Children and Teens’ Online Privacy Protection Act
This bill expands federal online privacy protections to cover teenagers ages 13 through 16, prohibiting tech companies from serving them targeted ads based on personal data, browsing history, or behavioral profiling. Online platforms and apps must get affirmative consent before collecting personal information—from parents for children under 13, and directly from teens ages 13 to 16. Parents and teens also gain the right to review, correct, and permanently delete their data and uploaded content, and companies are forbidden from denying service just because someone requests data deletion. Furthermore, the bill expands protected personal information to include biometric data, precise location details, voice and video files, and device identifiers.
What this bill touches.
Who it helps · who it burdens.
Who it helps
- Children and teens under age 17Gains new privacy protections, including a ban on individual-specific targeted advertising, limits on data collection and retention, rights to access, correct, and delete personal data, and verifiable consent requirements prior to data collection or material changes in data use (Sec. 2(b)).
- Parents and legal guardians of children under 13Gain the right to receive direct notice and provide verifiable consent before their children's data is collected, used, or transferred outside the U.S., as well as the right to review, correct, and delete their children's personal information (Sec. 2(b)(2)-(3)).
Who it burdens
- Commercial website, online service, and mobile app operatorsMust obtain verifiable consent before collecting personal data from children (via parents) or teens, ban targeted advertising to users under 17, minimize data collection and retention, provide direct notices before transferring data abroad, honor data deletion and correction requests, and maintain reasonable security measures under an expanded standard of actual or fairly implied knowledge of a user's age (Sec. 2(a)-(b)).
- Federal Trade CommissionRequired to issue guidance on implied age knowledge determinations, conduct a feasibility study and potential rulemaking on centralized consent mechanisms, publish safe harbor reports, and submit recurring oversight and enforcement reports to Congress (Sec. 2(b)(3)(E), Sec. 2(c)(2), Sec. 2(e)(3), Sec. 3).
- Government Accountability OfficeMust conduct a study and submit a report to Congress within one year examining privacy risks to teens using financial technology products (Sec. 4).
- K–12 schools and local educational agenciesMust post notices of agreements with online operators, provide operator notices upon request to parents or teens, and facilitate parent and teen data review requests when using commercial software under school agreements (Sec. 2(b)(3)(C)).