Children and Teens' Online Privacy Protection Act

This bill extends to minors (ages 12–16) privacy protections previously applicable only to children (ages 0–12) and otherwise establishes greater online privacy protections for children and minors.

Specifically, the bill prohibits an operator of a website, online service, online application, or mobile application directed to, or used or reasonably likely to be used by, a child or minor from collecting the user's personal information without

• providing notice and obtaining consent,
• providing a parent or minor with certain information upon request,
• conditioning participation by a user on the provision of personal information,
• establishing and maintaining reasonable procedures to protect the personal information collected from users.

The bill also prohibits targeted marketing directed to a child or directed to a minor without the minor's consent.

Children and Teens' Online Privacy Protection Act

This bill extends to minors (ages 12–16) privacy protections previously applicable only to children (ages 0–12) and otherwise establishes greater online privacy protections for children and minors.

Specifically, the bill prohibits an operator of a website, online service, online application, or mobile application directed to a child or minor with constructive knowledge the user is a child or minor from collecting the user's personal information without

• providing notice and obtaining consent,
• providing a parent or minor with certain information upon request,
• conditioning participation by a user on the provision of personal information,
• establishing and maintaining reasonable procedures to protect the personal information collected from users.

The bill also prohibits targeted marketing directed to a child or directed to a minor without the minor's consent.

The bill further outlines a set of principles governing how operators should collect and use personal information, as well as provide information to a parent or minor. A parent or minor must be able to challenge the accuracy of personal information, and an operator must provide for the erasure or correction of inaccurate personal information. Operators must also implement mechanisms for the erasure or elimination of personal information at the request of users and make users aware of such mechanisms.

Moreover, the bill prohibits the sale of internet-connected devices targeted to children and minors unless they meet certain cybersecurity and data security standards, and it requires manufacturers of such devices to display a privacy dashboard detailing how personal information is collected and used.