Children and Teens’ Online Privacy Protection Act

This bill amends the Children's Online Privacy Protection Act of 1998 to strengthen protections for the online collection, use, and disclosure of personal information of children (under 13) and teens (ages 13-16). It expands definitions, adds new requirements for operators, and imposes restrictions on data practices, including bans on using personal information for individual-specific advertising to children or teens and limits on data retention and storage in certain foreign nations.

Sec. 2, Amendments to Children's Online Privacy Protection Act of 1998: This section revises key definitions. 'Operator' now includes those who allow others to collect personal information or let users publicly disclose it, but excludes certain tax-exempt organizations. 'Personal information' is expanded to include persistent identifiers (like IP addresses), biometric data (fingerprints, facial templates), geolocation information (street name and city/town), and information linked to a child or teen. 'Teen' is defined as ages 13-16. 'High-impact social media company' is defined by revenue ($3 billion+), monthly active users (300 million+), and user-generated content focus. 'Knowledge' for such companies includes willful disregard of information. 'Individual-specific advertising to children or teens' is defined and excludes contextual advertising and search responses. The section also amends Section 1303 to make it unlawful for operators of child-directed sites or those with knowledge a user is a child or teen to collect personal information for individual-specific advertising, to retain data longer than necessary, or to store/transfer data to a covered nation without notice. It requires operators to obtain verifiable consent from a parent (for children) or teen (for teens) before material changes in data use, and to provide teens with rights to access, delete, correct, and refuse further use of their personal information. Operators must also establish reasonable security practices.

Sec. 3, Reports: The Federal Trade Commission must submit a report to Congress within 3 years detailing how high-impact social media companies ensure compliance with the Act. Additionally, within 1 year and annually thereafter, the FTC must report on enforcement actions, investigations, and complaints related to the Act.

Sec. 4, Severability: If any part of this Act is found invalid, the rest of the Act remains in effect.