[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 1409 Introduced in Senate (IS)]
<DOC>
118th CONGRESS
1st Session
S. 1409
To protect the safety of children on the internet.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
May 2, 2023
Mr. Blumenthal (for himself, Mrs. Blackburn, Mr. Lujan, Mrs. Capito,
Ms. Baldwin, Mr. Cassidy, Ms. Klobuchar, Ms. Ernst, Mr. Peters, Mr.
Daines, Mr. Hickenlooper, Mr. Rubio, Mr. Warner, Mr. Sullivan, Mr.
Coons, Mr. Young, Mr. Schatz, Mr. Grassley, Mr. Murphy, Mr. Graham, Mr.
Welch, Mr. Marshall, Ms. Hassan, Mrs. Hyde-Smith, Mr. Durbin, Mr.
Mullin, Mr. Casey, Mr. Risch, Mr. Whitehouse, Mrs. Britt, Mr. Scott of
Florida, Ms. Lummis, and Mr. Cornyn) introduced the following bill;
which was read twice and referred to the Committee on Commerce,
Science, and Transportation
_______________________________________________________________________
A BILL
To protect the safety of children on the internet.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) Short Title.--This Act may be cited as the ``Kids Online Safety
Act''.
(b) Table of Contents.--The table of contents for this Act is as
follows:
Sec. 1. Short title; table of contents.
Sec. 2. Definitions.
Sec. 3. Duty of care.
Sec. 4. Safeguards for minors.
Sec. 5. Disclosure.
Sec. 6. Transparency.
Sec. 7. Independent research.
Sec. 8. Market research.
Sec. 9. Age verification study and report.
Sec. 10. Guidance.
Sec. 11. Enforcement.
Sec. 12. Kids online safety council.
Sec. 13. Effective date.
Sec. 14. Rules of construction and other matters.
Sec. 15. Severability.
SEC. 2. DEFINITIONS.
In this Act:
(1) Child.--The term ``child'' means an individual who is
under the age of 13.
(2) Compulsive usage.--The term ``compulsive usage'' means
any response stimulated by external factors that causes an
individual to engage in repetitive behavior reasonably likely
to cause psychological distress, loss of control, anxiety,
depression, or harmful stress responses.
(3) Covered platform.--
(A) In general.--The term ``covered platform''
means a social media service, social network, online
video game (including educational games), messaging
application, video streaming service, or an online
platform that connects to the internet and that is
used, or is reasonably likely to be used, by a minor.
(B) Exceptions.--The term ``covered platform'' does
not include--
(i) an entity acting in its capacity as a
provider of--
(I) a common carrier service
subject to the Communications Act of
1934 (47 U.S.C. 151 et seq.) and all
Acts amendatory thereof and
supplementary thereto;
(II) a broadband internet access
service (as such term is defined for
purposes of section 8.1(b) of title 47,
Code of Federal Regulations, or any
successor regulation);
(III) an email service; or
(IV) a wireless messaging service
provided through the short messaging
service or multimedia messaging service
protocols;
(ii) an organization not organized to carry
on business for its own profit or that of its
members;
(iii) any public or private preschool,
elementary, or secondary school, or any
institution of vocational, professional, or
higher education; or
(iv) a product or service that primarily
functions as business-to-business software.
(4) Mental health disorder.--The term ``mental health
disorder'' has the meaning given the term ``mental disorder''
in the Diagnostic and Statistical Manual of Mental Health
Disorders, 5th Edition (or the most current successor edition).
(5) Minor.--The term ``minor'' means an individual who is
under the age of 17.
(6) Online platform.--The term ``online platform'' means
any public-facing website, online service, online application,
or mobile application that predominantly provides a community
forum for user generated content, including sharing videos,
images, games, audio files, or other content.
(7) Parent.--The term ``parent'' includes a legal guardian
or an individual with legal custody over a minor.
(8) Personal data.--The term ``personal data'' means
information that identifies or is linked or reasonably linkable
to a particular minor, including a consumer device identifier
associated with a minor.
(9) Personalized recommendation system.--The term
``personalized recommendation system'' means a fully or
partially automated system used to suggest, promote, or rank
information based on the personal data of users.
(10) Sexual exploitation and abuse.--The term ``sexual
exploitation and abuse'' means any of the following:
(A) Coercion and enticement, as described in
section 2422 of title 18, United States Code.
(B) Child sexual abuse material, as described in
sections 2251, 2252, 2252A, and 2260 of title 18,
United States Code.
(C) Trafficking for the production of images, as
described in section 2251A of title 18, United States
Code.
(D) Sex trafficking of children, as described in
section 1591 of title 18, United States Code.
(11) Targeted advertising.--
(A) In general.--The term ``targeted advertising''
means displaying an advertisement to an individual
where the advertisement is selected based on personal
data about the individual to predict the individual's
preferences and interests.
(B) Exclusions.--Such term does not include--
(i) advertising or marketing directed to an
individual in response to the individual's
request for information or express selection of
a product or service;
(ii) contextual advertising where an
advertisement is displayed to an individual
based on the content in which the advertisement
appears and does not vary based on who the
individual is; or
(iii) processing personal data solely to
measure or report advertising performance,
reach, or frequency.
SEC. 3. DUTY OF CARE.
(a) Prevention of Harm to Minors.--A covered platform shall act in
the best interests of a user that the platform knows or reasonably
should know is a minor by taking reasonable measures in its design and
operation of products and services to prevent and mitigate the
following:
(1) Consistent with evidence-informed medical information,
the following mental health disorders: anxiety, depression,
eating disorders, substance use disorders, and suicidal
behaviors.
(2) Patterns of use that indicate or encourage addiction-
like behaviors.
(3) Physical violence, online bullying, and harassment of
the minor.
(4) Sexual exploitation and abuse.
(5) Promotion and marketing of narcotic drugs (as defined
in section 102 of the Controlled Substances Act (21 U.S.C.
802)), tobacco products, gambling, or alcohol.
(6) Predatory, unfair, or deceptive marketing practices, or
other financial harms.
(b) Limitation.--Nothing in subsection (a) shall be construed to
require a covered platform to prevent or preclude--
(1) any minor from deliberately and independently searching
for, or specifically requesting, content; or
(2) the covered platform or individuals on the platform
from providing resources for the prevention or mitigation of
suicidal behaviors, substance use, and other harms, including
evidence-informed information and clinical resources.
SEC. 4. SAFEGUARDS FOR MINORS.
(a) Safeguards for Minors.--
(1) Safeguards.--A covered platform shall provide an
individual that the covered platform knows or reasonably should
know is a minor with readily accessible and easy-to-use
safeguards to, as applicable--
(A) limit the ability of other individuals to
communicate with the minor;
(B) prevent other users, whether registered or not,
from viewing the minor's personal data collected by or
shared on the covered platform, in particular
restricting public access to personal data;
(C) limit features that increase, sustain, or
extend use of the covered platform by the minor, such
as automatic playing of media, rewards for time spent
on the platform, notifications, and other features that
result in compulsive usage of the covered platform by
the minor;
(D) control personalized recommendation systems,
including the right to--
(i) opt out of such personalized
recommendation systems, while still allowing
the display of content based on a chronological
format; or
(ii) limit types or categories of
recommendations from such systems; and
(E) restrict the sharing of the geolocation of the
minor and provide notice regarding the tracking of the
minor's geolocation.
(2) Options.--A covered platform shall provide an
individual that the covered platform knows or reasonably should
know is a minor with readily accessible and easy-to-use options
to--
(A) delete the minor's account and delete any
personal data collected from, or shared by, the minor
on the covered platform; or
(B) limit the amount of time spent by the minor on
the covered platform.
(3) Default safeguard settings for minors.--A covered
platform shall provide that, in the case of a user that the
platform knows or reasonably should know is a minor, the
default setting for any safeguard described under paragraph (1)
shall be the option available on the platform that provides the
most protective level of control that is offered by the
platform over privacy and safety for that user.
(b) Parental Tools.--
(1) Tools.--A covered platform shall provide readily
accessible and easy-to-use settings for parents to support an
individual that the platform knows or reasonably should know is
a minor with respect to the individual's use of the platform.
(2) Requirements.--The parental tools provided by a covered
platform shall include--
(A) the ability to manage a minor's privacy and
account settings, including the safeguards and options
established under subsection (a), in a manner that
allows parents to--
(i) view the privacy and account settings;
and
(ii) in the case of a user that the
platform knows or reasonably should know is a
child, change and control the privacy and
account settings;
(B) the ability to restrict purchases and financial
transactions by the minor, where applicable; and
(C) the ability to view metrics of total time spent
on the platform.
(3) Notice to minors.--A covered platform shall provide
clear and conspicuous notice to an individual that the platform
knows or reasonably should know is a minor when tools described
in this subsection are in effect and what settings or controls
have been applied.
(4) Default tools.--A covered platform shall provide that,
in the case of a user that the platform knows or reasonably
should know is a child, the tools described in this subsection
shall be enabled by default.
(c) Reporting Mechanism.--
(1) Reports submitted by parents, minors, and schools.--A
covered platform shall provide--
(A) a readily accessible and easy-to-use means to
submit reports to the covered platform of harms to
minors;
(B) an electronic point of contact specific to
matters involving harms to a minor; and
(C) confirmation of the receipt of such a report
and a means to track a submitted report.
(2) Timing.--A covered platform shall establish an internal
process to receive and substantively respond to reports in a
reasonable and timely manner, but in no case later than--
(A) 7 days after the receipt of a report, if, for
the most recent calendar year, the platform averaged
more than 10,000,000 active users on a monthly basis in
the United States;
(B) 21 days after the receipt of a report, if, for
the most recent calendar year, the platform averaged
less than 10,000,000 active users on a monthly basis in
the United States; and
(C) notwithstanding subparagraphs (A) and (B), if
the report involves an imminent threat to the safety of
a minor, as promptly as needed to address the reported
threat to safety.
(d) Advertising of Illegal Products.--A covered platform shall not
facilitate the advertising of narcotic drugs (as defined in section 102
of the Controlled Substances Act (21 U.S.C. 802)), tobacco products,
gambling, or alcohol to an individual that the covered platform knows
or reasonably should know is a minor.
(e) Application.--
(1) Accessibility.--With respect to safeguards and parental
controls described under subsections (a) and (b), a covered
platform shall provide--
(A) information and control options in a clear and
conspicuous manner that takes into consideration the
differing ages, capacities, and developmental needs of
the minors most likely to access the covered platform
and does not encourage minors or parents to weaken or
disable safeguards or parental controls;
(B) readily accessible and easy-to-use controls to
enable or disable safeguards or parental controls, as
appropriate; and
(C) information and control options in the same
language, form, and manner as the covered platform
provides the product or service used by minors and
their parents.
(2) Dark patterns prohibition.--It shall be unlawful for
any covered platform to design, modify, or manipulate a user
interface of a covered platform with the purpose or substantial
effect of subverting or impairing user autonomy, decision-
making, or choice in order to weaken or disable safeguards or
parental controls required under this section.
(3) Rules of construction.--Nothing in this section shall
be construed to--
(A) prevent a covered platform from taking
reasonable measures to--
(i) block, detect, or prevent the
distribution of unlawful, obscene, or other
harmful material to minors as described in
section 3(a); or
(ii) block or filter spam, prevent criminal
activity, or protect the security of a platform
or service; or
(B) require the disclosure of a minor's browsing
behavior, search history, messages, contact list, or
other content or metadata of their communications.
SEC. 5. DISCLOSURE.
(a) Notice.--
(1) Registration.--Prior to registration or purchase of a
covered platform by an individual that the platform knows or
reasonably should know is a minor, the platform shall provide
clear, conspicuous, and easy-to-understand--
(A) notice of the policies and practices of the
covered platform with respect to personal data and
safeguards for minors;
(B) information about how to access the safeguards
and parental tools required under section 4; and
(C) notice about whether the covered platform,
including any personalized recommendation systems used
by the platform, pose any heightened risks of harms to
minors.
(2) Parental notification.--
(A) Notice and acknowledgment.--In the case of an
individual that a covered platform knows or reasonably
should know is a child, the platform shall additionally
provide information about the parental tools and
safeguards required under section 4 to a parent of the
child and obtain express affirmative acknowledgment
from the parent prior to the initial use of the covered
platform by the child.
(B) Reasonable effort.--A covered platform shall be
deemed to have satisfied the requirement described in
subparagraph (A) if the covered platform has undertaken
a reasonable effort (taking into consideration
available technology) to ensure a parent receives the
information described in such subparagraph and to
obtain a parent's express affirmative acknowledgment.
(3) Consolidated notices.--A covered platform may
consolidate the process for providing information and (if
applicable) obtaining parental acknowledgment as required under
this subsection with its obligations to obtain consent for data
privacy practices, provided the content of the notice meets the
requirements of this subsection.
(4) Rulemaking.--The Federal Trade Commission may issue
rules pursuant to section 553 of title 5, United States Code,
to establish templates or models of short-form notices that
include the minimum level of information and labels necessary
for the disclosures required under paragraph (1).
(b) Personalized Recommendation System.--A covered platform that
operates personalized recommendation systems shall set out in its terms
and conditions, in a clear, conspicuous, and easy-to-understand
manner--
(1) an overview of how those personalized recommendation
systems are used by the covered platform to provide information
to users of the platform who are minors, including how such
systems use the personal data of minors; and
(2) information about options for minors or their parents
to control personalized recommendation systems (including by
opting out of such systems).
(c) Advertising and Marketing Information and Labels.--
(1) Information and labels.--A covered platform that
facilitates advertising aimed at users that the platform knows
or reasonably should know are minors shall provide clear,
conspicuous, and easy-to-understand information and labels to
minors on advertisements regarding--
(A) the name of the product, service, or brand and
the subject matter of an advertisement;
(B) why the minor is being targeted for a
particular advertisement if the covered platform
engages in targeted advertising, including material
information about how the minor's personal data was
used to target the advertisement; and
(C) whether particular media displayed to the minor
is an advertisement or marketing material, including
disclosure of endorsements of products, services, or
brands made for commercial consideration by other users
of the platform.
(2) Rulemaking.--The Federal Trade Commission may issue
rules pursuant to section 553 of title 5, United States Code,
to establish templates or models of short-form notices that
include the minimum level of information and labels necessary
for the disclosures required under paragraph (1).
(d) Resources for Parents and Minors.--A covered platform shall
provide to minors and parents clear, conspicuous, easy-to-understand,
and comprehensive information in a prominent location regarding--
(1) its policies and practices with respect to personal
data and safeguards for minors; and
(2) how to access the safeguards and tools required under
section 4.
(e) Resources in Additional Languages.--A covered platform shall
ensure, to the extent practicable, that the disclosures required by
this section are made available in the same language, form, and manner
as the covered platform provides any product or service used by minors
and their parents.
SEC. 6. TRANSPARENCY.
(a) In General.--Subject to subsection (b), not less frequently
than once a year, a covered platform shall issue a public report
identifying the reasonably foreseeable risk of material harms to minors
and describing the prevention and mitigation measures taken to address
such risk based on an independent, third-party audit conducted through
reasonable inspection of the covered platform.
(b) Scope of Application.--The requirements of this section shall
apply to a covered platform if--
(1) for the most recent calendar year, the platform
averaged more than 10,000,000 active users on a monthly basis
in the United States; and
(2) the platform predominantly provides a community forum
for user-generated content and discussion, including sharing
videos, images, games, audio files, discussion in a virtual
setting, or other content, such as acting as a social media
platform, virtual reality environment, or a social network
service.
(c) Content.--
(1) Transparency.--The public reports required of a covered
platform under this section shall include--
(A) an assessment of the extent to which the
platform is likely to be accessed by minors;
(B) a description of the commercial interests of
the covered platform in use by minors;
(C) an accounting, based on the data held by the
covered platform, of--
(i) the number of individuals using the
covered platform reasonably believed to be
minors in the United States, disaggregated by
the age ranges of 0-5, 6-9, 10-12, and 13-16;
and
(ii) the median and mean amounts of time
spent on the platform by minors in the United
States who have accessed the platform during
the reporting year on a daily, weekly, and
monthly basis, disaggregated by the age ranges
of 0-5, 6-9, 10-12, and 13-16;
(D) an accounting of total reports received
regarding, and the prevalence (which can be based on
scientifically valid sampling methods using the content
available to the covered platform in the normal course
of business) of content related to, the harms described
in section 3(a), disaggregated by category of harm; and
(E) a description of any material breaches of
parental tools or assurances regarding minors,
representations regarding the use of the personal data
of minors, and other matters regarding non-compliance.
(2) Systemic risks assessment.--The public reports required
of a covered platform under this section shall include--
(A) an assessment of the reasonably foreseeable
risk of harms to minors posed by the covered platform,
including identifying any other physical, mental,
developmental, or financial harms in addition to those
described in section 3(a);
(B) an assessment of how recommendation systems and
targeted advertising systems can contribute to harms to
minors;
(C) a description of whether and how the covered
platform uses system design features that increase,
sustain, or extend use of a product or service by a
minor, such as automatic playing of media, rewards for
time spent, and notifications;
(D) a description of whether, how, and for what
purpose the platform collects or processes categories
of personal data that may cause reasonably foreseeable
risk of harms to minors;
(E) an evaluation of the efficacy of safeguards for
minors under section 4, and any issues in delivering
such safeguards and the associated parental tools; and
(F) an evaluation of any other relevant matters of
public concern over risk of harms to minors.
(3) Mitigation.--The public reports required of a covered
platform under this section shall include--
(A) a description of the safeguards and parental
tools available to minors and parents on the covered
platform;
(B) a description of interventions by the covered
platform when it had or has reason to believe that
harms to minors could occur;
(C) a description of the prevention and mitigation
measures intended to be taken in response to the known
and emerging risks identified in its assessment of
system risks, including steps taken to--
(i) prevent harms to minors, including
adapting or removing system design features or
addressing through parental controls;
(ii) provide the most protective level of
control over privacy and safety by default; and
(iii) adapt recommendation systems to
prioritize the best interests of users who are
minors, as described in section 3(a);
(D) a description of internal processes for
handling reports and automated detection mechanisms for
harms to minors, including the rate, timeliness, and
effectiveness of responses under the requirement of
section 4(c);
(E) the status of implementing prevention and
mitigation measures identified in prior assessments;
and
(F) a description of the additional measures to be
taken by the covered platform to address the
circumvention of safeguards for minors and parental
tools.
(d) Reasonable Inspection.--In conducting an inspection of the
systemic risks of harm to minors under this section, an independent,
third-party auditor shall--
(1) take into consideration the function of recommendation
systems;
(2) consult parents and youth experts, including youth and
families with relevant past or current experience, public
health and mental health nonprofit organizations, health and
development organizations, and civil society with respect to
the prevention of harms to minors;
(3) conduct research based on experiences of minors that
use the covered platform, including reports under section 4(c)
and information provided by law enforcement;
(4) take account of research, including research regarding
system design features, marketing, or product integrity,
industry best practices, or outside research; and
(5) consider indicia or inferences of age of users, in
addition to any self-declared information about the age of
individuals.
(e) Cooperation With Independent, Third-Party Audit.--To facilitate
the report required by subsection (c), a covered platform shall--
(1) provide or otherwise make available to the independent
third-party conducting the audit all information and material
in its possession, custody, or control that is relevant to the
audit;
(2) provide or otherwise make available to the independent
third-party conducting the audit access to all network,
systems, and assets relevant to the audit; and
(3) disclose all relevant facts to the independent third-
party conducting the audit, and not misrepresent in any manner,
expressly or by implication, any relevant fact.
(f) Privacy Safeguards.--
(1) In issuing the public reports required under this
section, a covered platform shall take steps to safeguard the
privacy of its users, including ensuring that data is presented
in a de-identified, aggregated format such that it is
reasonably impossible for the data to be linked back to any
individual user.
(2) This section shall not be construed to require the
disclosure of information that will lead to material
vulnerabilities for the privacy of users or the security of a
covered platform's service or create a significant risk of the
violation of Federal or State law.
(g) Location.--The public reports required under this section
should be posted by a covered platform on an easy to find location on a
publicly available website.
SEC. 7. INDEPENDENT RESEARCH.
(a) Definitions.--In this section:
(1) Assistant secretary.--The term ``Assistant Secretary''
means the Assistant Secretary of Commerce for Communications
and Information.
(2) De-identified data.--The term ``de-identified data''
means information--
(A) that does not identify and is not linked or
reasonably linkable to an individual or an individual's
device; and
(B) with respect to which a covered platform or
researcher takes reasonable technical and contractual
measures to ensure that the information is not used to
re-identify any individual or individual's device.
(3) Eligible researcher.--
(A) In general.--The term ``eligible researcher''
means an individual or group of individuals affiliated
with or employed by--
(i) an institution of higher education (as
defined in section 101 of the Higher Education
Act of 1965 (20 U.S.C. 1001)); or
(ii) a nonprofit organization described in
section 501(c)(3) of the Internal Revenue Code
of 1986.
(B) Limitation.--Such term shall not include an
individual or group of individuals that is--
(i) not located in the United States; or
(ii) affiliated with the government of a
foreign adversary (as defined in section
8(c)(2) of the Secure and Trusted
Communications Networks Act of 2019 (47 U.S.C.
1607(c)(2))).
(4) Independent research.--The term ``independent
research'' means the scientific or historical analysis of
information that is performed for the primary purpose of
advancing understanding, knowledge, and remedies regarding the
harms to minors described in section 3(a).
(5) Noncommercial purpose.--The term ``noncommercial
purpose'' means a purpose that does not involve any direct or
indirect use of data sets for the sale, resale, solicitation,
rental, or lease of a service, or any use by which the user
expects a profit, including the sale to the general public of a
publication containing independent research.
(6) Program.--The term ``Program'' means the program
established under subsection (b)(1).
(7) Qualified researcher.--The term ``qualified
researcher'' means an eligible researcher who is approved by
the Assistant Secretary to conduct independent research
regarding harms to minors under the Program.
(b) Independent Research Program Relating to Identified Harms to
Minors.--
(1) Establishment.--Subject to paragraph (2), the Assistant
Secretary shall establish a program, with public notice and an
opportunity to comment, under which an eligible researcher may
apply for, and a covered platform shall provide, access to data
sets from the covered platform for the sole purpose of
conducting independent research regarding the harms described
in section 3(a).
(2) Scope of application.--The requirements of this
subsection shall apply to a covered platform if--
(A) for the most recent calendar year, the platform
averaged more than 10,000,000 active users on a monthly
basis in the United States; and
(B) the platform predominantly provides a community
forum for user generated content and discussion,
including sharing videos, images, games, audio files,
discussion in a virtual setting, or other content, such
as acting as a social media platform, virtual reality
environment, or social network service.
(3) Processes, procedures, and standards.--Not later than 1
year after the date of enactment of this Act, the Assistant
Secretary shall establish for the program established under
this subsection--
(A) definitions for data sets (related to harms
described in section 3(a)) that qualify for disclosure
to researchers under the program and standards of
access for data sets to be provided under the program;
(B) a process by which an eligible researcher may
submit an application described in paragraph (1);
(C) an appeals process for eligible researchers to
appeal adverse decisions on applications described in
paragraph (1) (including a decision to grant an appeal
under paragraph (4)(C));
(D) procedures for implementation of the program,
including methods for--
(i) participation by covered platforms;
(ii) evaluation of researcher proposals for
alignment with program objectives and scoping;
and
(iii) verification by the Assistant
Secretary of the credentials of eligible
researchers and processes for the application
or disqualification to participate in the
program;
(E) standards for privacy, security, and
confidentiality required to participate in the program,
including rules to ensure that the privacy and safety
of users is not infringed by the program;
(F) a mechanism to allow individuals to control the
use of their personal data under the program, including
the ability to opt out of the program;
(G) standards for transparency regarding the
operation and administration of the program; and
(H) rules to prevent requests for data sets that
present financial conflicts of interest, including
efforts by covered platforms to gain a competitive
advantage by directly funding data access requests, the
use of qualified researcher status for commercial gain,
or efforts by covered platforms to obtain access to
intellectual property that is otherwise protected by
law.
(4) Duties and rights of covered platforms.--
(A) Access to data sets.--
(i) In general.--If the Assistant Secretary
approves an application under paragraph (1)
with respect to a covered platform, the covered
platform shall, in a timely manner, provide the
qualified researcher with access to data sets
necessary to conduct independent research
described in that paragraph.
(ii) Limitations.--Nothing in this section
shall be construed to require a covered
platform to provide access to data sets that
are intellectual property protected by Federal
law, trade secrets, or commercial or financial
information.
(iii) Form of access.--A covered platform
shall provide to a qualified researcher access
to data sets under clause (i) through online
databases, application programming interfaces,
and data files as appropriate.
(B) Nondisclosure agreement.--A covered platform
may require, as a condition of access to the data sets
of the covered platform, that a qualified researcher
enter into a nondisclosure agreement restricting the
release of data sets, provided that--
(i) the agreement does not restrict the
publication or discussion regarding the
qualified researcher's findings; and
(ii) the terms of the agreement allow the
qualified researcher to provide the original
agreement or a copy of the agreement to the
Assistant Secretary.
(C) Appeal.--
(i) Agency appeal.--A covered platform may
appeal the granting of an application under
paragraph (1) on the grounds that, and the
Assistant Secretary shall grant such appeal
if--
(I) the covered platform does not
have access to the requested data sets
or the requested data sets are not
reasonably tailored to application; or
(II) providing access to the data
sets will lead to material
vulnerabilities for the privacy of
users or the security of the covered
platform's service or create a
significant risk of the violation of
Federal or state law.
(ii) Judicial review.--A decision of the
Assistant Secretary with respect to an appeal
under clause (i) shall be considered to be a
final agency action for purposes of judicial
review under chapter 7 of title 5, United
States Code.
(iii) Alternative means of fulfillment.--As
part of an appeal under clause (i) that is made
on the basis of subclause (II) of such clause,
a covered platform shall propose one or more
alternative data sets or means of accessing the
requested data sets that are appropriate and
sufficient to fulfill the purpose of the
application, or shall explain why there are no
alternative data sets or means of access which
acceptably mitigate the applicable privacy,
security, or legal concerns.
(D) Timing.--A covered platform for which this
provision applies shall participate in the program
established under this subsection no later than two
years after enactment of this Act.
(5) Application requirements.--In order to be approved to
access data sets from a covered platform, an eligible
researcher shall, in the application submitted under paragraph
(1)--
(A) explain the purpose for which the independent
research is undertaken;
(B) commit to conduct the research for
noncommercial purposes;
(C) demonstrate a proven record of expertise on the
proposed research topic and related research
methodologies;
(D) if the eligible researcher is seeking access to
data sets that include personal data, explain why the
data sets are requested, and the means through which
such data sets shall be accessed are the least
sensitive and the most privacy-protective means that
will permit completion of the research and not
compromise the privacy or safety of users; and
(E) commit to fulfill, and demonstrate a capacity
to fulfill, the specific data security and
confidentiality requirements corresponding to the
application.
(6) Privacy and duty of confidentiality.--
(A) Researcher confidentiality.--To protect user
privacy, a qualified researcher shall keep data sets
provided by a covered platform under the program
confidential and secure to the specifications set forth
under the program rules and the approved application.
(B) Platform confidentiality.--A covered platform
shall use reasonable measures to enable researcher
access to data sets under the program in a secure and
privacy-protective manner, including through the de-
identification of personal data or use of other
privacy-enhancing technologies.
(C) Federal agencies.--Nothing in this subsection
shall be construed to authorize--
(i) a Federal agency to seek access to the
data of a covered platform through the program;
or
(ii) a qualified researcher to transfer or
share any data sets provided by a covered
platform under the program with a Federal
agency.
(D) Security.--Nothing in this subsection shall be
construed in a manner that would result in data sets
from a covered platform being transferred to the
Government of the People's Republic of China or the
government of another foreign adversary (as defined in
section 8(c)(2) of the Secure and Trusted
Communications Networks Act of 2019 (47 U.S.C.
1607(c)(2))).
(c) Safe Harbor for Collection of Data for Independent Research
Regarding Identified Harms to Minors.--If, in the course of conducting
independent research for noncommercial purposes regarding harms
described in section 3(a) (without regard to whether such research is
conducted under the program), an eligible researcher collects or uses
data from a covered platform in a manner that violates the terms of
service of the platform, no cause of action based on such violation
shall lie or be maintained in any court against such researcher unless
the violation relates to the failure of the researcher to take
reasonable measures to protect user privacy and security.
(d) Rulemaking.--The Assistant Secretary, in consultation with the
Secretary of Commerce, the Director of the National Institute of
Standards and Technology, the Director of the National Science
Foundation, and the Director of the National Institutes of Health shall
promulgate rules in accordance with section 553 of title 5, United
States Code, as necessary to implement this section.
SEC. 8. MARKET RESEARCH.
(a) Market Research by Covered Platforms.--The Federal Trade
Commission, in consultation with the Secretary of Commerce, shall issue
guidance for covered platforms seeking to conduct market- and product-
focused research on minors. Such guidance shall include--
(1) a standard consent form that provides minors and their
parents a clear, conspicuous, and easy-to-understand
explanation of the scope and purpose of the research to be
conducted, and provides an opportunity for informed consent;
and
(2) recommendations for research practices for studies that
may include minors, disaggregated by the age ranges of 0-5, 6-
9, 10-12, and 13-16.
(b) Timing.--The Federal Trade Commission shall issue such guidance
not later than 18 months after the date of enactment of this Act. In
doing so, they shall seek input from members of the public and the
representatives of the Kids Online Safety Council established under
section 12.
SEC. 9. AGE VERIFICATION STUDY AND REPORT.
(a) Study.--The Director of the National Institute of Standards and
Technology, in coordination with the Federal Communications Commission,
Federal Trade Commission, and the Secretary of Commerce, shall conduct
a study evaluating the most technologically feasible methods and
options for developing systems to verify age at the device or operating
system level.
(b) Contents.--Such study shall consider --
(1) the benefits of creating a device or operating system
level age verification system;
(2) what information may need to be collected to create
this type of age verification system;
(3) the accuracy of such systems and their impact or steps
to improve accessibility, including for individuals with
disabilities;
(4) how such a system or systems could verify age while
mitigating risks to user privacy and data security and
safeguarding minors' personal data, emphasizing minimizing the
amount of data collected and processed by covered platforms and
age verification providers for such a system; and
(5) the technical feasibility, including the need for
potential hardware and software changes, including for devices
currently in commerce and owned by consumers.
(c) Report.--Not later than 1 year after the date of enactment of
this Act, the agencies described in subsection (a) shall submit a
report containing the results of the study conducted under such
subsection to the Committee on Commerce, Science, and Transportation of
the Senate and the Committee on Energy and Commerce of the House of
Representatives.
SEC. 10. GUIDANCE.
(a) In General.--Not later than 18 months after the date of
enactment of this Act, the Federal Trade Commission, in consultation
with the Kids Online Safety Council established under section 12, shall
issue guidance to--
(1) provide information and examples for covered platforms
and auditors regarding--
(A) identifying features that are used to increase,
sustain, or extend use of the covered platform by a
minor;
(B) safeguarding minors against the possible misuse
of parental tools;
(C) best practices in providing minors and parents
the most protective level of control over privacy and
safety;
(D) using indicia or inferences of age of users for
assessing use of the covered platform by minors;
(E) methods for evaluating the efficacy of
safeguards; and
(F) providing additional control options that allow
parents to address the harms described in section 3(a);
and
(2) outline conduct that does not have the purpose or
substantial effect of subverting or impairing user autonomy,
decision-making, or choice, or of causing, increasing, or
encouraging compulsive usage for a minor, such as--
(A) de minimis user interface changes derived from
testing consumer preferences, including different
styles, layouts, or text, where such changes are not
done with the purpose of weakening or disabling
safeguards or parental controls;
(B) algorithms or data outputs outside the control
of a covered platform; and
(C) establishing default settings that provide
enhanced privacy protection to users or otherwise
enhance their autonomy and decision-making ability.
(b) Guidance to Schools.--Not later than 18 months after the date
of enactment of this Act, the Secretary of Education, in consultation
with the Federal Trade Commission and the Kids Online Safety Council
established under section 12, shall issue guidance to assist to assist
elementary and secondary schools in using the notice, safeguards and
tools provided under this Act and providing information on online
safety for students and teachers.
(c) Limitation on Federal Trade Commission Guidance.--
(1) Effect of guidance.--No guidance issued by the Federal
Trade Commission with respect to this Act shall--
(A) confer any rights on any person, State, or
locality; or
(B) operate to bind the Federal Trade Commission or
any person to the approach recommended in such
guidance.
(2) Use in enforcement actions.--In any enforcement action
brought pursuant to this Act, the Federal Trade Commission--
(A) shall allege a violation of a provision of this
Act; and
(B) may not base such enforcement action on, or
execute a consent order based on, practices that are
alleged to be inconsistent with guidance issued by the
Federal Trade Commission with respect to this Act,
unless the practices are alleged to violate a provision
of this Act.
SEC. 11. ENFORCEMENT.
(a) Enforcement by Federal Trade Commission.--
(1) Unfair and deceptive acts or practices.--A violation of
this Act or a regulation promulgated under this Act shall be
treated as a violation of a rule defining an unfair or
deceptive act or practice prescribed under section 18(a)(1)(B)
of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
(2) Powers of the commission.--
(A) In general.--The Federal Trade Commission
(referred to in this section as the ``Commission'')
shall enforce this Act and any regulation promulgated
under this Act in the same manner, by the same means,
and with the same jurisdiction, powers, and duties as
though all applicable terms and provisions of the
Federal Trade Commission Act (15 U.S.C. 41 et seq.)
were incorporated into and made a part of this Act.
(B) Privileges and immunities.--Any person that
violates this Act or a regulation promulgated under
this Act shall be subject to the penalties, and
entitled to the privileges and immunities, provided in
the Federal Trade Commission Act (15 U.S.C. 41 et
seq.).
(3) Authority preserved.--Nothing in this Act shall be
construed to limit the authority of the Commission under any
other provision of law.
(b) Enforcement by State Attorneys General.--
(1) In general.--
(A) Civil actions.--In any case in which the
attorney general of a State has reason to believe that
an interest of the residents of that State has been or
is threatened or adversely affected by the engagement
of any person in a practice that violates this Act or a
regulation promulgated under this Act, the State, as
parens patriae, may bring a civil action on behalf of
the residents of the State in a district court of the
United States or a State court of appropriate
jurisdiction to--
(i) enjoin that practice;
(ii) enforce compliance with this Act or
such regulation;
(iii) on behalf of residents of the State,
obtain damages, restitution, or other
compensation, each of which shall be
distributed in accordance with State law; or
(iv) obtain such other relief as the court
may consider to be appropriate.
(B) Notice.--
(i) In general.--Before filing an action
under subparagraph (A), the attorney general of
the State involved shall provide to the
Commission--
(I) written notice of that action;
and
(II) a copy of the complaint for
that action.
(ii) Exemption.--
(I) In general.--Clause (i) shall
not apply with respect to the filing of
an action by an attorney general of a
State under this paragraph if the
attorney general of the State
determines that it is not feasible to
provide the notice described in that
clause before the filing of the action.
(II) Notification.--In an action
described in subclause (I), the
attorney general of a State shall
provide notice and a copy of the
complaint to the Commission at the same
time as the attorney general files the
action.
(2) Intervention.--
(A) In general.--On receiving notice under
paragraph (1)(B), the Commission shall have the right
to intervene in the action that is the subject of the
notice.
(B) Effect of intervention.--If the Commission
intervenes in an action under paragraph (1), it shall
have the right--
(i) to be heard with respect to any matter
that arises in that action; and
(ii) to file a petition for appeal.
(3) Construction.--For purposes of bringing any civil
action under paragraph (1), nothing in this Act shall be
construed to prevent an attorney general of a State from
exercising the powers conferred on the attorney general by the
laws of that State to--
(A) conduct investigations;
(B) administer oaths or affirmations; or
(C) compel the attendance of witnesses or the
production of documentary and other evidence.
(4) Actions by the commission.--In any case in which an
action is instituted by or on behalf of the Commission for
violation of this Act or a regulation promulgated under this
Act, no State may, during the pendency of that action,
institute a separate action under paragraph (1) against any
defendant named in the complaint in the action instituted by or
on behalf of the Commission for that violation.
(5) Venue; service of process.--
(A) Venue.--Any action brought under paragraph (1)
may be brought in--
(i) the district court of the United States
that meets applicable requirements relating to
venue under section 1391 of title 28, United
States Code; or
(ii) a State court of competent
jurisdiction.
(B) Service of process.--In an action brought under
paragraph (1) in a district court of the United States,
process may be served wherever defendant--
(i) is an inhabitant; or
(ii) may be found.
SEC. 12. KIDS ONLINE SAFETY COUNCIL.
(a) Establishment.--Not later than 180 days after the date of
enactment of this Act, the Secretary of Commerce shall establish and
convene the Kids Online Safety Council for the purpose of providing
advice on matters related to this Act.
(b) Participation.--The Kids Online Safety Council shall include
diverse participation from--
(1) academic experts, health professionals, and members of
civil society with expertise in mental health, substance use
disorders, and the prevention of harms to minors;
(2) representatives in academia and civil society with
specific expertise in privacy and civil liberties;
(3) parents and youth representation;
(4) representatives of covered platforms;
(5) representatives of the National Telecommunications and
Information Administration, the National Institute of Standards
and Technology, the Federal Trade Commission, the Department of
Justice, and the Department of Health and Human Services;
(6) State attorneys general or their designees acting in
State or local government; and
(7) representatives of communities of socially
disadvantaged individuals (as defined in section 8 of the Small
Business Act (15 U.S.C. 637)).
(c) Activities.--The matters to be addressed by the Kids Online
Safety Council shall include--
(1) identifying emerging or current risks of harms to
minors associated with online platforms;
(2) recommending measures and methods for assessing,
preventing, and mitigating harms to minors online;
(3) recommending methods and themes for conducting research
regarding online harms to minors; and
(4) recommending best practices and clear, consensus-based
technical standards for transparency reports and audits, as
required under this Act, including methods, criteria, and scope
to promote overall accountability.
SEC. 13. EFFECTIVE DATE.
Except as otherwise provided in this Act, this Act shall take
effect on the date that is 18 months after the date of enactment of
this Act.
SEC. 14. RULES OF CONSTRUCTION AND OTHER MATTERS.
(a) Relationship to Other Laws.--Nothing in this Act shall be
construed to--
(1) preempt section 444 of the General Education Provisions
Act (20 U.S.C. 1232g, commonly known as the ``Family
Educational Rights and Privacy Act of 1974'') or other Federal
or State laws governing student privacy;
(2) preempt the Children's Online Privacy Protection Act of
1998 (15 U.S.C. 6501 et seq.) or any rule or regulation
promulgated under such Act; or
(3) authorize any action that would conflict with section
18(h) of the Federal Trade Commission Act (15 U.S.C. 57a(h)).
(b) Protections for Privacy.--Nothing in this Act shall be
construed to require--
(1) the affirmative collection of any personal data with
respect to the age of users that a covered platform is not
already collecting in the normal course of business; or
(2) a covered platform to implement an age gating or age
verification functionality.
(c) Compliance.--Nothing in this Act shall be construed to restrict
a covered platform's ability to--
(1) cooperate with law enforcement agencies regarding
activity that the covered platform reasonably and in good faith
believes may violate Federal, State, or local laws, rules, or
regulations;
(2) comply with a civil, criminal, or regulatory inquiry or
any investigation, subpoena, or summons by Federal, State,
local, or other government authorities; or
(3) investigate, establish, exercise, respond to, or defend
against legal claims.
SEC. 15. SEVERABILITY.
If any provision of this Act, or an amendment made by this Act, is
determined to be unenforceable or invalid, the remaining provisions of
this Act and the amendments made by this Act shall not be affected.
<all>