7ii7 sensitivity of information collected1 stored1 or transmitted by each subset of connected device2 and 7iii7 functionality of each subset of connected device2 7,b7 consider incorporating1 to the extent practicable1 existing cybersecurity and data security standards2 and 7,c7 ensure that the cybersecurity and data security standards-- 7i7 are consistent with ,fair ,information ,practice ,principles described in section #d2 and 7ii7 promote data minimization4 #aj4 ,rule for treatment of users of websites1 services1 and applications directed to children or minors ,for the purposes of this ,act1 an operator of a website1 online service1 online application1 or mobile application that is directed to children or minors shall treat each user of that website1 online service1 online application1 or mobile application as a child or minor1 respective to whether the website1 online service1 online application1 or mobile application is directed to children or minors1 except as permitted by the ,commission pursuant to a regulation promulgated under this ,act4 #aa4 ,enforcement and applicability 7a7 ,enforcement by the ,commission 7#a7 ,in general ,except as otherwise provided1 this ,act and the regulations prescribed under this ,act shall be enforced by the ,commission under the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#b7 ,unfair or deceptive acts or practices ,subject to subsection 7b71 a violation of this ,act or a regulation prescribed under this ,act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#c7 ,actions by the ,commission 7,a7 ,in general ,subject to subsection 7b71 and except as provided in subsection 7d77#a71 the ,commission shall prevent any person from violating this ,act or a regulation prescribed under this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act1 and any person who violates this ,act or such regulation shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act4 7,b7 ,violations ,in an action brought by the ,commission to enforce this ,act and the regulations prescribed under this ,act1 each connected device that fails to meet a standard promulgated under this ,act shall be treated as a separate violation4 7b7 ,enforcement by certain other agencies ,notwithstanding subsection 7a71 compliance with the requirements imposed under this ,act shall be enforced as follows3 7#a7 ,under section #h of the ,federal ,deposit ,insurance ,act 7#ab ,u4,s4,c4 #ahah7 by the appropriate ,federal banking agency1 with respect to an insured depository institution 7as such terms are defined in section #c of such ,act 7#ab ,u4,s4,c4 #ahac774 7#b7 ,under the ,federal ,credit ,union ,act 7#ab ,u4,s4,c4 #agea et seq47 by the ,national ,credit ,union ,administration ,board1 with respect to any ,federal credit union4 7#c7 ,under part ,a of subtitle ,,vii of title #di1 ,united ,states ,code1 by the ,secretary of ,transportation1 with respect to any air carrier or foreign air carrier subject to such part4 7#d7 ,under the ,packers and ,stockyards ,act1 #aiba 7#g ,u4,s4,c4 #aha et seq47 7except as provided in section #djf of that ,act 7#g ,u4,s4,c4 #bbf2 #bbg77 by the ,secretary of ,agriculture1 with respect to any activities subject to that ,act4 7#e7 ,under the ,farm ,credit ,act of #aiga 7#ab ,u4,s4,c4 #bjja et seq47 by the ,farm ,credit ,administration1 with respect to any ,federal land bank1 ,federal land bank association1 ,federal intermediate credit bank1 or production credit association4 7c7 ,enforcement by ,state attorneys general 7#a7 ,in general 7,a7 ,civil actions ,in any case in which the attorney general of a ,state has reason to believe that an interest of the residents of that ,state has been or is threatened or adversely affected by the engagement of any person in a practice that violates this ,act or a regulation prescribed under this ,act1 the ,state1 as parens patriae1 may bring a civil action on behalf of the residents of the ,state in a district court of the ,united ,states of appropriate jurisdiction to-- 7i7 enjoin that practice2 7ii7 enforce compliance with this ,act or such regulation2 7iii7 obtain damages1 restitution1 or other compensation on behalf of residents of the ,state2 or 7iv7 obtain such other relief as the court may consider to be appropriate4 7,b7 ,notice 7i7 ,in general ,before filing an action under subparagraph 7,a71 the attorney general of the ,state involved shall provide to the ,commission-- 7,i7 written notice of that action2 and 7,,ii7 a copy of the complaint for that action4 7ii7 ,exemption 7,i7 ,in general ,clause 7i7 shall not apply with respect to the filing of an action by an attorney general of a ,state under this paragraph if the attorney general of the ,state determines that it is not feasible to provide the notice described in that clause before the filing of the action4 7,,ii7 ,notification ,in an action described in subclause 7,i71 the attorney general of a ,state shall provide notice and a copy of the complaint to the ,commission at the same time as the attorney general files the action4 7#b7 ,intervention 7,a7 ,in general ,on receiving notice under paragraph 7#a77;,b71 the ,commission shall have the right to intervene in the action that is the subject of the notice4 7,b7 ,effect of intervention ,if the ,commission intervenes in an action under paragraph 7#a71 it shall have the right-- 7i7 to be heard with respect to any matter that arises in that action2 and 7ii7 to file a petition for appeal4 7#c7 ,construction ,for purposes of bringing any civil action under paragraph 7#a71 nothing in this ,act shall be construed to prevent an attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of that ,state to-- 7,a7 conduct investigations2 7,b7 administer oaths or affirmations2 or 7,c7 compel the attendance of witnesses or the production of documentary and other evidence4 7#d7 ,actions by the ,commission ,in any case in which an action is instituted by or on behalf of the ,commission for violation of this ,act or a regulation prescribed under this ,act1 no ,state may1 during the pendency of that action1 institute an action under paragraph 7#a7 against any defendant named in the complaint in the action instituted by or on behalf of the ,commission for that violation4 7#e7 ,venue2 service of process 7,a7 ,venue ,any action brought under paragraph 7#a7 may be brought in the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code4 7,b7 ,service of process ,in an action brought under paragraph 7#a71 process may be served in any district in which the defendant-- 7i7 is an inhabitant2 or 7ii7 may be found4 7d7 ,telecommunications carriers and cable operators 7#a7 ,enforcement by ,commission ,notwithstanding section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b771 compliance with the requirements imposed under this ,act shall be enforced by the ,commission with respect to any telecommunications carrier 7as defined in section #c of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aec774 7#b7 ,relationship to other laws ,to the extent that section #bbb1 #cch7;i71 or #fca of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbb2 #cch7;i72 #eea7 is inconsistent with this ,act1 this ,act controls4 7e7 ,safe harbors 7#a7 ,definition ,in this subsection-- 7,a7 the term applicable section means section #e1 #f1 #g1 #h1 or #i of this ,act2 7,b7 the term covered operator means an operator subject to guidelines approved under paragraph 7#b72 7,c7 the term requesting entity means an entity that submits a safe harbor request to the ,commission2 and 7,d7 the term safe harbor request means a request to have self-regulatory guidelines described in paragraph 7#b77;,a7 approved under that paragraph4 7#b7 ,guidelines 7,a7 ,in general ,an operator may satisfy the requirements of regulations issued under an applicable section by following a set of self-regulatory guidelines1 issued by representatives of the marketing or online industries1 or by other persons1 that1 after notice and an opportunity for comment1 are approved by the ,commission upon making a determination that the guidelines meet the requirements of the regulations issued under that applicable section4 7,b7 ,expedited response to requests ,not later than #ahj days after the date on which a safe harbor request is filed under subparagraph 7,a71 the ,commission shall act upon the request set forth in writing the conclusions of the ,commission with regard to the request4 7,c7 ,appeals ,a requesting entity may appeal the final action of the ,commission under subparagraph 7,b71 or a failure by the ,commission to act in the period described in that paragraph1 to a district court of the ,united ,states of appropriate jurisdiction1 as provided for in section #gjf of title #e1 ,united ,states ,code4 7#c7 ,incentives 7,a7 ,self-regulatory incentives ,in prescribing regulations under an applicable section1 the ,commission shall provide incentives for self-regulation by covered operators to implement the protections afforded children and minors1 as applicable1 under the regulatory requirements described in those sections4 7,b7 ,deemed compliance ,the incentives under subparagraph 7,a7 shall include provisions for ensuring that a covered operator will be deemed to be in compliance with the requirements of the regulations under an applicable section if that person complies with guidelines approved under paragraph 7#b74 7#d7 ,regulations ,in prescribing regulations relating to safe harbor guidelines under an applicable section1 the ,commission shall-- 7,a7 establish criteria for the approval of guidelines that will ensure that a covered operator provides substantially the same or greater protections for children and minors1 as applicable1 as those contained in the regulations issued under the applicable section2 and 7,b7 require that any report or documentation required to be submitted to the ,commission by a covered operator or requesting entity will be published on the internet website of the ,commission1 except to the extent that the report or documentation contains proprietary information1 which the ,commission may in its discretion redact4 #ab4 ,effective dates 7a7 ,in general ,except as provided in subsections 7b7 and 7c71 this ,act and the amendments made by this ,act shall take effect on the date that is #a year after the date of enactment of this ,act4 7b7 ,authority ,to promulgate regulations ,the following shall take effect on the date of enactment of this ,act3 7#a7 ,section #b7;b74 7#b7 ,the amendments made by subsections 7a77#f7 and 7b7 of section #c4 7#c7 ,sections #e7;b71 #f7;b71 #g7;b71 #h7;c71 and #i7;b74 7c7 ,digital ,marketing ,bill of ,rights for minors ,section #e7;a7 shall take effect on the date that is #ahj days after the promulgation of regulations under that subsection4 7d7 ,privacy dashboard for connected devices for children and minors ,subsections 7a7 and 7b7 of section #h shall take effect on the date that is #ahj days after the promulgation of regulations under such subsection4