,i #aafth ,,congress #b;d ,session ,h4 ,r4 #egjc ,,in ,,the ,,house ,,of ,,representatives ,january #bi1 #bjbj,ms4 ,castor of ,florida introduced the following bill2 which was referred to the ,committee on ,energy and ,commerce ,a ,,bill ,to amend the ,children's ,online ,privacy ,protection ,act of #aiih to update and expand the coverage of such ,act1 and for other purposes4 #a4 ,short title2 table of contents ,this ,act may be cited as the ,protecting the ,information of our ,vulnerable ,children and ,youth ,act or the ,,privcy ,,act4 #b4 ,definitions ,section #acjb of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja7 is amended-- 7#a7 in paragraph 7#a7-- 7,a7 by inserting or children after child2 and 7,b7 by inserting or individuals1 respectively1 after individual2 7#b7 by striking paragraph 7#aj72 7#c7 by redesignating paragraphs 7#b7 through 7#i7 as paragraphs 7#c7 through 7#aj71 respectively2 7#d7 inserting after paragraph 7#a7 the following3 7#b7 ,young consumer ,the term young consumer means an individual over the age of #ab and under the age of #ah4 2 7#e7 by amending paragraph 7#c7 7as so redesignated7 to read as follows3 7#c7 ,covered entity ,the term covered entity means-- 7,a7 any organization1 corporation1 trust1 partnership1 sole proprietorship1 unincorporated association1 or venture over which the ,commission has authority pursuant to section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b772 7,b7 notwithstanding section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b771 common carriers2 and 7,c7 notwithstanding sections #d and #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd and #de7;a77#b771 any nonprofit organization1 including any organization described in section #eja7;c7 of the ,internal ,revenue ,code of #aihf that is exempt from taxation under section #eja7;a7 of the ,internal ,revenue ,code of #aihf4 2 7#f7 by amending paragraph 7#e7 7as so redesignated7 to read as follows3 7#e7 ,disclose ,the term disclose means to intentionally or unintentionally release1 transfer1 sell1 disseminate1 share1 publish1 lease1 license1 make available1 allow access to1 fail to restrict access to1 or otherwise communicate covered information4 2 7#g7 by amending paragraph 7#i7 7as so redesignated7 to read as follows3 7#i7 ,covered information ,the term covered information-- 7,a7 means any information1 linked or reasonably linkable to a specific young consumer or child1 or consumer device of a young consumer or child2 7,b7 may include-- 7i7 a name1 alias1 home or other physical address1 online identifier1 ,internet ,protocol address1 email address1 account name1 ,social ,security number1 physical characteristics or description1 telephone number1 ,state identification card number1 driver's license number1 where applicable1 passport number1 or other similar identifier2 7ii7 race1 religion1 sex1 sexual orientation1 sexual behavior1 familial status1 gender identity1 disability1 age1 political affiliation1 or national origin2 7iii7 commercial information1 including records relating to personal property1 products or services purchased1 obtained1 or considered1 or other purchasing or consuming histories or tendencies2 7iv7 biometric information2 7v7 ,internet or other electronic network activity information1 including browsing history1 search history1 and information regarding a young consumer's or child's interaction with an ,internet website1 application1 or advertisement2 7vi7 geolocation information2 7vii7 audio1 electronic1 visual1 thermal1 olfactory1 or similar information2 7viii7 education information2 7ix7 health information2 7x7 facial recognition information2 7xi7 contents of and parties to information1 including with respect to electronic mail1 text messages1 picture messages1 voicemails1 audio conversations1 and video conversations2 7xii7 financial information1 including bank account numbers1 credit card numbers1 debit card numbers1 or insurance policy numbers1 where applicable2 7xiii7 inferences drawn from any of the information described in this paragraph to create a profile about a young consumer or child reflecting the young consumer's or child's preferences1 characteristics1 psychological trends1 predispositions1 behavior1 attitudes1 intelligence1 abilities1 and aptitudes2 and 7,c7 does not include-- 7i7 information that is processed solely for the purpose of employment of a young consumer2 7ii7 de-identified information4 2 7#h7 by amending paragraph 7#aj7 7as so redesignated7 to read as follows3 7#aj7 ,verifiable consent ,the term verifiable consent means express1 affirmative consent freely given by a young consumer1 or by the parent of a child1 to the processing of covered information of that young consumer or child1 respectively-- 7,a7 that is specific1 informed1 and unambiguous2 7,b7 that is given separately for each process of specific types of covered information2 7,c7 where the young consumer or parent of a child1 as applicable1 has not received any financial or other incentive in exchange for such consent2 and 7,d7 that is given before any processing occurs1 at a time and in a context in which the young consumer or parent of a child1 as applicable1 would reasonably expect to make choices concerning such processing4 2 7#i7 by redesignating paragraphs 7#aa7 and 7#ab7 as paragraphs 7#ab7 and 7#ac71 respectively2 and 7#aj7 by adding at the end the following3 7#ad7 ,process ,the term process means any operation or set of operations which is performed on covered information1 whether or not by automated means1 including collecting1 creating1 acquiring1 disclosing1 recording1 deriving1 inferring1 obtaining1 assembling1 organizing1 structuring1 storing1 retaining1 adapting or altering1 using1 or retrieving covered information4 7#ae7 ,de-identified information and related terms 7,a7 ,the term de-identified information means information that has been de-identified by a covered entity1 where the covered entity publicly discloses the methods it uses to de-identify information4 7,b7 ,the term de-identify means the removal of identifying information from information such that the information is not reasonably linkable to a specific young consumer or child or consumer device of a young consumer or child4 7,c7 ,the term re-identify means to link information that has been de-identified to a specific young consumer or child or consumer device of a young consumer or child4 7#af7 ,state ,the term ,state means each of the several ,states1 the ,district of ,columbia1 each territory of the ,united ,states1 and each federally recognized ,indian ,tribe4 7#ag7 ,service provider ,the term service provider means a covered entity that processes covered information at the direction of1 and for the sole benefit of1 another covered entity1 and-- 7,a7 is contractually or legally prohibited from processing such covered information for any other purpose2 and 7,b7 complies with all of the requirements of this ,act4 4 #c4 ,unfair or deceptive acts or practices ,section #acjc of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #fejb7 is amended-- 7#a7 in the section heading1 by striking collection and use of personal information from and about children on the internet and inserting processing of covered information from and about young consumers or children2 7#b7 by amending subsection 7a7 to read as follows3 7a7 ,acts prohibited ,it is unlawful for a covered entity that has actual or constructive knowledge that such covered entity is processing covered information about a young consumer or child to process such information in a manner that violates the regulations prescribed under subsection 7b74 2 7#c7 by amending subsection 7b7 to read as follows3 7b7 ,in general ,not later than #a year after the date of enactment of the ,protecting the ,information of our ,vulnerable ,children and ,youth ,act1 the ,commission shall1 under section #eec of title #e1 ,united ,states ,code1 revise regulations issued under this ,act prior to such date of enactment and issue additional regulations as necessary that implement the requirements and prohibitions set forth in paragraphs 7#a7 through 7#g74 ,the ,commission shall have the authority to revise such regulations every #g years or as it determines necessary due to changes in or emerging technology4 7#a7 ,transparency ,such regulations shall require a covered entity to develop and make publicly available at all times and in a machine-readable format1 a privacy policy1 in a manner that is clear1 easily understood1 and written in plain and concise language1 that includes-- 7,a7 the categories of covered information that the covered entity processes about young consumers and children2 7,b7 how and under what circumstances covered information is collected directly from a young consumer or child2 7,c7 the categories and the sources of any covered information processed by a covered entity that is not collected directly from a young consumer or child2 7,d7 a description of the purposes for which the covered entity processes covered information1 including-- 7i7 a description of whether and how the covered entity customizes products or services1 or adjusts the prices of products or services for young consumers or children or based in any part on processing of covered information2 7ii7 a description of whether and how the covered entity1 or the covered entity's affiliates or service providers1 de-identifies information1 including the methods used to de-identify such information2 and 7iii7 a description of whether and how the covered entity1 or the covered entity's affiliates or service providers1 generates or uses any consumer score to make decisions concerning a young consumer or child1 and the source or sources of any such consumer score2 7,e7 a description of how long and the circumstances under which the covered entity retains covered information2 7,f7 a description of all of the purposes for which the covered entity discloses covered information with service providers and1 on a biennial basis1 the categories of service providers2 7,g7 a description of whether and for what purposes the covered entity discloses information to third parties2 7,h7 whether a covered entity sells or otherwise shares covered information with data brokers or processes covered information for targeted advertising2 7,i7 whether a covered entity collects covered information about young consumers or children over time and across different websites or mobile applications when a young consumer or child uses the covered entity's website or mobile application2 7,j7 how a young consumer or a parent of a child can exercise their rights to access1 correct1 and delete such young consumer's or child's covered information as set forth under paragraph 7#e72 7,k7 how a young consumer or a parent of a child can grant1 withhold1 or withdraw the consent required under paragraph 7#b71 including how to modify consent for the processing of covered information1 and the consequences of withholding1 withdrawing1 or modifying such consent2 7,l7 the effective date of the notice2 and 7,m7 how the covered entity will communicate material changes of the privacy policy to the young consumer or the parent of a child4 7#b7 ,consent required 7,a7 ,in general ,such regulations shall require a covered entity that has actual or constructive knowledge that such covered entity is processing covered information about a young consumer or child-- 7i7 to provide clear and concise notice to a young consumer or the parent of a child of the items of covered information about such young consumer or child1 respectively1 that is processed by such covered entity and how such covered entity processes such covered information and obtain verifiable consent for such processing2 and 7ii7 if such covered entity determines1 including through constructive knowledge1 that such covered entity has not obtained verifiable consent for the processing of covered information about a young consumer or child1 to1 not later than #dh hours after such determination-- 7,i7 obtain verifiable consent2 or 7,,ii7 delete all covered information about such young consumer or child4 7,b7 ,when consent not required ,such regulations shall provide that verifiable consent under this paragraph is not required in the case of-- 7i7 online contact information collected from a young consumer or child that-- 7,i7 is used only to respond directly on a one-time basis to a specific request from the young consumer or child2 7,,ii7 is not used to re-contact the young consumer or child2 and 7,,iii7 is not retained by the covered entity after responding as described in subclause 7,i72 7ii7 a request for the name or online contact information of a young consumer or the parent of a child that is used for the sole purpose of obtaining verifiable consent or providing notice under subparagraph 7,a77i7 and where such information is not retained by the covered entity if verifiable consent is not obtained within #dh hours2 or 7iii7 the processing of such information by the covered entity is necessary-- 7,i7 to respond to judicial process2 or 7,,ii7 to the extent permitted under other provisions of law1 to provide information to law enforcement agencies or for an investigation on a matter related to public safety4 7,c7 ,withdrawal of consent ,such regulations shall further provide a young consumer or the parent of a child1 as applicable1 a mechanism to withdraw his or her consent at any time in a manner that is as easy as the mechanism to give consent4 ,such withdrawal of consent shall not be construed to affect the lawfulness of any processing based on verifiable consent before such withdrawal4 7,d7 ,prohibition on limiting or discontinuing service ,such regulations shall prohibit a covered entity from refusing to provide a service1 or discontinuing a service provided1 to a young consumer or child1 if the young consumer or parent of the child1 as applicable1 refuses to consent1 or withdraws consent1 to the processing of any covered information not essential to the covered entity to provide such service4 7#c7 ,retention of data 7,a7 ,retention ,limitations ,subject to the exceptions provided in subparagraph 7,b71 such regulations shall prohibit a covered entity from keeping1 retaining1 or otherwise storing covered information for longer than is reasonably necessary for the purposes for which the covered information is processed4 7,b7 ,exceptions ,further retention of covered information shall not be considered to be incompatible with the purposes of processing described in subparagraph 7,a7 if such processing is necessary and done solely for the purposes of-- 7i7 compliance with laws1 regulations1 or other legal obligations2 7ii7 preventing risks to the health or safety of a child or young adults or groups of children or young adults2 or 7iii7 repairing errors that impair existing functionality4 7#d7 ,limitation on disclosing covered information to third parties 7,a7 ,disclosures ,such regulations shall prohibit a covered entity from disclosing covered information to a third party unless the covered entity has a written agreement with such third party that-- 7i7 specifies all of the purposes for which the third party may process the covered information for which the covered entity has verifiable consent2 7ii7 prohibits the third party from processing covered information for any purpose other than the purposes specified under clause 7i72 and 7iii7 requires the third party to provide at least the same privacy and security protections as the covered entity2 or 7,b7 ,responsibilities of covered entities regarding third parties ,such regulations shall require a covered entity-- 7i7 to perform reasonable due diligence in selecting any third party to enter into an agreement under subparagraph 7,a7 and to exercise reasonable oversight over all such third parties to assure compliance with the requirements of this ,act2 and 7ii7 if the covered entity has actual or constructive knowledge that a third party has violated the agreement described in subparagraph 7,a7 to-- 7,i7 to the extent practicable1 promptly take steps to ensure compliance with such agreement2 and 7,,ii7 promptly report to the ,commission that such a violation occurred4 7#e7 ,right to access1 correct1 and delete covered information 7,a7 ,access ,such regulations shall require a covered entity1 upon request of a young consumer or the parent of a child and after proper identification of such young consumer or parent1 to promptly provide to such young consumer or parent1 as applicable-- 7i7 access to all covered information pertaining to such young consumer or child including a description of-- 7,i7 each type of covered information processed by the covered entity pertaining to the young consumer or child1 as applicable2 7,,ii7 each purpose for which the covered entity processes each category of covered information pertaining to the young consumer or child1 as applicable2 7,,iii7 the names of each third party to which the covered entity disclosed the covered information2 7,,iv7 each source other than the young consumer or child1 as applicable1 from which the covered entity obtained covered information pertaining to that young consumer or child1 as applicable2 7,v7 how long the covered information will be retained or stored by the covered entity and1 if not known1 the criteria the covered entity uses to determine how long the covered information will be retained or stored by the covered entity2 and 7,,vi7 with respect to any consumer score of the young consumer or child1 as applicable1 processed by the covered entity1 of-- 7aa7 how such consumer score is used by the covered entity to make decisions with respect to that young consumer or child1 as applicable2 and 7bb7 the source that created the consumer score if not created by the covered entity2 and 7ii7 a simple and reasonable mechanism by which a young consumer or parent of a child may request access to the information described under clause 7i71 as applicable4 7,b7 ,deletion ,such regulations shall require a covered entity1 subject to the exceptions established under subparagraph 7,d7-- 7i7 to establish a simple and reasonable mechanism by which a young consumer or parent of a child with respect to whom the covered entity processes covered information may request the covered entity to delete any covered information 7or any component thereof72 and 7ii7 to delete such covered information not later than #de days after receiving such request4 7,c7 ,correction ,such regulations shall require a covered entity1 subject to the exceptions established under subparagraph 7,d7-- 7i7 to provide each young consumer or parent of a child with respect to whom the covered entity processes covered information1 as applicable1 a simple and reasonable mechanism by which that young consumer or parent may submit a request to the entity-- 7,i7 to dispute the accuracy or completeness of that covered information1 or part or component thereof2 and 7,,ii7 to request that such covered information1 or part or component thereof1 be corrected for accuracy or completeness2 and 7ii7 not later than #de days after receiving a request under clause 7i7-- 7,i7 to determine whether the covered information disputed or requested to be corrected is inaccurate or incomplete2 and 7,,ii7 to correct the accuracy or completeness of any covered information determined by the covered entity to be inaccurate or incomplete4 7,d7 ,exceptions ,such regulations shall permit a covered entity to deny a request made under subparagraphs 7,a71 7,b71 or 7,c7 if-- 7i7 the covered entity is unable to verify the identity of the young consumer or parent of a child making the request after making a reasonable effort to verify the identity of such young consumer or parent2 or 7ii7 with respect to the request made1 the covered entity determines that-- 7,i7 the entity is limited from doing so by law1 legally recognized privilege1 or other legal obligation2 or 7,,ii7 fulfilling the request would create a legitimate risk to the privacy1 security1 or safety of someone other than the young consumer or child1 as applicable2 or 7iii7 with respect to a request to correct covered information made under subparagraph 7,c7 or a request to delete covered information made under subparagraph 7,d71 the covered entity determines that the retention of the covered information is necessary to-- 7,i7 complete the transaction with the young consumer or child1 as applicable1 for which the covered information was collected2 7,,ii7 provide a product or service affirmatively requested by the young consumer or parent of a child1 as applicable2 7,,iii7 perform a contract with the young consumer or a parent of a child1 as applicable1 including a contract for billing1 financial reporting1 or accounting2 7,,iv7 to keep a record of the covered information for law enforcement purposes2 or 7,v7 identify and repair errors that impair the functionality of the ,internet website or online service2 or 7iv7 the covered information is used in public or peer-reviewed scientific1 medical1 or statistical research in the public interest that adheres to commonly accepted ethical standards or laws1 with informed consent consistent with section #ej4bj of title #ba1 ,code of ,federal ,regulations1 provided that the research must already be in progress at the time of request to access1 correct1 or delete is made under subparagraphs 7,a71 7,b71 or 7,c74 7,e7 ,prohibition on limiting or discontinuing service ,such regulations shall prohibit a covered entity from refusing to provide a service1 or discontinuing a service provided1 to a young consumer or child1 if the young consumer or parent of the child1 as applicable1 exercises any of the rights set forth in regulations under this paragraph4 7#f7 ,additional prohibited practices with respect to young consumers and children 7,a7 ,in general ,such regulations shall prohibit a covered entity from-- 7i7 processing any covered information in a manner that is inconsistent with what a reasonable young consumer or parent of a child would expect in the context of a particular transaction or the young consumer's or parent's relationship with such covered entity or seeking to obtain verifiable consent for such processing2 7ii7 providing targeting advertisements or engaging in other marketing to a specific child1 based on that child's covered information or behavior1 or based on the covered information or behavior of children who are similar to that child in gender1 income level1 age1 race1 or ethnicity2 and 7iii7 conditioning the participation of a child in a game1 sweepstakes1 or other contest on consenting to the processing of more covered information than is necessary for such child to participate4 7,b7 ,exceptions ,nothing in subparagraph 7,a7 shall prohibit a covered entity from processing covered information if necessary solely for purposes of-- 7i7 detecting and preventing security incidents2 7ii7 preventing imminent danger to the personal safety of an individual or group of individuals2 7iii7 identifying and repairing errors that impair the functionality of the ,internet website or online service2 or 7iv7 complying with any ,federal1 ,state1 or local law1 rule1 regulation1 or other legal obligation1 including civil1 criminal1 or regulatory inquiries1 investigations1 subpoenas1 disclosures of information required by a court order or other properly executed compulsory process4 7,c7 ,de-identified information ,such regulations shall prohibit a covered entity that de-identifies information1 and any third party with which the covered entity discloses such de-identified information1 from re-identifying1 or attempting to re-identify1 any information that the covered entity has de-identified4 ,such regulations shall also require a covered entity to contractually prohibit any third party with which the covered entity discloses such de-identified information from re-identifying or attempting to re-identify such information4 7#g7 ,security ,requirements 7,a7 ,in general ,such regulations shall require a covered entity to establish and implement reasonable security policies1 practices1 and procedures for the treatment and protection of covered information1 taking into consideration-- 7i7 the size1 nature1 scope1 and complexity of the activities engaged in by such covered entity2 7ii7 the sensitivity of any covered information at issue2 7iii7 the state of the art in administrative1 technical1 and physical safeguards for protecting such information2 and 7iv7 the cost of implementing such policies1 practices1 and procedures4 7,b7 ,specific requirements ,such regulations shall require the policies1 practices1 and procedures established pursuant to regulations issued under subparagraph 7,a7 to include the following3 7i7 ,a written security policy with respect to the processing of such covered information4 7ii7 ,the identification of an officer or other individual as the point of contact with responsibility for the management of information security4 7iii7 ,a process for identifying and assessing any reasonably foreseeable vulnerabilities in the system or systems maintained by such covered entity that contains such covered information1 including regular monitoring for a breach of security of such system or systems4 7iv7 ,a process for taking preventive and corrective action to mitigate against any vulnerabilities identified in the process required by clause 7iii71 which may include-- 7,i7 implementing any changes to the security practices1 architecture1 installation1 or implementation of network or operating software2 and 7,,ii7 regular testing or otherwise monitoring the effectiveness of the safeguards4 7v7 ,a process for determining if the covered information is no longer needed and deleting such covered information by shredding1 permanently erasing1 or otherwise modifying the covered information contained in such data to make such covered information permanently unreadable or indecipherable4 7vi7 ,a process for overseeing persons who have access to covered information1 including through ,internet-connected devices1 by-- 7,i7 taking reasonable steps to select and retain persons that are capable of maintaining appropriate safeguards for the covered information or ,internet-connected devices at issue2 and 7,,ii7 requiring all such persons to implement and maintain such security measures4 7vii7 ,a process for employee training and supervision for implementation of the policies1 practices1 and procedures required by this subsection4 7viii7 ,a written plan or protocol for internal and public response in the event of a breach of security4 7,c7 ,periodic assessment and consume privacy and data security modernization ,such regulations shall require a covered entity1 not less frequently than every #ab months1 to monitor1 evaluate1 and adjust1 as appropriate1 the policies1 practices1 and procedures of such covered entity in light of any relevant changes in-- 7i7 technology2 7ii7 internal or external threats and vulnerabilities to covered information2 and 7iii7 the changing business arrangements of the covered entity4 7,d7 ,submission of policies to the ,,ftc ,such regulations shall require a covered entity to submit the policies1 practices1 and procedures of the covered entity to the ,commission in conjunction with a notification of a breach of security required by any ,federal or ,state statute or regulation or upon request of the ,commission4 2 and 7#d7 in subsection 7c7-- 7,a7 by inserting subsection 7a77#b7 or after violation of2 and 7,b7 by striking under subsection 7a7 and inserting under subsection 7b74 #d4 ,repeal of safe harbors provision and conforming amendments 7a7 ,in general ,section #acjd of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #fejc7 is repealed4 7b7 ,conforming amendments ,the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja et seq47 is amended-- 7#a7 by striking operator each place it appears and inserting covered entity2 7#b7 in section #acjc7;c71 by striking sections #acjd and #acjf and inserting section #acjf2 and 7#c7 in section #acje7;b71 by striking paragraph 7#c74 #e4 ,administration and applicability of ,act 7a7 ,enforcement by ,federal ,trade ,commission ,section #acjf7;d7 of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feje7;d77 is amended-- 7#a7 in the first sentence1 by striking this title4 ,any entity and inserting this title1 and any entity2 7#b7 by striking ,the ,commission shall prevent and inserting the following3 7#a7 ,in general ,except as provided in paragraphs 7#b7 through 7#d71 the ,commission shall prevent 2 and 7#c7 by adding at the end the following3 7#b7 ,increased civil penalty amount ,in the case of a civil penalty under subsection 7l7 or 7m7 of section #e of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 relating to acts or practices in violation of any provision of this title or a regulation prescribed under this title1 the maximum dollar amount per violation shall be #fc1gie4 7#c7 ,nature of relief available ,in any action commenced by the ,commission under section #ai7;a7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77 to enforce this title1 the ,commission shall seek all appropriate relief described in subsection 7b7 of such section1 and may1 notwithstanding such subsection1 seek any exemplary or punitive damages4 4 7b7 ,enforcement by certain other agencies ,section #acjf of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feje7 is further amended-- 7#a7 in subsection 7b7-- 7,a7 in paragraph 7#a71 by striking 1 in the case of and all that follows and inserting the following3 by the appropriate ,federal banking agency1 with respect to any insured depository institution 7as those terms are defined in section #c of that ,act 7#ab ,u4,s4,c4 #ahac7722 7,b7 in paragraph 7#f71 by striking ,federal land bank1 ,federal land bank association1 ,federal intermediate credit bank1 or production credit association and inserting ,farm ,credit ,bank1 ,agricultural ,credit ,bank 7to the extent exercising the authorities of a ,farm ,credit ,bank71 ,federal ,land ,credit ,association1 or agricultural credit association2 and 7,c7 by striking paragraph 7#b7 and redesignating paragraphs 7#c7 through 7#f7 as paragraphs 7#b7 through 7#e71 respectively2 and 7#b7 in subsection 7c71 by striking subsection 7a7 each place it appears and inserting subsection 7b74 #f4 ,review ,section #acjg of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #fejf7 is amended-- 7#a7 in the matter preceding paragraph 7#a71 by striking the regulations initially issued under section #acjc and inserting the regulations issued under section #acjc for the initial implementation of the amendments made by the ,protecting the ,information of our ,vulnerable ,children and ,youth ,act2 and 7#b7 by amending paragraph 7#a7 to read as follows3 7#a7 review the implementation of this title1 including the effect of the implementation of this title on practices relating to the processing of covered information about young consumers or children and young consumer's and children's ability to obtain access to information of their choice online2 and 4 #g4 ,private right of action ,the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja et seq47 is amended-- 7#a7 by redesignating sections #acjg and #acjh as sections #acjh and #acji1 respectively2 and 7#b7 by inserting after section #acjf the following3 #acjg4 ,private right of action 7a7 ,right of action ,any parent of a young consumer or parent of a child alleging a violation of this title or a regulation prescribed under this title with respect to the covered information of such young consumer or child may bring a civil action in any court of competent jurisdiction4 7b7 ,injury in fact ,a violation of this ,act or a regulation promulgated under this ,act with respect to the covered information of a young consumer or child constitutes an injury in fact to that young consumer or child4 7c7 ,relief ,in a civil action brought under subsection 7a7 in which the plaintiff prevails1 the court may award-- 7#a7 injunctive relief2 7#b7 actual damages2 7#c7 punitive damages2 7#d7 reasonable attorney's fees and costs2 and 7#e7 any other relief that the court determines appropriate4 7d7 ,pre-,dispute arbitration agreements 7#a7 ,in general ,no pre-dispute arbitration agreement or pre-dispute joint-action waiver shall be valid or enforceable with respect to any claim arising out of this ,act or the regulations issued under this ,act4 7#b7 ,determination ,a determination as to whether and how this ,act applies to an arbitration agreement shall be determined under ,federal law by the court1 rather than the arbitrator1 irrespective of whether the party opposing arbitration challenges such agreement specifically or in conjunction with any other term of the contract containing such agreement4 7#c7 ,definitions ,as used in this subsection-- 7,a7 the term pre-dispute arbitration agreement means any agreement to arbitrate a dispute that has not arisen at the time of the making of the agreement2 and 7,b7 the term pre-dispute joint-action waiver means an agreement1 whether or not part of a pre-dispute arbitration agreement1 that would prohibit1 or waive the right of1 one of the parties to the agreement to participate in a joint1 class1 or collective action in a judicial1 arbitral1 administrative1 or other forum1 concerning a dispute that has not yet arisen at the time of the making of the agreement4 7e7 ,non-,waiveability ,the rights and remedies provided under this ,act may not be waived or limited by contract or otherwise4 4 #h4 ,relationship to other law ,section #acjf of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feje7 is further amended by adding at the end the following3 7f7 ,relationship to other law ,nothing in this ,act may be construed to modify1 limit1 or supersede the operation of any privacy or security provision in any other ,federal statute or regulation4 4 #i4 ,additional conforming amendment ,the heading of title ,,xiii of division ,c of the ,omnibus ,consolidated and ,emergency ,supplemental ,appropriations ,act1 #aiii 7,public ,law #aje-bgg2 #aab ,stat4 #bfha-gbh7 is amended by inserting and ,young ,consumer's after ,children's4