,i  #aaf? ,,congress  #b;d ,session  ,h4
 ,r4 #egjc  ,,9 ,,! ,,h\se ,,(          
,,repres5tatives  ,janu>y #bi1 #bjbj,ms4
 ,ca/or ( ,florida introduc$ ! foll[+   
bill2 :i* 0 ref]r$ to ! ,committee on   
,en]gy & ,comm]ce  ,a ,,bill  ,to am5d !
 ,*ildr5's ,onl9e ,privacy ,protection  
,act ( #aiih to update & exp& ! cov]age 
( su* ,act1 & = o!r purposes4  #a4 ,%ort
 title2 table ( cont5ts  ,?is ,act may  
be cit$ z ! ,protect+ ! ,in=mation ( our
 ,vuln]able ,*ildr5 & ,y\? ,act or !    
,,privcy ,,act4  #b4 ,def9itions        
,section #acjb ( ! ,*ildr5's ,onl9e     
,privacy ,protection ,act ( #aiih 7#ae  
,u4,s4,c4 #feja7 is am5d$--  7#a7 9     
p>agraph 7#a7-- 7,a7 by ins]t+ or *ildr5
 aft] *ild2 &  7,b7 by ins]t+ or        
individuals1 respectively1 aft]         
individual2  7#b7 by /rik+ p>agraph     
7#aj72  7#c7 by r$esignat+ p>agraphs    
7#b7 ?r\gh 7#i7 z p>agraphs 7#c7 ?r\gh  
7#aj71 respectively2  7#d7 ins]t+ aft]  
p>agraph 7#a7 ! foll[+3  7#b7 ,"y       
consum] ,! t]m "y consum] means an      

individual ov] ! age ( #ab & "u ! age ( 
#ah4  2  7#e7 by am5d+ p>agraph 7#c7 7z 
s r$esignat$7 to read z foll[s3  7#c7   
,cov]$ entity ,! t]m cov]$ entity       
means-- 7,a7 any organization1          
corporation1 tru/1 p>tn]%ip1 sole       
proprietor%ip1 un9corporat$ association1
 or v5ture ov] :i* ! ,commission has    
au?ority pursuant to section #e7;a77#b7 
( ! ,f$]al ,trade ,commission ,act 7#ae 
,u4,s4,c4 #de7;a77#b772  7,b7 not)/&+   
section #e7;a77#b7 ( ! ,f$]al ,trade    
,commission ,act 7#ae ,u4,s4,c4         
#de7;a77#b771 common c>ri]s2 &  7,c7    
not)/&+ sections #d & #e7;a77#b7 ( !    
,f$]al ,trade ,commission ,act 7#ae     
,u4,s4,c4 #dd & #de7;a77#b771 any       
nonpr(it organization1 includ+ any      
organization describ$ 9 section #eja7;c7
 ( ! ,int]nal ,rev5ue ,code ( #aihf t is
 exempt f taxation "u section #eja7;a7 (
 ! ,int]nal ,rev5ue ,code ( #aihf4  2   
7#f7 by am5d+ p>agraph 7#e7 7z s        
r$esignat$7 to read z foll[s3  7#e7     
,disclose ,! t]m disclose means to      

int5tionally or un9t5tionally release1  
transf]1 sell1 dissem9ate1 %>e1 publi%1 
lease1 lic5se1 make available1 all[     
access to1 fail to re/rict access to1 or
 o!rwise communicate cov]$ in=mation4  2
  7#g7 by am5d+ p>agraph 7#i7 7z s      
r$esignat$7 to read z foll[s3  7#i7     
,cov]$ in=mation ,! t]m cov]$           
in=mation--  7,a7 means any in=mation1  
l9k$ or reasonably l9kable to a specific
 "y consum] or *ild1 or consum] device (
 a "y consum] or *ild2  7,b7 may        
include-- 7i7 a "n1 alias1 home or o!r  
physical address1 onl9e id5tifi]1       
,int]net ,protocol address1 email       
address1 acc\nt "n1 ,social ,security   
numb]1 physical *>act]i/ics or          
description1 telephone numb]1 ,/ate     
id5tification c>d numb]1 driv]'s lic5se 
numb]1 :]e applicable1 passport numb]1  
or o!r simil> id5tifi]2  7ii7 race1     
religion1 sex1 sexual ori5tation1 sexual
 behavior1 familial /atus1 g5d] id5tity1
 disability1 age1 political affiliation1
 or national orig92  7iii7 comm]cial    

in=mation1 includ+ records relat+ to    
p]sonal prop]ty1 products or s]vices    
pur*as$1 obta9$1 or consid]$1 or o!r    
pur*as+ or consum+ hi/ories or t5d5cies2
  7iv7 biometric in=mation2  7v7        
,int]net or o!r electronic network      
activity in=mation1 includ+ br[s+       
hi/ory1 se>* hi/ory1 & in=mation reg>d+ 
a "y consum]'s or *ild's int]action ) an
 ,int]net website1 application1 or      
adv]tisem5t2  7vi7 geolocation          
in=mation2  7vii7 audio1 electronic1    
visual1 !rmal1 olfactory1 or simil>     
in=mation2  7viii7 education in=mation2 
7ix7 heal? in=mation2  7x7 facial       
recognition in=mation2  7xi7 cont5ts ( &
 p>ties to in=mation1 includ+ ) respect 
to electronic mail1 text messages1      
picture messages1 voicemails1 audio     
conv]sations1 & video conv]sations2     
7xii7 f9ancial in=mation1 includ+ bank  
acc\nt numb]s1 cr$it c>d numb]s1 debit  
c>d numb]s1 or insurance policy numb]s1 
:]e applicable2  7xiii7 inf]5ces drawn f
 any ( ! in=mation describ$ 9 ?is       

p>agraph to create a pr(ile ab\t a "y   
consum] or *ild reflect+ ! "y consum]'s 
or *ild's pref]5ces1 *>act]i/ics1       
psy*ological tr5ds1 pr$ispositions1     
behavior1 attitudes1 intellig5ce1       
abilities1 & aptitudes2 &  7,c7 does n  
include-- 7i7 in=mation t is process$   
solely = ! purpose ( employm5t ( a "y   
consum]2  7ii7 de-id5tifi$ in=mation4  2
  7#h7 by am5d+ p>agraph 7#aj7 7z s     
r$esignat$7 to read z foll[s3  7#aj7    
,v]ifiable cons5t ,! t]m v]ifiable      
cons5t means express1 affirmative cons5t
 freely giv5 by a "y consum]1 or by !   
p>5t ( a *ild1 to ! process+ ( cov]$    
in=mation ( t "y consum] or *ild1       
respectively--  7,a7 t is specific1     
in=m$1 & unambigu\s2  7,b7 t is giv5    
sep>ately = ea* process ( specific types
 ( cov]$ in=mation2  7,c7 :]e ! "y      
consum] or p>5t ( a *ild1 z applicable1 
has n receiv$ any f9ancial or o!r       
inc5tive 9 ex*ange = su* cons5t2 &  7,d7
 t is giv5 be=e any process+ occurs1 at 
a "t & 9 a context 9 :i* ! "y consum] or

 p>5t ( a *ild1 z applicable1 w\ld      
reasonably expect to make *oices conc]n+
 su* process+4  2  7#i7 by r$esignat+   
p>agraphs 7#aa7 & 7#ab7 z p>agraphs     
7#ab7 & 7#ac71 respectively2 &  7#aj7 by
 add+ at ! end ! foll[+3  7#ad7 ,process
 ,! t]m process means any op]ation or   
set ( op]ations :i* is p]=m$ on cov]$   
in=mation1 :e!r or n by automat$ means1 
includ+ collect+1 creat+1 acquir+1      
disclos+1 record+1 d]iv+1 inf]r+1       
obta9+1 assembl+1 organiz+1 /ructur+1   
/or+1 reta9+1 adapt+ or alt]+1 us+1 or  
retriev+ cov]$ in=mation4  7#ae7        
,de-id5tifi$ in=mation & relat$ t]ms    
7,a7 ,! t]m de-id5tifi$ in=mation means 
in=mation t has be5 de-id5tifi$ by a    
cov]$ entity1 :]e ! cov]$ entity        
publicly discloses ! me?ods x uses to   
de-id5tify in=mation4  7,b7 ,! t]m      
de-id5tify means ! removal ( id5tify+   
in=mation f in=mation su* t ! in=mation 
is n reasonably l9kable to a specific "y
 consum] or *ild or consum] device ( a  
"y consum] or *ild4  7,c7 ,! t]m        

re-id5tify means to l9k in=mation t has 
be5 de-id5tifi$ to a specific "y consum]
 or *ild or consum] device ( a "y       
consum] or *ild4  7#af7 ,/ate ,! t]m    
,/ate means ea* ( ! sev]al ,/ates1 !    
,di/rict ( ,columbia1 ea* t]ritory ( !  
,unit$ ,/ates1 & ea* f$]ally recogniz$  
,indian ,tribe4  7#ag7 ,s]vice provid]  
,! t]m s]vice provid] means a cov]$     
entity t processes cov]$ in=mation at ! 
direction (1 & = ! sole b5efit (1 ano!r 
cov]$ entity1 &--  7,a7 is contractually
 or legally prohibit$ f process+ su*    
cov]$ in=mation = any o!r purpose2 &    
7,b7 complies ) all ( ! requirem5ts (   
?is ,act4  4  #c4 ,unfair or deceptive  
acts or practices ,section #acjc ( !    
,*ildr5's ,onl9e ,privacy ,protection   
,act ( #aiih 7#ae ,u4,s4,c4 #fejb7 is   
am5d$--  7#a7 9 ! section head+1 by     
/rik+ collection & use ( p]sonal        
in=mation f & ab\t *ildr5 on ! int]net &
 ins]t+ process+ ( cov]$ in=mation f &  
ab\t "y consum]s or *ildr52  7#b7 by    
am5d+ subsection 7a7 to read z foll[s3  

7a7 ,acts prohibit$ ,x is unlawful = a  
cov]$ entity t has actual or con/ructive
 k t su* cov]$ entity is process+ cov]$ 
in=mation ab\t a "y consum] or *ild to  
process su* in=mation 9 a mann] t       
violates ! regulations prescrib$ "u     
subsection 7b74  2  7#c7 by am5d+       
subsection 7b7 to read z foll[s3  7b7 ,9
 g5]al ,n lat] ?an #a ye> aft] ! date ( 
enactm5t ( ! ,protect+ ! ,in=mation (   
our ,vuln]able ,*ildr5 & ,y\? ,act1 !   
,commission %all1 "u section #eec (     
title #e1 ,unit$ ,/ates ,code1 revise   
regulations issu$ "u ?is ,act prior to  
su* date ( enactm5t & issue additional  
regulations z necess>y t implem5t !     
requirem5ts & prohibitions set =? 9     
p>agraphs 7#a7 ?r\gh 7#g74 ,!           
,commission %all h ! au?ority to revise 
su* regulations e #g ye>s or z x        
det]m9es necess>y due to *anges 9 or    
em]g+ te*nology4  7#a7 ,transp>5cy ,su* 
regulations %all require a cov]$ entity 
to develop & make publicly available at 
all times & 9 a ma*9e-readable =mat1 a  

privacy policy1 9 a mann] t is cle>1    
easily und]/ood1 & writt5 9 pla9 &      
concise language1 t includes--  7,a7 !  
categories ( cov]$ in=mation t ! cov]$  
entity processes ab\t "y consum]s &     
*ildr52  7,b7 h[ & "u :at circum/ances  
cov]$ in=mation is collect$ directly f a
 "y consum] or *ild2  7,c7 ! categories 
& ! s\rces ( any cov]$ in=mation        
process$ by a cov]$ entity t is n       
collect$ directly f a "y consum] or     
*ild2  7,d7 a description ( ! purposes =
 :i* ! cov]$ entity processes cov]$     
in=mation1 includ+--  7i7 a description 
( :e!r & h[ ! cov]$ entity cu/omizes    
products or s]vices1 or adju/s ! prices 
( products or s]vices = "y consum]s or  
*ildr5 or bas$ 9 any "p on process+ (   
cov]$ in=mation2  7ii7 a description (  
:e!r & h[ ! cov]$ entity1 or ! cov]$    
entity's affiliates or s]vice provid]s1 
de-id5tifies in=mation1 includ+ ! me?ods
 us$ to de-id5tify su* in=mation2 &     
7iii7 a description ( :e!r & h[ ! cov]$ 
entity1 or ! cov]$ entity's affiliates  

or s]vice provid]s1 g5]ates or uses any 
consum] score to make decisions conc]n+ 
a "y consum] or *ild1 & ! s\rce or      
s\rces ( any su* consum] score2  7,e7 a 
description ( h[ long & ! circum/ances  
"u :i* ! cov]$ entity reta9s cov]$      
in=mation2  7,f7 a description ( all ( !
 purposes = :i* ! cov]$ entity discloses
 cov]$ in=mation ) s]vice provid]s &1 on
 a bi5nial basis1 ! categories ( s]vice 
provid]s2  7,g7 a description ( :e!r & =
 :at purposes ! cov]$ entity discloses  
in=mation to ?ird p>ties2  7,h7 :e!r a  
cov]$ entity sells or o!rwise %>es cov]$
 in=mation ) data brok]s or processes   
cov]$ in=mation = t>get$ adv]tis+2  7,i7
 :e!r a cov]$ entity collects cov]$     
in=mation ab\t "y consum]s or *ildr5 ov]
 "t & across diff]5t websites or mobile 
applications :5 a "y consum] or *ild    
uses ! cov]$ entity's website or mobile 
application2  7,j7 h[ a "y consum] or a 
p>5t ( a *ild c ex]cise _! rights to    
access1 correct1 & delete su* "y        
consum]'s or *ild's cov]$ in=mation z   

set =? "u p>agraph 7#e72  7,k7 h[ a "y  
consum] or a p>5t ( a *ild c grant1     
)hold1 or )draw ! cons5t requir$ "u     
p>agraph 7#b71 includ+ h[ to modify     
cons5t = ! process+ ( cov]$ in=mation1 &
 ! consequ5ces ( )hold+1 )draw+1 or     
modify+ su* cons5t2  7,l7 ! effective   
date ( ! notice2 &  7,m7 h[ ! cov]$     
entity w communicate mat]ial *anges ( ! 
privacy policy to ! "y consum] or ! p>5t
 ( a *ild4  7#b7 ,cons5t requir$  7,a7  
,9 g5]al ,su* regulations %all require a
 cov]$ entity t has actual or           
con/ructive k t su* cov]$ entity is     
process+ cov]$ in=mation ab\t a "y      
consum] or *ild--  7i7 to provide cle> &
 concise notice to a "y consum] or !    
p>5t ( a *ild ( ! items ( cov]$         
in=mation ab\t su* "y consum] or *ild1  
respectively1 t is process$ by su* cov]$
 entity & h[ su* cov]$ entity processes 
su* cov]$ in=mation & obta9 v]ifiable   
cons5t = su* process+2 &  7ii7 if su*   
cov]$ entity det]m9es1 includ+ ?r\gh    
con/ructive k1 t su* cov]$ entity has n 

obta9$ v]ifiable cons5t = ! process+ (  
cov]$ in=mation ab\t a "y consum] or    
*ild1 to1 n lat] ?an #dh h\rs aft] su*  
det]m9ation--  7,i7 obta9 v]ifiable     
cons5t2 or  7,,ii7 delete all cov]$     
in=mation ab\t su* "y consum] or *ild4  
7,b7 ,:5 cons5t n requir$ ,su*          
regulations %all provide t v]ifiable    
cons5t "u ?is p>agraph is n requir$ 9 ! 
case (--  7i7 onl9e contact in=mation   
collect$ f a "y consum] or *ild t-- 7,i7
 is us$ only to respond directly on a   
"o-"t basis to a specific reque/ f ! "y 
consum] or *ild2  7,,ii7 is n us$ to    
re-contact ! "y consum] or *ild2 &      
7,,iii7 is n reta9$ by ! cov]$ entity   
aft] respond+ z describ$ 9 subclause    
7,i72  7ii7 a reque/ = ! "n or onl9e    
contact in=mation ( a "y consum] or !   
p>5t ( a *ild t is us$ = ! sole purpose 
( obta9+ v]ifiable cons5t or provid+    
notice "u subp>agraph 7,a77i7 & :]e su* 
in=mation is n reta9$ by ! cov]$ entity 
if v]ifiable cons5t is n obta9$ )9 #dh  
h\rs2 or  7iii7 ! process+ ( su*        

in=mation by ! cov]$ entity is          
necess>y-- 7,i7 to respond to judicial  
process2 or  7,,ii7 to ! ext5t p]mitt$  
"u o!r provisions ( law1 to provide     
in=mation to law en=cem5t ag5cies or =  
an inve/igation on a matt] relat$ to    
public safety4  7,c7 ,)drawal ( cons5t  
,su* regulations %all fur!r provide a "y
 consum] or ! p>5t ( a *ild1 z          
applicable1 a me*anism to )draw 8 or h] 
cons5t at any "t 9 a mann] t is z easy z
 ! me*anism to give cons5t4 ,su* )drawal
 ( cons5t %all n be con/ru$ to affect ! 
lawfulness ( any process+ bas$ on       
v]ifiable cons5t be=e su* )drawal4  7,d7
 ,prohibition on limit+ or discont9u+   
s]vice ,su* regulations %all prohibit a 
cov]$ entity f refus+ to provide a      
s]vice1 or discont9u+ a s]vice provid$1 
to a "y consum] or *ild1 if ! "y consum]
 or p>5t ( ! *ild1 z applicable1 refuses
 to cons5t1 or )draws cons5t1 to !      
process+ ( any cov]$ in=mation n        
ess5tial to ! cov]$ entity to provide   
su* s]vice4  7#c7 ,ret5tion ( data  7,a7

 ,ret5tion ,limitations ,subject to !   
exceptions provid$ 9 subp>agraph 7,b71  
su* regulations %all prohibit a cov]$   
entity f keep+1 reta9+1 or o!rwise /or+ 
cov]$ in=mation = long] ?an is          
reasonably necess>y = ! purposes = :i* !
 cov]$ in=mation is process$4  7,b7     
,exceptions ,fur!r ret5tion ( cov]$     
in=mation %all n be consid]$ to be      
incompatible ) ! purposes ( process+    
describ$ 9 subp>agraph 7,a7 if su*      
process+ is necess>y & done solely = !  
purposes (--  7i7 compliance ) laws1    
regulations1 or o!r legal obligations2  
7ii7 prev5t+ risks to ! heal? or safety 
( a *ild or "y adults or gr\ps ( *ildr5 
or "y adults2 or  7iii7 repair+ errors t
 impair exi/+ functionality4  7#d7      
,limitation on disclos+ cov]$ in=mation 
to ?ird p>ties  7,a7 ,disclosures ,su*  
regulations %all prohibit a cov]$ entity
 f disclos+ cov]$ in=mation to a ?ird   
p>ty unless ! cov]$ entity has a writt5 
agreem5t ) su* ?ird p>ty t--  7i7       
specifies all ( ! purposes = :i* ! ?ird 

p>ty may process ! cov]$ in=mation = :i*
 ! cov]$ entity has v]ifiable cons5t2   
7ii7 prohibits ! ?ird p>ty f process+   
cov]$ in=mation = any purpose o!r ?an ! 
purposes specifi$ "u clause 7i72 &      
7iii7 requires ! ?ird p>ty to provide at
 lea/ ! same privacy & security         
protections z ! cov]$ entity2 or  7,b7  
,responsibilities ( cov]$ entities      
reg>d+ ?ird p>ties ,su* regulations %all
 require a cov]$ entity-- 7i7 to p]=m   
reasonable due dilig5ce 9 select+ any   
?ird p>ty to ent] into an agreem5t "u   
subp>agraph 7,a7 & to ex]cise reasonable
 ov]sight ov] all su* ?ird p>ties to    
assure compliance ) ! requirem5ts ( ?is 
,act2 &  7ii7 if ! cov]$ entity has     
actual or con/ructive k t a ?ird p>ty   
has violat$ ! agreem5t describ$ 9       
subp>agraph 7,a7 to--  7,i7 to ! ext5t  
practicable1 promptly take /eps to      
ensure compliance ) su* agreem5t2 &     
7,,ii7 promptly report to ! ,commission 
t su* a violation occurr$4  7#e7 ,"r to 
access1 correct1 & delete cov]$         

in=mation  7,a7 ,access ,su* regulations
 %all require a cov]$ entity1 ^u reque/ 
( a "y consum] or ! p>5t ( a *ild & aft]
 prop] id5tification ( su* "y consum] or
 p>5t1 to promptly provide to su* "y    
consum] or p>5t1 z applicable--  7i7    
access to all cov]$ in=mation p]ta9+ to 
su* "y consum] or *ild includ+ a        
description (--  7,i7 ea* type ( cov]$  
in=mation process$ by ! cov]$ entity    
p]ta9+ to ! "y consum] or *ild1 z       
applicable2  7,,ii7 ea* purpose = :i* ! 
cov]$ entity processes ea* category (   
cov]$ in=mation p]ta9+ to ! "y consum]  
or *ild1 z applicable2  7,,iii7 ! names 
( ea* ?ird p>ty to :i* ! cov]$ entity   
disclos$ ! cov]$ in=mation2  7,,iv7 ea* 
s\rce o!r ?an ! "y consum] or *ild1 z   
applicable1 f :i* ! cov]$ entity obta9$ 
cov]$ in=mation p]ta9+ to t "y consum]  
or *ild1 z applicable2  7,v7 h[ long !  
cov]$ in=mation w be reta9$ or /or$ by !
 cov]$ entity &1 if n kn[n1 ! crit]ia ! 
cov]$ entity uses to det]m9e h[ long !  
cov]$ in=mation w be reta9$ or /or$ by !

 cov]$ entity2 &  7,,vi7 ) respect to   
any consum] score ( ! "y consum] or     
*ild1 z applicable1 process$ by ! cov]$ 
entity1 (--  7aa7 h[ su* consum] score  
is us$ by ! cov]$ entity to make        
decisions ) respect to t "y consum] or  
*ild1 z applicable2 &  7bb7 ! s\rce t   
creat$ ! consum] score if n creat$ by ! 
cov]$ entity2 &  7ii7 a simple &        
reasonable me*anism by :i* a "y consum] 
or p>5t ( a *ild may reque/ access to ! 
in=mation describ$ "u clause 7i71 z     
applicable4  7,b7 ,deletion ,su*        
regulations %all require a cov]$ entity1
 subject to ! exceptions e/abli%$ "u    
subp>agraph 7,d7--  7i7 to e/abli% a    
simple & reasonable me*anism by :i* a "y
 consum] or p>5t ( a *ild ) respect to  
:om ! cov]$ entity processes cov]$      
in=mation may reque/ ! cov]$ entity to  
delete any cov]$ in=mation 7or any      
compon5t !re(72 &  7ii7 to delete su*   
cov]$ in=mation n lat] ?an #de days aft]
 receiv+ su* reque/4  7,c7 ,correction  
,su* regulations %all require a cov]$   

entity1 subject to ! exceptions e/abli%$
 "u subp>agraph 7,d7--  7i7 to provide  
ea* "y consum] or p>5t ( a *ild )       
respect to :om ! cov]$ entity processes 
cov]$ in=mation1 z applicable1 a simple 
& reasonable me*anism by :i* t "y       
consum] or p>5t may submit a reque/ to !
 entity--  7,i7 to dispute ! accuracy or
 complet5ess ( t cov]$ in=mation1 or "p 
or compon5t !re(2 &  7,,ii7 to reque/ t 
su* cov]$ in=mation1 or "p or compon5t  
!re(1 be correct$ = accuracy or         
complet5ess2 &  7ii7 n lat] ?an #de days
 aft] receiv+ a reque/ "u clause 7i7--  
7,i7 to det]m9e :e!r ! cov]$ in=mation  
disput$ or reque/$ to be correct$ is    
inaccurate or incomplete2 &  7,,ii7 to  
correct ! accuracy or complet5ess ( any 
cov]$ in=mation det]m9$ by ! cov]$      
entity to be inaccurate or incomplete4  
7,d7 ,exceptions ,su* regulations %all  
p]mit a cov]$ entity to d5y a reque/    
made "u subp>agraphs 7,a71 7,b71 or 7,c7
 if--  7i7 ! cov]$ entity is unable to  
v]ify ! id5tity ( ! "y consum] or p>5t (

 a *ild mak+ ! reque/ aft] mak+ a       
reasonable ef=t to v]ify ! id5tity ( su*
 "y consum] or p>5t2 or  7ii7 ) respect 
to ! reque/ made1 ! cov]$ entity        
det]m9es t-- 7,i7 ! entity is limit$ f  
do+ s by law1 legally recogniz$         
privilege1 or o!r legal obligation2 or  
7,,ii7 fulfill+ ! reque/ w\ld create a  
legitimate risk to ! privacy1 security1 
or safety ( someone o!r ?an ! "y consum]
 or *ild1 z applicable2 or  7iii7 )     
respect to a reque/ to correct cov]$    
in=mation made "u subp>agraph 7,c7 or a 
reque/ to delete cov]$ in=mation made "u
 subp>agraph 7,d71 ! cov]$ entity       
det]m9es t ! ret5tion ( ! cov]$         
in=mation is necess>y to--  7,i7        
complete ! transaction ) ! "y consum] or
 *ild1 z applicable1 = :i* ! cov]$      
in=mation 0 collect$2  7,,ii7 provide a 
product or s]vice affirmatively reque/$ 
by ! "y consum] or p>5t ( a *ild1 z     
applicable2  7,,iii7 p]=m a contract ) !
 "y consum] or a p>5t ( a *ild1 z       
applicable1 includ+ a contract = bill+1 

f9ancial report+1 or acc\nt+2  7,,iv7 to
 keep a record ( ! cov]$ in=mation = law
 en=cem5t purposes2 or  7,v7 id5tify &  
repair errors t impair ! functionality (
 ! ,int]net website or onl9e s]vice2 or 
7iv7 ! cov]$ in=mation is us$ 9 public  
or pe]-review$ sci5tific1 m$ical1 or    
/ati/ical rese>* 9 ! public int]e/ t    
adh]es to commonly accept$ e?ical /&>ds 
or laws1 ) in=m$ cons5t consi/5t )      
section #ej4bj ( title #ba1 ,code (     
,f$]al ,regulations1 provid$ t ! rese>* 
mu/ already be 9 progress at ! "t (     
reque/ to access1 correct1 or delete is 
made "u subp>agraphs 7,a71 7,b71 or     
7,c74  7,e7 ,prohibition on limit+ or   
discont9u+ s]vice ,su* regulations %all 
prohibit a cov]$ entity f refus+ to     
provide a s]vice1 or discont9u+ a s]vice
 provid$1 to a "y consum] or *ild1 if ! 
"y consum] or p>5t ( ! *ild1 z          
applicable1 ex]cises any ( ! rights set 
=? 9 regulations "u ?is p>agraph4  7#f7 
,additional prohibit$ practices )       
respect to "y consum]s & *ildr5  7,a7 ,9

 g5]al ,su* regulations %all prohibit a 
cov]$ entity f-- 7i7 process+ any cov]$ 
in=mation 9 a mann] t is inconsi/5t )   
:at a reasonable "y consum] or p>5t ( a 
*ild w\ld expect 9 ! context ( a        
p>ticul> transaction or ! "y consum]'s  
or p>5t's relation%ip ) su* cov]$ entity
 or seek+ to obta9 v]ifiable cons5t =   
su* process+2  7ii7 provid+ t>get+      
adv]tisem5ts or engag+ 9 o!r m>ket+ to a
 specific *ild1 bas$ on t *ild's cov]$  
in=mation or behavior1 or bas$ on !     
cov]$ in=mation or behavior ( *ildr5 :o 
are simil> to t *ild 9 g5d]1 income     
level1 age1 race1 or e?nicity2 &  7iii7 
condition+ ! p>ticipation ( a *ild 9 a  
game1 sweep/akes1 or o!r conte/ on      
cons5t+ to ! process+ ( m cov]$         
in=mation ?an is necess>y = su* *ild to 
p>ticipate4  7,b7 ,exceptions ,no?+ 9   
subp>agraph 7,a7 %all prohibit a cov]$  
entity f process+ cov]$ in=mation if    
necess>y solely = purposes (--  7i7     
detect+ & prev5t+ security incid5ts2    
7ii7 prev5t+ imm95t dang] to ! p]sonal  

safety ( an individual or gr\p (        
individuals2  7iii7 id5tify+ & repair+  
errors t impair ! functionality ( !     
,int]net website or onl9e s]vice2 or    
7iv7 comply+ ) any ,f$]al1 ,/ate1 or    
local law1 rule1 regulation1 or o!r     
legal obligation1 includ+ civil1        
crim9al1 or regulatory inquiries1       
inve/igations1 subpo5as1 disclosures (  
in=mation requir$ by a c\rt ord] or o!r 
prop]ly execut$ compulsory process4     
7,c7 ,de-id5tifi$ in=mation ,su*        
regulations %all prohibit a cov]$ entity
 t de-id5tifies in=mation1 & any ?ird   
p>ty ) :i* ! cov]$ entity discloses su* 
de-id5tifi$ in=mation1 f re-id5tify+1 or
 attempt+ to re-id5tify1 any in=mation t
 ! cov]$ entity has de-id5tifi$4 ,su*   
regulations %all also require a cov]$   
entity to contractually prohibit any    
?ird p>ty ) :i* ! cov]$ entity discloses
 su* de-id5tifi$ in=mation f re-id5tify+
 or attempt+ to re-id5tify su*          
in=mation4  7#g7 ,security ,requirem5ts 
7,a7 ,9 g5]al ,su* regulations %all     

require a cov]$ entity to e/abli% &     
implem5t reasonable security policies1  
practices1 & proc$ures = ! treatm5t &   
protection ( cov]$ in=mation1 tak+ into 
consid]ation--  7i7 ! size1 nature1     
scope1 & complexity ( ! activities      
engag$ 9 by su* cov]$ entity2  7ii7 !   
s5sitivity ( any cov]$ in=mation at     
issue2  7iii7 ! /ate ( ! art 9          
adm9i/rative1 te*nical1 & physical      
safegu>ds = protect+ su* in=mation2 &   
7iv7 ! co/ ( implem5t+ su* policies1    
practices1 & proc$ures4  7,b7 ,specific 
requirem5ts ,su* regulations %all       
require ! policies1 practices1 &        
proc$ures e/abli%$ pursuant to          
regulations issu$ "u subp>agraph 7,a7 to
 include ! foll[+3  7i7 ,a writt5       
security policy ) respect to ! process+ 
( su* cov]$ in=mation4  7ii7 ,!         
id5tification ( an (fic] or o!r         
individual z ! po9t ( contact )         
responsibility = ! managem5t ( in=mation
 security4  7iii7 ,a process = id5tify+ 
& assess+ any reasonably =eseeable      

vuln]abilities 9 ! sy/em or sy/ems      
ma9ta9$ by su* cov]$ entity t conta9s   
su* cov]$ in=mation1 includ+ regul>     
monitor+ = a brea* ( security ( su*     
sy/em or sy/ems4  7iv7 ,a process = tak+
 prev5tive & corrective action to       
mitigate aga9/ any vuln]abilities       
id5tifi$ 9 ! process requir$ by clause  
7iii71 :i* may include--  7,i7 implem5t+
 any *anges to ! security practices1    
ar*itecture1 in/allation1 or            
implem5tation ( network or op]at+       
s(tw>e2 &  7,,ii7 regul> te/+ or o!rwise
 monitor+ ! effectiv5ess ( ! safegu>ds4 
7v7 ,a process = det]m9+ if ! cov]$     
in=mation is no long] ne$$ & delet+ su* 
cov]$ in=mation by %r$d+1 p]man5tly     
eras+1 or o!rwise modify+ ! cov]$       
in=mation conta9$ 9 su* data to make su*
 cov]$ in=mation p]man5tly unreadable or
 indeciph]able4  7vi7 ,a process =      
ov]see+ p]sons :o h access to cov]$     
in=mation1 includ+ ?r\gh                
,int]net-connect$ devices1 by--  7,i7   
tak+ reasonable /eps to select & reta9  

p]sons t are capable ( ma9ta9+          
appropriate safegu>ds = ! cov]$         
in=mation or ,int]net-connect$ devices  
at issue2 &  7,,ii7 requir+ all su*     
p]sons to implem5t & ma9ta9 su* security
 measures4  7vii7 ,a process = employee 
tra9+ & sup]vision = implem5tation ( !  
policies1 practices1 & proc$ures requir$
 by ?is subsection4  7viii7 ,a writt5   
plan or protocol = int]nal & public     
response 9 ! ev5t ( a brea* ( security4 
7,c7 ,p]iodic assessm5t & consume       
privacy & data security mod]nization    
,su* regulations %all require a cov]$   
entity1 n less frequ5tly ?an e #ab      
mon?s1 to monitor1 evaluate1 & adju/1 z 
appropriate1 ! policies1 practices1 &   
proc$ures ( su* cov]$ entity 9 light (  
any relevant *anges 9--  7i7 te*nology2 
7ii7 int]nal or ext]nal ?reats &        
vuln]abilities to cov]$ in=mation2 &    
7iii7 ! *ang+ bus9ess arrangem5ts ( !   
cov]$ entity4  7,d7 ,submission (       
policies to ! ,,ftc ,su* regulations    
%all require a cov]$ entity to submit ! 

policies1 practices1 & proc$ures ( !    
cov]$ entity to ! ,commission 9         
conjunction ) a notification ( a brea* (
 security requir$ by any ,f$]al or ,/ate
 /atute or regulation or ^u reque/ ( !  
,commission4  2 &  7#d7 9 subsection    
7c7-- 7,a7 by ins]t+ subsection 7a77#b7 
or aft] violation (2 &  7,b7 by /rik+ "u
 subsection 7a7 & ins]t+ "u subsection  
7b74  #d4 ,repeal ( safe h>bors         
provision & con=m+ am5dm5ts  7a7 ,9     
g5]al ,section #acjd ( ! ,*ildr5's      
,onl9e ,privacy ,protection ,act ( #aiih
 7#ae ,u4,s4,c4 #fejc7 is repeal$4  7b7 
,con=m+ am5dm5ts ,! ,*ildr5's ,onl9e    
,privacy ,protection ,act ( #aiih 7#ae  
,u4,s4,c4 #feja et seq47 is am5d$-- 7#a7
 by /rik+ op]ator ea* place x appe>s &  
ins]t+ cov]$ entity2  7#b7 9 section    
#acjc7;c71 by /rik+ sections #acjd &    
#acjf & ins]t+ section #acjf2 &  7#c7 9 
section #acje7;b71 by /rik+ p>agraph    
7#c74  #e4 ,adm9i/ration & applicability
 ( ,act  7a7 ,en=cem5t by ,f$]al ,trade 
,commission ,section #acjf7;d7 ( !      

,*ildr5's ,onl9e ,privacy ,protection   
,act ( #aiih 7#ae ,u4,s4,c4 #feje7;d77  
is am5d$--  7#a7 9 ! fir/ s5t5ce1 by    
/rik+ ?is title4 ,any entity & ins]t+   
?is title1 & any entity2  7#b7 by /rik+ 
,! ,commission %all prev5t & ins]t+ !   
foll[+3  7#a7 ,9 g5]al ,except z provid$
 9 p>agraphs 7#b7 ?r\gh 7#d71 !         
,commission %all prev5t  2 &  7#c7 by   
add+ at ! end ! foll[+3  7#b7 ,increas$ 
civil p5alty am\nt ,9 ! case ( a civil  
p5alty "u subsection 7l7 or 7m7 (       
section #e ( ! ,f$]al ,trade ,commission
 ,act 7#ae ,u4,s4,c4 #de7 relat+ to acts
 or practices 9 violation ( any         
provision ( ?is title or a regulation   
prescrib$ "u ?is title1 ! maximum doll> 
am\nt p] violation %all be #fc1gie4     
7#c7 ,nature ( relief available ,9 any  
action comm5c$ by ! ,commission "u      
section #ai7;a7 ( ! ,f$]al ,trade       
,commission ,act 7#ae ,u4,s4,c4         
#eg;a7a77 to en=ce ?is title1 !         
,commission %all seek all appropriate   
relief describ$ 9 subsection 7b7 ( su*  

section1 & may1 not)/&+ su* subsection1 
seek any exempl>y or punitive damages4  
4  7b7 ,en=cem5t by c]ta9 o!r ag5cies   
,section #acjf ( ! ,*ildr5's ,onl9e     
,privacy ,protection ,act ( #aiih 7#ae  
,u4,s4,c4 #feje7 is fur!r am5d$--  7#a7 
9 subsection 7b7-- 7,a7 9 p>agraph 7#a71
 by /rik+ 1 9 ! case ( & all t foll[s & 
ins]t+ ! foll[+3 by ! appropriate ,f$]al
 bank+ ag5cy1 ) respect to any insur$   
depository in/itution 7z ^? t]ms are    
def9$ 9 section #c ( t ,act 7#ab        
,u4,s4,c4 #ahac7722  7,b7 9 p>agraph    
7#f71 by /rik+ ,f$]al l& bank1 ,f$]al l&
 bank association1 ,f$]al int]m$iate    
cr$it bank1 or production cr$it         
association & ins]t+ ,f>m ,cr$it ,bank1 
,agricultural ,cr$it ,bank 7to ! ext5t  
ex]cis+ ! au?orities ( a ,f>m ,cr$it    
,bank71 ,f$]al ,l& ,cr$it ,association1 
or agricultural cr$it association2 &    
7,c7 by /rik+ p>agraph 7#b7 & r$esignat+
 p>agraphs 7#c7 ?r\gh 7#f7 z p>agraphs  
7#b7 ?r\gh 7#e71 respectively2 &  7#b7 9
 subsection 7c71 by /rik+ subsection 7a7

 ea* place x appe>s & ins]t+ subsection 
7b74  #f4 ,review ,section #acjg ( !    
,*ildr5's ,onl9e ,privacy ,protection   
,act ( #aiih 7#ae ,u4,s4,c4 #fejf7 is   
am5d$--  7#a7 9 ! matt] prec$+ p>agraph 
7#a71 by /rik+ ! regulations initially  
issu$ "u section #acjc & ins]t+ !       
regulations issu$ "u section #acjc = !  
initial implem5tation ( ! am5dm5ts made 
by ! ,protect+ ! ,in=mation ( our       
,vuln]able ,*ildr5 & ,y\? ,act2 &  7#b7 
by am5d+ p>agraph 7#a7 to read z foll[s3
  7#a7 review ! implem5tation ( ?is     
title1 includ+ ! effect ( !             
implem5tation ( ?is title on practices  
relat+ to ! process+ ( cov]$ in=mation  
ab\t "y consum]s or *ildr5 & "y         
consum]'s & *ildr5's ability to obta9   
access to in=mation ( _! *oice onl9e2 & 
4  #g4 ,private "r ( action ,! ,*ildr5's
 ,onl9e ,privacy ,protection ,act (     
#aiih 7#ae ,u4,s4,c4 #feja et seq47 is  
am5d$-- 7#a7 by r$esignat+ sections     
#acjg & #acjh z sections #acjh & #acji1 
respectively2 &  7#b7 by ins]t+ aft]    

section #acjf ! foll[+3  #acjg4 ,private
 "r ( action  7a7 ,"r ( action ,any p>5t
 ( a "y consum] or p>5t ( a *ild alleg+ 
a violation ( ?is title or a regulation 
prescrib$ "u ?is title ) respect to !   
cov]$ in=mation ( su* "y consum] or *ild
 may br+ a civil action 9 any c\rt (    
compet5t jurisdiction4  7b7 ,injury 9   
fact ,a violation ( ?is ,act or a       
regulation promulgat$ "u ?is ,act )     
respect to ! cov]$ in=mation ( a "y     
consum] or *ild con/itutes an injury 9  
fact to t "y consum] or *ild4  7c7      
,relief ,9 a civil action br\ght "u     
subsection 7a7 9 :i* ! pla9tiff         
prevails1 ! c\rt may aw>d--  7#a7       
injunctive relief2  7#b7 actual damages2
  7#c7 punitive damages2  7#d7          
reasonable attorney's fees & co/s2 &    
7#e7 any o!r relief t ! c\rt det]m9es   
appropriate4  7d7 ,pre-,dispute         
arbitration agreem5ts  7#a7 ,9 g5]al ,no
 pre-dispute arbitration agreem5t or    
pre-dispute jo9t-action waiv] %all be   
valid or en=ceable ) respect to any     

claim aris+ out ( ?is ,act or !         
regulations issu$ "u ?is ,act4  7#b7    
,det]m9ation ,a det]m9ation z to :e!r & 
h[ ?is ,act applies to an arbitration   
agreem5t %all be det]m9$ "u ,f$]al law  
by ! c\rt1 r ?an ! arbitrator1          
irrespective ( :e!r ! p>ty oppos+       
arbitration *all5ges su* agreem5t       
specifically or 9 conjunction ) any o!r 
t]m ( ! contract conta9+ su* agreem5t4  
7#c7 ,def9itions ,z us$ 9 ?is           
subsection-- 7,a7 ! t]m pre-dispute     
arbitration agreem5t means any agreem5t 
to arbitrate a dispute t has n aris5 at 
! "t ( ! mak+ ( ! agreem5t2 &  7,b7 !   
t]m pre-dispute jo9t-action waiv] means 
an agreem5t1 :e!r or n "p ( a           
pre-dispute arbitration agreem5t1 t w\ld
 prohibit1 or waive ! "r (1 "o ( !      
p>ties to ! agreem5t to p>ticipate 9 a  
jo9t1 class1 or collective action 9 a   
judicial1 arbitral1 adm9i/rative1 or o!r
 =um1 conc]n+ a dispute t has n yet     
aris5 at ! "t ( ! mak+ ( ! agreem5t4    
7e7 ,non-,waiveability ,! rights &      

rem$ies provid$ "u ?is ,act may n be    
waiv$ or limit$ by contract or o!rwise4 
4  #h4 ,relation%ip to o!r law ,section 
#acjf ( ! ,*ildr5's ,onl9e ,privacy     
,protection ,act ( #aiih 7#ae ,u4,s4,c4 
#feje7 is fur!r am5d$ by add+ at ! end !
 foll[+3  7f7 ,relation%ip to o!r law   
,no?+ 9 ?is ,act may be con/ru$ to      
modify1 limit1 or sup]s$e ! op]ation (  
any privacy or security provision 9 any 
o!r ,f$]al /atute or regulation4  4  #i4
 ,additional con=m+ am5dm5t ,! head+ (  
title ,,xiii ( division ,c ( ! ,omnibus 
,consolidat$ & ,em]g5cy ,supplem5tal    
,appropriations ,act1 #aiii 7,public    
,law #aje-bgg2 #aab ,/at4 #bfha-gbh7 is 
am5d$ by ins]t+ & ,"y ,consum]'s aft]   
,*ildr5's4