Us Congress 2025-2026 Regular Session

Us Congress Senate Bill SB836 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	II
2	2	119THCONGRESS
3	3	1
4	4	STSESSION S. 836
5	5	To amend the Children’s Online Privacy Protection Act of 1998 to strengthen
6	6	protections relating to the online collection, use, and disclosure of per-
7	7	sonal information of children and teens, and for other purposes.
8	8	IN THE SENATE OF THE UNITED STATES
9	9	MARCH4, 2025
10	10	Mr. M
11	11	ARKEY(for himself, Mr. CASSIDY, Ms. CANTWELL, Mr. SCHATZ, Mrs.
12	12	C
13	13	APITO, Ms. KLOBUCHAR, Mr. CRAPO, Mr. WYDEN, Mr. GRASSLEY, Mr.
14	14	L
15	15	UJA´N, Mr. BLUMENTHAL, Mr. MERKLEY, Mr. WELCH, Mr. KING, Mr.
16	16	K
17	17	ELLY, Mrs. BRITT, and Mr. HEINRICH) introduced the following bill;
18	18	which was read twice and referred to the Committee on Commerce,
19	19	Science, and Transportation
20	20	A BILL
21	21	To amend the Children’s Online Privacy Protection Act of
22	22	1998 to strengthen protections relating to the online
23	23	collection, use, and disclosure of personal information
24	24	of children and teens, and for other purposes.
25	25	Be it enacted by the Senate and House of Representa-1
26	26	tives of the United States of America in Congress assembled, 2
27	27	SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 3
28	28	(a) S
29	29	HORTTITLE.—This Act may be cited as the 4
30	30	‘‘Children and Teens’ Online Privacy Protection Act’’. 5
31	31	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
32	32	ssavage on LAPJG3WLY3PROD with BILLS 2
33	33	•S 836 IS
34	34	(b) TABLE OFCONTENTS.—The table of contents for 1
35	35	this Act is as follows: 2
36	36	Sec. 1. Short title; table of contents.
37	37	Sec. 2. Online collection, use, disclosure, and deletion of personal information
38	38	of children and teens.
39	39	Sec. 3. Study and reports of mobile and online application oversight and en-
40	40	forcement.
41	41	Sec. 4. GAO study.
42	42	Sec. 5. Severability.
43	43	SEC. 2. ONLINE COLLECTION, USE, DISCLOSURE, AND DE-
44	44	3
45	45	LETION OF PERSONAL INFORMATION OF 4
46	46	CHILDREN AND TEENS. 5
47	47	(a) D
48	48	EFINITIONS.—Section 1302 of the Children’s 6
49	49	Online Privacy Protection Act of 1998 (15 U.S.C. 6501) 7
50	50	is amended— 8
51	51	(1) by amending paragraph (2) to read as fol-9
52	52	lows: 10
53	53	‘‘(2) O
54	54	PERATOR.—The term ‘operator’— 11
55	55	‘‘(A) means any person— 12
56	56	‘‘(i) who, for commercial purposes, in 13
57	57	interstate or foreign commerce operates or 14
58	58	provides a website on the internet, an on-15
59	59	line service, an online application, or a mo-16
60	60	bile application; and 17
61	61	‘‘(ii) who— 18
62	62	‘‘(I) collects or maintains, either 19
63	63	directly or through a service provider, 20
64	64	personal information from or about 21
65	65	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
66	66	ssavage on LAPJG3WLY3PROD with BILLS 3
67	67	•S 836 IS
68	68	the users of that website, service, or 1
69	69	application; 2
70	70	‘‘(II) allows another person to 3
71	71	collect personal information directly 4
72	72	from users of that website, service, or 5
73	73	application (in which case, the oper-6
74	74	ator is deemed to have collected the 7
75	75	information); or 8
76	76	‘‘(III) allows users of that 9
77	77	website, service, or application to pub-10
78	78	licly disclose personal information (in 11
79	79	which case, the operator is deemed to 12
80	80	have collected the information); and 13
81	81	‘‘(B) does not include any nonprofit entity 14
82	82	that would otherwise be exempt from coverage 15
83	83	under section 5 of the Federal Trade Commis-16
84	84	sion Act (15 U.S.C. 45).’’; 17
85	85	(2) in paragraph (4)— 18
86	86	(A) by amending subparagraph (A) to read 19
87	87	as follows: 20
88	88	‘‘(A) the release of personal information 21
89	89	collected from a child or teen by an operator for 22
90	90	any purpose, except where the personal infor-23
91	91	mation is provided to a person other than an 24
92	92	operator who— 25
93	93	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
94	94	ssavage on LAPJG3WLY3PROD with BILLS 4
95	95	•S 836 IS
96	96	‘‘(i) provides support for the internal 1
97	97	operations of the website, online service, 2
98	98	online application, or mobile application of 3
99	99	the operator, excluding any activity relat-4
100	100	ing to individual-specific advertising to 5
101	101	children or teens; and 6
102	102	‘‘(ii) does not disclose or use that per-7
103	103	sonal information for any other purpose; 8
104	104	and’’; and 9
105	105	(B) in subparagraph (B)— 10
106	106	(i) by inserting ‘‘or teen’’ after 11
107	107	‘‘child’’ each place the term appears; 12
108	108	(ii) by striking ‘‘website or online 13
109	109	service’’ and inserting ‘‘website, online 14
110	110	service, online application, or mobile appli-15
111	111	cation’’; and 16
112	112	(iii) by striking ‘‘actual knowledge’’ 17
113	113	and inserting ‘‘actual knowledge or knowl-18
114	114	edge fairly implied on the basis of objective 19
115	115	circumstances’’; 20
116	116	(3) by striking paragraph (8) and inserting the 21
117	117	following: 22
118	118	‘‘(8) P
119	119	ERSONAL INFORMATION .— 23
120	120	‘‘(A) I
121	121	N GENERAL.—The term ‘personal in-24
122	122	formation’ means individually identifiable infor-25
123	123	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
124	124	ssavage on LAPJG3WLY3PROD with BILLS 5
125	125	•S 836 IS
126	126	mation about an individual collected online, in-1
127	127	cluding— 2
128	128	‘‘(i) a first and last name; 3
129	129	‘‘(ii) a home or other physical address 4
130	130	including street name and name of a city 5
131	131	or town; 6
132	132	‘‘(iii) an e-mail address; 7
133	133	‘‘(iv) a telephone number; 8
134	134	‘‘(v) a Social Security number; 9
135	135	‘‘(vi) any other identifier that the 10
136	136	Commission determines permits the phys-11
137	137	ical or online contacting of a specific indi-12
138	138	vidual; 13
139	139	‘‘(vii) a persistent identifier that can 14
140	140	be used to recognize a specific child or teen 15
141	141	over time and across different websites, on-16
142	142	line services, online applications, or mobile 17
143	143	applications, including but not limited to a 18
144	144	customer number held in a cookie, an 19
145	145	Internet Protocol (IP) address, a processor 20
146	146	or device serial number, or unique device 21
147	147	identifier, but excluding an identifier that 22
148	148	is used by an operator solely for providing 23
149	149	support for the internal operations of the 24
150	150	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
151	151	ssavage on LAPJG3WLY3PROD with BILLS 6
152	152	•S 836 IS
153	153	website, online service, online application, 1
154	154	or mobile application; 2
155	155	‘‘(viii) a photograph, video, or audio 3
156	156	file where such file contains a specific 4
157	157	child’s or teen’s image or voice; 5
158	158	‘‘(ix) geolocation information; 6
159	159	‘‘(x) information generated from the 7
160	160	measurement or technological processing of 8
161	161	an individual’s biological, physical, or phys-9
162	162	iological characteristics that is used to 10
163	163	identify an individual, including— 11
164	164	‘‘(I) fingerprints; 12
165	165	‘‘(II) voice prints; 13
166	166	‘‘(III) iris or retina imagery 14
167	167	scans; 15
168	168	‘‘(IV) facial templates; 16
169	169	‘‘(V) deoxyribonucleic acid 17
170	170	(DNA) information; or 18
171	171	‘‘(VI) gait; or 19
172	172	‘‘(xi) information linked or reasonably 20
173	173	linkable to a child or teen or the parents 21
174	174	of that child or teen (including any unique 22
175	175	identifier) that an operator collects online 23
176	176	from the child or teen and combines with 24
177	177	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
178	178	ssavage on LAPJG3WLY3PROD with BILLS 7
179	179	•S 836 IS
180	180	an identifier described in this subpara-1
181	181	graph. 2
182	182	‘‘(B) E
183	183	XCLUSION.—The term ‘personal in-3
184	184	formation’ shall not include an audio file that 4
185	185	contains a child’s or teen’s voice so long as the 5
186	186	operator— 6
187	187	‘‘(i) does not request information via 7
188	188	voice that would otherwise be considered 8
189	189	personal information under this paragraph; 9
190	190	‘‘(ii) provides clear notice of its collec-10
191	191	tion and use of the audio file and its dele-11
192	192	tion policy in its privacy policy; 12
193	193	‘‘(iii) only uses the voice within the 13
194	194	audio file solely as a replacement for writ-14
195	195	ten words, to perform a task, or engage 15
196	196	with a website, online service, online appli-16
197	197	cation, or mobile application, such as to 17
198	198	perform a search or fulfill a verbal instruc-18
199	199	tion or request; and 19
200	200	‘‘(iv) only maintains the audio file 20
201	201	long enough to complete the stated purpose 21
202	202	and then immediately deletes the audio file 22
203	203	and does not make any other use of the 23
204	204	audio file prior to deletion. 24
205	205	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
206	206	ssavage on LAPJG3WLY3PROD with BILLS 8
207	207	•S 836 IS
208	208	‘‘(C) SUPPORT FOR THE INTERNAL OPER -1
209	209	ATIONS OF A WEBSITE , ONLINE SERVICE, ON-2
210	210	LINE APPLICATION, OR MOBILE APPLICATION.— 3
211	211	‘‘(i) I
212	212	N GENERAL.—For purposes of 4
213	213	subparagraph (A)(vii), the term ‘support 5
214	214	for the internal operations of a website, on-6
215	215	line service, online application, or mobile 7
216	216	application’ means those activities nec-8
217	217	essary to— 9
218	218	‘‘(I) maintain or analyze the 10
219	219	functioning of the website, online serv-11
220	220	ice, online application, or mobile appli-12
221	221	cation; 13
222	222	‘‘(II) perform network commu-14
223	223	nications; 15
224	224	‘‘(III) authenticate users of, or 16
225	225	personalize the content on, the 17
226	226	website, online service, online applica-18
227	227	tion, or mobile application; 19
228	228	‘‘(IV) serve contextual adver-20
229	229	tising, provided that any persistent 21
230	230	identifier is only used as necessary for 22
231	231	technical purposes to serve the contex-23
232	232	tual advertisement, or cap the fre-24
233	233	quency of advertising; 25
234	234	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
235	235	ssavage on LAPJG3WLY3PROD with BILLS 9
236	236	•S 836 IS
237	237	‘‘(V) protect the security or in-1
238	238	tegrity of the user, website, online 2
239	239	service, online application, or mobile 3
240	240	application; 4
241	241	‘‘(VI) ensure legal or regulatory 5
242	242	compliance, or 6
243	243	‘‘(VII) fulfill a request of a child 7
244	244	or teen as permitted by subpara-8
245	245	graphs (A) through (C) of section 9
246	246	1303(b)(2). 10
247	247	‘‘(ii) C
248	248	ONDITION.—Except as specifi-11
249	249	cally permitted under clause (i), informa-12
250	250	tion collected for the activities listed in 13
251	251	clause (i) cannot be used or disclosed to 14
252	252	contact a specific individual, including 15
253	253	through individual-specific advertising to 16
254	254	children or teens, to amass a profile on a 17
255	255	specific individual, in connection with proc-18
256	256	esses that encourage or prompt use of a 19
257	257	website or online service, or for any other 20
258	258	purpose.’’; 21
259	259	(4) by amending paragraph (9) to read as fol-22
260	260	lows: 23
261	261	‘‘(9) V
262	262	ERIFIABLE CONSENT .—The term 24
263	263	‘verifiable consent’ means any reasonable effort (tak-25
264	264	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
265	265	ssavage on LAPJG3WLY3PROD with BILLS 10
266	266	•S 836 IS
267	267	ing into consideration available technology), includ-1
268	268	ing a request for authorization for future collection, 2
269	269	use, and disclosure described in the notice, to ensure 3
270	270	that, in the case of a child, a parent of the child, 4
271	271	or, in the case of a teen, the teen— 5
272	272	‘‘(A) receives direct notice of the personal 6
273	273	information collection, use, and disclosure prac-7
274	274	tices of the operator; and 8
275	275	‘‘(B) before the personal information of the 9
276	276	child or teen is collected, freely and unambig-10
277	277	uously authorizes— 11
278	278	‘‘(i) the collection, use, and disclosure, 12
279	279	as applicable, of that personal information; 13
280	280	and 14
281	281	‘‘(ii) any subsequent use of that per-15
282	282	sonal information.’’; 16
283	283	(5) in paragraph (10)— 17
284	284	(A) in the paragraph header, by striking 18
285	285	‘‘W
286	286	EBSITE OR ONLINE SERVICE DIRECTED TO 19
287	287	CHILDREN’’ and inserting ‘‘WEBSITE, ONLINE 20
288	288	SERVICE, ONLINE APPLICATION, OR MOBILE AP-21
289	289	PLICATION DIRECTED TO CHILDREN ’’; 22
290	290	(B) by striking ‘‘website or online service’’ 23
291	291	each place it appears and inserting ‘‘website, 24
292	292	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
293	293	ssavage on LAPJG3WLY3PROD with BILLS 11
294	294	•S 836 IS
295	295	online service, online application, or mobile ap-1
296	296	plication’’; and 2
297	297	(C) by adding at the end the following new 3
298	298	subparagraph: 4
299	299	‘‘(C) R
300	300	ULE OF CONSTRUCTION .—In con-5
301	301	sidering whether a website, online service, on-6
302	302	line application, or mobile application, or por-7
303	303	tion thereof, is directed to children, the Com-8
304	304	mission shall apply a totality of circumstances 9
305	305	test and will also consider competent and reli-10
306	306	able empirical evidence regarding audience com-11
307	307	position and evidence regarding the intended 12
308	308	audience of the website, online service, online 13
309	309	application, or mobile application.’’; and 14
310	310	(6) by adding at the end the following: 15
311	311	‘‘(13) C
312	312	ONNECTED DEVICE .—The term ‘con-16
313	313	nected device’ means a device that is capable of con-17
314	314	necting to the internet, directly or indirectly, or to 18
315	315	another connected device. 19
316	316	‘‘(14) O
317	317	NLINE APPLICATION.—The term ‘online 20
318	318	application’— 21
319	319	‘‘(A) means an internet-connected software 22
320	320	program; and 23
321	321	‘‘(B) includes a service or application of-24
322	322	fered via a connected device. 25
323	323	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
324	324	ssavage on LAPJG3WLY3PROD with BILLS 12
325	325	•S 836 IS
326	326	‘‘(15) MOBILE APPLICATION.—The term ‘mo-1
327	327	bile application’— 2
328	328	‘‘(A) means a software program that runs 3
329	329	on the operating system of— 4
330	330	‘‘(i) a cellular telephone; 5
331	331	‘‘(ii) a tablet computer; or 6
332	332	‘‘(iii) a similar portable computing de-7
333	333	vice that transmits data over a wireless 8
334	334	connection; and 9
335	335	‘‘(B) includes a service or application of-10
336	336	fered via a connected device. 11
337	337	‘‘(16) G
338	338	EOLOCATION INFORMATION .—The term 12
339	339	‘geolocation information’ means information suffi-13
340	340	cient to identify a street name and name of a city 14
341	341	or town. 15
342	342	‘‘(17) T
343	343	EEN.—The term ‘teen’ means an indi-16
344	344	vidual who has attained age 13 and is under the age 17
345	345	of 17. 18
346	346	‘‘(18) I
347	347	NDIVIDUAL-SPECIFIC ADVERTISING TO 19
348	348	CHILDREN OR TEENS.— 20
349	349	‘‘(A) I
350	350	N GENERAL.—The term ‘individual- 21
351	351	specific advertising to children or teens’ means 22
352	352	advertising or any other effort to market a 23
353	353	product or service that is directed to a specific 24
354	354	child or teen or a connected device that is 25
355	355	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
356	356	ssavage on LAPJG3WLY3PROD with BILLS 13
357	357	•S 836 IS
358	358	linked or reasonably linkable to a child or teen 1
359	359	based on— 2
360	360	‘‘(i) the personal information from— 3
361	361	‘‘(I) the child or teen; or 4
362	362	‘‘(II) a group of children or teens 5
363	363	who are similar in sex, age, household 6
364	364	income level, race, or ethnicity to the 7
365	365	specific child or teen to whom the 8
366	366	product or service is marketed; 9
367	367	‘‘(ii) profiling of a child or teen or 10
368	368	group of children or teens; or 11
369	369	‘‘(iii) a unique identifier of the con-12
370	370	nected device. 13
371	371	‘‘(B) E
372	372	XCLUSIONS.—The term ‘individual- 14
373	373	specific advertising to children or teens’ shall 15
374	374	not include— 16
375	375	‘‘(i) advertising or marketing to an in-17
376	376	dividual or the device of an individual in 18
377	377	response to the individual’s specific request 19
378	378	for information or feedback, such as a 20
379	379	child’s or teen’s current search query; 21
380	380	‘‘(ii) contextual advertising, such as 22
381	381	when an advertisement is displayed based 23
382	382	on the content of the website, online serv-24
383	383	ice, online application, mobile application, 25
384	384	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
385	385	ssavage on LAPJG3WLY3PROD with BILLS 14
386	386	•S 836 IS
387	387	or connected device in which the advertise-1
388	388	ment appears and does not vary based on 2
389	389	personal information related to the viewer; 3
390	390	or 4
391	391	‘‘(iii) processing personal information 5
392	392	solely for measuring or reporting adver-6
393	393	tising or content performance, reach, or 7
394	394	frequency, including independent measure-8
395	395	ment. 9
396	396	‘‘(C) R
397	397	ULE OF CONSTRUCTION .—Nothing 10
398	398	in subparagraph (A) shall be construed to pro-11
399	399	hibit an operator with actual knowledge or 12
400	400	knowledge fairly implied on the basis of objec-13
401	401	tive circumstances that a user is under the age 14
402	402	of 17 from delivering advertising or marketing 15
403	403	that is age-appropriate and intended for a child 16
404	404	or teen audience, so long as the operator does 17
405	405	not use any personal information other than 18
406	406	whether the user is under the age of 17. 19
407	407	‘‘(19) E
408	408	DUCATIONAL AGENCY OR INSTITU -20
409	409	TION.—The term ‘educational agency or institution’ 21
410	410	means— 22
411	411	‘‘(A) a State educational agency or local 23
412	412	educational agency, as such terms are defined 24
413	413	in section 8101 of the Elementary and Sec-25
414	414	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00014 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
415	415	ssavage on LAPJG3WLY3PROD with BILLS 15
416	416	•S 836 IS
417	417	ondary Education Act of 1965 (20 U.S.C. 1
418	418	7801); or 2
419	419	‘‘(B) an institutional day or residential 3
420	420	school, including a public school (including a 4
421	421	charter school) or private school, that provides 5
422	422	elementary or secondary education, as deter-6
423	423	mined under State law.’’. 7
424	424	(b) O
425	425	NLINECOLLECTION, USE, DISCLOSURE, AND 8
426	426	D
427	427	ELETION OFPERSONALINFORMATION OF CHILDREN 9
428	428	ANDTEENS.—Section 1303 of the Children’s Online Pri-10
429	429	vacy Protection Act of 1998 (15 U.S.C. 6502) is amend-11
430	430	ed— 12
431	431	(1) by striking the heading and inserting the 13
432	432	following: ‘‘
433	433	ONLINE COLLECTION , USE, DISCLO-14
434	434	SURE, AND DELETION OF PERSONAL INFORMA -15
435	435	TION OF CHILDREN AND TEENS .’’; 16
436	436	(2) in subsection (a)— 17
437	437	(A) by amending paragraph (1) to read as 18
438	438	follows: 19
439	439	‘‘(1) I
440	440	N GENERAL.—It is unlawful for an oper-20
441	441	ator of a website, online service, online application, 21
442	442	or mobile application directed to children or for any 22
443	443	operator of a website, online service, online applica-23
444	444	tion, or mobile application with actual knowledge or 24
445	445	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00015 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
446	446	ssavage on LAPJG3WLY3PROD with BILLS 16
447	447	•S 836 IS
448	448	knowledge fairly implied on the basis of objective cir-1
449	449	cumstances that a user is a child or teen— 2
450	450	‘‘(A) to collect personal information from a 3
451	451	child or teen in a manner that violates the regu-4
452	452	lations prescribed under subsection (b); 5
453	453	‘‘(B) except as provided in subparagraphs 6
454	454	(B) and (C) of section 1302(18), to collect, use, 7
455	455	disclose to third parties, or maintain personal 8
456	456	information of a child or teen for purposes of 9
457	457	individual-specific advertising to children or 10
458	458	teens (or to allow another person to collect, use, 11
459	459	disclose, or maintain such information for such 12
460	460	purpose); 13
461	461	‘‘(C) to collect the personal information of 14
462	462	a child or teen except when the collection of the 15
463	463	personal information is— 16
464	464	‘‘(i) consistent with the context of a 17
465	465	particular transaction or service or the re-18
466	466	lationship of the child or teen with the op-19
467	467	erator, including collection necessary to 20
468	468	fulfill a transaction or provide a product or 21
469	469	service requested by the child or teen; or 22
470	470	‘‘(ii) required or specifically author-23
471	471	ized by Federal or State law; or 24
472	472	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00016 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
473	473	ssavage on LAPJG3WLY3PROD with BILLS 17
474	474	•S 836 IS
475	475	‘‘(D) to store or transfer the personal in-1
476	476	formation of a child or teen outside of the 2
477	477	United States unless the operator provides di-3
478	478	rect notice to the parent of the child, in the 4
479	479	case of a child, or to the teen, in the case of 5
480	480	a teen, that the child’s or teen’s personal infor-6
481	481	mation is being stored or transferred outside of 7
482	482	the United States; or 8
483	483	‘‘(E) to retain the personal information of 9
484	484	a child or teen for longer than is reasonably 10
485	485	necessary to fulfill a transaction or provide a 11
486	486	service requested by the child or teen except as 12
487	487	required or specifically authorized by Federal or 13
488	488	State law.’’; and 14
489	489	(B) in paragraph (2)— 15
490	490	(i) in the header, by striking ‘‘
491	491	PAR-16
492	492	ENT’’ and inserting ‘‘‘PARENT OR TEEN’’’; 17
493	493	(ii) by striking ‘‘Notwithstanding 18
494	494	paragraph (1)’’ and inserting ‘‘Notwith-19
495	495	standing paragraph (1)(A)’’; 20
496	496	(iii) by striking ‘‘of such a website or 21
497	497	online service’’; and 22
498	498	(iv) by striking ‘‘subsection 23
499	499	(b)(1)(B)(iii) to the parent of a child’’ and 24
500	500	inserting ‘‘subsection (b)(1)(B)(iv) to the 25
501	501	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00017 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
502	502	ssavage on LAPJG3WLY3PROD with BILLS 18
503	503	•S 836 IS
504	504	parent of a child or under subsection 1
505	505	(b)(1)(C)(iv) to a teen’’; 2
506	506	(3) in subsection (b)— 3
507	507	(A) in paragraph (1)— 4
508	508	(i) in subparagraph (A)— 5
509	509	(I) by striking ‘‘operator of any 6
510	510	website’’ and all that follows through 7
511	511	‘‘from a child’’ and inserting ‘‘oper-8
512	512	ator of a website, online service, on-9
513	513	line application, or mobile application 10
514	514	directed to children or that has actual 11
515	515	knowledge or knowledge fairly implied 12
516	516	on the basis of objective circumstances 13
517	517	that a user is a child or teen’’; 14
518	518	(II) in clause (i)— 15
519	519	(aa) by striking ‘‘notice on 16
520	520	the website’’ and inserting ‘‘clear 17
521	521	and conspicuous notice on the 18
522	522	website’’; 19
523	523	(bb) by inserting ‘‘or teens’’ 20
524	524	after ‘‘children’’; 21
525	525	(cc) by striking ‘‘, and the 22
526	526	operator’s’’ and inserting ‘‘, the 23
527	527	operator’s’’; and 24
528	528	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00018 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
529	529	ssavage on LAPJG3WLY3PROD with BILLS 19
530	530	•S 836 IS
531	531	(dd) by striking ‘‘; and’’ and 1
532	532	inserting ‘‘, the rights and oppor-2
533	533	tunities available to the parent of 3
534	534	the child or teen under subpara-4
535	535	graphs (B) and (C), and the pro-5
536	536	cedures or mechanisms the oper-6
537	537	ator uses to ensure that personal 7
538	538	information is not collected from 8
539	539	children or teens except in ac-9
540	540	cordance with the regulations 10
541	541	promulgated under this para-11
542	542	graph;’’; 12
543	543	(III) in clause (ii)— 13
544	544	(aa) by striking ‘‘parental’’; 14
545	545	(bb) by inserting ‘‘or teens’’ 15
546	546	after ‘‘children’’; 16
547	547	(cc) by striking the semi-17
548	548	colon at the end and inserting ‘‘; 18
549	549	and’’; and 19
550	550	(IV) by inserting after clause (ii) 20
551	551	the following new clause: 21
552	552	‘‘(iii) to obtain verifiable consent from 22
553	553	a parent of a child or from a teen before 23
554	554	using or disclosing personal information of 24
555	555	the child or teen for any purpose that is a 25
556	556	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00019 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
557	557	ssavage on LAPJG3WLY3PROD with BILLS 20
558	558	•S 836 IS
559	559	material change from the original purposes 1
560	560	and disclosure practices specified to the 2
561	561	parent of the child or the teen under 3
562	562	clause (i);’’; 4
563	563	(ii) in subparagraph (B)— 5
564	564	(I) in the matter preceding clause 6
565	565	(i), by striking ‘‘website or online 7
566	566	service’’ and inserting ‘‘operator’’; 8
567	567	(II) in clause (i), by inserting 9
568	568	‘‘and the method by which the oper-10
569	569	ator obtained the personal informa-11
570	570	tion, and the purposes for which the 12
571	571	operator collects, uses, discloses, and 13
572	572	retains the personal information’’ be-14
573	573	fore the semicolon; 15
574	574	(III) in clause (ii)— 16
575	575	(aa) by inserting ‘‘to delete 17
576	576	personal information collected 18
577	577	from the child or content or in-19
578	578	formation submitted by the child 20
579	579	to a website, online service, on-21
580	580	line application, or mobile appli-22
581	581	cation and’’ after ‘‘the oppor-23
582	582	tunity at any time’’; and 24
583	583	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00020 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
584	584	ssavage on LAPJG3WLY3PROD with BILLS 21
585	585	•S 836 IS
586	586	(bb) by striking ‘‘; and’’ and 1
587	587	inserting a semicolon; 2
588	588	(IV) by redesignating clause (iii) 3
589	589	as clause (iv) and inserting after 4
590	590	clause (ii) the following new clause: 5
591	591	‘‘(iii) the opportunity to challenge the 6
592	592	accuracy of the personal information and, 7
593	593	if the parent of the child establishes the in-8
594	594	accuracy of the personal information, to 9
595	595	have the inaccurate personal information 10
596	596	corrected;’’; and 11
597	597	(V) in clause (iv), as so redesig-12
598	598	nated, by inserting ‘‘, if such informa-13
599	599	tion is available to the operator at the 14
600	600	time the parent makes the request’’ 15
601	601	before the semicolon; 16
602	602	(iii) by redesignating subparagraphs 17
603	603	(C) and (D) as subparagraphs (D) and 18
604	604	(E), respectively; 19
605	605	(iv) by inserting after subparagraph 20
606	606	(B) the following new subparagraph: 21
607	607	‘‘(C) require the operator to provide, upon 22
608	608	the request of a teen under this subparagraph 23
609	609	who has provided personal information to the 24
610	610	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00021 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
611	611	ssavage on LAPJG3WLY3PROD with BILLS 22
612	612	•S 836 IS
613	613	operator, upon proper identification of that 1
614	614	teen— 2
615	615	‘‘(i) a description of the specific types 3
616	616	of personal information collected from the 4
617	617	teen by the operator, the method by which 5
618	618	the operator obtained the personal infor-6
619	619	mation, and the purposes for which the op-7
620	620	erator collects, uses, discloses, and retains 8
621	621	the personal information; 9
622	622	‘‘(ii) the opportunity at any time to 10
623	623	delete personal information collected from 11
624	624	the teen or content or information sub-12
625	625	mitted by the teen to a website, online 13
626	626	service, online application, or mobile appli-14
627	627	cation and to refuse to permit the opera-15
628	628	tor’s further use or maintenance in retriev-16
629	629	able form, or online collection, of personal 17
630	630	information from the teen; 18
631	631	‘‘(iii) the opportunity to challenge the 19
632	632	accuracy of the personal information and, 20
633	633	if the teen establishes the inaccuracy of the 21
634	634	personal information, to have the inac-22
635	635	curate personal information corrected; and 23
636	636	‘‘(iv) a means that is reasonable 24
637	637	under the circumstances for the teen to ob-25
638	638	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00022 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
639	639	ssavage on LAPJG3WLY3PROD with BILLS 23
640	640	•S 836 IS
641	641	tain any personal information collected 1
642	642	from the teen, if such information is avail-2
643	643	able to the operator at the time the teen 3
644	644	makes the request;’’; 4
645	645	(v) in subparagraph (D), as so redes-5
646	646	ignated— 6
647	647	(I) by striking ‘‘a child’s’’ and in-7
648	648	serting ‘‘a child’s or teen’s’’; and 8
649	649	(II) by inserting ‘‘or teen’’ after 9
650	650	‘‘the child’’; and 10
651	651	(vi) by amending subparagraph (E), 11
652	652	as so redesignated, to read as follows: 12
653	653	‘‘(E) require the operator to establish, im-13
654	654	plement, and maintain reasonable security prac-14
655	655	tices to protect the confidentiality, integrity, 15
656	656	and accessibility of personal information of chil-16
657	657	dren or teens collected by the operator, and to 17
658	658	protect such personal information against unau-18
659	659	thorized access.’’; 19
660	660	(B) in paragraph (2)— 20
661	661	(i) in the matter preceding subpara-21
662	662	graph (A), by striking ‘‘verifiable parental 22
663	663	consent’’ and inserting ‘‘verifiable con-23
664	664	sent’’; 24
665	665	(ii) in subparagraph (A)— 25
666	666	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00023 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
667	667	ssavage on LAPJG3WLY3PROD with BILLS 24
668	668	•S 836 IS
669	669	(I) by inserting ‘‘or teen’’ after 1
670	670	‘‘collected from a child’’; 2
671	671	(II) by inserting ‘‘or teen’’ after 3
672	672	‘‘request from the child’’; and 4
673	673	(III) by inserting ‘‘or teen or to 5
674	674	contact another child or teen’’ after 6
675	675	‘‘to recontact the child’’; 7
676	676	(iii) in subparagraph (B)— 8
677	677	(I) by striking ‘‘parent or child’’ 9
678	678	and inserting ‘‘parent or teen’’; and 10
679	679	(II) by striking ‘‘parental con-11
680	680	sent’’ each place the term appears and 12
681	681	inserting ‘‘verifiable consent’’; 13
682	682	(iv) in subparagraph (C)— 14
683	683	(I) in the matter preceding clause 15
684	684	(i), by inserting ‘‘or teen’’ after 16
685	685	‘‘child’’ each place the term appears; 17
686	686	(II) in clause (i)— 18
687	687	(aa) by inserting ‘‘or teen’’ 19
688	688	after ‘‘child’’ each place the term 20
689	689	appears; and 21
690	690	(bb) by inserting ‘‘or teen, 22
691	691	as applicable,’’ after ‘‘parent’’ 23
692	692	each place the term appears; and 24
693	693	(III) in clause (ii)— 25
694	694	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00024 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
695	695	ssavage on LAPJG3WLY3PROD with BILLS 25
696	696	•S 836 IS
697	697	(aa) by striking ‘‘without 1
698	698	notice to the parent’’ and insert-2
699	699	ing ‘‘without notice to the parent 3
700	700	or teen, as applicable,’’; and 4
701	701	(bb) by inserting ‘‘or teen’’ 5
702	702	after ‘‘child’’ each place the term 6
703	703	appears; and 7
704	704	(v) in subparagraph (D)— 8
705	705	(I) in the matter preceding clause 9
706	706	(i), by inserting ‘‘or teen’’ after 10
707	707	‘‘child’’ each place the term appears; 11
708	708	(II) in clause (ii), by inserting 12
709	709	‘‘or teen’’ after ‘‘child’’; and 13
710	710	(III) in the flush text following 14
711	711	clause (iii)— 15
712	712	(aa) by inserting ‘‘or teen, 16
713	713	as applicable,’’ after ‘‘parent’’ 17
714	714	each place the term appears; and 18
715	715	(bb) by inserting ‘‘or teen’’ 19
716	716	after ‘‘child’’; 20
717	717	(C) by redesignating paragraph (3) as 21
718	718	paragraph (4) and inserting after paragraph 22
719	719	(2) the following new paragraph: 23
720	720	‘‘(3) A
721	721	PPLICATION TO OPERATORS ACTING 24
722	722	UNDER AGREEMENTS WITH EDUCATIONAL AGENCIES 25
723	723	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00025 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
724	724	ssavage on LAPJG3WLY3PROD with BILLS 26
725	725	•S 836 IS
726	726	OR INSTITUTIONS.—The regulations may provide 1
727	727	that verifiable consent under paragraph (1)(A)(ii) is 2
728	728	not required for an operator that is acting under a 3
729	729	written agreement with an educational agency or in-4
730	730	stitution that, at a minimum, requires the— 5
731	731	‘‘(A) operator to— 6
732	732	‘‘(i) limit its collection, use, and dis-7
733	733	closure of the personal information from a 8
734	734	child or teen to solely educational purposes 9
735	735	and for no other commercial purposes; 10
736	736	‘‘(ii) provide the educational agency or 11
737	737	institution with a notice of the specific 12
738	738	types of personal information the operator 13
739	739	will collect from the child or teen, the 14
740	740	method by which the operator will obtain 15
741	741	the personal information, and the purposes 16
742	742	for which the operator will collect, use, dis-17
743	743	close, and retain the personal information; 18
744	744	‘‘(iii) provide the educational agency 19
745	745	or institution with a link to the operator’s 20
746	746	online notice of information practices as 21
747	747	required under subsection (b)(1)(A)(i); and 22
748	748	‘‘(iv) provide the educational agency 23
749	749	or institution, upon request, with a means 24
750	750	to review the personal information collected 25
751	751	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00026 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
752	752	ssavage on LAPJG3WLY3PROD with BILLS 27
753	753	•S 836 IS
754	754	from a child or teen, to prevent further use 1
755	755	or maintenance or future collection of per-2
756	756	sonal information from a child or teen, and 3
757	757	to delete personal information collected 4
758	758	from a child or teen or content or informa-5
759	759	tion submitted by a child or teen to the op-6
760	760	erator’s website, online service, online ap-7
761	761	plication, or mobile application; 8
762	762	‘‘(B) representative of the educational 9
763	763	agency or institution to acknowledge and agree 10
764	764	that they have authority to authorize the collec-11
765	765	tion, use, and disclosure of personal information 12
766	766	from children or teens on behalf of the edu-13
767	767	cational agency or institution, along with such 14
768	768	authorization, their name, and title at the edu-15
769	769	cational agency or institution; and 16
770	770	‘‘(C) educational agency or institution to— 17
771	771	‘‘(i) provide on its website a notice 18
772	772	that identifies the operator with which it 19
773	773	has entered into a written agreement 20
774	774	under this subsection and provides a link 21
775	775	to the operator’s online notice of informa-22
776	776	tion practices as required under paragraph 23
777	777	(1)(A)(i); 24
778	778	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00027 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
779	779	ssavage on LAPJG3WLY3PROD with BILLS 28
780	780	•S 836 IS
781	781	‘‘(ii) provide the operator’s notice re-1
782	782	garding its information practices, as re-2
783	783	quired under subparagraph (A)(ii), upon 3
784	784	request, to a parent, in the case of a child, 4
785	785	or a parent or teen, in the case of a teen; 5
786	786	and 6
787	787	‘‘(iii) upon the request of a parent, in 7
788	788	the case of a child, or a parent or teen, in 8
789	789	the case of a teen, request the operator 9
790	790	provide a means to review the personal in-10
791	791	formation from the child or teen and pro-11
792	792	vide the parent, in the case of a child, or 12
793	793	parent or teen, in the case of the teen, a 13
794	794	means to review the personal informa-14
795	795	tion.’’; 15
796	796	(D) by amending paragraph (4), as so re-16
797	797	designated, to read as follows: 17
798	798	‘‘(4) T
799	799	ERMINATION OF SERVICE .—The regula-18
800	800	tions shall permit the operator of a website, online 19
801	801	service, online application, or mobile application to 20
802	802	terminate service provided to a child whose parent 21
803	803	has refused, or a teen who has refused, under the 22
804	804	regulations prescribed under paragraphs (1)(B)(ii) 23
805	805	and (1)(C)(ii), to permit the operator’s further use 24
806	806	or maintenance in retrievable form, or future online 25
807	807	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00028 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
808	808	ssavage on LAPJG3WLY3PROD with BILLS 29
809	809	•S 836 IS
810	810	collection of, personal information from that child or 1
811	811	teen.’’; and 2
812	812	(E) by adding at the end the following new 3
813	813	paragraphs: 4
814	814	‘‘(5) C
815	815	ONTINUATION OF SERVICE .—The regula-5
816	816	tions shall prohibit an operator from discontinuing 6
817	817	service provided to a child or teen on the basis of 7
818	818	a request by the parent of the child or by the teen, 8
819	819	under the regulations prescribed under subpara-9
820	820	graph (B) or (C) of paragraph (1), respectively, to 10
821	821	delete personal information collected from the child 11
822	822	or teen, to the extent that the operator is capable of 12
823	823	providing such service without such information. 13
824	824	‘‘(6) R
825	825	ULE OF CONSTRUCTION .—A request 14
826	826	made pursuant to subparagraph (B) or (C) of para-15
827	827	graph (1) to delete or correct personal information 16
828	828	of a child or teen shall not be construed— 17
829	829	‘‘(A) to limit the authority of a law en-18
830	830	forcement agency to obtain any content or in-19
831	831	formation from an operator pursuant to a law-20
832	832	fully executed warrant or an order of a court of 21
833	833	competent jurisdiction; 22
834	834	‘‘(B) to require an operator or third party 23
835	835	delete or correct information that— 24
836	836	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00029 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
837	837	ssavage on LAPJG3WLY3PROD with BILLS 30
838	838	•S 836 IS
839	839	‘‘(i) any other provision of Federal or 1
840	840	State law requires the operator or third 2
841	841	party to maintain; or 3
842	842	‘‘(ii) was submitted to the website, on-4
843	843	line service, online application, or mobile 5
844	844	application of the operator by any person 6
845	845	other than the user who is attempting to 7
846	846	erase or otherwise eliminate the content or 8
847	847	information, including content or informa-9
848	848	tion submitted by the user that was repub-10
849	849	lished or resubmitted by another person; or 11
850	850	‘‘(C) to prohibit an operator from— 12
851	851	‘‘(i) retaining a record of the deletion 13
852	852	request and the minimum information nec-14
853	853	essary for the purposes of ensuring compli-15
854	854	ance with a request made pursuant to sub-16
855	855	paragraph (B) or (C); 17
856	856	‘‘(ii) preventing, detecting, protecting 18
857	857	against, or responding to security inci-19
858	858	dents, identity theft, or fraud, or reporting 20
859	859	those responsible for such actions; 21
860	860	‘‘(iii) protecting the integrity or secu-22
861	861	rity of a website, online service, online ap-23
862	862	plication or mobile application; or 24
863	863	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00030 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
864	864	ssavage on LAPJG3WLY3PROD with BILLS 31
865	865	•S 836 IS
866	866	‘‘(iv) ensuring that the child’s or 1
867	867	teen’s information remains deleted. 2
868	868	‘‘(7) C
869	869	OMMON VERIFIABLE CONSENT MECHA -3
870	870	NISM.— 4
871	871	‘‘(A) I
872	872	N GENERAL.— 5
873	873	‘‘(i) F
874	874	EASIBILITY OF MECHANISM .— 6
875	875	The Commission shall assess the feasi-7
876	876	bility, with notice and public comment, of 8
877	877	allowing operators the option to use a com-9
878	878	mon verifiable consent mechanism that 10
879	879	fully meets the requirements of this title. 11
880	880	‘‘(ii) R
881	881	EQUIREMENTS.—The feasibility 12
882	882	assessment described in clause (i) shall 13
883	883	consider whether a single operator could 14
884	884	use a common verifiable consent mecha-15
885	885	nism to obtain verifiable consent, as re-16
886	886	quired under this title, from a parent of a 17
887	887	child or from a teen on behalf of multiple, 18
888	888	listed operators that provide a joint or re-19
889	889	lated service. 20
890	890	‘‘(B) R
891	891	EPORT.—Not later than 1 year 21
892	892	after the date of enactment of this paragraph, 22
893	893	the Commission shall submit a report to the 23
894	894	Committee on Commerce, Science, and Trans-24
895	895	portation of the Senate and the Committee on 25
896	896	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00031 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
897	897	ssavage on LAPJG3WLY3PROD with BILLS 32
898	898	•S 836 IS
899	899	Energy and Commerce of the House of Rep-1
900	900	resentatives with the findings of the assessment 2
901	901	required by subparagraph (A). 3
902	902	‘‘(C) R
903	903	EGULATIONS.—If the Commission 4
904	904	finds that the use of a common verifiable con-5
905	905	sent mechanism is feasible and would meet the 6
906	906	requirements of this title, the Commission shall 7
907	907	issue regulations to permit the use of a common 8
908	908	verifiable consent mechanism in accordance 9
909	909	with the findings outlined in such report.’’; 10
910	910	(4) in subsection (c), by striking ‘‘a regulation 11
911	911	prescribed under subsection (a)’’ and inserting ‘‘sub-12
912	912	paragraph (B), (C), (D), or (E) of subsection (a)(1), 13
913	913	or of a regulation prescribed under subsection (b),’’; 14
914	914	and 15
915	915	(5) by striking subsection (d) and inserting the 16
916	916	following: 17
917	917	‘‘(d) R
918	918	ELATIONSHIP TOSTATELAW.—The provisions 18
919	919	of this title shall preempt any State law, rule, or regula-19
920	920	tion only to the extent that such State law, rule, or regula-20
921	921	tion conflicts with a provision of this title. Nothing in this 21
922	922	title shall be construed to prohibit any State from enacting 22
923	923	a law, rule, or regulation that provides greater protection 23
924	924	to children or teens than the provisions of this title.’’. 24
925	925	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00032 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
926	926	ssavage on LAPJG3WLY3PROD with BILLS 33
927	927	•S 836 IS
928	928	(c) SAFEHARBORS.—Section 1304 of the Children’s 1
929	929	Online Privacy Protection Act of 1998 (15 U.S.C. 6503) 2
930	930	is amended— 3
931	931	(1) in subsection (b)(1), by inserting ‘‘and 4
932	932	teens’’ after ‘‘children’’; and 5
933	933	(2) by adding at the end the following: 6
934	934	‘‘(d) P
935	935	UBLICATION.— 7
936	936	‘‘(1) I
937	937	N GENERAL.—Subject to the restrictions 8
938	938	described in paragraph (2), the Commission shall 9
939	939	publish on the internet website of the Commission 10
940	940	any report or documentation required by regulation 11
941	941	to be submitted to the Commission to carry out this 12
942	942	section. 13
943	943	‘‘(2) R
944	944	ESTRICTIONS ON PUBLICATION .—The re-14
945	945	strictions described in section 6(f) and section 21 of 15
946	946	the Federal Trade Commission Act (15 U.S.C. 16
947	947	46(f), 57b–2) applicable to the disclosure of infor-17
948	948	mation obtained by the Commission shall apply in 18
949	949	same manner to the disclosure under this subsection 19
950	950	of information obtained by the Commission from a 20
951	951	report or documentation described in paragraph 21
952	952	(1).’’. 22
953	953	(d) A
954	954	CTIONS BYSTATES.—Section 1305 of the Chil-23
955	955	dren’s Online Privacy Protection Act of 1998 (15 U.S.C. 24
956	956	6504) is amended— 25
957	957	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00033 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
958	958	ssavage on LAPJG3WLY3PROD with BILLS 34
959	959	•S 836 IS
960	960	(1) in subsection (a)(1)— 1
961	961	(A) in the matter preceding subparagraph 2
962	962	(A), by inserting ‘‘section 1303(a)(1) or’’ before 3
963	963	‘‘any regulation’’; and 4
964	964	(B) in subparagraph (B), by inserting 5
965	965	‘‘section 1303(a)(1) or’’ before ‘‘the regula-6
966	966	tion’’; and 7
967	967	(2) in subsection (d)— 8
968	968	(A) by inserting ‘‘section 1303(a)(1) or’’ 9
969	969	before ‘‘any regulation’’; and 10
970	970	(B) by inserting ‘‘section 1303(a)(1) or’’ 11
971	971	before ‘‘that regulation’’. 12
972	972	(e) A
973	973	DMINISTRATION AND APPLICABILITY OFACT.— 13
974	974	Section 1306 of the Children’s Online Privacy Protection 14
975	975	Act of 1998 (15 U.S.C. 6505) is amended— 15
976	976	(1) in subsection (b)— 16
977	977	(A) in paragraph (1), by striking ‘‘, in the 17
978	978	case of’’ and all that follows through ‘‘the 18
979	979	Board of Directors of the Federal Deposit In-19
980	980	surance Corporation;’’ and inserting the fol-20
981	981	lowing: ‘‘by the appropriate Federal banking 21
982	982	agency, with respect to any insured depository 22
983	983	institution (as those terms are defined in sec-23
984	984	tion 3 of that Act (12 U.S.C. 1813));’’; and 24
985	985	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00034 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
986	986	ssavage on LAPJG3WLY3PROD with BILLS 35
987	987	•S 836 IS
988	988	(B) by striking paragraph (2) and redesig-1
989	989	nating paragraphs (3) through (6) as para-2
990	990	graphs (2) through (5), respectively; 3
991	991	(2) in subsection (d)— 4
992	992	(A) by inserting ‘‘section 1303(a)(1) or’’ 5
993	993	before ‘‘a rule’’; and 6
994	994	(B) by striking ‘‘such rule’’ and inserting 7
995	995	‘‘section 1303(a)(1) or a rule of the Commis-8
996	996	sion under section 1303’’; and 9
997	997	(3) by adding at the end the following new sub-10
998	998	sections: 11
999	999	‘‘(f) D
1000	1000	ETERMINATION OF WHETHER ANOPERATOR 12
1001	1001	H
1002	1002	ASKNOWLEDGEFAIRLYIMPLIED ON THE BASIS OF 13
1003	1003	O
1004	1004	BJECTIVECIRCUMSTANCES.— 14
1005	1005	‘‘(1) R
1006	1006	ULE OF CONSTRUCTION .—For purposes 15
1007	1007	of enforcing this title or a regulation promulgated 16
1008	1008	under this title, in making a determination as to 17
1009	1009	whether an operator has knowledge fairly implied on 18
1010	1010	the basis of objective circumstances that a specific 19
1011	1011	user is a child or teen, the Commission or State at-20
1012	1012	torneys general shall rely on competent and reliable 21
1013	1013	evidence, taking into account the totality of the cir-22
1014	1014	cumstances, including whether a reasonable and pru-23
1015	1015	dent person under the circumstances would have 24
1016	1016	known that the user is a child or teen. Nothing in 25
1017	1017	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00035 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
1018	1018	ssavage on LAPJG3WLY3PROD with BILLS 36
1019	1019	•S 836 IS
1020	1020	this title, including a determination described in the 1
1021	1021	preceding sentence, shall be construed to require an 2
1022	1022	operator to— 3
1023	1023	‘‘(A) affirmatively collect any personal in-4
1024	1024	formation with respect to the age of a child or 5
1025	1025	teen that an operator is not already collecting 6
1026	1026	in the normal course of business; or 7
1027	1027	‘‘(B) implement an age gating or age 8
1028	1028	verification functionality. 9
1029	1029	‘‘(2) C
1030	1030	OMMISSION GUIDANCE.— 10
1031	1031	‘‘(A) I
1032	1032	N GENERAL.—Within 180 days of 11
1033	1033	enactment, the Commission shall issue guidance 12
1034	1034	to provide information, including best practices 13
1035	1035	and examples for operators to understand the 14
1036	1036	Commission’s determination of whether an op-15
1037	1037	erator has knowledge fairly implied on the basis 16
1038	1038	of objective circumstances that a user is a child 17
1039	1039	or teen. 18
1040	1040	‘‘(B) L
1041	1041	IMITATION.—No guidance issued by 19
1042	1042	the Commission with respect to this title shall 20
1043	1043	confer any rights on any person, State, or local-21
1044	1044	ity, nor shall operate to bind the Commission or 22
1045	1045	any person to the approach recommended in 23
1046	1046	such guidance. In any enforcement action 24
1047	1047	brought pursuant to this title, the Commission 25
1048	1048	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00036 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
1049	1049	ssavage on LAPJG3WLY3PROD with BILLS 37
1050	1050	•S 836 IS
1051	1051	or State attorney general, as applicable, shall 1
1052	1052	allege a specific violation of a provision of this 2
1053	1053	title. The Commission or State attorney gen-3
1054	1054	eral, as applicable, may not base an enforce-4
1055	1055	ment action on, or execute a consent order 5
1056	1056	based on, practices that are alleged to be incon-6
1057	1057	sistent with any such guidance, unless the prac-7
1058	1058	tices allegedly violate this title. For purposes of 8
1059	1059	enforcing this title or a regulation promulgated 9
1060	1060	under this title, State attorneys general shall 10
1061	1061	take into account any guidance issued by the 11
1062	1062	Commission under subparagraph (A). 12
1063	1063	‘‘(g) A
1064	1064	DDITIONALREQUIREMENT.—Any regulations 13
1065	1065	issued under this title shall include a description and anal-14
1066	1066	ysis of the impact of proposed and final Rules on small 15
1067	1067	entities per the Regulatory Flexibility Act of 1980 (5 16
1068	1068	U.S.C. 601 et seq.).’’. 17
1069	1069	SEC. 3. STUDY AND REPORTS OF MOBILE AND ONLINE AP-18
1070	1070	PLICATION OVERSIGHT AND ENFORCEMENT. 19
1071	1071	(a) O
1072	1072	VERSIGHTREPORT.—Not later than 3 years 20
1073	1073	after the date of enactment of this Act, the Federal Trade 21
1074	1074	Commission shall submit to the Committee on Commerce, 22
1075	1075	Science, and Transportation of the Senate and the Com-23
1076	1076	mittee on Energy and Commerce of the House of Rep-24
1077	1077	resentatives a report on the processes of platforms that 25
1078	1078	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00037 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
1079	1079	ssavage on LAPJG3WLY3PROD with BILLS 38
1080	1080	•S 836 IS
1081	1081	offer mobile and online applications for ensuring that, of 1
1082	1082	those applications that are websites, online services, online 2
1083	1083	applications, or mobile applications directed to children, 3
1084	1084	the applications operate in accordance with— 4
1085	1085	(1) this Act, the amendments made by this Act, 5
1086	1086	and rules promulgated under this Act; and 6
1087	1087	(2) rules promulgated by the Commission under 7
1088	1088	section 18 of the Federal Trade Commission Act (15 8
1089	1089	U.S.C. 57a) relating to unfair or deceptive acts or 9
1090	1090	practices in marketing. 10
1091	1091	(b) E
1092	1092	NFORCEMENT REPORT.—Not later than 1 year 11
1093	1093	after the date of enactment of this Act, and each year 12
1094	1094	thereafter, the Federal Trade Commission shall submit to 13
1095	1095	the Committee on Commerce, Science, and Transportation 14
1096	1096	of the Senate and the Committee on Energy and Com-15
1097	1097	merce of the House of Representatives a report that ad-16
1098	1098	dresses, at a minimum— 17
1099	1099	(1) the number of actions brought by the Com-18
1100	1100	mission during the reporting year to enforce the 19
1101	1101	Children’s Online Privacy Protection Act of 1998 20
1102	1102	(15 U.S.C. 6501) (referred to in this subsection as 21
1103	1103	the ‘‘Act’’) and the outcome of each such action; 22
1104	1104	(2) the total number of investigations or inquir-23
1105	1105	ies into potential violations of the Act; during the re-24
1106	1106	porting year; 25
1107	1107	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00038 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
1108	1108	ssavage on LAPJG3WLY3PROD with BILLS 39
1109	1109	•S 836 IS
1110	1110	(3) the total number of open investigations or 1
1111	1111	inquiries into potential violations of the Act as of the 2
1112	1112	time the report is submitted; 3
1113	1113	(4) the number and nature of complaints re-4
1114	1114	ceived by the Commission relating to an allegation 5
1115	1115	of a violation of the Act during the reporting year; 6
1116	1116	and 7
1117	1117	(5) policy or legislative recommendations to 8
1118	1118	strengthen online protections for children and teens. 9
1119	1119	SEC. 4. GAO STUDY. 10
1120	1120	(a) S
1121	1121	TUDY.—The Comptroller General of the United 11
1122	1122	States (in this section referred to as the ‘‘Comptroller 12
1123	1123	General’’) shall conduct a study on the privacy of teens 13
1124	1124	who use financial technology products. Such study shall— 14
1125	1125	(1) identify the type of financial technology 15
1126	1126	products that teens are using; 16
1127	1127	(2) identify the potential risks to teens’ privacy 17
1128	1128	from using such financial technology products; and 18
1129	1129	(3) determine whether existing laws are suffi-19
1130	1130	cient to address such risks to teens’ privacy. 20
1131	1131	(b) R
1132	1132	EPORT.—Not later than 1 year after the date 21
1133	1133	of enactment of this section, the Comptroller General shall 22
1134	1134	submit to Congress a report containing the results of the 23
1135	1135	study conducted under subsection (a), together with rec-24
1136	1136	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00039 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836
1137	1137	ssavage on LAPJG3WLY3PROD with BILLS 40
1138	1138	•S 836 IS
1139	1139	ommendations for such legislation and administrative ac-1
1140	1140	tion as the Comptroller General determines appropriate. 2
1141	1141	SEC. 5. SEVERABILITY. 3
1142	1142	If any provision of this Act, or an amendment made 4
1143	1143	by this Act, is determined to be unenforceable or invalid, 5
1144	1144	the remaining provisions of this Act and the amendments 6
1145	1145	made by this Act shall not be affected. 7
1146	1146	Æ
1147	1147	VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00040 Fmt 6652 Sfmt 6301 E:\BILLS\S836.IS S836
1148	1148	ssavage on LAPJG3WLY3PROD with BILLS