HR6484-119

2. Definitions In this Act: The term child means an individual who is under the age of 13. The term Commission means the Federal Trade Commission. The term compulsive usage means a persistent and repetitive use of a covered platform that substantially limits one or more major life activities of an individual (described in section 3(2) of the Americans with Disabilities Act of 1990 (42 U.S.C. 12102(2))). The term covered platform means a platform that is a website, software, application, or electronic service connected to the internet that— is publicly available for use by consumers; enables the creation of a username or user identifier— that is searchable on the platform; and that can be followed by or is similarly accessible to other users of the platform; as the predominant purpose of the platform, facilitates the sharing and access to user-generated content through text, images, video, audio, or any other interactive medium; uses a design feature to promote user engagement on the platform; and uses the personal information of the user to advertise, market, or make content recommendations. The term design feature— means any feature or component of a covered platform that encourages or increases the frequency, time spent, or activity of a user on the covered platform; and includes any of the following: Infinite scrolling or auto play. Rewards or incentives based on the frequency, time spent, or activity of a user on the covered platform. Notifications and push alerts. Badges or other visual award symbols based on the frequency, time spent, or activity of a minor on the covered platform. Appearance altering filters. The term know or knows means to have actual knowledge or to have acted in willful disregard. The term minor means an individual who is under the age of 17. The term narcotic drug has the meaning given that term in section 102 of the Controlled Substances Act (21 U.S.C. 802). The term parent means the legal guardian of a minor. The term personal information has the meaning given that term in section 1302 of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501). The term physical violence has the meaning given the term crime of violence under section 16 of title 18, United States Code. The term sexual exploitation and abuse means any of the following: Any offense, including coercion and enticement, as described in section 2422 of title 18, United States Code. Child pornography, as defined in section 2256 of title 18, United States Code. Trafficking for the production of images, as described in section 2251 of title 18, United States Code. Any offense described in section 1591 of title 18, United States Code. The term State means each State of the United States, the District of Columbia, each commonwealth, territory, or possession of the United States, and each federally recognized Indian Tribe. The term user means, with respect to a covered platform, an individual who registers an account or creates a profile on the covered platform. The term verifiable parental consent has the meaning given that term in section 1302 of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501)).

3. Preventing harm to minors A covered platform shall establish, implement, maintain, and enforce reasonable policies, practices, and procedures that address the following harms to minors: Threats of physical violence. Sexual exploitation and abuse. Distribution, sale, or use of narcotic drugs, tobacco products, cannabis products, gambling, or alcohol. Any financial harm caused by deceptive practices. The policies, practices, and procedures required under subsection (a) shall be appropriate to each of the following: The size and complexity of the covered platform. The technological feasibility of addressing the harms described in subsection (a). Nothing in subsection (a) may be construed to require a covered platform to prevent or preclude any minor from— deliberately and independently searching for, or specifically requesting, content; or accessing resources and information regarding the prevention or mitigation of the harms described in subsection (a). Nothing in this section may be construed to allow a government entity to enforce subsection (a) based upon the viewpoint of users expressed by or through any speech, expression, or information protected by the First Amendment to the Constitution of the United States.

4. Safeguards for minors A covered platform shall provide a user or visitor to the covered platform, that the covered platform knows is a minor, with readily accessible and easy-to-use safeguards to, as applicable, do each of the following: Limit the ability of other users or visitors to communicate with the minor. Limit by default design features that result in compulsive usage of the covered platform by the minor. A covered platform shall provide a user that the covered platform knows is a minor with a readily accessible and easy-to-use option to limit the amount of time spent by the minor on the covered platform. A covered platform shall provide that, in the case of a user or visitor that the platform knows is a minor, the default setting for any safeguard described under paragraph (1) is the option available on the platform that provides the most protective level of control that is offered by the platform with respect to privacy and safety for that user or visitor. A covered platform shall provide readily accessible and easy-to-use parental tools for parents to support a user that the platform knows is a minor with respect to the use of the platform by that user. The parental tools provided by a covered platform under paragraph (1) include each of the following: The ability to manage the privacy and account settings of a minor, including any safeguard and option established under subsection (a), in a manner that allows parents to— view the privacy and account settings; and in the case of a user that the platform knows is a child, change and control the privacy and account settings. The ability to restrict purchases and financial transactions by the minor, if applicable. The ability to view metrics of total time spent on the covered platform and restrict time spent on the covered platform by the minor. A covered platform shall provide clear and conspicuous notice to a user when the tools described in this subsection are in effect and what settings or controls have been applied. In the case of a user that the platform knows is a child, a covered platform shall enable the tools required under paragraph (1) by default. If, before the effective date of this subsection, a covered platform provides a parent of a user that the platform knows is a child with notice and the ability to enable the parental tools described under this subsection in a manner that would otherwise comply with this subsection, and the parent opted out of enabling such tools, the covered platform is not required to enable such tools with respect to such user by default on and after the date on which this subsection takes effect. A covered platform shall provide each of the following: A readily accessible and easy-to-use means for a user and visitor to a covered platform to submit a report to the covered platform of any harm to a minor related to use of the covered platform. An electronic point of contact specific to matters involving harms to a minor. Confirmation of the receipt of such report and, within the applicable time period described in paragraph (2), a substantive response to the individual that submitted the report. A covered platform shall establish an internal process to receive and substantively respond to a report submitted under paragraph (1) in a reasonable and timely manner, but in no case later than— 10 days after the date on which the report is received; and notwithstanding subparagraph (A), if the report involves an imminent threat to the safety of a minor, as promptly as needed to address the reported threat to safety. A covered platform shall not facilitate the advertising of narcotic drugs, cannabis products, tobacco products, gambling, or alcohol to an individual that the covered platform knows is a minor. With respect to safeguards and parental tools described under subsections (a) and (b), a covered platform shall provide each of the following: Information and control options in a clear and conspicuous manner that takes into consideration the differing ages, capacities, and developmental needs of the minors most likely to access the covered platform and does not encourage minors or parents to weaken or disable safeguards or parental tools. Readily accessible and easy-to-use controls to enable or disable safeguards or parental tools, as appropriate. Information and control options in the same language, form, and manner as the covered platform provides the product or service used by minors and their parents. If the device of a user or user account does not have access to the internet at the time of a change to parental tools, a covered platform shall apply changes the next time the device or user is connected to the internet. Nothing in this section may be construed to do any of the following: Prevent a covered platform from taking reasonable measures to— block, detect, or prevent the distribution of unlawful, obscene, or other harmful material to minors as described in section 3(a); or block or filter spam, prevent criminal activity, or protect the security of a platform or service. Require the disclosure of the browsing behavior, search history, messages, contact list, or other content or metadata of the communications of a minor. Prevent a covered platform from entering into an agreement with a third party, whose primary or exclusive function is to provide the safeguards or parental tools required under subsections (a) and (b) or to assist with meeting the requirements described under subsections (a) and (b). Prevent a parent or user from authorizing a third party described in subparagraph (3) to implement such safeguards or parental tools required under subsections (a) and (b).

5. Disclosure Before any registration or purchase on a covered platform by an individual that the platform knows is a minor, the platform shall provide clear, conspicuous, and easy-to-understand notice on each of the following: The policies and practices of the covered platform with respect to safeguards for minors. Information about how to access the safeguards and parental tools required under section 4. In the case of an individual that a covered platform knows is a child, the platform shall provide information about the parental tools and safeguards required under section 4 to a parent of the child and obtain verifiable parental consent. A covered platform shall be deemed to have satisfied the requirement described in subparagraph (A) if the covered platform is in compliance with the requirements of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501 et seq.) to use reasonable efforts (taking into consideration available technology) to provide a parent with the information described in subparagraph (A) and to obtain verifiable parental consent. For purposes of this section, a covered platform may consolidate the process for providing information and obtaining verifiable parental consent or the consent of the minor involved (as applicable) required under this subsection with the obligations of the covered platform to provide relevant notice and obtain verifiable parental consent under the Children’s Online Privacy Protection Act of 1998. A covered platform shall provide clear, conspicuous, and easy-to-understand labels and information, which may be provided through a link to another web page or disclosure, to minors on advertisements regarding the disclosure of endorsements of products, services, or brands made for commercial consideration by other users of the platform.

6. Audit; report Not later than 1 year after the date of the enactment of this Act, and annually thereafter, a covered platform shall have an independent, third-party auditor conduct an independent, third-party audit of the covered platform. In conducting an audit required by subsection (a), an independent, third-party auditor shall do the following: Consider widely accepted or evidence-based approaches, best practices, frameworks, and methods related to the measures, safeguards for minors, and parental tools required under this Act. Consider widely accepted or evidence-based approaches, best practices, frameworks, and methods related to identifying, preventing, and mitigating the harms to minors listed in section 3(a) of this Act. Consult with parents (including parents with relevant experience), public health and mental health nonprofit organizations, health and development organizations, and experts in freedom of expression about methods to identify, prevent, and mitigate such harms. An audit required by subsection (a) shall include the following: An assessment of the extent to which the relevant covered platform is likely to be accessed by minors, including differences between children and teens. An accounting of the following: The number of users using such covered platform that such covered platform knows to be minors located in the United States. The median and mean amounts of time spent on such covered platform by such users during the year in which such audit is conducted. A description of the policies, practices, and procedures implemented to address the harms described in section 3. The number of times that the safeguards for minors described in section 4(a) have been exercised during the year in which such audit is conducted. The number of times that the parental tools described in section 4(b) have been exercised during the year in which such audit is conducted. The number of reports received by such covered platform through the reporting mechanism described in section 4(c) during the year in which such audit is conducted. A description of such safeguards for minors and parental tools that are available to minors and parents on such covered platform. A description of how such covered platform handles reports received through such reporting mechanism, including the rate of response to such a report and the timeliness and substantiveness of any such response. A description of whether, how, and for what purpose such covered platform collects or processes categories of personal information of minors. If the covered platform has a process used to create, implement, or evaluate the impact of a design feature of the covered platform used by minors, a description of such process. A covered platform shall facilitate an audit of the covered platform required by subsection (a) by doing the following: Provide or otherwise make available to the independent, third-party auditor that conducts such audit all information and materials in the possession, custody, or control of such covered platform relevant to such audit. Provide or otherwise make available to such auditor access to all networks, systems, and assets relevant to such audit. Disclose all material facts to such auditor and not misrepresent any material fact. Not later than 30 days after the date on which an audit required by subsection (a) is completed, the relevant covered platform shall submit to the Commission the results of the audit.

7. Enforcement A violation of this Act shall be treated as a violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices. The Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act. Any person who violates this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act. In any case in which the attorney general of a State, or an official or agency of a State, has reason to believe that an interest of the residents of such State has been or is threatened or adversely affected by an act or practice in violation of this Act, the State, as parens patriae, may bring a civil action on behalf of the residents of the State in an appropriate State court or an appropriate district court of the United States to— enjoin such act or practice; enforce compliance with this Act; obtain damages, restitution, or other compensation on behalf of residents of the State; or obtain such other legal and equitable relief as the court may consider to be appropriate. Before filing an action under this subsection, the attorney general, official, or agency of the State involved shall provide to the Commission a written notice of such action and a copy of the complaint for such action. If the attorney general, official, or agency determines that it is not feasible to provide the notice described in this paragraph before the filing of the action, the attorney general, official, or agency shall provide written notice of the action and a copy of the complaint to the Commission immediately upon the filing of the action. On receiving notice under paragraph (2) of an action under this subsection, the Commission shall have the right— to intervene in the action; and upon so intervening— to be heard on all matters arising therein; and to file petitions for appeal. If the Commission or the Attorney General of the United States has instituted a civil action for violation of this Act (referred to in this subparagraph as the Federal action), no State attorney general, official, or agency may bring an action under this subsection during the pendency of the Federal action against any defendant named in the complaint in the Federal action for any violation of this Act alleged in such complaint. For purposes of bringing a civil action under this subsection, nothing in this Act shall be construed to prevent an attorney general, official, or agency of a State from exercising the powers conferred on the attorney general, official, or agency by the laws of such State to conduct investigations, administer oaths and affirmations, or compel the attendance of witnesses or the production of documentary and other evidence.

8. Kids Online Safety Council The Secretary of Commerce shall establish a Kids Online Safety Council (in this section referred to as the Council). The duties of the Council shall be to submit to Congress reports with recommendations and advice on matters related to the safety of minors online, including the following: An identification of risks, including emerging risks, for minors who engage with covered platforms. An identification of the benefits for minors who engaged with covered platforms. Recommendations with respect to methods for assessing, preventing, and mitigating harms to minors online. Recommendations with respect to methods and themes for research regarding harms to minors online. Recommendations with respect to best practices and clear, consensus-based standards for the reports and audits required under this Act, including best practices and standards with respect to methods, criteria, and scope that promote accountability. In appointing members under subsection (c), the Secretary shall seek to ensure that the Council includes representatives of the following: Academic experts with specific expertise in the prevention of harms to minors online. Researchers with specific expertise with respect to social media. Parents and minors with demonstrated experience with respect to the safety of minors online. Educators with demonstrated experience with respect to the safety of minors online. Covered platforms. Experts in academia and civil society with specific expertise in constitutional law, privacy, free expression, access to information, and civil liberties. State attorneys general or designees thereof who work in State or local government. Each appointment under subsection (c) shall be made not later than the date that is 180 days after the date on which this Act takes effect (as specified in section 14). Each member of the Council shall be appointed for the life of the Council and a vacancy in the Council shall be filled in the manner in which the original appointment was made. The Council, once fully appointed, shall select a Chair and Vice Chair of the Council. Not later than 3 years after the date on which this Act takes effect (as specified in section 14), the Council shall submit to Congress a final report that includes the following: A detailed statement of the findings and conclusions of the Council with respect to the recommendations and advice described in subsection (b). The dissenting opinions of any member of the Council who does not support the findings and conclusions described in paragraph (1). Any recommendations for legislative or administrative actions to address the online safety of minors. The Council shall terminate on the date that is 30 days after the date on which the Council submits the final report of the Council under subsection (h). Chapter 10 of title 5, United States Code, does not apply to the Council.

9. Rules of construction Nothing in this Act may be construed to— limit or impair the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501 et seq.) or any rule or regulation promulgated under such Act; authorize any action in conflict with section 18(h) of the Federal Trade Commission Act (15 U.S.C. 57a(h)); or expand, limit the scope of, or alter the meaning of section 230 of the Communications Act of 1934 (47 U.S.C. 230). Nothing in this Act may be construed to restrict the ability of a covered platform to— cooperate with a law enforcement agency regarding activity that the covered platform reasonably and in good faith believes may violate a Federal, State, or local law, rule, or regulation; comply with a lawful civil, criminal, or regulatory inquiry, subpoena, or summons from a Federal, State, local, or other government authority; investigate, establish, exercise, respond to, or defend against a legal claim; prevent, detect, or respond to security incidents, identity theft, fraud, harassment, or any other malicious, deceptive, or illegal activity; or investigate or report an individual or entity responsible for an activity described in paragraph (4). Nothing in this Act may be construed to require the affirmative collection of any personal information with respect to the age of users that a covered platform is not already collecting in the normal course of business.

10. Relationship to State laws No State or political subdivision of a State may prescribe, maintain, or enforce any law, rule, regulation, requirement, standard, or other provision having the force and effect of law, if such law, rule, regulation, requirement, standard, or other provision relates to the provisions of this Act.