,,ii #aafth ,,congress #ast ,session ,s4 #gdh ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,march #ab1 #bjai,mr4 ,markey 7for himself and ,mr4 ,hawley7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to amend the ,children's ,online ,privacy ,protection ,act of #aiih to strengthen protections relating to the online collection1 use1 and disclosure of personal information of children and minors1 and for other purposes4 #a4 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,table of contents4 ,sec4 #b4 ,definitions4 ,sec4 #c4 ,online collection1 use1 and disclosure of personal information of children and minors4 ,sec4 #d4 ,fair ,information ,practices ,principles4 ,sec4 #e4 ,digital ,marketing ,bill of ,rights for ,minors4 ,sec4 #f4 ,targeted marketing to children or minors4 ,sec4 #g4 ,removal of content4 ,sec4 #h4 ,privacy dashboard for connected devices for children and minors4 ,sec4 #i4 ,prohibition on sale of connected devices for children and minors that fail to meet appropriate cybersecurity and data security standards4 ,sec4 #aj4 ,rule for treatment of users of websites1 services1 and applications directed to children or minors4 ,sec4 #aa4 ,study of mobile and online application oversight4 ,sec4 #ab4 ,youth ,privacy and ,marketing ,division4 ,sec4 #ac4 ,enforcement and applicability4 #b4 ,definitions 7a7 ,in general ,in this ,act3 7#a7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#b7 ,standards ,the term standards means benchmarks1 guidelines1 best practices1 methodologies1 procedures1 and processes4 7b7 ,other definitions ,the definitions set forth in section #acjb of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja71 as amended by section #c7;a7 of this ,act1 shall apply in this ,act1 except to the extent the ,commission provides otherwise by regulations issued under section #eec of title #e1 ,united ,states ,code4 #c4 ,online collection1 use1 and disclosure of personal information of children and minors 7a7 ,definitions ,section #acjb of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja7 is amended-- 7#a7 by amending paragraph 7#b7 to read as follows3 7#b7 ,operator ,the term operator-- 7,a7 means any person-- 7i7 who1 for commercial purposes1 in interstate or foreign commerce operates or provides a website on the internet1 an online service1 an online application1 or a mobile application2 and 7ii7 who-- 7,i7 collects or maintains1 either directly or through a service provider1 personal information from or about the users of that website1 service1 application1 or connected device2 7,,ii7 allows another person to collect personal information directly from users of that website1 service1 application1 or connected device 7in which case1 the operator is deemed to have collected the information72 or 7,,iii7 allows users of that website1 service1 application1 or connected device to publicly disclose personal information 7in which case1 the operator is deemed to have collected the information72 and 7,b7 does not include any nonprofit entity that would otherwise be exempt from coverage under section #e of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de74 2 7#b7 in paragraph 7#d7-- 7,a7 by amending subparagraph 7,a7 to read as follows3 7,a7 the release of personal information collected from a child or minor for any purpose1 except where the personal information is provided to a person other than an operator who-- 7i7 provides support for the internal operations of the website1 online service1 online application1 or mobile application of the operator1 excluding any activity relating to targeted marketing directed to children1 minors1 or connected devices2 and 7ii7 does not disclose or use that personal information for any other purpose2 and 2 and 7,b7 in subparagraph 7,b7-- 7i7 by inserting or minor after child each place the term appears2 7ii7 by inserting or minors after children2 and 7iii7 by striking website or online service and inserting website1 online service1 online application1 or mobile application2 7#c7 in paragraph 7#h71 by striking subparagraphs 7,f7 and 7,g7 and inserting the following3 7,f7 geolocation information2 7,g7 information used for biometric identification1 as defined in section #gjabc of title #df1 ,united ,states ,code1 of an individual2 7,h7 information reasonably associated with or attributed to an individual2 7,i7 information 7including an internet protocol address7 that permits the identification of-- 7i7 an individual2 or 7ii7 any device used by an individual to directly or indirectly access the internet or an online service1 online application1 or mobile application2 or 7,j7 information concerning a child or minor or the parents of that child or minor 7including any unique or substantially unique identifier1 such as a customer number7 that an operator collects online from the child or minor and combines with an identifier described in this paragraph4 2 7#d7 by amending paragraph 7#i7 to read as follows3 7#i7 ,verifiable consent ,the term verifiable consent means any reasonable effort 7taking into consideration available technology71 including a request for authorization for future collection1 use1 and disclosure described in the notice1 to ensure that1 in the case of a child1 a parent of the child1 or1 in the case of a minor1 the minor-- 7,a7 receives specific notice of the personal information collection1 use1 and disclosure practices of the operator2 and 7,b7 before the personal information of the child or minor is collected1 freely and unambiguously authorizes-- 7i7 the collection1 use1 and disclosure1 as applicable1 of that personal information2 and 7ii7 any subsequent use of that personal information4 2 7#e7 by striking paragraph 7#aj7 and redesignating paragraphs 7#aa7 and 7#ab7 as paragraphs 7#aj7 and 7#aa71 respectively2 and 7#f7 by adding at the end the following3 7#ab7 ,connected device ,the term connected device means a device that is capable of connecting to the internet1 directly or indirectly1 or to another connected device4 7#ac7 ,online ,the term online means-- 7,a7 connected to or compatible with the internet2 or 7,b7 via the internet4 7#ad7 ,online application ,the term online application-- 7,a7 means an internet-connected software program2 and 7,b7 includes a service or application offered via a connected device4 7#ae7 ,online service ,the term online service-- 7,a7 means broadband internet access service1 as defined in the ,report and ,order on ,remand1 ,declaratory ,ruling1 and ,order in the matter of protecting and promoting the open internet1 adopted by the ,federal ,communications ,commission on ,february #bf1 #bjae 7,,fcc #ae-bd72 and 7,b7 includes a service or application offered via a connected device4 7#af7 ,directed to a child or minor 7,a7 ,in general ,the terms directed to a child or directed to a minor means1 with respect to a website1 online service1 online application1 or mobile application1 the website1 online service1 online application1 or mobile application is targeted to children or minors1 as the case may be1 as demonstrated by-- 7i7 the subject matter of the website1 online service1 online application1 or mobile application2 7ii7 the visual content of the website1 online service1 online application1 or mobile application2 7iii7 the use of animated characters or child-oriented activities for children1 or the use of minor-oriented characters or minor-oriented activities for minors1 and related incentives on the website1 online service1 online application1 or mobile application2 7iv7 the music or other audio content on the website1 online service1 online application1 or mobile application2 7v7 the age of models on the website1 online service1 online application1 or mobile application2 7vi7 the presence1 on the website1 online service1 online application1 or mobile application1 of-- 7,i7 child celebrities2 7,,ii7 celebrities who appeal to children2 7,,iii7 teen celebrities2 or 7,,iv7 celebrities who appeal to minors2 7vii7 the language used on the website1 online service1 online application1 or mobile application2 7viii7 advertising content used on1 or used to advertise1 the website1 online service1 online application1 or mobile application2 or 7ix7 reliable empirical evidence relating to-- 7,i7 the composition of the audience of the website1 online service1 online application1 or mobile application2 and 7,,ii7 the intended audience of the website1 online service1 online application1 or mobile application4 7,b7 ,rules of construction 7i7 ,services deemed directed to children or minors ,for the purposes of this title1 a website1 online service1 online application1 or mobile application shall be deemed to be directed to children or minors if the operator of the website1 online service1 online application1 or mobile application has actual knowledge that the website1 online service1 online application1 or mobile application collects personal information directly from users of any other website1 online service1 online application1 or mobile application that is directed to children or minors under the criteria described in subparagraph 7,a74 7ii7 ,services deemed directed to mixed audiences 7,i7 ,in general ,a website1 online service1 online application1 or mobile application that is directed to children or minors under the criteria described in subparagraph 7,a71 but that does not target children or minors as the primary audience of the website1 online service1 online application1 or mobile application1 shall not be deemed to be directed to children or minors for purposes of this title if the website1 online service1 online application1 or mobile application-- 7aa7 does not collect personal information from any user of the website1 online service1 online application1 or mobile application before verifying age information of the user2 and 7bb7 does not1 without first complying with any relevant notice and consent provision under this title1 collect1 use1 or disclose personal information of any user who identifies themselves to the website1 online service1 online application1 or mobile application as an individual who is under the age of #af4 7,,ii7 ,use of certain tools ,for purposes of this title1 a website1 online service1 online application1 or mobile application1 shall not be deemed directed to children or minors solely because the website1 online service1 online application1 or mobile application refers or links to any other website1 online service1 online application1 or mobile application directed to children or minors by using information location tools1 including-- 7aa7 a directory2 7bb7 an index2 7cc7 a reference2 7dd7 a pointer2 or 7ee7 a hypertext link4 7#ag7 ,mobile application ,the term mobile application-- 7,a7 means a software program that runs on the operating system of-- 7i7 a cellular telephone2 7ii7 a tablet computer2 or 7iii7 a similar portable computing device that transmits data over a wireless connection2 and 7,b7 includes a service or application offered via a connected device4 7#ah7 ,geolocation information ,the term geolocation information means information sufficient to identify a street name and name of a city or town4 7#ai7 ,minor ,the term minor means an individual over the age of #ab and under the age of #af4 7#bj7 ,targeted marketing ,the term targeted marketing means advertising or any other effort to market a product or service that is directed to a specific individual or device-- 7,a7 based on-- 7i7 the personal information of-- 7,i7 the individual2 or 7,,ii7 a group of individuals who are similar in gender1 age1 income level1 race1 or ethnicity to the specific individual to whom the product or service is marketed2 7ii7 psychological profiling2 or 7iii7 a unique identifier of the device2 and 7,b7 as a result of use by the individual1 access by any device of the individual1 or use by a group of individuals who are similar to the specific individual1 of-- 7i7 a website2 7ii7 an online service2 7iii7 an online application2 7iv7 a mobile application2 or 7v7 an operating system4 4 7b7 ,online collection1 use1 and disclosure of personal information of children and minors ,section #acjc of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #fejb7 is amended-- 7#a7 by striking the heading and inserting the following3 ,online collection1 use1 and disclosure of personal information of children and minors42 7#b7 in subsection 7a7-- 7,a7 by amending paragraph 7#a7 to read as follows3 7#a7 ,in general ,it is unlawful for an operator of a website1 online service1 online application1 or mobile application directed to a child or minor1 or an operator having constructive knowledge that personal information being collected is from a child or minor1 to collect personal information from a child or minor in a manner that violates the regulations prescribed under subsection 7b74 2 and 7,b7 in paragraph 7#b7-- 7i7 by striking of such a website or online service2 and 7ii7 by striking subsection 7b77#a77;,b77iii7 to the parent of a child and inserting subsection 7b77#a77;,a77iii7 to the parent of a child or under subsection 7b77#a77;,a77iv7 to a minor2 and 7#c7 in subsection 7b7-- 7,a7 by amending paragraph 7#a7 to read as follows3 7#a7 ,regulations 7,a7 ,in general ,not later than #a year after the date of the enactment of the ,act entitled ,an ,act to amend the ,children's ,online ,privacy ,protection ,act of #aiih to strengthen protections relating to the online collection1 use1 and disclosure of personal information of children and minors1 and for other purposes1 the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations to require an operator of a website1 online service1 online application1 or mobile application directed to children or minors1 or an operator having constructive knowledge that personal information being collected is from a child or minor-- 7i7 to provide clear and conspicuous notice in clear and plain language of-- 7,i7 the types of personal information the operator collects2 7,,ii7 how the operator uses the information2 7,,iii7 whether and why the operator discloses the information2 and 7,,iv7 the procedures or mechanisms the operator uses to ensure that personal information is not collected from children or minors except in accordance with the regulations promulgated under this paragraph2 7ii7 to obtain verifiable consent for the collection1 use1 or disclosure of personal information of a child or minor2 7iii7 to provide to a parent whose child has provided personal information to the operator1 upon request by and proper identification of the parent-- 7,i7 a description of the specific types of personal information collected from the child by the operator2 7,,ii7 the opportunity at any time to delete personal information collected from the child2 and 7,,iii7 a means that is reasonable under the circumstances for the parent to obtain any personal information collected from the child1 if such information is available to the operator at the time the parent makes the request2 7iv7 to provide to a minor who has provided personal information to the operator1 upon request by and proper identification of the minor-- 7,i7 a description of the specific types of personal information collected from the minor by the operator2 7,,ii7 the opportunity at any time to delete personal information collected from the minor2 and 7,,iii7 a means that is reasonable under the circumstances for the minor to obtain any personal information collected from the minor1 if such information is available to the operator at the time the minor makes the request2 7v7 not to condition participation in a game1 or use of a website1 service1 or application1 by a child or minor on the provision by the child or minor of more personal information than is reasonably required to participate in the game or use the website1 service1 or application2 and 7vi7 to establish and maintain reasonable procedures to protect the confidentiality1 security1 and integrity of personal information collected from children and minors4 7,b7 ,updates ,not less frequently than once every #d years after the date on which regulations are promulgated under subparagraph 7,a71 the ,commission shall update those regulations as necessary4 2 7,b7 in paragraph 7#b7-- 7i7 in the matter preceding subparagraph 7,a71 by striking verifiable parental consent and inserting verifiable consent2 7ii7 in subparagraph 7,a7-- 7,i7 by inserting or minor after collected from a child2 7,,ii7 by inserting or minor after request from the child2 and 7,,iii7 by inserting or minor or to contact a different child or minor after to recontact the child2 7iii7 in subparagraph 7,b7-- 7,i7 by striking parent or child and inserting parent1 child1 or minor2 and 7,,ii7 by striking parental consent each place the term appears and inserting verifiable consent2 7iv7 in subparagraph 7,c7-- 7,i7 in the matter preceding clause 7i71 by inserting or minor after child each place the term appears2 7,,ii7 in clause 7i7-- 7aa7 by inserting or minor after child each place the term appears2 and 7bb7 by inserting or minor1 as applicable1 after parent each place the term appears2 and 7,,iii7 in clause 7ii7-- 7aa7 by inserting or minor1 as applicable1 after parent2 and 7bb7 by inserting or minor after child each place the term appears2 and 7v7 in subparagraph 7,d7-- 7,i7 in the matter preceding clause 7i71 by inserting or minor after child each place the term appears2 7,,ii7 in clause 7ii71 by inserting or minor after child2 and 7,,iii7 in the flush text following clause 7iii7-- 7aa7 by inserting or minor1 as applicable1 after parent each place the term appears2 and 7bb7 by inserting or minor after child2 and 7,c7 by amending paragraph 7#c7 to read as follows3 7#c7 ,continuation of service ,the regulations shall prohibit an operator from discontinuing service provided to a child or minor on the basis of a request by the parent of the child or by the minor1 under the regulations prescribed under clauses 7iii77,,ii7 and 7iv77,,ii71 respectively1 of paragraph 7#a77;,a7 to delete personal information collected from the child or minor1 to the extent that the operator is capable of providing such service without such information4 4 7c7 ,safe harbors ,section #acjd of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #fejc7 is amended-- 7#a7 in subsection 7b77#a71 by inserting and minors after children2 and 7#b7 by adding at the end the following3 7d7 ,publication ,the ,commission shall publish on the internet website of the ,commission any report or documentation required by regulation to be submitted to the ,commission to carry out this section1 except to the extent that the report or documentation contains proprietary information1 which the ,commission may in its discretion redact4 4 7d7 ,administration and applicability of ,act ,section #acjf of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feje7 is amended-- 7#a7 in subsection 7b7-- 7,a7 in paragraph 7#a71 by striking 1 in the case of and all that follows and inserting the following3 by the appropriate ,federal banking agency1 with respect to any insured depository institution 7as those terms are defined in section #c of that ,act 7#ab ,u4,s4,c4 #ahac7722 and 7,b7 by striking paragraph 7#b7 and redesignating paragraphs 7#c7 through 7#f7 as paragraphs 7#b7 through 7#e71 respectively2 and 7#b7 by adding at the end the following new subsection3 7f7 ,telecommunications carriers and cable operators 7#a7 ,enforcement by commission ,notwithstanding section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b771 compliance with the requirements imposed under this title shall be enforced by the ,commission with respect to any telecommunications carrier 7as defined in section #c of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aec774 7#b7 ,relationship to other law ,to the extent that section #bbb1 #cch7;i71 or #fca of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbb2 #cch7;i72 #eea7 is inconsistent with this title1 this title controls4 4 #d4 ,fair ,information ,practices ,principles ,the ,fair ,information ,practices ,principles described in this section are the following3 7#a7 ,collection limitation principle ,except as provided in paragraph 7#c71 personal information should be collected from a child or minor only when collection of the personal information is-- 7,a7 consistent with the context of a particular transaction or service or the relationship of the child or minor with the operator1 including collection necessary to fulfill a transaction or provide a service requested by the child or minor2 or 7,b7 required or specifically authorized by law4 7#b7 ,data quality principle ,the personal information of a child or minor should be accurate1 complete1 and kept up-to-date to the extent necessary to fulfill the purposes described in subparagraphs 7,a7 through 7,d7 of paragraph 7#c74 7#c7 ,purpose specification principle ,the purposes for which personal information is collected should be specified to the parent of a child or to a minor not later than at the time of the collection of the information4 ,the subsequent use or disclosure of the information should be limited to-- 7,a7 fulfillment of the transaction or service requested by the child or minor2 7,b7 support for the internal operations of the website1 service1 or application1 as described in section #cab4b of title #af1 ,code of ,federal ,regulations1 excluding any activity relating to targeted marketing directed to children1 minors1 or a device of a child or minor2 7,c7 compliance with legal process or other purposes expressly authorized under specific legal authority2 or 7,d7 other purposes-- 7i7 that are specified in a notice to the child or minor2 and 7ii7 to which the child or minor has consented under paragraph 7#g7 before the information is used or disclosed for such other purposes4 7#d7 ,retention limitation principle 7,a7 ,in general ,the personal information of a child or minor should not be retained for longer than is necessary to fulfill a transaction or provide a service requested by the child or minor or such other purposes specified in subparagraphs 7,a7 through 7,d7 of paragraph 7#c74 7,b7 ,data disposal ,the operator should implement a reasonable and appropriate data disposal policy based on the nature and sensitivity of personal information described in subparagraph 7,a74 7#e7 ,security safeguards principle ,the personal information of a child or minor should be protected by reasonable and appropriate security safeguards against risks such as loss or unauthorized access1 destruction1 use1 modification1 or disclosure4 7#f7 ,openness principle 7,a7 ,general principle ,the operator should maintain a general policy of openness about developments1 practices1 and policies with respect to the personal information of a child or minor4 7,b7 ,provision of information ,the operator should provide to each parent of a child1 or to each minor1 using the website1 online service1 online application1 or mobile application of the operator with a clear and prominent means-- 7i7 to identify and contact the operator1 by1 at a minimum1 disclosing1 clearly and prominently1 the identity of the operator and-- 7,i7 in the case of an operator who is an individual1 the address of the principal residence of the operator and an email address and telephone number for the operator2 or 7,,ii7 in the case of any other operator1 the address of the principal place of business of the operator and an email address and telephone number for the operator2 7ii7 to determine whether the operator possesses any personal information of the child or minor1 the nature of any such information1 and the purposes for which the information was collected and is being retained2 7iii7 to obtain any personal information of the child or minor that is in the possession of the operator from the operator1 or from a person specified by the operator1 within a reasonable time after making a request1 at a charge 7if any7 that is not excessive1 in a reasonable manner1 and in a form that is readily intelligible to the child or minor2 7iv7 to challenge the accuracy of personal information of the child or minor that is in the possession of the operator2 7v7 to determine if the child or minor has established the inaccuracy of personal information in a challenge under clause 7iv7 in order to have such information erased1 corrected1 completed1 or otherwise amended2 and 7vi7 to determine the method by which the operator obtains data relevant to the child or minor4 7,c7 ,limitation ,nothing in this paragraph shall be construed to permit an operator to erase or otherwise modify personal information requested by a law enforcement agency pursuant to legal authority4 7#g7 ,individual participation principle ,the operator should-- 7,a7 obtain consent from a parent of a child or from a minor before using or disclosing the personal information of the child or minor for any purpose other than the purposes described in subparagraphs 7,a7 through 7,c7 of paragraph 7#c72 and 7,b7 obtain affirmative express consent from a parent of a child or from a minor before using or disclosing previously collected personal information of the child or minor for purposes that constitute a material change in practice from the original purposes specified to the child or minor under paragraph 7#c74 7#h7 ,racial and socioeconomic profiling ,the personal information of a child or minor shall not be used to direct content to the child or minor1 or a group of individuals similar to the child or minor1 on the basis of race1 socioeconomic factors1 or any proxy thereof4 #e4 ,digital ,marketing ,bill of ,rights for ,minors 7a7 ,acts prohibited 7#a7 ,prohibition 7,a7 ,in general ,except as provided in subparagraph 7,b71 it shall be unlawful for an operator of a website1 online service1 online application1 or mobile application to collect personal information from a minor if-- 7i7 7,i7 the minor is a user of the website1 online service1 online application1 or mobile application2 and 7,,ii7 the operator has constructive knowledge that the minor is a minor2 or 7ii7 the website1 online service1 online application1 or mobile application is directed to minors4 7,b7 ,exception ,subparagraph 7,a7 shall not apply to an operator that has adopted and complies with a ,digital ,marketing ,bill of ,rights for ,minors that is consistent with the ,fair ,information ,practices ,principles described in section #d4 7#b7 ,effective date ,this subsection shall take effect on the date that is #ahj days after the promulgation of regulations under subsection 7b74 7b7 ,regulations 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations to implement this section1 including regulations further defining the ,fair ,information ,practices ,principles described in section #d4 7#b7 ,updates ,not less frequently than once every #d years after the date on which regulations are promulgated under paragraph 7#a71 the ,commission shall update those regulations as necessary4 #f4 ,targeted marketing to children or minors 7a7 ,acts prohibited 7#a7 ,children ,it shall be unlawful for an operator of a website1 online service1 online application1 or mobile application to use1 disclose to third parties1 or compile personal information of a child for purposes of targeted marketing if-- 7,a7 7i7 the child is a user of the website1 online service1 online application1 or mobile application2 and 7ii7 the operator has constructive knowledge that the child is a child2 or 7,b7 the website1 online service1 online application1 or mobile application is directed to a child4 7#b7 ,minors 7,a7 ,prohibition ,except as provided in subparagraph 7,b71 it shall be unlawful for an operator of a website1 online service1 online application1 or mobile application to use1 disclose to third parties1 or compile personal information of a minor for purposes of targeted marketing if-- 7i7 7,i7 the minor is a user of the website1 online service1 online application1 or mobile application2 and 7,,ii7 the operator has constructive knowledge that the minor is a minor2 or 7ii7 the website1 online service1 online application1 or mobile application is directed to a minor4 7,b7 ,exception ,subparagraph 7,a7 shall not apply to an operator that has obtained the verifiable consent of the relevant minor4 7#c7 ,effective date ,this subsection shall take effect on the date that is #ahj days after the promulgation of regulations under subsection 7b74 7b7 ,regulations 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations to implement this section4 7#b7 ,updates ,not less frequently than once every #d years after the date on which regulations are promulgated under paragraph 7#a71 the ,commission shall update those regulations as necessary4 #g4 ,removal of content 7a7 ,acts prohibited ,it is unlawful for an operator to make publicly available through a website1 online service1 online application1 or mobile application content or information that contains or displays personal information of children or minors in a manner that violates subsection 7b74 7b7 ,requirement 7#a7 ,in general ,an operator1 to the extent technologically feasible1 shall-- 7,a7 implement mechanisms that permit a user of the website1 online service1 online application1 or mobile application of the operator to erase or otherwise eliminate content or information that is-- 7i7 submitted to the website1 online service1 online application1 or mobile application by that user2 7ii7 publicly available through the website1 online service1 online application1 or mobile application2 and 7iii7 contains or displays personal information of children or minors2 and 7,b7 take appropriate steps to-- 7i7 make users aware of the mechanisms described in subparagraph 7,a72 and 7ii7 provide notice to users that the mechanisms described in subparagraph 7,a7 do not necessarily provide comprehensive removal of the content or information submitted by users4 7#b7 ,exceptions ,paragraph 7#a7 shall not be construed to require an operator or third party to erase or otherwise eliminate content or information that-- 7,a7 any other provision of ,federal or ,state law requires the operator or third party to maintain2 or 7,b7 was submitted to the website1 online service1 online application1 or mobile application of the operator by any person other than the user who is attempting to erase or otherwise eliminate the content or information1 including content or information submitted by the user that was republished or resubmitted by another person4 7c7 ,limitation ,nothing in this section shall be construed to limit the authority of a law enforcement agency to obtain any content or information from an operator as authorized by law or pursuant to an order of a court of competent jurisdiction4 7d7 ,effective date ,this section shall take effect on the date that is #ahj days after the date of enactment of this ,act4 #h4 ,privacy dashboard for connected devices for children and minors 7a7 ,in general ,a manufacturer of a connected device directed to a child or minor shall prominently display on the packaging for the connected device a standardized and easy-to-understand privacy dashboard1 detailing whether1 what1 and how personal information of a child or minor is-- 7#a7 collected from the connected device2 7#b7 transmitted from the connected device2 7#c7 retained on the connected device2 7#d7 retained by the manufacturer or affiliated person2 7#e7 used by the manufacturer or affiliated person2 and 7#f7 protected4 7b7 ,features ,a privacy dashboard under subsection 7a7 shall inform a consumer of-- 7#a7 the extent to which the connected device meets the highest cybersecurity and data security standards1 including if and how to obtain security patches2 7#b7 the extent to which the connected device gives-- 7,a7 a parent meaningful control over the information of a child of the parent2 and 7,b7 a minor meaningful control over the information of the minor2 7#c7 the extent to which the device minimizes the collection1 retention1 and use of information from a child or minor2 7#d7 the location of privacy policies2 7#e7 the type of personal information the connected device may collect2 7#f7 the minimum length of time during which a connected device will received security patches and software updates2 7#g7 whether the connected device can be used without being connected to the internet2 and 7#h7 any other information as the ,commission considers appropriate4 7c7 ,regulations 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 regulations to implement this section4 7#b7 ,updates ,not less frequently than once every #d years after the date on which regulations are promulgated under paragraph 7#a71 the ,commission shall update those regulations as necessary4 7d7 ,effective date ,subsections 7a7 and 7b7 shall take effect on the date that is #ahj days after the promulgation of regulations under subsection 7c74 #i4 ,prohibition on sale of connected devices for children and minors that fail to meet appropriate cybersecurity and data security standards 7a7 ,prohibition ,beginning #a year after the date of enactment of this ,act1 no person may sell a connected device unless the connected device meets appropriate cybersecurity and data security standards established by the ,commission4 7b7 ,cybersecurity and data security standards 7#a7 ,in general ,the ,commission shall promulgate1 under section #eec of title #e1 ,united ,states ,code1 cybersecurity and data security standards described in subsection 7a74 7#b7 ,considerations ,in promulgating cybersecurity and data security standards under paragraph 7#a71 the ,commission shall-- 7,a7 create cybersecurity and data security standards for different subsets of connected devices based on the varying degrees of-- 7i7 cybersecurity and data security risk associated with each subset of connected device2 7ii7 sensitivity of information collected1 stored1 or transmitted by each subset of connected device2 and 7iii7 functionality of each subset of connected device2 7,b7 consider incorporating1 to the extent practicable1 existing cybersecurity and data security standards2 and 7,c7 ensure that the cybersecurity and data security standards-- 7i7 are consistent with ,fair ,information ,practice ,principles described in section #d2 and 7ii7 promote data minimization4 #aj4 ,rule for treatment of users of websites1 services1 and applications directed to children or minors ,for the purposes of this ,act1 an operator of a website1 online service1 online application1 or mobile application that is directed to children or minors shall treat each user of that website1 online service1 online application1 or mobile application as a child or minor1 except as permitted by the ,commission pursuant to a regulation promulgated under this ,act4 #aa4 ,study of mobile and online application oversight ,not later than #b years after the date of enactment of this ,act1 the ,commission shall submit to each committee of the ,senate and each committee of the ,house of ,representatives that has jurisdiction over the ,commission a report on the processes of platforms that offer mobile and online applications for ensuring that1 of those applications that are directed to children or minors1 the applications operate in accordance with-- 7#a7 this ,act1 the amendments made by this ,act1 and rules promulgated under this ,act2 7#b7 rules promulgated by the ,commission under section #e of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 relating to unfair or deceptive acts or practices in marketing2 and 7#c7 any other ,federal or ,state law relating to the privacy of children or minors4 #ab4 ,youth ,privacy and ,marketing ,division 7a7 ,establishment ,there is established within the ,commission a division to be known as the ,youth ,privacy and ,marketing ,division4 7b7 ,director ,the ,youth ,privacy and ,marketing ,division shall be headed by a ,director1 who shall be appointed by the ,chairman of the ,commission4 7c7 ,duties ,the ,youth ,privacy and ,marketing ,division established under subsection 7a7 shall be responsible for addressing1 as it relates to this ,act and the amendments made by this ,act-- 7#a7 the privacy of children and minors2 and 7#b7 marketing directed at children and minors4 7d7 ,staff ,the ,director of the ,youth ,privacy and ,marketing ,division shall hire adequate staff to carry out the duties under subsection 7c71 including individuals who are experts in data protection1 digital advertising1 data analytics1 and youth development4 7e7 ,reports ,not later than #a year after the date of enactment of this ,act1 and each year thereafter1 the ,director of the ,youth and ,privacy ,marketing ,division shall submit to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives a report that includes-- 7#a7 a description of the work of the ,youth ,privacy and ,marketing ,division on emerging concerns relating to youth privacy and marketing practices2 and 7#b7 an assessment of how effectively the ,commission has1 during the period for which the report is submitted1 addressed youth privacy and marketing practices4 #ac4 ,enforcement and applicability 7a7 ,enforcement by the ,commission 7#a7 ,in general ,except as otherwise provided1 this ,act and the regulations prescribed under this ,act shall be enforced by the ,commission under the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7#b7 ,unfair or deceptive acts or practices ,subject to subsection 7b71 a violation of this ,act or a regulation prescribed under this ,act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 7#c7 ,actions by the ,commission 7,a7 ,in general ,subject to subsection 7b71 and except as provided in subsection 7d77#a71 the ,commission shall prevent any person from violating this ,act or a regulation prescribed under this ,act in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this ,act1 and any person who violates this ,act or such regulation shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act4 7,b7 ,violations 7i7 ,in general ,in an action brought by the ,commission to enforce this ,act and the regulations prescribed under this ,act1 each connected device that fails to meet a standard promulgated under this ,act shall be treated as a separate violation4 7ii7 ,civil penalty ,notwithstanding section #e7m7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7m771 a civil penalty recovered for a violation of this ,act or a regulation prescribed under this ,act may be in excess of the amounts provided for in that section as the court finds appropriate to deter violations of this ,act and regulations prescribed under this ,act4 7iii7 ,first violations ,in an action brought by the ,commission to enforce this ,act and the regulations prescribed under this ,act1 the ,commission may seek a civil penalty for any violation of this ,act or regulation prescribed under this ,act1 including any violation that is the first violation of this ,act or a regulation prescribed under this ,act that a person against whom the action is brought has committed4 7b7 ,enforcement by certain other agencies ,notwithstanding subsection 7a71 compliance with the requirements imposed under this ,act shall be enforced as follows3 7#a7 ,under section #h of the ,federal ,deposit ,insurance ,act 7#ab ,u4,s4,c4 #ahah7 by the appropriate ,federal banking agency1 with respect to an insured depository institution 7as such terms are defined in section #c of such ,act 7#ab ,u4,s4,c4 #ahac774 7#b7 ,under the ,federal ,credit ,union ,act 7#ab ,u4,s4,c4 #agea et seq47 by the ,national ,credit ,union ,administration ,board1 with respect to any ,federal credit union4 7#c7 ,under part ,a of subtitle ,,vii of title #di1 ,united ,states ,code1 by the ,secretary of ,transportation1 with respect to any air carrier or foreign air carrier subject to such part4 7#d7 ,under the ,packers and ,stockyards ,act1 #aiba 7#g ,u4,s4,c4 #aha et seq47 7except as provided in section #djf of that ,act 7#g ,u4,s4,c4 #bbf2 #bbg77 by the ,secretary of ,agriculture1 with respect to any activities subject to that ,act4 7#e7 ,under the ,farm ,credit ,act of #aiga 7#ab ,u4,s4,c4 #bjja et seq47 by the ,farm ,credit ,administration1 with respect to any ,federal land bank1 ,federal land bank association1 ,federal intermediate credit bank1 or production credit association4 7c7 ,enforcement by ,state attorneys general 7#a7 ,in general 7,a7 ,civil actions ,in any case in which the attorney general of a ,state has reason to believe that an interest of the residents of that ,state has been or is threatened or adversely affected by the engagement of any person in a practice that violates this ,act or a regulation prescribed under this ,act1 the ,state1 as parens patriae1 may bring a civil action on behalf of the residents of the ,state in a district court of the ,united ,states of appropriate jurisdiction to-- 7i7 enjoin that practice2 7ii7 enforce compliance with this ,act or such regulation2 7iii7 obtain damages1 restitution1 or other compensation on behalf of residents of the ,state2 or 7iv7 obtain such other relief as the court may consider to be appropriate4 7,b7 ,notice 7i7 ,in general ,before filing an action under subparagraph 7,a71 the attorney general of the ,state involved shall provide to the ,commission-- 7,i7 written notice of that action2 and 7,,ii7 a copy of the complaint for that action4 7ii7 ,exemption 7,i7 ,in general ,clause 7i7 shall not apply with respect to the filing of an action by an attorney general of a ,state under this paragraph if the attorney general of the ,state determines that it is not feasible to provide the notice described in that clause before the filing of the action4 7,,ii7 ,notification ,in an action described in subclause 7,i71 the attorney general of a ,state shall provide notice and a copy of the complaint to the ,commission at the same time as the attorney general files the action4 7#b7 ,intervention 7,a7 ,in general ,on receiving notice under paragraph 7#a77;,b71 the ,commission shall have the right to intervene in the action that is the subject of the notice4 7,b7 ,effect of intervention ,if the ,commission intervenes in an action under paragraph 7#a71 it shall have the right-- 7i7 to be heard with respect to any matter that arises in that action2 and 7ii7 to file a petition for appeal4 7#c7 ,construction ,for purposes of bringing any civil action under paragraph 7#a71 nothing in this ,act shall be construed to prevent an attorney general of a ,state from exercising the powers conferred on the attorney general by the laws of that ,state to-- 7,a7 conduct investigations2 7,b7 administer oaths or affirmations2 or 7,c7 compel the attendance of witnesses or the production of documentary and other evidence4 7#d7 ,actions by the ,commission ,in any case in which an action is instituted by or on behalf of the ,commission for violation of this ,act or a regulation prescribed under this ,act1 no ,state may1 during the pendency of that action1 institute an action under paragraph 7#a7 against any defendant named in the complaint in the action instituted by or on behalf of the ,commission for that violation4 7#e7 ,venue2 service of process 7,a7 ,venue ,any action brought under paragraph 7#a7 may be brought in the district court of the ,united ,states that meets applicable requirements relating to venue under section #acia of title #bh1 ,united ,states ,code4 7,b7 ,service of process ,in an action brought under paragraph 7#a71 process may be served in any district in which the defendant-- 7i7 is an inhabitant2 or 7ii7 may be found4 7d7 ,telecommunications carriers and cable operators 7#a7 ,enforcement by ,commission ,notwithstanding section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b771 compliance with the requirements imposed under this ,act shall be enforced by the ,commission with respect to any telecommunications carrier 7as defined in section #c of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aec774 7#b7 ,relationship to other laws ,to the extent that section #bbb1 #cch7;i71 or #fca of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbb2 #cch7;i72 #eea7 is inconsistent with this ,act1 this ,act controls4 7e7 ,safe harbors 7#a7 ,definition ,in this subsection-- 7,a7 the term applicable section means section #e1 #f1 #g1 #h1 or #i of this ,act2 7,b7 the term covered operator means an operator subject to guidelines approved under paragraph 7#b72 7,c7 the term requesting entity means an entity that submits a safe harbor request to the ,commission2 and 7,d7 the term safe harbor request means a request to have self-regulatory guidelines described in paragraph 7#b77;,a7 approved under that paragraph4 7#b7 ,guidelines 7,a7 ,in general ,an operator may satisfy the requirements of regulations issued under an applicable section by following a set of self-regulatory guidelines1 issued by representatives of the marketing or online industries1 or by other persons1 that1 after notice and an opportunity for comment1 are approved by the ,commission upon making a determination that the guidelines meet the requirements of the regulations issued under that applicable section4 7,b7 ,expedited response to requests ,not later than #ahj days after the date on which a safe harbor request is filed under subparagraph 7,a71 the ,commission shall act upon the request set forth in writing the conclusions of the ,commission with regard to the request4 7,c7 ,appeals ,a requesting entity may appeal the final action of the ,commission under subparagraph 7,b71 or a failure by the ,commission to act in the period described in that paragraph1 to a district court of the ,united ,states of appropriate jurisdiction1 as provided for in section #gjf of title #e1 ,united ,states ,code4 7#c7 ,incentives 7,a7 ,self-regulatory incentives ,in prescribing regulations under an applicable section1 the ,commission shall provide incentives for self-regulation by covered operators to implement the protections afforded children and minors1 as applicable1 under the regulatory requirements described in those sections4 7,b7 ,deemed compliance ,the incentives under subparagraph 7,a7 shall include provisions for ensuring that a covered operator will be deemed to be in compliance with the requirements of the regulations under an applicable section if that person complies with guidelines approved under paragraph 7#b74 7#d7 ,regulations ,in prescribing regulations relating to safe harbor guidelines under an applicable section1 the ,commission shall-- 7,a7 establish criteria for the approval of guidelines that will ensure that a covered operator provides substantially the same or greater protections for children and minors1 as applicable1 as those contained in the regulations issued under the applicable section2 and 7,b7 require that any report or documentation required to be submitted to the ,commission by a covered operator or requesting entity will be published on the internet website of the ,commission1 except to the extent that the report or documentation contains proprietary information1 which the ,commission may in its discretion redact4 7#e7 ,report by the ,inspector ,general 7,a7 ,in general ,not later than #b years after the date of enactment of this ,act1 and once each #b years thereafter1 the ,inspector ,general of the ,commission shall submit to the ,commission and each committee of the ,senate and each committee of the ,house of ,representatives that has jurisdiction over the ,commission a report regarding the safe harbor provisions under this subparagraph1 which shall include-- 7i7 an analysis of whether the safe harbor provisions are-- 7,i7 operating fairly and effectively2 and 7,,ii7 effectively protecting the interests of children and minors2 and 7ii7 proposals for policy changes that would improve the effectiveness of the safe harbor provisions4 7,b7 ,publication ,not later than #aj days after the date on which a report under subparagraph 7,a7 is submitted1 the ,commission shall publish the report on the internet website of the ,commission4 7f7 ,effective date ,this section shall take effect on the date that is #ij days after the date of enactment of this ,act4