Children and Teens’ Online Privacy Protection Act

This bill amends the Children's Online Privacy Protection Act of 1998 to strengthen protections for the online collection, use, and disclosure of personal information of children (under 13) and teens (ages 13 to 16). It expands the definition of personal information, requires verifiable consent from a parent for children or from the teen themselves, and bans the use of personal information for individual-specific advertising to children or teens.

Sec. 2, Online collection, use, disclosure, and deletion of personal information of children and teens: This section updates key definitions, including expanding 'operator' to cover online and mobile applications, and defining 'personal information' to include biometric data, geolocation, and persistent identifiers. It creates a new category of 'teen' (ages 13-16) and requires operators to obtain verifiable consent from teens (instead of parents) before collecting their data. It prohibits collecting personal information for individual-specific advertising to children or teens, limits data collection to what is necessary for a transaction, restricts storing data outside the U.S. without notice, and requires data deletion when no longer needed. It also gives parents of children and teens themselves rights to access, delete, and correct personal information.

Sec. 3, Study and reports of mobile and online application oversight and enforcement: The Federal Trade Commission must submit a report within 3 years on how app platforms ensure child-directed apps comply with this Act and FTC rules. It also requires an annual enforcement report detailing actions, investigations, complaints, and policy recommendations.

Sec. 4, GAO study: The Government Accountability Office must study the privacy and mental health risks to teens using financial technology products and report to Congress within one year with recommendations.

Sec. 5, Severability: If any part of this Act is found invalid, the rest of the Act remains in effect.