,,ii #aaith ,,congress #ast ,session ,s4 #hcf ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,march #d1 #bjbe,mr4 ,markey 7for himself1 ,mr4 ,cassidy1 ,ms4 ,cantwell1 ,mr4 ,schatz1 ,mrs4 ,capito1 ,ms4 ,klobuchar1 ,mr4 ,crapo1 ,mr4 ,wyden1 ,mr4 ,grassley1 ,mr4 ,lujn1 ,mr4 ,blumenthal1 ,mr4 ,merkley1 ,mr4 ,welch1 ,mr4 ,king1 ,mr4 ,kelly1 ,mrs4 ,britt1 and ,mr4 ,heinrich7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to amend the ,children's ,online ,privacy ,protection ,act of #aiih to strengthen protections relating to the online collection1 use1 and disclosure of personal information of children and teens1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,children and ,teens' ,online ,privacy ,protection ,act4 7b7 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4,sec4 #b4 ,online collection1 use1 disclosure1 and deletion of personal information of children and teens4,sec4 #c4 ,study and reports of mobile and online application oversight and enforcement4,sec4 #d4 ,,gao study4,sec4 #e4 ,severability4 #b4 ,online collection1 use1 disclosure1 and deletion of personal information of children and teens 7a7 ,definitions ,section #acjb of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja7 is amended-- 7#a7 by amending paragraph 7#b7 to read as follows3 7#b7 ,operator ,the term operator-- 7,a7 means any person-- 7i7 who1 for commercial purposes1 in interstate or foreign commerce operates or provides a website on the internet1 an online service1 an online application1 or a mobile application2 and 7ii7 who-- 7,i7 collects or maintains1 either directly or through a service provider1 personal information from or about the users of that website1 service1 or application2 7,,ii7 allows another person to collect personal information directly from users of that website1 service1 or application 7in which case1 the operator is deemed to have collected the information72 or 7,,iii7 allows users of that website1 service1 or application to publicly disclose personal information 7in which case1 the operator is deemed to have collected the information72 and 7,b7 does not include any nonprofit entity that would otherwise be exempt from coverage under section #e of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de74 2 7#b7 in paragraph 7#d7-- 7,a7 by amending subparagraph 7,a7 to read as follows3 7,a7 the release of personal information collected from a child or teen by an operator for any purpose1 except where the personal information is provided to a person other than an operator who-- 7i7 provides support for the internal operations of the website1 online service1 online application1 or mobile application of the operator1 excluding any activity relating to individual-specific advertising to children or teens2 and 7ii7 does not disclose or use that personal information for any other purpose2 and 2 and 7,b7 in subparagraph 7,b7-- 7i7 by inserting or teen after child each place the term appears2 7ii7 by striking website or online service and inserting website1 online service1 online application1 or mobile application2 and 7iii7 by striking actual knowledge and inserting actual knowledge or knowledge fairly implied on the basis of objective circumstances2 7#c7 by striking paragraph 7#h7 and inserting the following3 7#h7 ,personal information 7,a7 ,in general ,the term personal information means individually identifiable information about an individual collected online1 including-- 7i7 a first and last name2 7ii7 a home or other physical address including street name and name of a city or town2 7iii7 an e-mail address2 7iv7 a telephone number2 7v7 a ,social ,security number2 7vi7 any other identifier that the ,commission determines permits the physical or online contacting of a specific individual2 7vii7 a persistent identifier that can be used to recognize a specific child or teen over time and across different websites1 online services1 online applications1 or mobile applications1 including but not limited to a customer number held in a cookie1 an ,internet ,protocol 7,,ip7 address1 a processor or device serial number1 or unique device identifier1 but excluding an identifier that is used by an operator solely for providing support for the internal operations of the website1 online service1 online application1 or mobile application2 7viii7 a photograph1 video1 or audio file where such file contains a specific child's or teen's image or voice2 7ix7 geolocation information2 7x7 information generated from the measurement or technological processing of an individual's biological1 physical1 or physiological characteristics that is used to identify an individual1 including-- 7,i7 fingerprints2 7,,ii7 voice prints2 7,,iii7 iris or retina imagery scans2 7,,iv7 facial templates2 7,v7 deoxyribonucleic acid 7,,dna7 information2 or 7,,vi7 gait2 or 7xi7 information linked or reasonably linkable to a child or teen or the parents of that child or teen 7including any unique identifier7 that an operator collects online from the child or teen and combines with an identifier described in this subparagraph4 7,b7 ,exclusion ,the term personal information shall not include an audio file that contains a child's or teen's voice so long as the operator-- 7i7 does not request information via voice that would otherwise be considered personal information under this paragraph2 7ii7 provides clear notice of its collection and use of the audio file and its deletion policy in its privacy policy2 7iii7 only uses the voice within the audio file solely as a replacement for written words1 to perform a task1 or engage with a website1 online service1 online application1 or mobile application1 such as to perform a search or fulfill a verbal instruction or request2 and 7iv7 only maintains the audio file long enough to complete the stated purpose and then immediately deletes the audio file and does not make any other use of the audio file prior to deletion4 7,c7 ,support for the internal operations of a website1 online service1 online application1 or mobile application 7i7 ,in general ,for purposes of subparagraph 7,a77vii71 the term support for the internal operations of a website1 online service1 online application1 or mobile application means those activities necessary to-- 7,i7 maintain or analyze the functioning of the website1 online service1 online application1 or mobile application2 7,,ii7 perform network communications2 7,,iii7 authenticate users of1 or personalize the content on1 the website1 online service1 online application1 or mobile application2 7,,iv7 serve contextual advertising1 provided that any persistent identifier is only used as necessary for technical purposes to serve the contextual advertisement1 or cap the frequency of advertising2 7,v7 protect the security or integrity of the user1 website1 online service1 online application1 or mobile application2 7,,vi7 ensure legal or regulatory compliance1 or 7,,vii7 fulfill a request of a child or teen as permitted by subparagraphs 7,a7 through 7,c7 of section #acjc7;b77#b74 7ii7 ,condition ,except as specifically permitted under clause 7i71 information collected for the activities listed in clause 7i7 cannot be used or disclosed to contact a specific individual1 including through individual-specific advertising to children or teens1 to amass a profile on a specific individual1 in connection with processes that encourage or prompt use of a website or online service1 or for any other purpose4 2 7#d7 by amending paragraph 7#i7 to read as follows3 7#i7 ,verifiable consent ,the term verifiable consent means any reasonable effort 7taking into consideration available technology71 including a request for authorization for future collection1 use1 and disclosure described in the notice1 to ensure that1 in the case of a child1 a parent of the child1 or1 in the case of a teen1 the teen-- 7,a7 receives direct notice of the personal information collection1 use1 and disclosure practices of the operator2 and 7,b7 before the personal information of the child or teen is collected1 freely and unambiguously authorizes-- 7i7 the collection1 use1 and disclosure1 as applicable1 of that personal information2 and 7ii7 any subsequent use of that personal information4 2 7#e7 in paragraph 7#aj7-- 7,a7 in the paragraph header1 by striking ,website or online service directed to children and inserting ,website1 online service1 online application1 or mobile application directed to children2 7,b7 by striking website or online service each place it appears and inserting website1 online service1 online application1 or mobile application2 and 7,c7 by adding at the end the following new subparagraph3 7,c7 ,rule of construction ,in considering whether a website1 online service1 online application1 or mobile application1 or portion thereof1 is directed to children1 the ,commission shall apply a totality of circumstances test and will also consider competent and reliable empirical evidence regarding audience composition and evidence regarding the intended audience of the website1 online service1 online application1 or mobile application4 2 and 7#f7 by adding at the end the following3 7#ac7 ,connected device ,the term connected device means a device that is capable of connecting to the internet1 directly or indirectly1 or to another connected device4 7#ad7 ,online application ,the term online application-- 7,a7 means an internet-connected software program2 and 7,b7 includes a service or application offered via a connected device4 7#ae7 ,mobile application ,the term mobile application-- 7,a7 means a software program that runs on the operating system of-- 7i7 a cellular telephone2 7ii7 a tablet computer2 or 7iii7 a similar portable computing device that transmits data over a wireless connection2 and 7,b7 includes a service or application offered via a connected device4 7#af7 ,geolocation information ,the term geolocation information means information sufficient to identify a street name and name of a city or town4 7#ag7 ,teen ,the term teen means an individual who has attained age #ac and is under the age of #ag4 7#ah7 ,individual-specific advertising to children or teens 7,a7 ,in general ,the term individual-specific advertising to children or teens means advertising or any other effort to market a product or service that is directed to a specific child or teen or a connected device that is linked or reasonably linkable to a child or teen based on-- 7i7 the personal information from-- 7,i7 the child or teen2 or 7,,ii7 a group of children or teens who are similar in sex1 age1 household income level1 race1 or ethnicity to the specific child or teen to whom the product or service is marketed2 7ii7 profiling of a child or teen or group of children or teens2 or 7iii7 a unique identifier of the connected device4 7,b7 ,exclusions ,the term individual-specific advertising to children or teens shall not include-- 7i7 advertising or marketing to an individual or the device of an individual in response to the individual's specific request for information or feedback1 such as a child's or teen's current search query2 7ii7 contextual advertising1 such as when an advertisement is displayed based on the content of the website1 online service1 online application1 mobile application1 or connected device in which the advertisement appears and does not vary based on personal information related to the viewer2 or 7iii7 processing personal information solely for measuring or reporting advertising or content performance1 reach1 or frequency1 including independent measurement4 7,c7 ,rule of construction ,nothing in subparagraph 7,a7 shall be construed to prohibit an operator with actual knowledge or knowledge fairly implied on the basis of objective circumstances that a user is under the age of #ag from delivering advertising or marketing that is age-appropriate and intended for a child or teen audience1 so long as the operator does not use any personal information other than whether the user is under the age of #ag4 7#ai7 ,educational agency or institution ,the term educational agency or institution means-- 7,a7 a ,state educational agency or local educational agency1 as such terms are defined in section #haja of the ,elementary and ,secondary ,education ,act of #aife 7#bj ,u4,s4,c4 #ghja72 or 7,b7 an institutional day or residential school1 including a public school 7including a charter school7 or private school1 that provides elementary or secondary education1 as determined under ,state law4 4 7b7 ,online collection1 use1 disclosure1 and deletion of personal information of children and teens ,section #acjc of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #fejb7 is amended-- 7#a7 by striking the heading and inserting the following3 ,online collection1 use1 disclosure1 and deletion of personal information of children and teens42 7#b7 in subsection 7a7-- 7,a7 by amending paragraph 7#a7 to read as follows3 7#a7 ,in general ,it is unlawful for an operator of a website1 online service1 online application1 or mobile application directed to children or for any operator of a website1 online service1 online application1 or mobile application with actual knowledge or knowledge fairly implied on the basis of objective circumstances that a user is a child or teen-- 7,a7 to collect personal information from a child or teen in a manner that violates the regulations prescribed under subsection 7b72 7,b7 except as provided in subparagraphs 7,b7 and 7,c7 of section #acjb7ah71 to collect1 use1 disclose to third parties1 or maintain personal information of a child or teen for purposes of individual-specific advertising to children or teens 7or to allow another person to collect1 use1 disclose1 or maintain such information for such purpose72 7,c7 to collect the personal information of a child or teen except when the collection of the personal information is-- 7i7 consistent with the context of a particular transaction or service or the relationship of the child or teen with the operator1 including collection necessary to fulfill a transaction or provide a product or service requested by the child or teen2 or 7ii7 required or specifically authorized by ,federal or ,state law2 or 7,d7 to store or transfer the personal information of a child or teen outside of the ,united ,states unless the operator provides direct notice to the parent of the child1 in the case of a child1 or to the teen1 in the case of a teen1 that the child's or teen's personal information is being stored or transferred outside of the ,united ,states2 or 7,e7 to retain the personal information of a child or teen for longer than is reasonably necessary to fulfill a transaction or provide a service requested by the child or teen except as required or specifically authorized by ,federal or ,state law4 2 and 7,b7 in paragraph 7#b7-- 7i7 in the header1 by striking parent and inserting parent or teen2 7ii7 by striking ,notwithstanding paragraph 7#a7 and inserting ,notwithstanding paragraph 7#a77;,a72 7iii7 by striking of such a website or online service2 and 7iv7 by striking subsection 7b77#a77;,b77iii7 to the parent of a child and inserting subsection 7b77#a77;,b77iv7 to the parent of a child or under subsection 7b77#a77;,c77iv7 to a teen2 7#c7 in subsection 7b7-- 7,a7 in paragraph 7#a7-- 7i7 in subparagraph 7,a7-- 7,i7 by striking operator of any website and all that follows through from a child and inserting operator of a website1 online service1 online application1 or mobile application directed to children or that has actual knowledge or knowledge fairly implied on the basis of objective circumstances that a user is a child or teen2 7,,ii7 in clause 7i7-- 7aa7 by striking notice on the website and inserting clear and conspicuous notice on the website2 7bb7 by inserting or teens after children2 7cc7 by striking 1 and the operator's and inserting 1 the operator's2 and 7dd7 by striking 2 and and inserting 1 the rights and opportunities available to the parent of the child or teen under subparagraphs 7,b7 and 7,c71 and the procedures or mechanisms the operator uses to ensure that personal information is not collected from children or teens except in accordance with the regulations promulgated under this paragraph22 7,,iii7 in clause 7ii7-- 7aa7 by striking parental2 7bb7 by inserting or teens after children2 7cc7 by striking the semicolon at the end and inserting 2 and2 and 7,,iv7 by inserting after clause 7ii7 the following new clause3 7iii7 to obtain verifiable consent from a parent of a child or from a teen before using or disclosing personal information of the child or teen for any purpose that is a material change from the original purposes and disclosure practices specified to the parent of the child or the teen under clause 7i72 2 7ii7 in subparagraph 7,b7-- 7,i7 in the matter preceding clause 7i71 by striking website or online service and inserting operator2 7,,ii7 in clause 7i71 by inserting and the method by which the operator obtained the personal information1 and the purposes for which the operator collects1 uses1 discloses1 and retains the personal information before the semicolon2 7,,iii7 in clause 7ii7-- 7aa7 by inserting to delete personal information collected from the child or content or information submitted by the child to a website1 online service1 online application1 or mobile application and after the opportunity at any time2 and 7bb7 by striking 2 and and inserting a semicolon2 7,,iv7 by redesignating clause 7iii7 as clause 7iv7 and inserting after clause 7ii7 the following new clause3 7iii7 the opportunity to challenge the accuracy of the personal information and1 if the parent of the child establishes the inaccuracy of the personal information1 to have the inaccurate personal information corrected2 2 and 7,v7 in clause 7iv71 as so redesignated1 by inserting 1 if such information is available to the operator at the time the parent makes the request before the semicolon2 7iii7 by redesignating subparagraphs 7,c7 and 7,d7 as subparagraphs 7,d7 and 7,e71 respectively2 7iv7 by inserting after subparagraph 7,b7 the following new subparagraph3 7,c7 require the operator to provide1 upon the request of a teen under this subparagraph who has provided personal information to the operator1 upon proper identification of that teen-- 7i7 a description of the specific types of personal information collected from the teen by the operator1 the method by which the operator obtained the personal information1 and the purposes for which the operator collects1 uses1 discloses1 and retains the personal information2 7ii7 the opportunity at any time to delete personal information collected from the teen or content or information submitted by the teen to a website1 online service1 online application1 or mobile application and to refuse to permit the operator's further use or maintenance in retrievable form1 or online collection1 of personal information from the teen2 7iii7 the opportunity to challenge the accuracy of the personal information and1 if the teen establishes the inaccuracy of the personal information1 to have the inaccurate personal information corrected2 and 7iv7 a means that is reasonable under the circumstances for the teen to obtain any personal information collected from the teen1 if such information is available to the operator at the time the teen makes the request2 2 7v7 in subparagraph 7,d71 as so redesignated-- 7,i7 by striking a child's and inserting a child's or teen's2 and 7,,ii7 by inserting or teen after the child2 and 7vi7 by amending subparagraph 7,e71 as so redesignated1 to read as follows3 7,e7 require the operator to establish1 implement1 and maintain reasonable security practices to protect the confidentiality1 integrity1 and accessibility of personal information of children or teens collected by the operator1 and to protect such personal information against unauthorized access4 2 7,b7 in paragraph 7#b7-- 7i7 in the matter preceding subparagraph 7,a71 by striking verifiable parental consent and inserting verifiable consent2 7ii7 in subparagraph 7,a7-- 7,i7 by inserting or teen after collected from a child2 7,,ii7 by inserting or teen after request from the child2 and 7,,iii7 by inserting or teen or to contact another child or teen after to recontact the child2 7iii7 in subparagraph 7,b7-- 7,i7 by striking parent or child and inserting parent or teen2 and 7,,ii7 by striking parental consent each place the term appears and inserting verifiable consent2 7iv7 in subparagraph 7,c7-- 7,i7 in the matter preceding clause 7i71 by inserting or teen after child each place the term appears2 7,,ii7 in clause 7i7-- 7aa7 by inserting or teen after child each place the term appears2 and 7bb7 by inserting or teen1 as applicable1 after parent each place the term appears2 and 7,,iii7 in clause 7ii7-- 7aa7 by striking without notice to the parent and inserting without notice to the parent or teen1 as applicable12 and 7bb7 by inserting or teen after child each place the term appears2 and 7v7 in subparagraph 7,d7-- 7,i7 in the matter preceding clause 7i71 by inserting or teen after child each place the term appears2 7,,ii7 in clause 7ii71 by inserting or teen after child2 and 7,,iii7 in the flush text following clause 7iii7-- 7aa7 by inserting or teen1 as applicable1 after parent each place the term appears2 and 7bb7 by inserting or teen after child2 7,c7 by redesignating paragraph 7#c7 as paragraph 7#d7 and inserting after paragraph 7#b7 the following new paragraph3 7#c7 ,application to operators acting under agreements with educational agencies or institutions ,the regulations may provide that verifiable consent under paragraph 7#a77;,a77ii7 is not required for an operator that is acting under a written agreement with an educational agency or institution that1 at a minimum1 requires the-- 7,a7 operator to-- 7i7 limit its collection1 use1 and disclosure of the personal information from a child or teen to solely educational purposes and for no other commercial purposes2 7ii7 provide the educational agency or institution with a notice of the specific types of personal information the operator will collect from the child or teen1 the method by which the operator will obtain the personal information1 and the purposes for which the operator will collect1 use1 disclose1 and retain the personal information2 7iii7 provide the educational agency or institution with a link to the operator's online notice of information practices as required under subsection 7b77#a77;,a77i72 and 7iv7 provide the educational agency or institution1 upon request1 with a means to review the personal information collected from a child or teen1 to prevent further use or maintenance or future collection of personal information from a child or teen1 and to delete personal information collected from a child or teen or content or information submitted by a child or teen to the operator's website1 online service1 online application1 or mobile application2 7,b7 representative of the educational agency or institution to acknowledge and agree that they have authority to authorize the collection1 use1 and disclosure of personal information from children or teens on behalf of the educational agency or institution1 along with such authorization1 their name1 and title at the educational agency or institution2 and 7,c7 educational agency or institution to-- 7i7 provide on its website a notice that identifies the operator with which it has entered into a written agreement under this subsection and provides a link to the operator's online notice of information practices as required under paragraph 7#a77;,a77i72 7ii7 provide the operator's notice regarding its information practices1 as required under subparagraph 7,a77ii71 upon request1 to a parent1 in the case of a child1 or a parent or teen1 in the case of a teen2 and 7iii7 upon the request of a parent1 in the case of a child1 or a parent or teen1 in the case of a teen1 request the operator provide a means to review the personal information from the child or teen and provide the parent1 in the case of a child1 or parent or teen1 in the case of the teen1 a means to review the personal information4 2 7,d7 by amending paragraph 7#d71 as so redesignated1 to read as follows3 7#d7 ,termination of service ,the regulations shall permit the operator of a website1 online service1 online application1 or mobile application to terminate service provided to a child whose parent has refused1 or a teen who has refused1 under the regulations prescribed under paragraphs 7#a77;,b77ii7 and 7#a77;,c77ii71 to permit the operator's further use or maintenance in retrievable form1 or future online collection of1 personal information from that child or teen4 2 and 7,e7 by adding at the end the following new paragraphs3 7#e7 ,continuation of service ,the regulations shall prohibit an operator from discontinuing service provided to a child or teen on the basis of a request by the parent of the child or by the teen1 under the regulations prescribed under subparagraph 7,b7 or 7,c7 of paragraph 7#a71 respectively1 to delete personal information collected from the child or teen1 to the extent that the operator is capable of providing such service without such information4 7#f7 ,rule of construction ,a request made pursuant to subparagraph 7,b7 or 7,c7 of paragraph 7#a7 to delete or correct personal information of a child or teen shall not be construed-- 7,a7 to limit the authority of a law enforcement agency to obtain any content or information from an operator pursuant to a lawfully executed warrant or an order of a court of competent jurisdiction2 7,b7 to require an operator or third party delete or correct information that-- 7i7 any other provision of ,federal or ,state law requires the operator or third party to maintain2 or 7ii7 was submitted to the website1 online service1 online application1 or mobile application of the operator by any person other than the user who is attempting to erase or otherwise eliminate the content or information1 including content or information submitted by the user that was republished or resubmitted by another person2 or 7,c7 to prohibit an operator from-- 7i7 retaining a record of the deletion request and the minimum information necessary for the purposes of ensuring compliance with a request made pursuant to subparagraph 7,b7 or 7,c72 7ii7 preventing1 detecting1 protecting against1 or responding to security incidents1 identity theft1 or fraud1 or reporting those responsible for such actions2 7iii7 protecting the integrity or security of a website1 online service1 online application or mobile application2 or 7iv7 ensuring that the child's or teen's information remains deleted4 7#g7 ,common verifiable consent mechanism 7,a7 ,in general 7i7 ,feasibility of mechanism ,the ,commission shall assess the feasibility1 with notice and public comment1 of allowing operators the option to use a common verifiable consent mechanism that fully meets the requirements of this title4 7ii7 ,requirements ,the feasibility assessment described in clause 7i7 shall consider whether a single operator could use a common verifiable consent mechanism to obtain verifiable consent1 as required under this title1 from a parent of a child or from a teen on behalf of multiple1 listed operators that provide a joint or related service4 7,b7 ,report ,not later than #a year after the date of enactment of this paragraph1 the ,commission shall submit a report to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives with the findings of the assessment required by subparagraph 7,a74 7,c7 ,regulations ,if the ,commission finds that the use of a common verifiable consent mechanism is feasible and would meet the requirements of this title1 the ,commission shall issue regulations to permit the use of a common verifiable consent mechanism in accordance with the findings outlined in such report4 2 7#d7 in subsection 7c71 by striking a regulation prescribed under subsection 7a7 and inserting subparagraph 7,b71 7,c71 7,d71 or 7,e7 of subsection 7a77#a71 or of a regulation prescribed under subsection 7b712 and 7#e7 by striking subsection 7d7 and inserting the following3 7d7 ,relationship to ,state law ,the provisions of this title shall preempt any ,state law1 rule1 or regulation only to the extent that such ,state law1 rule1 or regulation conflicts with a provision of this title4 ,nothing in this title shall be construed to prohibit any ,state from enacting a law1 rule1 or regulation that provides greater protection to children or teens than the provisions of this title4 4 7c7 ,safe harbors ,section #acjd of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #fejc7 is amended-- 7#a7 in subsection 7b77#a71 by inserting and teens after children2 and 7#b7 by adding at the end the following3 7d7 ,publication 7#a7 ,in general ,subject to the restrictions described in paragraph 7#b71 the ,commission shall publish on the internet website of the ,commission any report or documentation required by regulation to be submitted to the ,commission to carry out this section4 7#b7 ,restrictions on publication ,the restrictions described in section #f7;f7 and section #ba of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #df7;f71 #eg;b-#b7 applicable to the disclosure of information obtained by the ,commission shall apply in same manner to the disclosure under this subsection of information obtained by the ,commission from a report or documentation described in paragraph 7#a74 4 7d7 ,actions by ,states ,section #acje of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #fejd7 is amended-- 7#a7 in subsection 7a77#a7-- 7,a7 in the matter preceding subparagraph 7,a71 by inserting section #acjc7;a77#a7 or before any regulation2 and 7,b7 in subparagraph 7,b71 by inserting section #acjc7;a77#a7 or before the regulation2 and 7#b7 in subsection 7d7-- 7,a7 by inserting section #acjc7;a77#a7 or before any regulation2 and 7,b7 by inserting section #acjc7;a77#a7 or before that regulation4 7e7 ,administration and applicability of ,act ,section #acjf of the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feje7 is amended-- 7#a7 in subsection 7b7-- 7,a7 in paragraph 7#a71 by striking 1 in the case of and all that follows through the ,board of ,directors of the ,federal ,deposit ,insurance ,corporation2 and inserting the following3 by the appropriate ,federal banking agency1 with respect to any insured depository institution 7as those terms are defined in section #c of that ,act 7#ab ,u4,s4,c4 #ahac7722 and 7,b7 by striking paragraph 7#b7 and redesignating paragraphs 7#c7 through 7#f7 as paragraphs 7#b7 through 7#e71 respectively2 7#b7 in subsection 7d7-- 7,a7 by inserting section #acjc7;a77#a7 or before a rule2 and 7,b7 by striking such rule and inserting section #acjc7;a77#a7 or a rule of the ,commission under section #acjc2 and 7#c7 by adding at the end the following new subsections3 7f7 ,determination of whether an operator has knowledge fairly implied on the basis of objective circumstances 7#a7 ,rule of construction ,for purposes of enforcing this title or a regulation promulgated under this title1 in making a determination as to whether an operator has knowledge fairly implied on the basis of objective circumstances that a specific user is a child or teen1 the ,commission or ,state attorneys general shall rely on competent and reliable evidence1 taking into account the totality of the circumstances1 including whether a reasonable and prudent person under the circumstances would have known that the user is a child or teen4 ,nothing in this title1 including a determination described in the preceding sentence1 shall be construed to require an operator to-- 7,a7 affirmatively collect any personal information with respect to the age of a child or teen that an operator is not already collecting in the normal course of business2 or 7,b7 implement an age gating or age verification functionality4 7#b7 ,commission guidance 7,a7 ,in general ,within #ahj days of enactment1 the ,commission shall issue guidance to provide information1 including best practices and examples for operators to understand the ,commission's determination of whether an operator has knowledge fairly implied on the basis of objective circumstances that a user is a child or teen4 7,b7 ,limitation ,no guidance issued by the ,commission with respect to this title shall confer any rights on any person1 ,state1 or locality1 nor shall operate to bind the ,commission or any person to the approach recommended in such guidance4 ,in any enforcement action brought pursuant to this title1 the ,commission or ,state attorney general1 as applicable1 shall allege a specific violation of a provision of this title4 ,the ,commission or ,state attorney general1 as applicable1 may not base an enforcement action on1 or execute a consent order based on1 practices that are alleged to be inconsistent with any such guidance1 unless the practices allegedly violate this title4 ,for purposes of enforcing this title or a regulation promulgated under this title1 ,state attorneys general shall take into account any guidance issued by the ,commission under subparagraph 7,a74 7g7 ,additional requirement ,any regulations issued under this title shall include a description and analysis of the impact of proposed and final ,rules on small entities per the ,regulatory ,flexibility ,act of #aihj 7#e ,u4,s4,c4 #fja et seq474 4 #c4 ,study and reports of mobile and online application oversight and enforcement 7a7 ,oversight report ,not later than #c years after the date of enactment of this ,act1 the ,federal ,trade ,commission shall submit to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives a report on the processes of platforms that offer mobile and online applications for ensuring that1 of those applications that are websites1 online services1 online applications1 or mobile applications directed to children1 the applications operate in accordance with-- 7#a7 this ,act1 the amendments made by this ,act1 and rules promulgated under this ,act2 and 7#b7 rules promulgated by the ,commission under section #ah of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7 relating to unfair or deceptive acts or practices in marketing4 7b7 ,enforcement report ,not later than #a year after the date of enactment of this ,act1 and each year thereafter1 the ,federal ,trade ,commission shall submit to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives a report that addresses1 at a minimum-- 7#a7 the number of actions brought by the ,commission during the reporting year to enforce the ,children's ,online ,privacy ,protection ,act of #aiih 7#ae ,u4,s4,c4 #feja7 7referred to in this subsection as the ,act7 and the outcome of each such action2 7#b7 the total number of investigations or inquiries into potential violations of the ,act2 during the reporting year2 7#c7 the total number of open investigations or inquiries into potential violations of the ,act as of the time the report is submitted2 7#d7 the number and nature of complaints received by the ,commission relating to an allegation of a violation of the ,act during the reporting year2 and 7#e7 policy or legislative recommendations to strengthen online protections for children and teens4 #d4 ,,gao study 7a7 ,study ,the ,comptroller ,general of the ,united ,states 7in this section referred to as the ,comptroller ,general7 shall conduct a study on the privacy of teens who use financial technology products4 ,such study shall-- 7#a7 identify the type of financial technology products that teens are using2 7#b7 identify the potential risks to teens' privacy from using such financial technology products2 and 7#c7 determine whether existing laws are sufficient to address such risks to teens' privacy4 7b7 ,report ,not later than #a year after the date of enactment of this section1 the ,comptroller ,general shall submit to ,congress a report containing the results of the study conducted under subsection 7a71 together with recommendations for such legislation and administrative action as the ,comptroller ,general determines appropriate4 #e4 ,severability ,if any provision of this ,act1 or an amendment made by this ,act1 is determined to be unenforceable or invalid1 the remaining provisions of this ,act and the amendments made by this ,act shall not be affected4