S. 836 — Children and Teens’ Online Privacy Protection Act

This section designates the Act as the “Children and Teens’ Online Privacy Protection Act” and sets forth the table of contents.

This section amends definitions in the Children’s Online Privacy Protection Act of 1998 (COPPA) as follows: (1) revises the definition of "operator" to include any person operating a website, online service, online application, or mobile application for commercial purposes who collects personal information directly or indirectly—including by allowing public disclosure or collection by others—and excludes nonprofits exempt from Federal Trade Commission Act coverage; (2) modifies the definition of "disclosure" to cover release of personal information from a child or teen except to support providers for internal operations (excluding individual-specific advertising), expands applicability to online and mobile applications, inserts "or teen," and replaces "actual knowledge" with "actual knowledge or knowledge fairly implied on the basis of objective circumstances"; and (3) replaces the definition of "personal information" with a broader list including names, addresses, email addresses and phone numbers, Social Security numbers, persistent identifiers (e.g., cookies, IP addresses, device IDs), photographs/videos/audio files containing a child's or teen's image or voice, geolocation information, biometrics (e.g., fingerprints, facial templates, DNA, gait), and information linked or reasonably linkable to a child or teen, with exclusions for audio files used solely as voice input replacements under specified conditions and identifiers used only for internal operations support (e.g., maintaining functionality, contextual advertising frequency capping, security).

This section directs the Federal Trade Commission (FTC) to submit two reports to the Senate Committee on Commerce, Science, and Transportation and the House Committee on Energy and Commerce. Subsection (a) requires an oversight report, due not later than 3 years after enactment, on platforms' processes for ensuring that child-directed websites, online services, online applications, or mobile applications comply with this Act (i.e., the Children's Online Privacy Protection Act of 1998, or COPPA), its amendments, rules under this Act, and FTC rules under section 18 of the FTC Act (15 U.S.C. 57a) on unfair or deceptive marketing practices. Subsection (b) requires annual enforcement reports, with the first due not later than 1 year after enactment, detailing (1) the number and outcomes of FTC actions to enforce COPPA during the reporting year; (2) the total number of investigations or inquiries into potential COPPA violations during the reporting year; (3) the total number of open investigations or inquiries at the time of submission; (4) the number and nature of COPPA-related complaints received during the reporting year; and (5) policy or legislative recommendations to strengthen online protections for children and teens.

This section directs the Comptroller General of the United States to conduct a study on the privacy and mental health of teens using financial technology products—including identifying the types of such products used by teens, potential risks to their privacy and mental health, and the sufficiency of existing laws to address those risks—and to submit a report to Congress with results and recommendations for legislation and administrative action not later than one year after enactment.

This section establishes a severability clause providing that the invalidity of any provision of the Act, or an amendment made by the Act, does not affect the remainder of the Act or its amendments.