S836-119

What This Bill Does

The Senate-passed Children and Teens' Online Privacy Protection Act would amend COPPA to cover teens ages 13 through 16 alongside children under 13. Covered commercial websites, online services, and mobile or online applications would face duties when directed to children or when they actually know, or objectively should know under the bill's specified standard, that a user is a child or teen. Parents would consent for children; teens would generally consent for themselves. The bill bans collecting, using, sharing, or retaining covered personal information for individual-specific advertising, subject to explicit exceptions. It also limits collection to the service or transaction context or legal authorization, limits retention, requires notice of overseas storage or transfers, and adds access, deletion, correction, and security requirements. It has passed the Senate and is not enacted law.

Who Benefits and How

Children, teens, and parents gain control over covered data and reduced exposure to targeted advertising, unnecessary retention, and unauthorized access. Schools can use a regulated written-agreement route for educational services without ordinary individual consent, provided information is used solely for education and notices and review mechanisms are supplied. Commercial online services retain room for contextual advertising, responses to specific searches, performance measurement, and age-appropriate advertising using only whether a user is under 17. The Senate amendment additionally exempts adult-profile advertising on household devices shared with minors. Qualifying transient voice commands and internal-operations identifiers have limited exclusions. Nonprofits otherwise exempt from FTC Act section 5 remain outside the operator definition; these are not blanket exemptions for commercial educational software or all voice data.

Who Bears the Burden and How

Website operators, mobile app providers, online advertising businesses, and connected-device services may bear consent-system, security, notice, correction, and deletion costs and lose opportunities to monetize minors' profiles. Covered schools using the agreement route must publish notices and arrange access to student data. The Federal Trade Commission must issue knowledge-standard guidance within 180 days, assess common consent mechanisms with a one-year report, publish safe-harbor program submissions subject to confidentiality restrictions, and prepare oversight and enforcement reports. State attorneys general can enforce the specified statutory prohibitions as well as regulations. Banking enforcement references are updated to appropriate federal banking agencies. No universal age verification or new age-data collection is required; enforcement must rest on the law rather than nonbinding guidance alone. The Government Accountability Office must study teen fintech privacy and mental-health risks. This bill does not appropriate a stated funding amount.

Key Provisions

• Expands the personal-information definition to persistent identifiers, images and voices, geolocation, identifying biometrics, and linked information, with narrow transient-audio and internal-operations exceptions.
• Prohibits individual-specific advertising to covered users under 17 while preserving contextual, search-responsive, measurement, adult-profile shared-device, and limited age-appropriate advertising exceptions.
• Requires verifiable consent before collection and materially changed use or disclosure; creates deletion and correction rights with exceptions for legal retention, lawful investigations, security, and content posted or reposted by another person.
• Protects continued service after a deletion request when service can still be provided without the deleted information, while allowing termination when future data use or collection needed for service is refused.
• Allows an educational written-agreement consent exception only through regulations and subject to educational-only use, notice, authorized school representatives, review, and deletion controls.
• Limits State-law preemption to conflicts and preserves greater State protections; requires competent evidence for the objective-knowledge standard and does not mandate age gating or verification.
• Requires a three-year FTC app-platform oversight report, annual FTC enforcement reports starting after one year, and a one-year GAO study of teens' financial technology privacy and mental health; preserves remaining provisions if one is invalidated.