Texas 2023 - 88th Regular

Texas House Bill HB4948 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New	Differences
1	1	88R7481 MLH-D
2	2	By: Martinez Fischer H.B. No. 4948
3	3
4	4
5	5	A BILL TO BE ENTITLED
6	6	AN ACT
7	7	relating to the regulation of Internet products, services, and
8	8	features accessed by children; providing a civil penalty.
9	9	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
10	10	SECTION 1. Subtitle C, Title 5, Business & Commerce Code, is
11	11	amended by adding Chapter 121 to read as follows:
12	12	CHAPTER 121. INTERNET PRODUCTS, SERVICES, AND FEATURES ACCESSED
13	13	BY CHILDREN
14	14	SUBCHAPTER A. GENERAL PROVISIONS
15	15	Sec. 121.001. DEFINITIONS. In this chapter:
16	16	(1) "Child" means an individual younger than 18 years
17	17	of age.
18	18	(2) "Consumer" has the meaning assigned by Section
19	19	20.01.
20	20	(3) "Personal identifying information" has the
21	21	meaning assigned by Section 521.002.
22	22	SUBCHAPTER B. DUTIES AND PROHIBITIONS
23	23	Sec. 121.051. DATA PROTECTION IMPACT ASSESSMENT REQUIRED.
24	24	(a) Except as provided by Subsection (d), a person shall conduct a
25	25	data protection impact assessment to assess and mitigate risks
26	26	posed to a child who accesses a product, service, or feature
27	27	provided by the person if the person:
28	28	(1) provides a product, service, or feature to a
29	29	consumer in this state through an Internet website that is likely to
30	30	be accessed by a child;
31	31	(2) collects a consumer's personal identifying
32	32	information; and
33	33	(3) in the preceding year:
34	34	(A) generated more than $25 million in annual
35	35	gross revenue;
36	36	(B) collected or used the personal identifying
37	37	information of more than 50,000 consumers; or
38	38	(C) generated more than half of the person's
39	39	annual gross revenue from the collection and sale of a consumer's
40	40	personal identifying information.
41	41	(b) An assessment under this section must:
42	42	(1) identify:
43	43	(A) the purpose of the product, service, or
44	44	feature;
45	45	(B) the manner in which the product, service, or
46	46	feature uses personal identifying information; and
47	47	(C) any risks to children posed by the manner in
48	48	which the product, service, or feature uses personal identifying
49	49	information; and
50	50	(2) assess:
51	51	(A) whether the product, service, or feature
52	52	poses a risk of exposing a child to harmful content;
53	53	(B) whether the algorithms or advertising
54	54	systems used by the product, service, or feature pose a risk of
55	55	exposing a child to harmful content; and
56	56	(C) the manner in which the product, service, or
57	57	feature:
58	58	(i) uses design features to increase or
59	59	extend use of the product by a child; and
60	60	(ii) collects and processes the child's
61	61	personal identifying information.
62	62	(c) For the purposes of this section:
63	63	(1) a product, service, or feature is considered
64	64	likely to be accessed by a child if the product, service, or
65	65	feature:
66	66	(A) is intended, wholly or partly, to be used by a
67	67	child;
68	68	(B) is routinely accessed by children;
69	69	(C) is substantially similar to another product,
70	70	service, or feature that is routinely accessed by children;
71	71	(D) is marketed to children; or
72	72	(E) has design elements that are known to
73	73	interest children, including games, cartoons, music, and content
74	74	pertaining to celebrities of interest to children; and
75	75	(2) content is considered harmful if the content is
76	76	reasonably likely to have a detrimental impact on a child's
77	77	physical, mental, or emotional health.
78	78	(d) This section does not apply to a person who:
79	79	(1) is required to maintain and disseminate a privacy
80	80	policy under the Health Insurance Portability and Accountability
81	81	Act of 1996 (42 U.S.C. Section 1320d et seq.); or
82	82	(2) provides a product, service, or feature to a
83	83	consumer through an Internet website if the product, service, or
84	84	feature is:
85	85	(A) a broadband service;
86	86	(B) a telecommunications service; or
87	87	(C) a service that involves the delivery or use
88	88	of a physical product.
89	89	Sec. 121.052. IMPACT MANAGEMENT PLAN REQUIRED. A person
90	90	required to conduct a data protection impact assessment under
91	91	Section 121.051 shall develop an impact management plan to mitigate
92	92	or eliminate any risks identified in the assessment. The plan must
93	93	include defined goals and a timeline to achieve those goals.
94	94	Sec. 121.053. PROVISION OF ASSESSMENT TO ATTORNEY GENERAL.
95	95	(a) On the request of the attorney general, a person required to
96	96	conduct a data protection impact assessment under Section 121.051
97	97	shall, not later than the third business day after the person
98	98	receives the request, provide a list of data protection impact
99	99	assessments conducted by the person under Section 121.051. The
100	100	list must include the product, service, or feature assessed and the
101	101	date of the assessment.
102	102	(b) On the request of the attorney general, a person
103	103	required to conduct a data protection impact assessment under
104	104	Section 121.051 shall, not later than the fifth business day after
105	105	the person receives the request, provide a copy of a data protection
106	106	impact assessment conducted by the person.
107	107	(c) Production of a data protection impact assessment under
108	108	this section does not constitute a waiver of attorney-client
109	109	privilege or attorney work product protection.
110	110	Sec. 121.054. PROTECTION OF PERSONAL IDENTIFYING
111	111	INFORMATION. (a) A person required to conduct a data protection
112	112	impact assessment under Section 121.051 shall:
113	113	(1) estimate the age of an individual using a product,
114	114	service, or feature, and, in the case of a child:
115	115	(A) configure default settings of a product,
116	116	service, or feature to a high level of privacy, unless the person
117	117	can demonstrate a compelling reason that alternate settings are in
118	118	the best interest of a child; and
119	119	(B) provide privacy information, terms of
120	120	service, policies, and community standards for a product, service,
121	121	or feature in a clear and concise manner able to be understood by a
122	122	child; or
123	123	(2) apply the requirements of Subdivisions (1)(A) and
124	124	(B) to all users of the product, service, or feature.
125	125	(b) If a product, service, or feature allows for another
126	126	person to monitor or track a child, a person required to conduct a
127	127	data protection impact assessment under Section 121.051 shall
128	128	ensure the product, service, or feature provides an obvious signal
129	129	to a child when the product, service, or feature is monitoring or
130	130	tracking the child.
131	131	(c) A person required to conduct a data protection impact
132	132	assessment under Section 121.051 shall enforce any terms, policies,
133	133	and community standards established by the person, including any
134	134	policies concerning use of a product by a child.
135	135	(d) A person required to conduct a data protection impact
136	136	assessment under Section 121.051 shall provide tools to help a
137	137	child or the child's parent or guardian exercise privacy rights and
138	138	report concerns relating to privacy. A tool under this subsection
139	139	must be prominently displayed, easily accessible, and responsive to
140	140	requests by a child or the child's parent or guardian.
141	141	Sec. 121.055. IMPROPER USE OF PERSONAL IDENTIFYING
142	142	INFORMATION. (a) A person required to conduct a data protection
143	143	impact assessment under Section 121.051 may not use a child's
144	144	personal identifying information for any purpose that is not:
145	145	(1) necessary to provide a product, service, or
146	146	feature; or
147	147	(2) the reason for which the person collected the
148	148	personal identifying information.
149	149	(b) A person required to conduct a data protection impact
150	150	assessment under Section 121.051 may not use a child's personal
151	151	identifying information in a manner that could:
152	152	(1) expose the child to harmful content, as described
153	153	by Section 121.051(c); or
154	154	(2) be detrimental to the physical or mental health
155	155	and well-being of the child.
156	156	(c) This section does not affect the ability of a person to
157	157	which this chapter applies to disclose personal identifying
158	158	information in a manner necessary to comply with a request by a
159	159	governmental entity or law enforcement.
160	160	Sec. 121.056. IMPROPER PROFILING OF CHILD. (a) In this
161	161	section, "profile" means the automated process of using personal
162	162	identifying information to analyze specific aspects of an
163	163	individual's demographic characteristics.
164	164	(b) A person required to conduct a data protection impact
165	165	assessment under Section 121.051 may not profile a child unless:
166	166	(1) the profiling is either:
167	167	(A) necessary to provide a product, service, or
168	168	feature; or
169	169	(B) in the best interests of the child; and
170	170	(2) the person has implemented safeguards to prevent
171	171	the child from accessing harmful content, as described by Section
172	172	121.051(c).
173	173	Sec. 121.057. IMPROPER USE OF GEOLOCATION DATA. (a) A
174	174	person required to conduct a data protection impact assessment
175	175	under Section 121.051 may not collect the precise geolocation data
176	176	of a child unless the business's product, service, or feature
177	177	provides an obvious sign to the child for the duration of the
178	178	collection process that the child's precise geolocation data is
179	179	being collected.
180	180	(b) A person required to conduct a data protection impact
181	181	assessment under Section 121.051 may not collect, use, or sell the
182	182	precise geolocation data of a child unless the collection, use, or
183	183	sale is necessary for the person to provide a product, service, or
184	184	feature to the child.
185	185	Sec. 121.058. USE OF DECEPTIVE DESIGN ELEMENTS PROHIBITED.
186	186	A person required to conduct a data protection impact assessment
187	187	under Section 121.051 may not use deceptive design elements
188	188	intended to induce a child to provide more personal identifying
189	189	information than is necessary under this chapter.
190	190	SUBCHAPTER C. DATA PROTECTION WORK GROUP
191	191	Sec. 121.101. DATA PROTECTION WORK GROUP. (a) In this
192	192	section, "work group" means the work group established under this
193	193	section.
194	194	(b) The consumer protection division of the attorney
195	195	general's office shall establish a work group to promote business
196	196	practices that protect the personal identifying information of
197	197	consumers. The work group consists of:
198	198	(1) two members appointed by the governor;
199	199	(2) two members appointed by the lieutenant governor;
200	200	(3) two members appointed by the speaker of the house
201	201	of representatives; and
202	202	(4) two members appointed by the attorney general.
203	203	(c) To be eligible to serve as a member of the work group, a
204	204	person must have expertise in two or more of the following areas:
205	205	(1) children's data privacy;
206	206	(2) physical health;
207	207	(3) mental health and well-being;
208	208	(4) computer science; or
209	209	(5) children's rights.
210	210	(d) A member of the work group receives no compensation for
211	211	serving on the work group but may be reimbursed for travel or other
212	212	expenses incurred while conducting the business of the work group.
213	213	(e) The work group shall solicit input from stakeholders and
214	214	prepare recommendations for the legislature on ways to protect the
215	215	personal identifying information of children in this state.
216	216	(f) Not later than January 1 of each odd-numbered year, the
217	217	work group shall submit to the legislature a report of the work
218	218	group's findings and recommendations. The report must:
219	219	(1) identify products likely to be used by children;
220	220	(2) evaluate and prioritize the best interests of
221	221	children;
222	222	(3) evaluate the manner in which the best interests of
223	223	children may be furthered by the products in Subdivision (1);
224	224	(4) evaluate whether the risks posed by the products
225	225	in Subdivision (1) are proportional to the safeguards put in place
226	226	by businesses;
227	227	(5) suggest ways to assess and mitigate risks to
228	228	children that arise from the products identified under Subdivision
229	229	(1); and
230	230	(6) identify best methods of publishing privacy
231	231	information, terms of service, policies, and community standards
232	232	for a product in a clear and concise manner able to be understood by
233	233	a child.
234	234	(g) This section expires on January 1, 2033.
235	235	SUBCHAPTER D. ENFORCEMENT
236	236	Sec. 121.151. CIVIL PENALTY. (a) A person who violates
237	237	this chapter is liable to the state for a civil penalty in an amount
238	238	not to exceed:
239	239	(1) $2,500 for each child exposed to harmful content
240	240	as described by Section 121.051(c) as a result of a negligent
241	241	violation; and
242	242	(2) $7,500 for each child exposed to harmful content
243	243	as described by Section 121.051(c) as a result of an intentional
244	244	violation.
245	245	(b) The attorney general may bring suit to recover a civil
246	246	penalty imposed under this section. The attorney general may
247	247	recover attorney's fees and costs incurred in bringing an action
248	248	under this section.
249	249	(c) The action may be brought in a district court in:
250	250	(1) Travis County; or
251	251	(2) a county in which any part of the violation or
252	252	threatened violation occurs.
253	253	(d) The attorney general shall deposit a civil penalty
254	254	collected under this section in the state treasury to the credit of
255	255	the general revenue fund.
256	256	Sec. 121.152. REQUIRED NOTICE. (a) If a person who
257	257	violates this chapter is in substantial compliance with the
258	258	requirements under Sections 121.051, 121.052, and 121.053, the
259	259	attorney general shall, before bringing suit under Section 121.151,
260	260	issue a notice to the person identifying the provisions of this
261	261	chapter that the attorney general alleges to have been violated by
262	262	the person.
263	263	(b) It shall be a complete defense to suit under Section
264	264	121.151 if, not later than the 90th day after receiving a notice
265	265	under Subsection (a), a person cures any violation of this chapter
266	266	and provides notice to the attorney general of the measures taken to
267	267	cure the violation and prevent further violations.
268	268	Sec. 121.153. NO PRIVATE CAUSE OF ACTION. Nothing in this
269	269	chapter may be construed to create a private cause of action for a
270	270	violation of this chapter.
271	271	Sec. 121.154. RULES. The attorney general shall adopt
272	272	rules to implement this chapter.
273	273	SECTION 2. This Act takes effect September 1, 2023.