SECTION 1. Short title; table of contents.
(a) Short title.—This Act may be cited as the “Children and Teens’ Online Privacy Protection Act”.
(b) Table of contents.—The table of contents for this Act is as follows: Sec. 1. Short title; table of contents.Sec. 2. Definitions.Sec. 3. Online collection, use, and disclosure of personal information of children and minors.Sec. 4. Fair Information Practices Principles.Sec. 5. Digital Marketing Bill of Rights for Minors.Sec. 6. Targeted marketing to children or minors.Sec. 7. Removal of content.Sec. 8. Privacy dashboard for connected devices for children and minors.Sec. 9. Rule for treatment of users of websites, services, and applications directed to children or minors.Sec. 10. Study of mobile and online application oversight.Sec. 11. Youth Privacy and Marketing Division.Sec. 12. Enforcement and applicability.Sec. 13. GAO study.
SEC. 2. Definitions.
(a) In general.—In this Act:
(1) COMMISSION.—The term “Commission” means the Federal Trade Commission.
(2) STANDARDS.—The term “standards” means benchmarks, guidelines, best practices, methodologies, procedures, and processes.
(b) Other definitions.—The definitions set forth in section 1302 of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501), as amended by section 3(a) of this Act, shall apply in this Act, except to the extent the Commission provides otherwise by regulations issued under section 553 of title 5, United States Code.
SEC. 3. Online collection, use, and disclosure of personal information of children and minors.
(a) Definitions.—Section 1302 of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501) is amended—
(1) by amending paragraph (2) to read as follows:
“(2) OPERATOR.—The term ‘operator’—
“(A) means any person—
“(i) who, for commercial purposes, in interstate or foreign commerce operates or provides a website on the internet, an online service, an online application, a mobile application, or a connected device; and
“(ii) who—
“(I) collects or maintains, either directly or through a service provider, personal information from or about the users of that website, service, application, or connected device;
“(II) allows another person to collect personal information directly from users of that website, service, application, or connected device (in which case, the operator is deemed to have collected the information); or
“(III) allows users of that website, service, application, or connected device to publicly disclose personal information (in which case, the operator is deemed to have collected the information); and
“(B) does not include any nonprofit entity that would otherwise be exempt from coverage under section 5 of the Federal Trade Commission Act (15 U.S.C. 45).”;
(2) in paragraph (4)—
(A) by amending subparagraph (A) to read as follows:
“(A) the release of personal information collected from a child or minor for any purpose, except where the personal information is provided to a person other than an operator who—
“(i) provides support for the internal operations of the website, online service, online application, mobile application, or connected device of the operator, excluding any activity relating to targeted marketing directed to children, minors, or connected devices; and
“(ii) does not disclose or use that personal information for any other purpose; and”; and
(B) in subparagraph (B)—
(i) by inserting “or minor” after “child” each place the term appears;
(ii) by inserting “or minors” after “children”; and
(iii) by striking “website or online service” and inserting “website, online service, online application, mobile application, or connected device”;
(3) in paragraph (8), by striking subparagraphs (F) and (G) and inserting the following:
“(F) geolocation information;
“(G) information generated from the measurement or technological processing of an individual's biological, physical, or physiological characteristics, including—
“(i) fingerprints;
“(ii) voice prints;
“(iii) iris or retina imagery scans;
“(iv) facial imagery or templates;
“(v) deoxyribonucleic acid (DNA) information; or
“(vi) gait;
“(H) information reasonably associated with or attributed to a child or minor;
“(I) information (including an internet protocol address) that permits the identification of—
“(i) an individual; or
“(ii) any device used by an individual to directly or indirectly access the internet or an online service, online application, mobile application, or connected device; or
“(J) information concerning a child or minor or the parents of that child or minor (including any unique or substantially unique identifier, such as a customer number) that an operator collects online from the child or minor and combines with an identifier described in this paragraph.”;
(4) by amending paragraph (9) to read as follows:
“(9) VERIFIABLE CONSENT.—The term ‘verifiable consent’ means any reasonable effort (ta