,i #aagth ,,congress #ast ,session ,h4 ,r4 #dhja ,,in ,,the ,,house ,,of ,,representatives ,july #bi1 #bjba ,ms4 ,castor of ,florida introduced the following bill2 which was referred to the ,committee on ,energy and ,commerce ,a ,,bill ,to amend the ,children's ,online ,privacy ,protection ,act of #aiih to update and expand the coverage of such ,act1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,protecting the ,information of our ,vulnerable ,children and ,youth ,act or the ,kids ,,privcy ,act4 7b7 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4 ,sec4 #b4 ,definitions4 ,sec4 #c4 ,requirements for processing of covered information of children or teenagers4 ,sec4 #d4 ,repeal of safe harbors provision4 ,sec4 #e4 ,administration and applicability of ,act4 ,sec4 #f4 ,review4 ,sec4 #g4 ,private right of action4 ,sec4 #h4 ,relationship to other law4 ,sec4 #i4 ,additional conforming amendment4 ,sec4 #aj4 ,implementing regulations4 ,sec4 #aa4 ,youth ,privacy and ,marketing ,division4 ,sec4 #ab4 ,commission defined4 ,sec4 #ac4 ,effective date4 #b4 ,definitions ,section #acjb of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja7 is amended-- 7#a7 by striking paragraphs 7#e7 and 7#aj72 7#b7 by redesignating paragraphs 7#b71 7#c71 7#d71 7#f71 7#g71 7#h71 and 7#i7 as paragraphs 7#c71 7#e71 7#f71 7#g71 7#h71 7#i71 and 7#aj71 respectively2 7#c7 by inserting after paragraph 7#a7 the following3 7#b7 ,teenager ,the term teenager means an individual over the age of #ab and under the age of #ah4 2 7#d7 by striking paragraph 7#c7 7as so redesignated7 and inserting the following3 7#c7 ,covered entity ,the term covered entity means-- 7,a7 any organization1 corporation1 trust1 partnership1 sole proprietorship1 unincorporated association1 or venture over which the ,commission has authority pursuant to section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b772 7,b7 notwithstanding section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b771 common carriers2 and 7,c7 notwithstanding sections #d and #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd and #de7;a77#b771 any nonprofit organization1 including any organization described in section #eja7;c7 of the ,internal ,revenue ,code of #aihf that is exempt from taxation under section #eja7;a7 of the ,internal ,revenue ,code of #aihf4 7#d7 ,operator ,the term operator means1 with respect to a digital service1 the covered entity that operates such service1 to the extent the covered entity is engaged in operating such service or in processing covered information obtained in connection with such service4 2 7#e7 by amending paragraph 7#f7 7as so redesignated7 to read as follows3 7#f7 ,disclose ,the term disclose means to intentionally or unintentionally release1 transfer1 sell1 disseminate1 share1 publish1 lease1 license1 make available1 allow access to1 fail to restrict access to1 or otherwise communicate covered information4 2 7#f7 by amending paragraph 7#i7 7as so redesignated7 to read as follows3 7#i7 ,covered information ,the term covered information-- 7,a7 means any information1 linked or reasonably linkable to a specific teenager or child1 or specific consumer device of a teenager or child2 7,b7 may include-- 7i7 a name1 alias1 home or other physical address1 online identifier1 ,internet ,protocol address1 email address1 account name1 ,social ,security number1 physical characteristics or description1 telephone number1 ,state identification card number1 driver's license number1 passport number1 or other similar identifier2 7ii7 actual or perceived race1 religion1 sex1 sexual orientation1 sexual behavior1 familial status1 gender identity1 disability1 age1 political affiliation1 or national origin2 7iii7 commercial information1 including records relating to personal property1 products or services purchased1 obtained1 or considered1 or other purchasing or consuming histories1 interests1 or tendencies2 7iv7 biometric information2 7v7 device identifiers1 online identifiers1 persistent identifiers1 or digital fingerprinting information2 7vi7 internet or other electronic network activity information1 including browsing history1 search history1 and information regarding a teenager's or child's interaction with an internet website1 application1 or advertisement2 7vii7 geolocation information2 7viii7 audio1 electronic1 visual1 thermal1 olfactory1 or similar information2 7ix7 education information2 7x7 health information2 7xi7 facial recognition information2 7xii7 contents of1 attachments to1 and parties to information1 including with respect to electronic mail1 text messages1 picture messages1 voicemails1 audio conversations1 and video conversations2 7xiii7 financial information1 including bank account numbers1 credit card numbers1 debit card numbers1 or insurance policy numbers2 and 7xiv7 inferences drawn from any of the information described in this paragraph to create a profile about a teenager or child reflecting the teenager's or child's preferences1 characteristics1 psychological trends1 predispositions1 behavior1 attitudes1 intelligence1 abilities1 or aptitudes2 and 7,c7 does not include-- 7i7 information that is processed solely for the purpose of employment of a teenager2 or 7ii7 de-identified information4 2 7#g7 by amending paragraph 7#aj7 7as so redesignated7 to read as follows3 7#aj7 ,verifiable consent ,the term verifiable consent means express1 affirmative consent freely given by a teenager1 or by the parent of a child1 to the processing of covered information of that teenager or child1 respectively-- 7,a7 that is specific1 informed1 and unambiguous1 taking into account the age and the developmental or cognitive needs and capabilities of the teenager or parent of a child1 as applicable2 7,b7 that is given separately for each processing activity2 7,c7 where the teenager or parent of a child1 as applicable1 has not received any financial or other incentive in exchange for such consent2 7,d7 that is given before any processing occurs1 at a time and in a context in which the teenager or parent of a child1 as applicable1 would reasonably expect to make choices concerning such processing2 and 7,e7 that is not obtained through the use of a design1 modification1 or manipulation of a user interface with the purpose or substantial effect of obscuring1 subverting1 or impairing user autonomy1 decision making1 or choice4 2 and 7#h7 by adding at the end the following3 7#ac7 ,process ,the term process means to perform any operation or set of operations on covered information1 whether or not by automated means1 including collecting1 creating1 acquiring1 disclosing1 sharing1 classifying1 sorting1 recording1 deriving1 inferring1 obtaining1 assembling1 organizing1 structuring1 storing1 retaining1 adapting or altering1 using1 or retrieving covered information4 7#ad7 ,de-identified information2 re-identify 7,a7 ,de-identified information ,the term de-identified information means information that cannot reasonably be used to infer information about1 or otherwise be linked to1 a specific teenager or child or specific consumer device of a teenager or child1 if the covered entity that possesses the information-- 7i7 takes reasonable measures to ensure that the information cannot be associated with a teenager or child2 7ii7 publicly commits to maintain and use the information in de-identified form and not to attempt to re-identify the information1 except for the purpose of testing the sufficiency of the de-identification measures2 and 7iii7 contractually obligates any recipients of the information to comply with clauses 7i7 and 7ii74 7,b7 ,re-identify ,the term re-identify means to link information that has been de-identified to a specific teenager or child or specific consumer device of a teenager or child4 7#ae7 ,state ,the term ,state means each of the several ,states1 the ,district of ,columbia1 each territory of the ,united ,states1 and each federally recognized ,indian ,tribe4 7#af7 ,service provider ,the term service provider means a covered entity that processes covered information at the direction of1 and for the sole benefit of1 another covered entity1 and-- 7,a7 is contractually or legally prohibited from processing such covered information for any other purpose2 and 7,b7 complies with all of the requirements of this title and the regulations promulgated under this title4 7#ag7 ,digital service ,the term digital service means a website1 online service1 online application1 mobile application1 or any other service that processes covered information digitally4 7#ah7 ,children's service ,the term children's service means-- 7,a7 a digital service or portion thereof that is directed to children2 or 7,b7 any other digital service or portion thereof1 if the operator of the service decides to treat all users of the service or portion1 as the case may be1 as children4 7#ai7 ,privacy risk ,the term privacy risk means potential adverse consequences to an individual1 group of individuals1 or society arising from the processing of covered information1 including-- 7,a7 physical harm2 7,b7 psychological or emotional harm2 7,c7 negative or harmful outcomes or decisions with respect to an individual's eligibility for rights1 benefits1 or opportunities2 7,d7 reputational and dignity harm2 7,e7 financial harm1 including price discrimination2 7,f7 inconvenience or expenditure of time2 7,g7 disruption and intrusion from unwanted communications or contacts2 7,h7 other effects that limit an individual's choices1 influence an individual's responses1 or predetermine results or outcomes for that individual2 and 7,i7 other demonstrable adverse consequences that affect an individual's private life1 including private family matters1 actions1 and communications within an individual's home or similar physical1 online1 or digital location4 7#bj7 ,privacy and security impact assessment and mitigation 7,,psiam7 7,a7 ,in general ,the terms privacy and security impact assessment and mitigation and ,,psiam mean1 with respect to a digital service1 an assessment and mitigation by the operator of the service of risks to the children and teenagers who access the service that arise from the processing of covered information1 taking into account privacy risks1 security risks1 the rights and best interests of children and teenagers1 differing ages1 capacities1 and developmental needs of children and teenagers1 and any significant internal or external emerging risks1 and ensuring that the ,,psiam builds in risk mitigation and compliance with the other requirements of this title4 7,b7 ,requirements ,in conducting a ,,psiam with respect to a digital service1 the operator of the service shall do the following3 7i7 ,embed the ,,psiam into the design process of the service and complete the ,,psiam before the launch of the service and on an ongoing basis1 and before making significant changes to the processing of covered information4 7ii7 ,publicly disclose the nature1 scope1 context1 and purposes of the processing of covered information4 7iii7 ,depending on the size of the service and level of risks identified-- 7,i7 seek and document the views of children1 teenagers1 and parents 7or their representatives71 as well as experts in children's and teenagers' developmental needs2 and 7,,ii7 take such views into account in the design of the service4 7iv7 ,publicly disclose an explanation of why the operator's processing of covered information is necessary and proportionate vis a vis the risks for the service1 and how the operator complies with the requirements of this title4 7v7 ,assess any processing of covered information that is not in the best interests of children or teenagers or that can be detrimental to their wellbeing and safety1 whether physical1 emotional1 developmental1 or material4 7vi7 ,identify1 assess1 and mitigate high-risk processing of covered information4 7vii7 ,identify measures taken to mitigate the risks identified under clause 7vi7 and comply with the other requirements of this title4 7viii7 ,provide for regular internal reporting on the effectiveness of controls and residual risks of the operator4 7,c7 ,auditable by ,commission ,the ,commission may audit a ,,psiam conducted by an operator as the ,commission considers necessary4 7#ba7 ,directed to children 7,a7 ,in general ,the term directed to children means1 with respect to a digital service1 that the digital service is targeted to or attractive to children1 as demonstrated by-- 7i7 the subject matter of the digital service2 7ii7 the visual content of the digital service2 7iii7 the use of animated characters or child-oriented activities for children1 and related incentives1 on the digital service2 7iv7 the music or other audio content on the digital service2 7v7 the age of models on the digital service2 7vi7 the presence on the digital service of-- 7,i7 child celebrities2 or 7,,ii7 celebrities who appeal to children2 7vii7 the language used on the digital service2 7viii7 advertising content used on1 or used to advertise1 the digital service2 7ix7 reliable empirical evidence relating to-- 7,i7 the composition of the audience of the digital service1 including-- 7aa7 data the operator of the digital service may directly or indirectly collect1 use1 profile1 buy1 sell1 classify1 or analyze 7via algorithms or other forms of data analytics1 including look-alike modeling7 about a user or groups of users to estimate1 identify1 or classify the age or age range 7or a proxy thereof7 of such user or groups of users2 7bb7 advertising information or results1 such as data1 reporting1 or information from the internal communications of the operator of the digital service1 including documentation about its advertising practices1 such as an advertisement insertion order1 or other promotional material to marketers1 that indicates that covered information is being collected from children that are using the digital service2 7cc7 data or reporting from the general or trade press of the digital service indicating that children are using the digital service2 7dd7 complaints from parents or other third parties about child users using the digital service1 whether through the complaint mechanism of the digital service1 by email1 or by other means2 and 7ee7 data or reporting from a privacy and security impact assessment and mitigation1 compliance program1 or other compliance1 risk management1 or internal process that documents privacy risks and controls related to children's privacy1 including the existence of data analytics controlled by the operator of the digital service1 including those of service providers1 and content analytics capabilities and functions or outputs2 and 7,,ii7 the intended audience of the digital service1 including data the operator of the digital service directly or indirectly collects1 uses1 profiles1 buys1 sells1 classifies1 or analyzes 7via algorithms or other forms of data analytics1 including look-alike modeling7 about the nature of the content of the digital service that estimates1 identifies1 or classifies the content as child-directed or similarly estimates1 identifies1 or classifies the intended or likely audience for the content2 or 7x7 any other evidence or circumstances the ,commission determines appropriate4 7,b7 ,covered information from other services ,a digital service shall be deemed to be directed to children if the operator of the digital service has actual or constructive knowledge that the digital service collects covered information directly from users of any other digital service that is directed to children under the criteria described in subparagraph 7,a74 7,c7 ,signals from third parties ,a digital service shall be deemed directed to children if the digital service receives a signal from a third party indicating that the digital service is intended for children or likely to appeal to children1 whether directly or using a flag or other formal industry standard or convention4 7,d7 ,limitation ,a digital service that does not target children as its primary audience shall not be deemed directed to children if the digital service-- 7i7 does not collect covered information from any visitor prior to collecting age information2 and 7ii7 prevents the collection1 use1 or disclosure of covered information from visitors who identify themselves as under age #ac without first complying with the notice and parental consent provisions of this title and the regulations promulgated under this title4 7,e7 ,further limitation ,a digital service shall not be deemed directed to children solely because the digital service refers or links to another digital service that is directed to children by using information location tools1 including a directory1 index1 reference1 pointer1 or hypertext link4 7,f7 ,determination regarding a portion of a digital service ,for purposes of determining whether a portion of a digital service is directed to children1 any reference in this paragraph to a digital service shall be considered to refer to such portion4 7#bb7 ,likely to be accessed by children or teenagers ,the term likely to be accessed by children or teenagers means1 with respect to a digital service1 that the possibility of more than a de minimis number of children or teenagers accessing the digital service is more probable than not4 ,in determining whether a digital service is likely to be accessed by children or teenagers1 the operator of the service shall consider whether the service has particular appeal to children or teenagers and whether effective measures 7such as age gating7 are in place that prevent children or teenagers from gaining access to the service4 7#bc7 ,age assurance ,the term age assurance means a verifiable process to estimate or determine the age of a user of a digital service with a given and documented degree of certainty4 7#bd7 ,age gate ,the term age gate means to use a verifiable process that meets a documented degree of certainty to restrict or block access to a digital service for users that do not meet an age requirement4 4 #c4 ,requirements for processing of covered information of children or teenagers 7a7 ,in general ,section #acjc of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #fejb7 is amended to read as follows3 #acjc4 ,requirements for processing of covered information of children or teenagers 7a7 ,requirements for children's services 7#a7 ,data minimization ,an operator of a children's service shall process covered information under the principle of data minimization1 requiring the operator to only process the minimum amount necessary for a specified purpose4 7#b7 ,transparency ,an operator of a children's service shall develop and make publicly available1 at all times and in a machine-readable format1 a privacy policy1 in a manner that is clear1 easily understood1 and written in plain and concise language1 that includes-- 7,a7 the categories of covered information that the operator processes about teenagers and children2 7,b7 how and under what circumstances covered information is collected directly from a teenager or child2 7,c7 the categories and the sources of any covered information processed by the operator that is not collected directly from a teenager or child2 7,d7 a description of the purposes for which the operator processes covered information1 including-- 7i7 a description of whether and how the operator customizes products or services1 or adjusts the prices of products or services for teenagers or children or based in any part on processing of covered information2 7ii7 a description of whether and how the operator1 or the operator's affiliates or service providers1 de-identifies information1 including the methods used to de-identify such information2 and 7iii7 a description of whether and how the operator1 or the operator's affiliates or service providers1 generates or uses any consumer score to make decisions concerning a teenager or child1 and the source or sources of any such consumer score2 7,e7 a description of how long and the circumstances under which the operator retains covered information2 7,f7 a description of all of the purposes for which the operator discloses covered information to service providers and1 on a biennial basis1 the categories of service providers2 7,g7 a description of whether and for what purposes the operator discloses covered information to third parties1 and the categories of covered information disclosed2 7,h7 a description of the categories of third parties to which covered information described in subparagraph 7,g7 is disclosed1 by category or categories of covered information for each category of third party to which the covered information is disclosed2 7,i7 whether the operator discloses covered information to data brokers2 7,j7 whether the operator collects covered information about teenagers or children over time and across different digital services when a teenager or child uses the operator's digital service2 7,k7 how a teenager or a parent of a child can exercise their rights to access1 correct1 and delete such teenager's or child's covered information as set forth in paragraph 7#f72 7,l7 a listing of all possible consents that may be obtained by the operator for the processing of covered information1 how a teenager or the parent of a child can grant1 withhold1 withdraw1 or modify any such consent1 and the consequences of withholding1 withdrawing1 or modifying any such consent2 7,m7 the effective date of the notice2 and 7,n7 how the operator will communicate material changes of the privacy policy to the teenager or the parent of a child4 7#c7 ,consent required 7,a7 ,in general ,an operator of a children's service shall-- 7i7 provide clear and concise notice to a teenager or the parent of a child of the items of covered information about such teenager or child1 respectively1 that is processed by such operator and how such operator processes such covered information and obtain verifiable consent for such processing2 and 7ii7 if such operator determines1 including through actual or constructive knowledge1 that such operator has not obtained verifiable consent for any specific processing of covered information about a teenager or child1 not later than #dh hours after such determination-- 7,i7 obtain verifiable consent2 or 7,,ii7 delete all covered information about such teenager or child4 7,b7 ,when consent not required ,verifiable consent under this paragraph is not required in the case of-- 7i7 online contact information collected from a teenager or child that-- 7,i7 is used only to respond directly on a one-time basis to a specific request from the teenager or child2 7,,ii7 is not used to re-contact the teenager or child2 and 7,,iii7 is not retained by the operator after responding as described in subclause 7,i72 7ii7 a request for the name or online contact information of a teenager or the parent of a child that is used for the sole purpose of obtaining verifiable consent or providing notice under subparagraph 7,a77i71 where such information is not retained by the operator if verifiable consent is not obtained within #dh hours2 or 7iii7 the processing of covered information that is necessary-- 7,i7 to respond to judicial process2 or 7,,ii7 to the extent permitted under other provisions of law1 to provide information to law enforcement agencies or for an investigation on a matter related to public safety4 7,c7 ,withdrawal of consent 7i7 ,mechanism for withdrawal ,an operator of a children's service shall provide a teenager or the parent of a child1 as applicable-- 7,i7 a mechanism to withdraw consent to the processing of covered information at any time in a manner that is as easy as the mechanism to give consent2 and 7,,ii7 clear and conspicuous notice of the mechanism required by subclause 7,i74 7ii7 ,effect of withdrawal on prior processing ,withdrawal of consent to the processing of covered information shall not be construed to affect the lawfulness of any processing of covered information based on verifiable consent that was in effect before such withdrawal4 7,d7 ,prohibition on limiting or discontinuing service ,an operator of a children's service may not refuse to provide a service1 or discontinue a service provided1 to a teenager or child1 if the teenager or parent of the child1 as applicable1 refuses to consent1 or withdraws consent1 to the processing of any covered information not technically required for the operator to provide such service4 7#d7 ,retention of data 7,a7 ,retention limitations ,subject to the exceptions provided in subparagraph 7,b71 an operator of a children's service may not keep1 retain1 or otherwise store covered information for longer than is reasonably necessary for the purposes for which the covered information is processed4 7,b7 ,exceptions ,further retention of covered information shall not be considered to be incompatible with the purposes of processing described in subparagraph 7,a7 if such processing is necessary and done solely for the purposes of-- 7i7 compliance with-- 7,i7 requirements to document compliance under this title2 or 7,,ii7 other laws1 regulations1 or legal obligations2 7ii7 preventing risks to the health or safety of a child or teenager or groups of children or teenagers2 or 7iii7 repairing errors that impair existing functionality4 7#e7 ,limitation on disclosing covered information to third parties 7,a7 ,disclosures ,an operator of a children's service may not disclose covered information to a third party unless the operator has a written agreement with such third party that-- 7i7 specifies all of the purposes for which the third party may process the covered information for which the operator has verifiable consent2 7ii7 prohibits the third party from processing covered information for any purpose other than the purposes specified under clause 7i72 and 7iii7 requires the third party to provide at least the same privacy and security protections as the operator4 7,b7 ,responsibilities of operators regarding third parties ,an operator of a children's service-- 7i7 shall perform reasonable due diligence in selecting any third party with which to enter into an agreement described in subparagraph 7,a7 and shall exercise reasonable oversight over all such third parties to assure compliance with the requirements of this title and the regulations promulgated under this title2 and 7ii7 if the operator has actual or constructive knowledge that a third party has violated an agreement described in subparagraph 7,a71 shall-- 7,i7 to the extent practicable1 promptly take steps to ensure compliance with such agreement2 and 7,,ii7 promptly report to the ,commission that such a violation occurred4 7#f7 ,right to access1 correct1 and delete covered information 7,a7 ,access ,an operator of a children's service1 subject to the exceptions in subparagraph 7,d71 shall1 upon request of a teenager or the parent of a child and after proper identification of such teenager or parent1 promptly provide to such teenager or parent1 as applicable-- 7i7 access to all covered information processed by the operator pertaining to such teenager or child1 including a description of-- 7,i7 each type of covered information processed by the operator pertaining to the teenager or child1 as applicable2 7,,ii7 each purpose for which the operator processes each category of covered information pertaining to the teenager or child1 as applicable2 7,,iii7 the names of each third party to which the operator disclosed the covered information2 7,,iv7 each source other than the teenager or child1 as applicable1 from which the operator obtained covered information pertaining to that teenager or child1 as applicable2 7,v7 how long the covered information will be retained or stored by the operator and1 if not known1 the criteria the operator uses to determine how long the covered information will be retained or stored by the operator2 and 7,,vi7 with respect to any score of the teenager or child1 as applicable1 processed by the operator-- 7aa7 how such score is used by the operator to make decisions with respect to that teenager or child1 as applicable2 and 7bb7 the source that created the score if not created by the operator2 and 7ii7 a simple and reasonable mechanism by which a teenager or parent of a child may request access to the information described under clause 7i71 as applicable4 7,b7 ,deletion ,an operator of a children's service1 subject to the exceptions in subparagraph 7,d71 shall-- 7i7 establish a simple1 publicly and easily accessible1 and reasonable mechanism by which a teenager or parent of a child with respect to whom the operator processes covered information may request the operator to delete any such covered information 7or any component thereof71 including publicly available covered information submitted to the service by the child or teenager2 and 7ii7 delete such covered information not later than #de days after receiving such request4 7,c7 ,correction ,an operator of a children's service1 subject to the exceptions in subparagraph 7,d71 shall-- 7i7 provide each teenager or parent of a child with respect to whom the operator processes covered information1 as applicable1 a simple1 publicly and easily accessible1 and reasonable mechanism by which that teenager or parent may submit a request to the operator-- 7,i7 to dispute the accuracy or completeness of that covered information1 or part or component thereof2 and 7,,ii7 to request that such covered information1 or part or component thereof1 be corrected for accuracy or completeness2 and 7ii7 not later than #de days after receiving a request under clause 7i7-- 7,i7 determine whether the covered information disputed or requested to be corrected is inaccurate or incomplete2 and 7,,ii7 correct the accuracy or completeness of any covered information determined by the operator to be inaccurate or incomplete4 7,d7 ,exceptions ,an operator of a children's service may deny a request made under subparagraph 7,a71 7,b71 or 7,c7 if-- 7i7 the operator is unable to verify the identity of the teenager or parent of a child making the request after making a reasonable effort to verify the identity of such teenager or parent2 7ii7 with respect to the request made1 the operator determines that-- 7,i7 the operator is limited from fulfilling the request by law1 legally recognized privilege1 or other legal obligation2 or 7,,ii7 fulfilling the request would create a legitimate risk to the privacy1 security1 or safety of someone other than the teenager or child1 as applicable2 7iii7 with respect to a request to delete covered information made under subparagraph 7,b7 or a request to correct covered information made under subparagraph 7,c71 the operator determines that the retention of the covered information is necessary to-- 7,i7 complete the transaction with the teenager or child1 as applicable1 for which the covered information was collected2 7,,ii7 provide a product or service affirmatively requested by the teenager or parent of a child1 as applicable2 7,,iii7 perform a contract with the teenager or a parent of a child1 as applicable1 including a contract for billing1 financial reporting1 or accounting2 7,,iv7 keep a record of the covered information for law enforcement purposes2 or 7,v7 identify and repair errors that impair the functionality of the children's service2 or 7iv7 the covered information is used in public or peer-reviewed scientific1 medical1 or statistical research in the public interest that adheres to commonly accepted ethical standards or laws1 with informed consent consistent with section #ej4bj of title #ba1 ,code of ,federal ,regulations1 if the research is already in progress at the time when the request to access1 delete1 or correct is made under subparagraph 7,a71 7,b71 or 7,c74 7,e7 ,prohibition on limiting or discontinuing service ,an operator of a children's service may not refuse to provide a service1 or discontinue a service provided1 to a teenager or child1 if the teenager or parent of the child1 as applicable1 exercises any of the rights set forth in this paragraph4 7#g7 ,additional prohibited practices with respect to teenagers and children 7,a7 ,in general ,an operator of a children's service may not-- 7i7 process any covered information in a manner that is inconsistent with what a reasonable teenager or parent of a child would expect in the context of a particular transaction or the teenager's or parent's relationship with such operator1 or seek to obtain verifiable consent for such processing2 7ii7 process any covered information in a manner that is harmful or has been shown to be detrimental to the well-being of children or teenagers2 7iii7 process covered information for the purpose of providing for targeted personalized advertising or engage in other marketing to a specific child or teenager or group of children or teenagers based on-- 7,i7 using the covered information1 online behavior1 or group identifiers of such child or teenager or of the children or teenagers in such group2 or 7,,ii7 using the covered information or online behavior of children or teenagers who share characteristics with such child or teenager or with the children or teenagers in such group1 including income level or protected characteristics or proxies thereof2 7iv7 condition the participation of a child or teenager in a game1 sweepstakes1 or other contest on consenting to the processing of more covered information than is necessary for such child or teenager to participate2 7v7 engage in cross-device tracking of a child or teenager unless the child or teenager is logged-in to a specific service1 for the sole purpose of facilitating the primary purpose of the good or service or a specific feature thereof2 7vi7 engage in algorithmic processes that discriminate on the basis of race1 age1 gender1 ability1 or other protected characteristics2 7vii7 disclose biometric information2 7viii7 disclose geolocation information2 or 7ix7 collect geolocation information by default or without making it clear to a user when geolocation tracking is in effect4 7,b7 ,exceptions ,nothing in subparagraph 7,a7 shall prohibit an operator from processing covered information if necessary solely for purposes of-- 7i7 detecting and preventing security incidents2 7ii7 preventing imminent danger to the personal safety of an individual or group of individuals2 7iii7 identifying and repairing errors that impair the core functionality of the children's service2 or 7iv7 complying with any ,federal1 ,state1 or local law1 rule1 regulation1 or other legal obligation1 including civil1 criminal1 or regulatory inquiries1 investigations1 subpoenas1 or court orders or other properly executed compulsory process requiring the disclosure of information4 7#h7 ,security ,requirements 7,a7 ,in general ,an operator of a children's service shall establish and implement reasonable security policies1 practices1 and procedures for the treatment and protection of covered information1 taking into consideration-- 7i7 the size1 nature1 scope1 and complexity of the activities engaged in by such operator2 7ii7 the sensitivity of any covered information at issue2 7iii7 the state of the art in administrative1 technical1 and physical safeguards for protecting such information2 and 7iv7 the cost of implementing such policies1 practices1 and procedures4 7,b7 ,specific requirements ,the policies1 practices1 and procedures established by an operator under subparagraph 7,a7 shall include the following3 7i7 ,a written security policy with respect to the processing of such covered information4 7ii7 ,the identification of an officer or other individual as the point of contact with responsibility for the management of information security4 7iii7 ,a process for identifying and assessing any reasonably foreseeable vulnerabilities in the system or systems maintained by such operator that contains such covered information1 including regular monitoring for a breach of security of such system or systems4 7iv7 ,a process for taking preventive and corrective action to mitigate against any vulnerabilities identified in the process required by clause 7iii71 which may include-- 7,i7 implementing any changes to the security practices1 architecture1 installation1 or implementation of network or operating software2 and 7,,ii7 regular testing or otherwise monitoring the effectiveness of the safeguards4 7v7 ,a process for determining if the covered information is no longer needed and deleting such covered information by shredding1 permanently erasing1 or otherwise modifying the covered information to make such covered information permanently unreadable or indecipherable4 7vi7 ,a process for overseeing persons who have access to covered information1 including through internet-connected devices1 by-- 7,i7 taking reasonable steps to select and retain persons that are capable of maintaining appropriate safeguards for the covered information or internet-connected devices at issue2 and 7,,ii7 requiring all such persons to implement and maintain such security measures4 7vii7 ,a process for employee training and supervision for implementation of the policies1 practices1 and procedures required by this subsection4 7viii7 ,a written plan or protocol for internal and public response in the event of a breach of security4 7,c7 ,periodic assessment and consumer privacy and data security modernization ,an operator of a children's service shall1 not less frequently than every #ab months1 monitor1 evaluate1 and adjust1 as appropriate1 the policies1 practices1 and procedures of such operator in light of any relevant changes in-- 7i7 technology2 7ii7 internal or external threats and vulnerabilities to covered information2 and 7iii7 the changing business arrangements of the operator4 7,d7 ,submission of policies to the ,,ftc ,an operator of a children's service shall submit the policies1 practices1 and procedures established by the operator under subparagraph 7,a7 to the ,commission in conjunction with a notification of a breach of security required by any ,federal or ,state statute or regulation or upon request of the ,commission4 7b7 ,rulemaking regarding requirements for digital services likely ,to be accessed by children or teenagers 7#a7 ,in general ,the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 that contain requirements for operators of digital services that are not children's services but are likely to be accessed by children or teenagers1 which shall be based on the requirements of subsection 7a7 but modified as the ,commission considers appropriate given a risk-based approach to determine age and to determine and mitigate privacy risks and security risks to the child or teenager1 and given differing developmental needs and cognitive capacities of children or teenagers4 ,the ,commission may include in such regulations different requirements for operators of different types of such services4 7#b7 ,best interests of child or teenager ,the regulations promulgated under paragraph 7#a7 shall require an operator to make the best interests of children and teenagers a primary design consideration when designing its service1 including by conducting a privacy and security impact assessment and mitigation for the service1 addressing all privacy risks to children and teenagers which arise from the processing of covered information1 taking into account the best interests of children and teenagers4 7#c7 ,risk-based approach to determining age of user 7,a7 ,in general ,the regulations promulgated under paragraph 7#a7 shall require a risk-based approach to determining the age of a specific user of a digital service under which higher privacy risks and security risks from the processing of covered information require a higher certainty of age assurance4 7,b7 ,age assurance ,the regulations promulgated under paragraph 7#a7 shall require an operator to conduct an age assurance to determine the age of each specific user4 7,c7 ,approval of age assurance mechanisms ,the ,commission shall establish in the regulations promulgated under paragraph 7#a7 a process under which an operator may obtain the approval of the ,commission of particular mechanisms of age assurance as meeting the age assurance requirements of such regulations for particular levels of privacy risks4 7,d7 ,data minimization ,the regulations required by paragraph 7#a7 shall provide that any data collected for age assurance shall be the minimal amount necessary and destroyed immediately or as determined by the ,commission1 but consistent with standards that still allow for auditing and compliance4 7c7 ,prohibition on certain advertising or marketing for digital services likely ,to be accessed by children or teenagers ,an operator of a digital service that is likely to be accessed by children or teenagers may not process covered information for the purpose of providing for targeted personalized advertising or engage in other marketing to a specific child or teenager or group of children or teenagers based on-- 7#a7 using the covered information1 online behavior1 or group identifiers of such child or teenager or of the children or teenagers in such group2 or 7#b7 using the covered information or online behavior of children or teenagers who share characteristics with such child or teenager or with the children or teenagers in such group1 including income level or protected characteristics or proxies thereof4 7d7 ,enforcement ,subject to section #acjf1 a violation of this section or a regulation promulgated under this section shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b774 4 7b7 ,conforming amendments ,section #acje of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #fejd7 is amended-- 7#a7 in subsection 7a77#a7-- 7,a7 by striking any regulation of the ,commission prescribed under section #acjc7;b7 and inserting section #acjc or a regulation promulgated under such section2 and 7,b7 in subparagraph 7,b71 by striking the regulation and inserting such section or such regulation2 and 7#b7 in subsection 7d7-- 7,a7 by striking any regulation prescribed under section #acjc and inserting section #acjc or a regulation promulgated under such section2 and 7,b7 by striking that regulation and inserting such section or such regulation4 #d4 ,repeal of safe harbors provision 7a7 ,in general ,section #acjd of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #fejc7 is repealed4 7b7 ,conforming amendment ,section #acje7;b7 of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #fejd7;b77 is amended by striking paragraph 7#c74 #e4 ,administration and applicability of ,act 7a7 ,enforcement by ,federal ,trade ,commission ,section #acjf7;d7 of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feje7;d77 is amended to read as follows3 7d7 ,actions by the ,commission 7#a7 ,in general ,except as provided in paragraphs 7#b7 and 7#c71 the ,commission shall prevent any person from violating section #acjc or a regulation promulgated under such section in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this title1 and any entity that violates such section or such regulation shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act in the same manner1 by the same means1 and with the same jurisdiction1 power1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act were incorporated into and made a part of this title4 7#b7 ,increased civil penalty amount ,in the case of a civil penalty under subsection 7l7 or 7m7 of section #e of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 relating to acts or practices in violation of section #acjc or a regulation promulgated under such section1 the maximum dollar amount per violation shall be #fc1gie4 7#c7 ,nature of relief available ,in any action commenced by the ,commission under subsection 7a7 of section #ai of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;b7 to enforce section #acjc of this title or a regulation promulgated under such section1 the ,commission shall seek all appropriate relief described in subsection 7b7 of such section #ai1 and may1 notwithstanding such subsection1 seek any exemplary or punitive damages4 4 7b7 ,enforcement by certain other agencies ,section #acjf of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feje7 is amended-- 7#a7 in subsection 7b7-- 7,a7 in paragraph 7#a71 by striking 1 in the case of and all that follows and inserting the following3 by the appropriate ,federal banking agency1 with respect to any insured depository institution 7as those terms are defined in section #c of that ,act 7#ab ,u4,s4,c4 #ahac7722 7,b7 in paragraph 7#f71 by striking ,federal land bank1 ,federal land bank association1 ,federal intermediate credit bank1 or production credit association and inserting ,farm ,credit ,bank1 ,agricultural ,credit ,bank 7to the extent exercising the authorities of a ,farm ,credit ,bank71 ,federal ,land ,credit ,association1 or agricultural credit association2 and 7,c7 by striking paragraph 7#b7 and redesignating paragraphs 7#c7 through 7#f7 as paragraphs 7#b7 through 7#e71 respectively2 and 7#b7 in subsection 7c71 by striking subsection 7a7 each place it appears and inserting subsection 7b74 #f4 ,review ,section #acjg of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #fejf7 is amended-- 7#a7 in the matter preceding paragraph 7#a71 by striking the regulations initially issued under section #acjc and inserting the regulations issued under section #aj7;a7 of the ,protecting the ,information of our ,vulnerable ,children and ,youth ,act 7relating to the implementation of the amendments made by such ,act to this title72 and 7#b7 by amending paragraph 7#a7 to read as follows3 7#a7 review the implementation of this title1 including the effect of the implementation of this title on practices relating to the processing of covered information about teenagers or children and teenager's and children's ability to obtain access to information of their choice online2 and 4 #g4 ,private right of action ,the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja et seq47 is amended-- 7#a7 by redesignating sections #acjg and #acjh as sections #acjh and #acji1 respectively2 and 7#b7 by inserting after section #acjf the following3 #acjg4 ,private right of action 7a7 ,right of action ,any parent of a teenager or parent of a child alleging a violation of section #acjc or a regulation promulgated under such section with respect to the covered information of such teenager or child may bring a civil action in any court of competent jurisdiction4 7b7 ,injury in fact ,a violation of section #acjc or a regulation promulgated under such section with respect to the covered information of a teenager or child constitutes an injury in fact to that teenager or child4 7c7 ,relief ,in a civil action brought under subsection 7a7 in which the plaintiff prevails1 the court may award-- 7#a7 injunctive relief2 7#b7 actual damages2 7#c7 punitive damages2 7#d7 reasonable attorney's fees and costs2 and 7#e7 any other relief that the court determines appropriate4 7d7 ,pre-,dispute arbitration agreements 7#a7 ,in general ,no pre-dispute arbitration agreement or pre-dispute joint-action waiver shall be valid or enforceable with respect to any claim arising under section #acjc or a regulation promulgated under such section4 7#b7 ,determination ,a determination as to whether and how this title or a regulation promulgated under this title applies to an arbitration agreement shall be determined under ,federal law by the court1 rather than the arbitrator1 irrespective of whether the party opposing arbitration challenges such agreement specifically or in conjunction with any other term of the contract containing such agreement4 7#c7 ,definitions ,as used in this subsection-- 7,a7 the term pre-dispute arbitration agreement means any agreement to arbitrate a dispute that has not arisen at the time of the making of the agreement2 and 7,b7 the term pre-dispute joint-action waiver means an agreement1 whether or not part of a pre-dispute arbitration agreement1 that would prohibit1 or waive the right of1 one of the parties to the agreement to participate in a joint1 class1 or collective action in a judicial1 arbitral1 administrative1 or other forum1 concerning a dispute that has not yet arisen at the time of the making of the agreement4 7e7 ,non-,waiveability ,the rights and remedies provided under this title may not be waived or limited by contract or otherwise4 4 #h4 ,relationship to other law ,section #acjf of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feje7 is further amended by adding at the end the following3 7f7 ,relationship to other law 7#a7 ,other ,federal privacy or security provisions ,nothing in this title or a regulation promulgated under this title may be construed to modify1 limit1 or supersede the operation of any privacy or security provision in any other ,federal statute or regulation4 7#b7 ,state law ,nothing in this title or a regulation promulgated under this title may be construed to preempt1 displace1 or supplant any ,state common law or statute1 except to the extent that any such common law or statute specifically and directly conflicts with the provisions of this title or a regulation promulgated under this title1 and then only to the extent of the specific and direct conflict4 ,any such common law or statute is not in specific and direct conflict if it affords a greater level of protection to a child or teenager than the provisions of this title or a regulation promulgated under this title4 7#c7 ,section #bcj of the ,communications ,act of #aicd ,nothing in section #bcj of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bcj7 may be construed to impair or limit the provisions of this title or a regulation promulgated under this title4 4 #i4 ,additional conforming amendment ,the heading of title ,,xiii of division ,c of the ,omnibus ,consolidated and ,emergency ,supplemental ,appropriations ,act1 #aiii 7,public ,law #aje-bgg2 #aab ,stat4 #bfha-gbh7 is amended by inserting and ,teenager's after ,children's4 #aj4 ,implementing regulations 7a7 ,in general ,not later than #a year after the date of the enactment of this ,act1 the ,commission shall promulgate regulations under section #eec of title #e1 ,united ,states ,code1 to implement the amendments made by this ,act1 including the regulations required by subsection 7b7 of section #acjc of the ,children's ,online ,privacy ,protection ,act of #aiih1 as amended by this ,act4 7b7 ,review and revision ,not later than #aj years after the date on which the ,commission promulgates the regulations required by subsection 7a71 the ,commission shall review such regulations and1 if the ,commission considers revisions to such regulations appropriate1 promulgate such revisions under section #eec of title #e1 ,united ,states ,code4 #aa4 ,youth ,privacy and ,marketing ,division 7a7 ,establishment ,there is established within the ,commission a division to be known as the ,youth ,privacy and ,marketing ,division4 7b7 ,director ,the ,youth ,privacy and ,marketing ,division shall be headed by a ,director1 who shall be appointed by the ,chairman of the ,commission4 7c7 ,duties ,the ,youth ,privacy and ,marketing ,division shall be responsible for addressing1 as it relates to this ,act and the amendments made by this ,act-- 7#a7 the privacy of children and teenagers2 and 7#b7 marketing directed at children and teenagers4 7d7 ,staff ,the ,director of the ,youth ,privacy and ,marketing ,division shall hire adequate staff to carry out the duties under subsection 7c71 including individuals who are experts in data protection1 digital advertising1 data analytics1 and youth development4 7e7 ,reports ,not later than #a year after the date of the enactment of this ,act1 and each year thereafter1 the ,director of the ,youth ,privacy and ,marketing ,division shall submit to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives a report that includes-- 7#a7 a description of the work of the ,youth ,privacy and ,marketing ,division on emerging concerns relating to youth privacy and marketing practices2 and 7#b7 an assessment of how effectively the ,commission has1 during the period for which the report is submitted1 addressed youth privacy and marketing practices4 7f7 ,definitions ,in this section1 the terms child and teenager have the meanings given such terms in section #acjb of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja71 as amended by this ,act4 #ab4 ,commission defined ,in this ,act1 the term ,commission means the ,federal ,trade ,commission4 #ac4 ,effective date ,the amendments made by this ,act shall take effect on the date that is #a year after the ,commission promulgates the regulations required by section #aj7;a74