Website Feedback Button
Fish and Game Home

Alaska Department of Fish and Game


Secondary Site Navigation

U.S. Government:
Children's Online Privacy Protection Act of 1998

H.R. 4328--OMNIBUS APPROPRIATIONS BILL FY99

TITLE XIII--CHILDREN'S ONLINE PRIVACY PROTECTION

     SEC. 1301. SHORT TITLE.

       This title may be cited as the ``Children's Online Privacy 
     Protection Act of 1998''.

     SEC. 1302. DEFINITIONS.

       In this title:
       (1) Child.--The term ``child'' means an individual under 
     the age of 13.
       (2) Operator.--The term ``operator''--
       (A) means any person who operates a website located on the 
     Internet or an online service and who collects or maintains 
     personal information from or about the users of or visitors 
     to such website or online service, or on whose behalf such 
     information is collected or maintained, where such website or 
     online service is operated for commercial purposes, including 
     any person offering products or services for sale through 
     that website or online service, involving commerce--
       (i) among the several States or with 1 or more foreign 
     nations;
       (ii) in any territory of the United States or in the 
     District of Columbia, or between any such territory and--

     (I) another such territory; or
     (II) any State or foreign nation; or

       (iii) between the District of Columbia and any State, 
     territory, or foreign nation; but
       (B) does not include any nonprofit entity that would 
     otherwise be exempt from coverage under section 5 of the 
     Federal Trade Commission Act (15 U.S.C. 45).
       (3) Commission.--The term ``Commission'' means the Federal 
     Trade Commission.
       (4) Disclosure.--The term ``disclosure'' means, with 
     respect to personal information--
       (A) the release of personal information collected from a 
     child in identifiable form by an operator for any purpose, 
     except where such information is provided to a person other 
     than the operator who provides support for the internal 
     operations of the website and does not disclose or use that 
     information for any other purpose; and
       (B) making personal information collected from a child by a 
     website or online service directed to children or with actual 
     knowledge that such information was collected from a child, 
     publicly available in identifiable form, by any means 
     including by a public posting, through the Internet, or 
     through--
       (i) a home page of a website;
       (ii) a pen pal service;
       (iii) an electronic mail service;
       (iv) a message board; or
       (v) a chat room.
       (5) Federal agency.--The term ``Federal agency'' means an 
     agency, as that term is defined in section 551(1) of title 5, 
     United States Code.
       (6) Internet.--The term ``Internet'' means collectively the 
     myriad of computer and telecommunications facilities, 
     including equipment and operating software, which comprise 
     the interconnected world-wide network of networks that employ 
     the Transmission Control Protocol/Internet Protocol, or any 
     predecessor or successor protocols to such protocol, to 
     communicate information of all kinds by wire or radio.
       (7) Parent.--The term ``parent'' includes a legal guardian.
       (8) Personal information.--The term ``personal 
     information'' means individually identifiable information 
     about an individual collected online, including--
       (A) a first and last name;
       (B) a home or other physical address including street name 
     and name of a city or town;
       (C) an e-mail address;
       (D) a telephone number;
       (E) a Social Security number;
       (F) any other identifier that the Commission determines 
     permits the physical or online contacting of a specific 
     individual; or
       (G) information concerning the child or the parents of that 
     child that the website collects online from the child and 
     combines with an identifier described in this paragraph.
       (9) Verifiable parental consent.--The term ``verifiable 
     parental consent'' means any reasonable effort (taking into 
     consideration available technology), including a request for 
     authorization for future collection, use, and disclosure 
     described in the notice, to ensure that a parent of a child 
     receives notice of the operator's personal information 
     collection, use, and disclosure practices, and authorizes the 
     collection, use, and disclosure, as applicable, of personal 
     information and the subsequent use of that information before 
     that information is collected from that child.
       (10) Website or online service directed to children.--
       (A) In general.--The term ``website or online service 
     directed to children'' means--
       (i) a commercial website or online service that is targeted 
     to children; or
       (ii) that portion of a commercial website or online service 
     that is targeted to children.
       (B) Limitation.--A commercial website or online service, or 
     a portion of a commercial website or online service, shall 
     not be deemed directed to children solely for referring or 
     linking to a commercial website or online service directed to 
     children by using information location tools, including a 
     directory, index, reference, pointer, or hypertext link.
       (11) Person.--The term ``person'' means any individual, 
     partnership, corporation, trust, estate, cooperative, 
     association, or other entity.
       (12) Online contact information.--The term ``online contact 
     information'' means an e-mail address or another 
     substantially similar identifier that permits direct contact 
     with a person online.

     SEC. 1303. REGULATION OF UNFAIR AND DECEPTIVE ACTS AND 
                   PRACTICES IN CONNECTION WITH THE COLLECTION AND 
                   USE OF PERSONAL INFORMATION FROM AND ABOUT 
                   CHILDREN ON THE INTERNET.

       (a) Acts Prohibited.--
       (1) In general.--It is unlawful for an operator of a 
     website or online service directed to children, or any 
     operator that has actual knowledge that it is collecting 
     personal information from a child, to collect personal 
     information from a child in a manner that violates the 
     regulations prescribed under subsection (b).
       (2) Disclosure to parent protected.--Notwithstanding 
     paragraph (1), neither an operator of such a website or 
     online service nor the operator's agent shall be held to be 
     liable under any Federal or State law for any disclosure made 
     in good faith and following reasonable procedures in 
     responding to a request for disclosure of personal 
     information under subsection (b)(1)(B)(iii) to the parent of 
     a child.
       (b) Regulations.--
       (1) In general.--Not later than 1 year after the date of 
     the enactment of this Act, the Commission shall promulgate 
     under section 553 of title 5, United States Code, regulations 
     that--
       (A) require the operator of any website or online service 
     directed to children that collects personal information from 
     children or the operator of a website or online service that 
     has actual knowledge that it is collecting personal 
     information from a child--

[[Page H11241]]

       (i) to provide notice on the website of what information is 
     collected from children by the operator, how the operator 
     uses such information, and the operator's disclosure 
     practices for such information; and
       (ii) to obtain verifiable parental consent for the 
     collection, use, or disclosure of personal information from 
     children;
       (B) require the operator to provide, upon request of a 
     parent under this subparagraph whose child has provided 
     personal information to that website or online service, upon 
     proper identification of that parent, to such parent--
       (i) a description of the specific types of personal 
     information collected from the child by that operator;
       (ii) the opportunity at any time to refuse to permit the 
     operator's further use or maintenance in retrievable form, or 
     future online collection, of personal information from that 
     child; and
       (iii) notwithstanding any other provision of law, a means 
     that is reasonable under the circumstances for the parent to 
     obtain any personal information collected from that child;
       (C) prohibit conditioning a child's participation in a 
     game, the offering of a prize, or another activity on the 
     child disclosing more personal information than is reasonably 
     necessary to participate in such activity; and
       (D) require the operator of such a website or online 
     service to establish and maintain reasonable procedures to 
     protect the confidentiality, security, and integrity of 
     personal information collected from children.
       (2) When consent not required.--The regulations shall 
     provide that verifiable parental consent under paragraph 
     (1)(A)(ii) is not required in the case of--
       (A) online contact information collected from a child that 
     is used only to respond directly on a one-time basis to a 
     specific request from the child and is not used to recontact 
     the child and is not maintained in retrievable form by the 
     operator;
       (B) a request for the name or online contact information of 
     a parent or child that is used for the sole purpose of 
     obtaining parental consent or providing notice under this 
     section and where such information is not maintained in 
     retrievable form by the operator if parental consent is not 
     obtained after a reasonable time;
       (C) online contact information collected from a child that 
     is used only to respond more than once directly to a specific 
     request from the child and is not used to recontact the child 
     beyond the scope of that request--
       (i) if, before any additional response after the initial 
     response to the child, the operator uses reasonable efforts 
     to provide a parent notice of the online contact information 
     collected from the child, the purposes for which it is to be 
     used, and an opportunity for the parent to request that the 
     operator make no further use of the information and that it 
     not be maintained in retrievable form; or
       (ii) without notice to the parent in such circumstances as 
     the Commission may determine are appropriate, taking into 
     consideration the benefits to the child of access to 
     information and services, and risks to the security and 
     privacy of the child, in regulations promulgated under this 
     subsection;
       (D) the name of the child and online contact information 
     (to the extent reasonably necessary to protect the safety of 
     a child participant on the site)--
       (i) used only for the purpose of protecting such safety;
       (ii) not used to recontact the child or for any other 
     purpose; and
       (iii) not disclosed on the site,
       if the operator uses reasonable efforts to provide a parent 
     notice of the name and online contact information collected 
     from the child, the purposes for which it is to be used, and 
     an opportunity for the parent to request that the operator 
     make no further use of the information and that it not be 
     maintained in retrievable form; or
       (E) the collection, use, or dissemination of such 
     information by the operator of such a website or online 
     service necessary--
       (i) to protect the security or integrity of its website;
       (ii) to take precautions against liability;
       (iii) to respond to judicial process; or
       (iv) to the extent permitted under other provisions of law, 
     to provide information to law enforcement agencies or for an 
     investigation on a matter related to public safety.
       (3) Termination of service.--The regulations shall permit 
     the operator of a website or an online service to terminate 
     service provided to a child whose parent has refused, under 
     the regulations prescribed under paragraph (1)(B)(ii), to 
     permit the operator's further use or maintenance in 
     retrievable form, or future online collection, of personal 
     information from that child.
     (c) Enforcement.--Subject to sections 1304 and 1306, a 
     violation of a regulation prescribed under subsection (a) 
     shall be treated as a violation of a rule defining an unfair 
     or deceptive act or practice prescribed under section 
     18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 
     57a(a)(1)(B)).
     (d) Inconsistent State Law.--No State or local government may 
     impose any liability for commercial activities or actions by 
     operators in interstate or foreign commerce in connection 
     with an activity or action described in this title that is 
     inconsistent with the treatment of those activities or 
     actions under this section.

     SEC. 1304. SAFE HARBORS.

     (a) Guidelines.--An operator may satisfy the requirements of 
     regulations issued under section 1303(b) by following a set 
     of self-regulatory guidelines, issued by representatives of 
     the marketing or online industries, or by other persons, 
     approved under subsection (b).
     (b) Incentives.--
       (1) Self-regulatory incentives.--In prescribing regulations 
     under section 1303, the Commission shall provide incentives 
     for self-regulation by operators to implement the protections 
     afforded children under the regulatory requirements described 
     in subsection (b) of that section.
       (2) Deemed compliance.--Such incentives shall include 
     provisions for ensuring that a person will be deemed to be in 
     compliance with the requirements of the regulations under 
     section 1303 if that person complies with guidelines that, 
     after notice and comment, are approved by the Commission upon 
     making a determination that the guidelines meet the 
     requirements of the regulations issued under section 1303.
       (3) Expedited response to requests.--The Commission shall 
     act upon requests for safe harbor treatment within 180 days 
     of the filing of the request, and shall set forth in writing 
     its conclusions with regard to such requests.
     (c) Appeals.--Final action by the Commission on a request for 
     approval of guidelines, or the failure to act within 180 days 
     on a request for approval of guidelines, submitted under 
     subsection (b) may be appealed to a district court of the 
     United States of appropriate jurisdiction as provided for 
     in section 706 of title 5, United States Code.

     SEC. 1305. ACTIONS BY STATES.

       (a) In General.--
       (1) Civil actions.--In any case in which the attorney 
     general of a State has reason to believe that an interest of 
     the residents of that State has been or is threatened or 
     adversely affected by the engagement of any person in a 
     practice that violates any regulation of the Commission 
     prescribed under section 1303(b), the State, as parens 
     patriae, may bring a civil action on behalf of the residents 
     of the State in a district court of the United States of 
     appropriate jurisdiction to--
       (A) enjoin that practice;
       (B) enforce compliance with the regulation;
       (C) obtain damage, restitution, or other compensation on 
     behalf of residents of the State; or
       (D) obtain such other relief as the court may consider to 
     be appropriate.
       (2) Notice.--
       (A) In general.--Before filing an action under paragraph 
     (1), the attorney general of the State involved shall provide 
     to the Commission--
       (i) written notice of that action; and
       (ii) a copy of the complaint for that action.
       (B) Exemption.--
       (i) In general.--Subparagraph (A) shall not apply with 
     respect to the filing of an action by an attorney general of 
     a State under this subsection, if the attorney general 
     determines that it is not feasible to provide the notice 
     described in that subparagraph before the filing of the 
     action.
       (ii) Notification.--In an action described in clause (i), 
     the attorney general of a State shall provide notice and a 
     copy of the complaint to the Commission at the same time as 
     the attorney general files the action.
       (b) Intervention.--
       (1) In general.--On receiving notice under subsection 
     (a)(2), the Commission shall have the right to intervene in 
     the action that is the subject of the notice.
       (2) Effect of intervention.--If the Commission intervenes 
     in an action under subsection (a), it shall have the right--
       (A) to be heard with respect to any matter that arises in 
     that action; and
       (B) to file a petition for appeal.
       (3) Amicus curiae.--Upon application to the court, a person 
     whose self-regulatory guidelines have been approved by the 
     Commission and are relied upon as a defense by any defendant 
     to a proceeding under this section may file amicus curiae in 
     that proceeding.
       (c) Construction.--For purposes of bringing any civil 
     action under subsection (a), nothing in this title shall be 
     construed to prevent an attorney general of a State from 
     exercising the powers conferred on the attorney general by 
     the laws of that State to--
       (1) conduct investigations;
       (2) administer oaths or affirmations; or
       (3) compel the attendance of witnesses or the production of 
     documentary and other evidence.
       (d) Actions by the Commission.--In any case in which an 
     action is instituted by or on behalf of the Commission for 
     violation of any regulation prescribed under section 1303, no 
     State may, during the pendency of that action, institute an 
     action under subsection (a) against any defendant named in 
     the complaint in that action for violation of that 
     regulation.
       (e) Venue; Service of Process.--
       (1) Venue.--Any action brought under subsection (a) may be 
     brought in the district court of the United States that meets 
     applicable requirements relating to venue under section 1391 
     of title 28, United States Code.
       (2) Service of process.--In an action brought under 
     subsection (a), process may be served in any district in 
     which the defendant--
       (A) is an inhabitant; or
       (B) may be found.

     SEC. 1306. ADMINISTRATION AND APPLICABILITY OF ACT.

       (a) In General.--Except as otherwise provided, this title 
     shall be enforced by the Commission under the Federal Trade 
     Commission Act (15 U.S.C. 41 et seq.).
       (b) Provisions.--Compliance with the requirements imposed 
     under this title shall be enforced under--
       (1) section 8 of the Federal Deposit Insurance Act (12 
     U.S.C. 1818), in the case of--
       (A) national banks, and Federal branches and Federal 
     agencies of foreign banks, by the Office of the Comptroller 
     of the Currency;
       (B) member banks of the Federal Reserve System (other than 
     national banks), branches and agencies of foreign banks 
     (other than Federal branches, Federal agencies, and insured 
     State

[[Page H11242]]

     branches of foreign banks), commercial lending companies 
     owned or controlled by foreign banks, and organizations 
     operating under section 25 or 25(a) of the Federal Reserve 
     Act (12 U.S.C. 601 et seq. and 611 et seq.), by the Board; 
     and
       (C) banks insured by the Federal Deposit Insurance 
     Corporation (other than members of the Federal Reserve 
     System) and insured State branches of foreign banks, by the 
     Board of Directors of the Federal Deposit Insurance 
     Corporation;
       (2) section 8 of the Federal Deposit Insurance Act (12 
     U.S.C. 1818), by the Director of the Office of Thrift 
     Supervision, in the case of a savings association the 
     deposits of which are insured by the Federal Deposit 
     Insurance Corporation;
       (3) the Federal Credit Union Act (12 U.S.C. 1751 et seq.) 
     by the National Credit Union Administration Board with 
     respect to any Federal credit union;
       (4) part A of subtitle VII of title 49, United States Code, 
     by the Secretary of Transportation with respect to any air 
     carrier or foreign air carrier subject to that part;
       (5) the Packers and Stockyards Act, 1921 (7 U.S.C. 181 et 
     seq.) (except as provided in section 406 of that Act (7 
     U.S.C. 226, 227)), by the Secretary of Agriculture with 
     respect to any activities subject to that Act; and
       (6) the Farm Credit Act of 1971 (12 U.S.C. 2001 et seq.) by 
     the Farm Credit Administration with respect to any Federal 
     land bank, Federal land bank association, Federal 
     intermediate credit bank, or production credit association.
       (c) Exercise of Certain Powers.--For the purpose of the 
     exercise by any agency referred to in subsection (a) of its 
     powers under any Act referred to in that subsection, a 
     violation of any requirement imposed under this title shall 
     be deemed to be a violation of a requirement imposed under 
     that Act. In addition to its powers under any provision of 
     law specifically referred to in subsection (a), each of the 
     agencies referred to in that subsection may exercise, for the 
     purpose of enforcing compliance with any requirement imposed 
     under this title, any other authority conferred on it by law.
       (d) Actions by the Commission.--The Commission shall 
     prevent any person from violating a rule of the Commission 
     under section 1303 in the same manner, by the same means, and 
     with the same jurisdiction, powers, and duties as though all 
     applicable terms and provisions of the Federal Trade 
     Commission Act (15 U.S.C. 41 et seq.) were incorporated into 
     and made a part of this title. Any entity that violates such 
     rule shall be subject to the penalties and entitled to the 
     privileges and immunities provided in the Federal Trade 
     Commission Act in the same manner, by the same means, and 
     with the same jurisdiction, power, and duties as though all 
     applicable terms and provisions of the Federal Trade 
     Commission Act were incorporated into and made a part of this 
     title.
       (e) Effect on Other Laws.--Nothing contained in the Act 
     shall be construed to limit the authority of the Commission 
     under any other provisions of law.

     SEC. 1307. REVIEW.

       Not later than 5 years after the effective date of the 
     regulations initially issued under section 1303, the 
     Commission shall--
       (1) review the implementation of this title, including the 
     effect of the implementation of this title on practices 
     relating to the collection and disclosure of information 
     relating to children, children's ability to obtain access to 
     information of their choice online, and on the availability 
     of websites directed to children; and
       (2) prepare and submit to Congress a report on the results 
     of the review under paragraph (1).

     SEC. 1308. EFFECTIVE DATE.

       Sections 1303(a), 1305, and 1306 of this title take effect 
     on the later of--
       (1) the date that is 18 months after the date of enactment 
     of this Act; or
       (2) the date on which the Commission rules on the first 
     application filed for safe harbor treatment under section 
     1304 if the Commission does not rule on the first such 
     application within one year after the date of enactment of 
     this Act, but in no case later than the date that is 30 
     months after the date of enactment of this Act.
Please take a moment to help us improve your experience at the ADF&G website.
How did you arrive at our website?
Why did you visit our website today?
Did you find what you were looking for?
How easy or hard was it to find?
Very Easy Very Hard
Please provide any other comments or suggestions about your experience on the ADF&G website.

Having Trouble with this form?