II 119THCONGRESS 1 STSESSION S. 836 To amend the Children’s Online Privacy Protection Act of 1998 to strengthen protections relating to the online collection, use, and disclosure of per- sonal information of children and teens, and for other purposes. IN THE SENATE OF THE UNITED STATES MARCH4, 2025 Mr. M ARKEY(for himself, Mr. CASSIDY, Ms. CANTWELL, Mr. SCHATZ, Mrs. C APITO, Ms. KLOBUCHAR, Mr. CRAPO, Mr. WYDEN, Mr. GRASSLEY, Mr. L UJA´N, Mr. BLUMENTHAL, Mr. MERKLEY, Mr. WELCH, Mr. KING, Mr. K ELLY, Mrs. BRITT, and Mr. HEINRICH) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To amend the Children’s Online Privacy Protection Act of 1998 to strengthen protections relating to the online collection, use, and disclosure of personal information of children and teens, and for other purposes. Be it enacted by the Senate and House of Representa-1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 3 (a) S HORTTITLE.—This Act may be cited as the 4 ‘‘Children and Teens’ Online Privacy Protection Act’’. 5 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 2 •S 836 IS (b) TABLE OFCONTENTS.—The table of contents for 1 this Act is as follows: 2 Sec. 1. Short title; table of contents. Sec. 2. Online collection, use, disclosure, and deletion of personal information of children and teens. Sec. 3. Study and reports of mobile and online application oversight and en- forcement. Sec. 4. GAO study. Sec. 5. Severability. SEC. 2. ONLINE COLLECTION, USE, DISCLOSURE, AND DE- 3 LETION OF PERSONAL INFORMATION OF 4 CHILDREN AND TEENS. 5 (a) D EFINITIONS.—Section 1302 of the Children’s 6 Online Privacy Protection Act of 1998 (15 U.S.C. 6501) 7 is amended— 8 (1) by amending paragraph (2) to read as fol-9 lows: 10 ‘‘(2) O PERATOR.—The term ‘operator’— 11 ‘‘(A) means any person— 12 ‘‘(i) who, for commercial purposes, in 13 interstate or foreign commerce operates or 14 provides a website on the internet, an on-15 line service, an online application, or a mo-16 bile application; and 17 ‘‘(ii) who— 18 ‘‘(I) collects or maintains, either 19 directly or through a service provider, 20 personal information from or about 21 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 3 •S 836 IS the users of that website, service, or 1 application; 2 ‘‘(II) allows another person to 3 collect personal information directly 4 from users of that website, service, or 5 application (in which case, the oper-6 ator is deemed to have collected the 7 information); or 8 ‘‘(III) allows users of that 9 website, service, or application to pub-10 licly disclose personal information (in 11 which case, the operator is deemed to 12 have collected the information); and 13 ‘‘(B) does not include any nonprofit entity 14 that would otherwise be exempt from coverage 15 under section 5 of the Federal Trade Commis-16 sion Act (15 U.S.C. 45).’’; 17 (2) in paragraph (4)— 18 (A) by amending subparagraph (A) to read 19 as follows: 20 ‘‘(A) the release of personal information 21 collected from a child or teen by an operator for 22 any purpose, except where the personal infor-23 mation is provided to a person other than an 24 operator who— 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 4 •S 836 IS ‘‘(i) provides support for the internal 1 operations of the website, online service, 2 online application, or mobile application of 3 the operator, excluding any activity relat-4 ing to individual-specific advertising to 5 children or teens; and 6 ‘‘(ii) does not disclose or use that per-7 sonal information for any other purpose; 8 and’’; and 9 (B) in subparagraph (B)— 10 (i) by inserting ‘‘or teen’’ after 11 ‘‘child’’ each place the term appears; 12 (ii) by striking ‘‘website or online 13 service’’ and inserting ‘‘website, online 14 service, online application, or mobile appli-15 cation’’; and 16 (iii) by striking ‘‘actual knowledge’’ 17 and inserting ‘‘actual knowledge or knowl-18 edge fairly implied on the basis of objective 19 circumstances’’; 20 (3) by striking paragraph (8) and inserting the 21 following: 22 ‘‘(8) P ERSONAL INFORMATION .— 23 ‘‘(A) I N GENERAL.—The term ‘personal in-24 formation’ means individually identifiable infor-25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 5 •S 836 IS mation about an individual collected online, in-1 cluding— 2 ‘‘(i) a first and last name; 3 ‘‘(ii) a home or other physical address 4 including street name and name of a city 5 or town; 6 ‘‘(iii) an e-mail address; 7 ‘‘(iv) a telephone number; 8 ‘‘(v) a Social Security number; 9 ‘‘(vi) any other identifier that the 10 Commission determines permits the phys-11 ical or online contacting of a specific indi-12 vidual; 13 ‘‘(vii) a persistent identifier that can 14 be used to recognize a specific child or teen 15 over time and across different websites, on-16 line services, online applications, or mobile 17 applications, including but not limited to a 18 customer number held in a cookie, an 19 Internet Protocol (IP) address, a processor 20 or device serial number, or unique device 21 identifier, but excluding an identifier that 22 is used by an operator solely for providing 23 support for the internal operations of the 24 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 6 •S 836 IS website, online service, online application, 1 or mobile application; 2 ‘‘(viii) a photograph, video, or audio 3 file where such file contains a specific 4 child’s or teen’s image or voice; 5 ‘‘(ix) geolocation information; 6 ‘‘(x) information generated from the 7 measurement or technological processing of 8 an individual’s biological, physical, or phys-9 iological characteristics that is used to 10 identify an individual, including— 11 ‘‘(I) fingerprints; 12 ‘‘(II) voice prints; 13 ‘‘(III) iris or retina imagery 14 scans; 15 ‘‘(IV) facial templates; 16 ‘‘(V) deoxyribonucleic acid 17 (DNA) information; or 18 ‘‘(VI) gait; or 19 ‘‘(xi) information linked or reasonably 20 linkable to a child or teen or the parents 21 of that child or teen (including any unique 22 identifier) that an operator collects online 23 from the child or teen and combines with 24 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 7 •S 836 IS an identifier described in this subpara-1 graph. 2 ‘‘(B) E XCLUSION.—The term ‘personal in-3 formation’ shall not include an audio file that 4 contains a child’s or teen’s voice so long as the 5 operator— 6 ‘‘(i) does not request information via 7 voice that would otherwise be considered 8 personal information under this paragraph; 9 ‘‘(ii) provides clear notice of its collec-10 tion and use of the audio file and its dele-11 tion policy in its privacy policy; 12 ‘‘(iii) only uses the voice within the 13 audio file solely as a replacement for writ-14 ten words, to perform a task, or engage 15 with a website, online service, online appli-16 cation, or mobile application, such as to 17 perform a search or fulfill a verbal instruc-18 tion or request; and 19 ‘‘(iv) only maintains the audio file 20 long enough to complete the stated purpose 21 and then immediately deletes the audio file 22 and does not make any other use of the 23 audio file prior to deletion. 24 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 8 •S 836 IS ‘‘(C) SUPPORT FOR THE INTERNAL OPER -1 ATIONS OF A WEBSITE , ONLINE SERVICE, ON-2 LINE APPLICATION, OR MOBILE APPLICATION.— 3 ‘‘(i) I N GENERAL.—For purposes of 4 subparagraph (A)(vii), the term ‘support 5 for the internal operations of a website, on-6 line service, online application, or mobile 7 application’ means those activities nec-8 essary to— 9 ‘‘(I) maintain or analyze the 10 functioning of the website, online serv-11 ice, online application, or mobile appli-12 cation; 13 ‘‘(II) perform network commu-14 nications; 15 ‘‘(III) authenticate users of, or 16 personalize the content on, the 17 website, online service, online applica-18 tion, or mobile application; 19 ‘‘(IV) serve contextual adver-20 tising, provided that any persistent 21 identifier is only used as necessary for 22 technical purposes to serve the contex-23 tual advertisement, or cap the fre-24 quency of advertising; 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 9 •S 836 IS ‘‘(V) protect the security or in-1 tegrity of the user, website, online 2 service, online application, or mobile 3 application; 4 ‘‘(VI) ensure legal or regulatory 5 compliance, or 6 ‘‘(VII) fulfill a request of a child 7 or teen as permitted by subpara-8 graphs (A) through (C) of section 9 1303(b)(2). 10 ‘‘(ii) C ONDITION.—Except as specifi-11 cally permitted under clause (i), informa-12 tion collected for the activities listed in 13 clause (i) cannot be used or disclosed to 14 contact a specific individual, including 15 through individual-specific advertising to 16 children or teens, to amass a profile on a 17 specific individual, in connection with proc-18 esses that encourage or prompt use of a 19 website or online service, or for any other 20 purpose.’’; 21 (4) by amending paragraph (9) to read as fol-22 lows: 23 ‘‘(9) V ERIFIABLE CONSENT .—The term 24 ‘verifiable consent’ means any reasonable effort (tak-25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 10 •S 836 IS ing into consideration available technology), includ-1 ing a request for authorization for future collection, 2 use, and disclosure described in the notice, to ensure 3 that, in the case of a child, a parent of the child, 4 or, in the case of a teen, the teen— 5 ‘‘(A) receives direct notice of the personal 6 information collection, use, and disclosure prac-7 tices of the operator; and 8 ‘‘(B) before the personal information of the 9 child or teen is collected, freely and unambig-10 uously authorizes— 11 ‘‘(i) the collection, use, and disclosure, 12 as applicable, of that personal information; 13 and 14 ‘‘(ii) any subsequent use of that per-15 sonal information.’’; 16 (5) in paragraph (10)— 17 (A) in the paragraph header, by striking 18 ‘‘W EBSITE OR ONLINE SERVICE DIRECTED TO 19 CHILDREN’’ and inserting ‘‘WEBSITE, ONLINE 20 SERVICE, ONLINE APPLICATION, OR MOBILE AP-21 PLICATION DIRECTED TO CHILDREN ’’; 22 (B) by striking ‘‘website or online service’’ 23 each place it appears and inserting ‘‘website, 24 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 11 •S 836 IS online service, online application, or mobile ap-1 plication’’; and 2 (C) by adding at the end the following new 3 subparagraph: 4 ‘‘(C) R ULE OF CONSTRUCTION .—In con-5 sidering whether a website, online service, on-6 line application, or mobile application, or por-7 tion thereof, is directed to children, the Com-8 mission shall apply a totality of circumstances 9 test and will also consider competent and reli-10 able empirical evidence regarding audience com-11 position and evidence regarding the intended 12 audience of the website, online service, online 13 application, or mobile application.’’; and 14 (6) by adding at the end the following: 15 ‘‘(13) C ONNECTED DEVICE .—The term ‘con-16 nected device’ means a device that is capable of con-17 necting to the internet, directly or indirectly, or to 18 another connected device. 19 ‘‘(14) O NLINE APPLICATION.—The term ‘online 20 application’— 21 ‘‘(A) means an internet-connected software 22 program; and 23 ‘‘(B) includes a service or application of-24 fered via a connected device. 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 12 •S 836 IS ‘‘(15) MOBILE APPLICATION.—The term ‘mo-1 bile application’— 2 ‘‘(A) means a software program that runs 3 on the operating system of— 4 ‘‘(i) a cellular telephone; 5 ‘‘(ii) a tablet computer; or 6 ‘‘(iii) a similar portable computing de-7 vice that transmits data over a wireless 8 connection; and 9 ‘‘(B) includes a service or application of-10 fered via a connected device. 11 ‘‘(16) G EOLOCATION INFORMATION .—The term 12 ‘geolocation information’ means information suffi-13 cient to identify a street name and name of a city 14 or town. 15 ‘‘(17) T EEN.—The term ‘teen’ means an indi-16 vidual who has attained age 13 and is under the age 17 of 17. 18 ‘‘(18) I NDIVIDUAL-SPECIFIC ADVERTISING TO 19 CHILDREN OR TEENS.— 20 ‘‘(A) I N GENERAL.—The term ‘individual- 21 specific advertising to children or teens’ means 22 advertising or any other effort to market a 23 product or service that is directed to a specific 24 child or teen or a connected device that is 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 13 •S 836 IS linked or reasonably linkable to a child or teen 1 based on— 2 ‘‘(i) the personal information from— 3 ‘‘(I) the child or teen; or 4 ‘‘(II) a group of children or teens 5 who are similar in sex, age, household 6 income level, race, or ethnicity to the 7 specific child or teen to whom the 8 product or service is marketed; 9 ‘‘(ii) profiling of a child or teen or 10 group of children or teens; or 11 ‘‘(iii) a unique identifier of the con-12 nected device. 13 ‘‘(B) E XCLUSIONS.—The term ‘individual- 14 specific advertising to children or teens’ shall 15 not include— 16 ‘‘(i) advertising or marketing to an in-17 dividual or the device of an individual in 18 response to the individual’s specific request 19 for information or feedback, such as a 20 child’s or teen’s current search query; 21 ‘‘(ii) contextual advertising, such as 22 when an advertisement is displayed based 23 on the content of the website, online serv-24 ice, online application, mobile application, 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 14 •S 836 IS or connected device in which the advertise-1 ment appears and does not vary based on 2 personal information related to the viewer; 3 or 4 ‘‘(iii) processing personal information 5 solely for measuring or reporting adver-6 tising or content performance, reach, or 7 frequency, including independent measure-8 ment. 9 ‘‘(C) R ULE OF CONSTRUCTION .—Nothing 10 in subparagraph (A) shall be construed to pro-11 hibit an operator with actual knowledge or 12 knowledge fairly implied on the basis of objec-13 tive circumstances that a user is under the age 14 of 17 from delivering advertising or marketing 15 that is age-appropriate and intended for a child 16 or teen audience, so long as the operator does 17 not use any personal information other than 18 whether the user is under the age of 17. 19 ‘‘(19) E DUCATIONAL AGENCY OR INSTITU -20 TION.—The term ‘educational agency or institution’ 21 means— 22 ‘‘(A) a State educational agency or local 23 educational agency, as such terms are defined 24 in section 8101 of the Elementary and Sec-25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00014 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 15 •S 836 IS ondary Education Act of 1965 (20 U.S.C. 1 7801); or 2 ‘‘(B) an institutional day or residential 3 school, including a public school (including a 4 charter school) or private school, that provides 5 elementary or secondary education, as deter-6 mined under State law.’’. 7 (b) O NLINECOLLECTION, USE, DISCLOSURE, AND 8 D ELETION OFPERSONALINFORMATION OF CHILDREN 9 ANDTEENS.—Section 1303 of the Children’s Online Pri-10 vacy Protection Act of 1998 (15 U.S.C. 6502) is amend-11 ed— 12 (1) by striking the heading and inserting the 13 following: ‘‘ ONLINE COLLECTION , USE, DISCLO-14 SURE, AND DELETION OF PERSONAL INFORMA -15 TION OF CHILDREN AND TEENS .’’; 16 (2) in subsection (a)— 17 (A) by amending paragraph (1) to read as 18 follows: 19 ‘‘(1) I N GENERAL.—It is unlawful for an oper-20 ator of a website, online service, online application, 21 or mobile application directed to children or for any 22 operator of a website, online service, online applica-23 tion, or mobile application with actual knowledge or 24 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00015 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 16 •S 836 IS knowledge fairly implied on the basis of objective cir-1 cumstances that a user is a child or teen— 2 ‘‘(A) to collect personal information from a 3 child or teen in a manner that violates the regu-4 lations prescribed under subsection (b); 5 ‘‘(B) except as provided in subparagraphs 6 (B) and (C) of section 1302(18), to collect, use, 7 disclose to third parties, or maintain personal 8 information of a child or teen for purposes of 9 individual-specific advertising to children or 10 teens (or to allow another person to collect, use, 11 disclose, or maintain such information for such 12 purpose); 13 ‘‘(C) to collect the personal information of 14 a child or teen except when the collection of the 15 personal information is— 16 ‘‘(i) consistent with the context of a 17 particular transaction or service or the re-18 lationship of the child or teen with the op-19 erator, including collection necessary to 20 fulfill a transaction or provide a product or 21 service requested by the child or teen; or 22 ‘‘(ii) required or specifically author-23 ized by Federal or State law; or 24 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00016 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 17 •S 836 IS ‘‘(D) to store or transfer the personal in-1 formation of a child or teen outside of the 2 United States unless the operator provides di-3 rect notice to the parent of the child, in the 4 case of a child, or to the teen, in the case of 5 a teen, that the child’s or teen’s personal infor-6 mation is being stored or transferred outside of 7 the United States; or 8 ‘‘(E) to retain the personal information of 9 a child or teen for longer than is reasonably 10 necessary to fulfill a transaction or provide a 11 service requested by the child or teen except as 12 required or specifically authorized by Federal or 13 State law.’’; and 14 (B) in paragraph (2)— 15 (i) in the header, by striking ‘‘ PAR-16 ENT’’ and inserting ‘‘‘PARENT OR TEEN’’’; 17 (ii) by striking ‘‘Notwithstanding 18 paragraph (1)’’ and inserting ‘‘Notwith-19 standing paragraph (1)(A)’’; 20 (iii) by striking ‘‘of such a website or 21 online service’’; and 22 (iv) by striking ‘‘subsection 23 (b)(1)(B)(iii) to the parent of a child’’ and 24 inserting ‘‘subsection (b)(1)(B)(iv) to the 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00017 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 18 •S 836 IS parent of a child or under subsection 1 (b)(1)(C)(iv) to a teen’’; 2 (3) in subsection (b)— 3 (A) in paragraph (1)— 4 (i) in subparagraph (A)— 5 (I) by striking ‘‘operator of any 6 website’’ and all that follows through 7 ‘‘from a child’’ and inserting ‘‘oper-8 ator of a website, online service, on-9 line application, or mobile application 10 directed to children or that has actual 11 knowledge or knowledge fairly implied 12 on the basis of objective circumstances 13 that a user is a child or teen’’; 14 (II) in clause (i)— 15 (aa) by striking ‘‘notice on 16 the website’’ and inserting ‘‘clear 17 and conspicuous notice on the 18 website’’; 19 (bb) by inserting ‘‘or teens’’ 20 after ‘‘children’’; 21 (cc) by striking ‘‘, and the 22 operator’s’’ and inserting ‘‘, the 23 operator’s’’; and 24 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00018 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 19 •S 836 IS (dd) by striking ‘‘; and’’ and 1 inserting ‘‘, the rights and oppor-2 tunities available to the parent of 3 the child or teen under subpara-4 graphs (B) and (C), and the pro-5 cedures or mechanisms the oper-6 ator uses to ensure that personal 7 information is not collected from 8 children or teens except in ac-9 cordance with the regulations 10 promulgated under this para-11 graph;’’; 12 (III) in clause (ii)— 13 (aa) by striking ‘‘parental’’; 14 (bb) by inserting ‘‘or teens’’ 15 after ‘‘children’’; 16 (cc) by striking the semi-17 colon at the end and inserting ‘‘; 18 and’’; and 19 (IV) by inserting after clause (ii) 20 the following new clause: 21 ‘‘(iii) to obtain verifiable consent from 22 a parent of a child or from a teen before 23 using or disclosing personal information of 24 the child or teen for any purpose that is a 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00019 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 20 •S 836 IS material change from the original purposes 1 and disclosure practices specified to the 2 parent of the child or the teen under 3 clause (i);’’; 4 (ii) in subparagraph (B)— 5 (I) in the matter preceding clause 6 (i), by striking ‘‘website or online 7 service’’ and inserting ‘‘operator’’; 8 (II) in clause (i), by inserting 9 ‘‘and the method by which the oper-10 ator obtained the personal informa-11 tion, and the purposes for which the 12 operator collects, uses, discloses, and 13 retains the personal information’’ be-14 fore the semicolon; 15 (III) in clause (ii)— 16 (aa) by inserting ‘‘to delete 17 personal information collected 18 from the child or content or in-19 formation submitted by the child 20 to a website, online service, on-21 line application, or mobile appli-22 cation and’’ after ‘‘the oppor-23 tunity at any time’’; and 24 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00020 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 21 •S 836 IS (bb) by striking ‘‘; and’’ and 1 inserting a semicolon; 2 (IV) by redesignating clause (iii) 3 as clause (iv) and inserting after 4 clause (ii) the following new clause: 5 ‘‘(iii) the opportunity to challenge the 6 accuracy of the personal information and, 7 if the parent of the child establishes the in-8 accuracy of the personal information, to 9 have the inaccurate personal information 10 corrected;’’; and 11 (V) in clause (iv), as so redesig-12 nated, by inserting ‘‘, if such informa-13 tion is available to the operator at the 14 time the parent makes the request’’ 15 before the semicolon; 16 (iii) by redesignating subparagraphs 17 (C) and (D) as subparagraphs (D) and 18 (E), respectively; 19 (iv) by inserting after subparagraph 20 (B) the following new subparagraph: 21 ‘‘(C) require the operator to provide, upon 22 the request of a teen under this subparagraph 23 who has provided personal information to the 24 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00021 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 22 •S 836 IS operator, upon proper identification of that 1 teen— 2 ‘‘(i) a description of the specific types 3 of personal information collected from the 4 teen by the operator, the method by which 5 the operator obtained the personal infor-6 mation, and the purposes for which the op-7 erator collects, uses, discloses, and retains 8 the personal information; 9 ‘‘(ii) the opportunity at any time to 10 delete personal information collected from 11 the teen or content or information sub-12 mitted by the teen to a website, online 13 service, online application, or mobile appli-14 cation and to refuse to permit the opera-15 tor’s further use or maintenance in retriev-16 able form, or online collection, of personal 17 information from the teen; 18 ‘‘(iii) the opportunity to challenge the 19 accuracy of the personal information and, 20 if the teen establishes the inaccuracy of the 21 personal information, to have the inac-22 curate personal information corrected; and 23 ‘‘(iv) a means that is reasonable 24 under the circumstances for the teen to ob-25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00022 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 23 •S 836 IS tain any personal information collected 1 from the teen, if such information is avail-2 able to the operator at the time the teen 3 makes the request;’’; 4 (v) in subparagraph (D), as so redes-5 ignated— 6 (I) by striking ‘‘a child’s’’ and in-7 serting ‘‘a child’s or teen’s’’; and 8 (II) by inserting ‘‘or teen’’ after 9 ‘‘the child’’; and 10 (vi) by amending subparagraph (E), 11 as so redesignated, to read as follows: 12 ‘‘(E) require the operator to establish, im-13 plement, and maintain reasonable security prac-14 tices to protect the confidentiality, integrity, 15 and accessibility of personal information of chil-16 dren or teens collected by the operator, and to 17 protect such personal information against unau-18 thorized access.’’; 19 (B) in paragraph (2)— 20 (i) in the matter preceding subpara-21 graph (A), by striking ‘‘verifiable parental 22 consent’’ and inserting ‘‘verifiable con-23 sent’’; 24 (ii) in subparagraph (A)— 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00023 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 24 •S 836 IS (I) by inserting ‘‘or teen’’ after 1 ‘‘collected from a child’’; 2 (II) by inserting ‘‘or teen’’ after 3 ‘‘request from the child’’; and 4 (III) by inserting ‘‘or teen or to 5 contact another child or teen’’ after 6 ‘‘to recontact the child’’; 7 (iii) in subparagraph (B)— 8 (I) by striking ‘‘parent or child’’ 9 and inserting ‘‘parent or teen’’; and 10 (II) by striking ‘‘parental con-11 sent’’ each place the term appears and 12 inserting ‘‘verifiable consent’’; 13 (iv) in subparagraph (C)— 14 (I) in the matter preceding clause 15 (i), by inserting ‘‘or teen’’ after 16 ‘‘child’’ each place the term appears; 17 (II) in clause (i)— 18 (aa) by inserting ‘‘or teen’’ 19 after ‘‘child’’ each place the term 20 appears; and 21 (bb) by inserting ‘‘or teen, 22 as applicable,’’ after ‘‘parent’’ 23 each place the term appears; and 24 (III) in clause (ii)— 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00024 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 25 •S 836 IS (aa) by striking ‘‘without 1 notice to the parent’’ and insert-2 ing ‘‘without notice to the parent 3 or teen, as applicable,’’; and 4 (bb) by inserting ‘‘or teen’’ 5 after ‘‘child’’ each place the term 6 appears; and 7 (v) in subparagraph (D)— 8 (I) in the matter preceding clause 9 (i), by inserting ‘‘or teen’’ after 10 ‘‘child’’ each place the term appears; 11 (II) in clause (ii), by inserting 12 ‘‘or teen’’ after ‘‘child’’; and 13 (III) in the flush text following 14 clause (iii)— 15 (aa) by inserting ‘‘or teen, 16 as applicable,’’ after ‘‘parent’’ 17 each place the term appears; and 18 (bb) by inserting ‘‘or teen’’ 19 after ‘‘child’’; 20 (C) by redesignating paragraph (3) as 21 paragraph (4) and inserting after paragraph 22 (2) the following new paragraph: 23 ‘‘(3) A PPLICATION TO OPERATORS ACTING 24 UNDER AGREEMENTS WITH EDUCATIONAL AGENCIES 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00025 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 26 •S 836 IS OR INSTITUTIONS.—The regulations may provide 1 that verifiable consent under paragraph (1)(A)(ii) is 2 not required for an operator that is acting under a 3 written agreement with an educational agency or in-4 stitution that, at a minimum, requires the— 5 ‘‘(A) operator to— 6 ‘‘(i) limit its collection, use, and dis-7 closure of the personal information from a 8 child or teen to solely educational purposes 9 and for no other commercial purposes; 10 ‘‘(ii) provide the educational agency or 11 institution with a notice of the specific 12 types of personal information the operator 13 will collect from the child or teen, the 14 method by which the operator will obtain 15 the personal information, and the purposes 16 for which the operator will collect, use, dis-17 close, and retain the personal information; 18 ‘‘(iii) provide the educational agency 19 or institution with a link to the operator’s 20 online notice of information practices as 21 required under subsection (b)(1)(A)(i); and 22 ‘‘(iv) provide the educational agency 23 or institution, upon request, with a means 24 to review the personal information collected 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00026 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 27 •S 836 IS from a child or teen, to prevent further use 1 or maintenance or future collection of per-2 sonal information from a child or teen, and 3 to delete personal information collected 4 from a child or teen or content or informa-5 tion submitted by a child or teen to the op-6 erator’s website, online service, online ap-7 plication, or mobile application; 8 ‘‘(B) representative of the educational 9 agency or institution to acknowledge and agree 10 that they have authority to authorize the collec-11 tion, use, and disclosure of personal information 12 from children or teens on behalf of the edu-13 cational agency or institution, along with such 14 authorization, their name, and title at the edu-15 cational agency or institution; and 16 ‘‘(C) educational agency or institution to— 17 ‘‘(i) provide on its website a notice 18 that identifies the operator with which it 19 has entered into a written agreement 20 under this subsection and provides a link 21 to the operator’s online notice of informa-22 tion practices as required under paragraph 23 (1)(A)(i); 24 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00027 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 28 •S 836 IS ‘‘(ii) provide the operator’s notice re-1 garding its information practices, as re-2 quired under subparagraph (A)(ii), upon 3 request, to a parent, in the case of a child, 4 or a parent or teen, in the case of a teen; 5 and 6 ‘‘(iii) upon the request of a parent, in 7 the case of a child, or a parent or teen, in 8 the case of a teen, request the operator 9 provide a means to review the personal in-10 formation from the child or teen and pro-11 vide the parent, in the case of a child, or 12 parent or teen, in the case of the teen, a 13 means to review the personal informa-14 tion.’’; 15 (D) by amending paragraph (4), as so re-16 designated, to read as follows: 17 ‘‘(4) T ERMINATION OF SERVICE .—The regula-18 tions shall permit the operator of a website, online 19 service, online application, or mobile application to 20 terminate service provided to a child whose parent 21 has refused, or a teen who has refused, under the 22 regulations prescribed under paragraphs (1)(B)(ii) 23 and (1)(C)(ii), to permit the operator’s further use 24 or maintenance in retrievable form, or future online 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00028 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 29 •S 836 IS collection of, personal information from that child or 1 teen.’’; and 2 (E) by adding at the end the following new 3 paragraphs: 4 ‘‘(5) C ONTINUATION OF SERVICE .—The regula-5 tions shall prohibit an operator from discontinuing 6 service provided to a child or teen on the basis of 7 a request by the parent of the child or by the teen, 8 under the regulations prescribed under subpara-9 graph (B) or (C) of paragraph (1), respectively, to 10 delete personal information collected from the child 11 or teen, to the extent that the operator is capable of 12 providing such service without such information. 13 ‘‘(6) R ULE OF CONSTRUCTION .—A request 14 made pursuant to subparagraph (B) or (C) of para-15 graph (1) to delete or correct personal information 16 of a child or teen shall not be construed— 17 ‘‘(A) to limit the authority of a law en-18 forcement agency to obtain any content or in-19 formation from an operator pursuant to a law-20 fully executed warrant or an order of a court of 21 competent jurisdiction; 22 ‘‘(B) to require an operator or third party 23 delete or correct information that— 24 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00029 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 30 •S 836 IS ‘‘(i) any other provision of Federal or 1 State law requires the operator or third 2 party to maintain; or 3 ‘‘(ii) was submitted to the website, on-4 line service, online application, or mobile 5 application of the operator by any person 6 other than the user who is attempting to 7 erase or otherwise eliminate the content or 8 information, including content or informa-9 tion submitted by the user that was repub-10 lished or resubmitted by another person; or 11 ‘‘(C) to prohibit an operator from— 12 ‘‘(i) retaining a record of the deletion 13 request and the minimum information nec-14 essary for the purposes of ensuring compli-15 ance with a request made pursuant to sub-16 paragraph (B) or (C); 17 ‘‘(ii) preventing, detecting, protecting 18 against, or responding to security inci-19 dents, identity theft, or fraud, or reporting 20 those responsible for such actions; 21 ‘‘(iii) protecting the integrity or secu-22 rity of a website, online service, online ap-23 plication or mobile application; or 24 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00030 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 31 •S 836 IS ‘‘(iv) ensuring that the child’s or 1 teen’s information remains deleted. 2 ‘‘(7) C OMMON VERIFIABLE CONSENT MECHA -3 NISM.— 4 ‘‘(A) I N GENERAL.— 5 ‘‘(i) F EASIBILITY OF MECHANISM .— 6 The Commission shall assess the feasi-7 bility, with notice and public comment, of 8 allowing operators the option to use a com-9 mon verifiable consent mechanism that 10 fully meets the requirements of this title. 11 ‘‘(ii) R EQUIREMENTS.—The feasibility 12 assessment described in clause (i) shall 13 consider whether a single operator could 14 use a common verifiable consent mecha-15 nism to obtain verifiable consent, as re-16 quired under this title, from a parent of a 17 child or from a teen on behalf of multiple, 18 listed operators that provide a joint or re-19 lated service. 20 ‘‘(B) R EPORT.—Not later than 1 year 21 after the date of enactment of this paragraph, 22 the Commission shall submit a report to the 23 Committee on Commerce, Science, and Trans-24 portation of the Senate and the Committee on 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00031 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 32 •S 836 IS Energy and Commerce of the House of Rep-1 resentatives with the findings of the assessment 2 required by subparagraph (A). 3 ‘‘(C) R EGULATIONS.—If the Commission 4 finds that the use of a common verifiable con-5 sent mechanism is feasible and would meet the 6 requirements of this title, the Commission shall 7 issue regulations to permit the use of a common 8 verifiable consent mechanism in accordance 9 with the findings outlined in such report.’’; 10 (4) in subsection (c), by striking ‘‘a regulation 11 prescribed under subsection (a)’’ and inserting ‘‘sub-12 paragraph (B), (C), (D), or (E) of subsection (a)(1), 13 or of a regulation prescribed under subsection (b),’’; 14 and 15 (5) by striking subsection (d) and inserting the 16 following: 17 ‘‘(d) R ELATIONSHIP TOSTATELAW.—The provisions 18 of this title shall preempt any State law, rule, or regula-19 tion only to the extent that such State law, rule, or regula-20 tion conflicts with a provision of this title. Nothing in this 21 title shall be construed to prohibit any State from enacting 22 a law, rule, or regulation that provides greater protection 23 to children or teens than the provisions of this title.’’. 24 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00032 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 33 •S 836 IS (c) SAFEHARBORS.—Section 1304 of the Children’s 1 Online Privacy Protection Act of 1998 (15 U.S.C. 6503) 2 is amended— 3 (1) in subsection (b)(1), by inserting ‘‘and 4 teens’’ after ‘‘children’’; and 5 (2) by adding at the end the following: 6 ‘‘(d) P UBLICATION.— 7 ‘‘(1) I N GENERAL.—Subject to the restrictions 8 described in paragraph (2), the Commission shall 9 publish on the internet website of the Commission 10 any report or documentation required by regulation 11 to be submitted to the Commission to carry out this 12 section. 13 ‘‘(2) R ESTRICTIONS ON PUBLICATION .—The re-14 strictions described in section 6(f) and section 21 of 15 the Federal Trade Commission Act (15 U.S.C. 16 46(f), 57b–2) applicable to the disclosure of infor-17 mation obtained by the Commission shall apply in 18 same manner to the disclosure under this subsection 19 of information obtained by the Commission from a 20 report or documentation described in paragraph 21 (1).’’. 22 (d) A CTIONS BYSTATES.—Section 1305 of the Chil-23 dren’s Online Privacy Protection Act of 1998 (15 U.S.C. 24 6504) is amended— 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00033 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 34 •S 836 IS (1) in subsection (a)(1)— 1 (A) in the matter preceding subparagraph 2 (A), by inserting ‘‘section 1303(a)(1) or’’ before 3 ‘‘any regulation’’; and 4 (B) in subparagraph (B), by inserting 5 ‘‘section 1303(a)(1) or’’ before ‘‘the regula-6 tion’’; and 7 (2) in subsection (d)— 8 (A) by inserting ‘‘section 1303(a)(1) or’’ 9 before ‘‘any regulation’’; and 10 (B) by inserting ‘‘section 1303(a)(1) or’’ 11 before ‘‘that regulation’’. 12 (e) A DMINISTRATION AND APPLICABILITY OFACT.— 13 Section 1306 of the Children’s Online Privacy Protection 14 Act of 1998 (15 U.S.C. 6505) is amended— 15 (1) in subsection (b)— 16 (A) in paragraph (1), by striking ‘‘, in the 17 case of’’ and all that follows through ‘‘the 18 Board of Directors of the Federal Deposit In-19 surance Corporation;’’ and inserting the fol-20 lowing: ‘‘by the appropriate Federal banking 21 agency, with respect to any insured depository 22 institution (as those terms are defined in sec-23 tion 3 of that Act (12 U.S.C. 1813));’’; and 24 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00034 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 35 •S 836 IS (B) by striking paragraph (2) and redesig-1 nating paragraphs (3) through (6) as para-2 graphs (2) through (5), respectively; 3 (2) in subsection (d)— 4 (A) by inserting ‘‘section 1303(a)(1) or’’ 5 before ‘‘a rule’’; and 6 (B) by striking ‘‘such rule’’ and inserting 7 ‘‘section 1303(a)(1) or a rule of the Commis-8 sion under section 1303’’; and 9 (3) by adding at the end the following new sub-10 sections: 11 ‘‘(f) D ETERMINATION OF WHETHER ANOPERATOR 12 H ASKNOWLEDGEFAIRLYIMPLIED ON THE BASIS OF 13 O BJECTIVECIRCUMSTANCES.— 14 ‘‘(1) R ULE OF CONSTRUCTION .—For purposes 15 of enforcing this title or a regulation promulgated 16 under this title, in making a determination as to 17 whether an operator has knowledge fairly implied on 18 the basis of objective circumstances that a specific 19 user is a child or teen, the Commission or State at-20 torneys general shall rely on competent and reliable 21 evidence, taking into account the totality of the cir-22 cumstances, including whether a reasonable and pru-23 dent person under the circumstances would have 24 known that the user is a child or teen. Nothing in 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00035 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 36 •S 836 IS this title, including a determination described in the 1 preceding sentence, shall be construed to require an 2 operator to— 3 ‘‘(A) affirmatively collect any personal in-4 formation with respect to the age of a child or 5 teen that an operator is not already collecting 6 in the normal course of business; or 7 ‘‘(B) implement an age gating or age 8 verification functionality. 9 ‘‘(2) C OMMISSION GUIDANCE.— 10 ‘‘(A) I N GENERAL.—Within 180 days of 11 enactment, the Commission shall issue guidance 12 to provide information, including best practices 13 and examples for operators to understand the 14 Commission’s determination of whether an op-15 erator has knowledge fairly implied on the basis 16 of objective circumstances that a user is a child 17 or teen. 18 ‘‘(B) L IMITATION.—No guidance issued by 19 the Commission with respect to this title shall 20 confer any rights on any person, State, or local-21 ity, nor shall operate to bind the Commission or 22 any person to the approach recommended in 23 such guidance. In any enforcement action 24 brought pursuant to this title, the Commission 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00036 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 37 •S 836 IS or State attorney general, as applicable, shall 1 allege a specific violation of a provision of this 2 title. The Commission or State attorney gen-3 eral, as applicable, may not base an enforce-4 ment action on, or execute a consent order 5 based on, practices that are alleged to be incon-6 sistent with any such guidance, unless the prac-7 tices allegedly violate this title. For purposes of 8 enforcing this title or a regulation promulgated 9 under this title, State attorneys general shall 10 take into account any guidance issued by the 11 Commission under subparagraph (A). 12 ‘‘(g) A DDITIONALREQUIREMENT.—Any regulations 13 issued under this title shall include a description and anal-14 ysis of the impact of proposed and final Rules on small 15 entities per the Regulatory Flexibility Act of 1980 (5 16 U.S.C. 601 et seq.).’’. 17 SEC. 3. STUDY AND REPORTS OF MOBILE AND ONLINE AP-18 PLICATION OVERSIGHT AND ENFORCEMENT. 19 (a) O VERSIGHTREPORT.—Not later than 3 years 20 after the date of enactment of this Act, the Federal Trade 21 Commission shall submit to the Committee on Commerce, 22 Science, and Transportation of the Senate and the Com-23 mittee on Energy and Commerce of the House of Rep-24 resentatives a report on the processes of platforms that 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00037 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 38 •S 836 IS offer mobile and online applications for ensuring that, of 1 those applications that are websites, online services, online 2 applications, or mobile applications directed to children, 3 the applications operate in accordance with— 4 (1) this Act, the amendments made by this Act, 5 and rules promulgated under this Act; and 6 (2) rules promulgated by the Commission under 7 section 18 of the Federal Trade Commission Act (15 8 U.S.C. 57a) relating to unfair or deceptive acts or 9 practices in marketing. 10 (b) E NFORCEMENT REPORT.—Not later than 1 year 11 after the date of enactment of this Act, and each year 12 thereafter, the Federal Trade Commission shall submit to 13 the Committee on Commerce, Science, and Transportation 14 of the Senate and the Committee on Energy and Com-15 merce of the House of Representatives a report that ad-16 dresses, at a minimum— 17 (1) the number of actions brought by the Com-18 mission during the reporting year to enforce the 19 Children’s Online Privacy Protection Act of 1998 20 (15 U.S.C. 6501) (referred to in this subsection as 21 the ‘‘Act’’) and the outcome of each such action; 22 (2) the total number of investigations or inquir-23 ies into potential violations of the Act; during the re-24 porting year; 25 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00038 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 39 •S 836 IS (3) the total number of open investigations or 1 inquiries into potential violations of the Act as of the 2 time the report is submitted; 3 (4) the number and nature of complaints re-4 ceived by the Commission relating to an allegation 5 of a violation of the Act during the reporting year; 6 and 7 (5) policy or legislative recommendations to 8 strengthen online protections for children and teens. 9 SEC. 4. GAO STUDY. 10 (a) S TUDY.—The Comptroller General of the United 11 States (in this section referred to as the ‘‘Comptroller 12 General’’) shall conduct a study on the privacy of teens 13 who use financial technology products. Such study shall— 14 (1) identify the type of financial technology 15 products that teens are using; 16 (2) identify the potential risks to teens’ privacy 17 from using such financial technology products; and 18 (3) determine whether existing laws are suffi-19 cient to address such risks to teens’ privacy. 20 (b) R EPORT.—Not later than 1 year after the date 21 of enactment of this section, the Comptroller General shall 22 submit to Congress a report containing the results of the 23 study conducted under subsection (a), together with rec-24 VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00039 Fmt 6652 Sfmt 6201 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS 40 •S 836 IS ommendations for such legislation and administrative ac-1 tion as the Comptroller General determines appropriate. 2 SEC. 5. SEVERABILITY. 3 If any provision of this Act, or an amendment made 4 by this Act, is determined to be unenforceable or invalid, 5 the remaining provisions of this Act and the amendments 6 made by this Act shall not be affected. 7 Æ VerDate Sep 11 2014 00:25 Mar 19, 2025 Jkt 059200 PO 00000 Frm 00040 Fmt 6652 Sfmt 6301 E:\BILLS\S836.IS S836 ssavage on LAPJG3WLY3PROD with BILLS