U.S. Government:
Children's Online Privacy Protection Act of 1998
H.R. 4328--OMNIBUS APPROPRIATIONS BILL FY99
TITLE XIII--CHILDREN'S ONLINE PRIVACY PROTECTION
SEC. 1301. SHORT TITLE.
This title may be cited as the ``Children's Online Privacy
Protection Act of 1998''.
SEC. 1302. DEFINITIONS.
In this title:
(1) Child.--The term ``child'' means an individual under
the age of 13.
(2) Operator.--The term ``operator''--
(A) means any person who operates a website located on the
Internet or an online service and who collects or maintains
personal information from or about the users of or visitors
to such website or online service, or on whose behalf such
information is collected or maintained, where such website or
online service is operated for commercial purposes, including
any person offering products or services for sale through
that website or online service, involving commerce--
(i) among the several States or with 1 or more foreign
nations;
(ii) in any territory of the United States or in the
District of Columbia, or between any such territory and--
(I) another such territory; or
(II) any State or foreign nation; or
(iii) between the District of Columbia and any State,
territory, or foreign nation; but
(B) does not include any nonprofit entity that would
otherwise be exempt from coverage under section 5 of the
Federal Trade Commission Act (15 U.S.C. 45).
(3) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(4) Disclosure.--The term ``disclosure'' means, with
respect to personal information--
(A) the release of personal information collected from a
child in identifiable form by an operator for any purpose,
except where such information is provided to a person other
than the operator who provides support for the internal
operations of the website and does not disclose or use that
information for any other purpose; and
(B) making personal information collected from a child by a
website or online service directed to children or with actual
knowledge that such information was collected from a child,
publicly available in identifiable form, by any means
including by a public posting, through the Internet, or
through--
(i) a home page of a website;
(ii) a pen pal service;
(iii) an electronic mail service;
(iv) a message board; or
(v) a chat room.
(5) Federal agency.--The term ``Federal agency'' means an
agency, as that term is defined in section 551(1) of title 5,
United States Code.
(6) Internet.--The term ``Internet'' means collectively the
myriad of computer and telecommunications facilities,
including equipment and operating software, which comprise
the interconnected world-wide network of networks that employ
the Transmission Control Protocol/Internet Protocol, or any
predecessor or successor protocols to such protocol, to
communicate information of all kinds by wire or radio.
(7) Parent.--The term ``parent'' includes a legal guardian.
(8) Personal information.--The term ``personal
information'' means individually identifiable information
about an individual collected online, including--
(A) a first and last name;
(B) a home or other physical address including street name
and name of a city or town;
(C) an e-mail address;
(D) a telephone number;
(E) a Social Security number;
(F) any other identifier that the Commission determines
permits the physical or online contacting of a specific
individual; or
(G) information concerning the child or the parents of that
child that the website collects online from the child and
combines with an identifier described in this paragraph.
(9) Verifiable parental consent.--The term ``verifiable
parental consent'' means any reasonable effort (taking into
consideration available technology), including a request for
authorization for future collection, use, and disclosure
described in the notice, to ensure that a parent of a child
receives notice of the operator's personal information
collection, use, and disclosure practices, and authorizes the
collection, use, and disclosure, as applicable, of personal
information and the subsequent use of that information before
that information is collected from that child.
(10) Website or online service directed to children.--
(A) In general.--The term ``website or online service
directed to children'' means--
(i) a commercial website or online service that is targeted
to children; or
(ii) that portion of a commercial website or online service
that is targeted to children.
(B) Limitation.--A commercial website or online service, or
a portion of a commercial website or online service, shall
not be deemed directed to children solely for referring or
linking to a commercial website or online service directed to
children by using information location tools, including a
directory, index, reference, pointer, or hypertext link.
(11) Person.--The term ``person'' means any individual,
partnership, corporation, trust, estate, cooperative,
association, or other entity.
(12) Online contact information.--The term ``online contact
information'' means an e-mail address or another
substantially similar identifier that permits direct contact
with a person online.
SEC. 1303. REGULATION OF UNFAIR AND DECEPTIVE ACTS AND
PRACTICES IN CONNECTION WITH THE COLLECTION AND
USE OF PERSONAL INFORMATION FROM AND ABOUT
CHILDREN ON THE INTERNET.
(a) Acts Prohibited.--
(1) In general.--It is unlawful for an operator of a
website or online service directed to children, or any
operator that has actual knowledge that it is collecting
personal information from a child, to collect personal
information from a child in a manner that violates the
regulations prescribed under subsection (b).
(2) Disclosure to parent protected.--Notwithstanding
paragraph (1), neither an operator of such a website or
online service nor the operator's agent shall be held to be
liable under any Federal or State law for any disclosure made
in good faith and following reasonable procedures in
responding to a request for disclosure of personal
information under subsection (b)(1)(B)(iii) to the parent of
a child.
(b) Regulations.--
(1) In general.--Not later than 1 year after the date of
the enactment of this Act, the Commission shall promulgate
under section 553 of title 5, United States Code, regulations
that--
(A) require the operator of any website or online service
directed to children that collects personal information from
children or the operator of a website or online service that
has actual knowledge that it is collecting personal
information from a child--
[[Page H11241]]
(i) to provide notice on the website of what information is
collected from children by the operator, how the operator
uses such information, and the operator's disclosure
practices for such information; and
(ii) to obtain verifiable parental consent for the
collection, use, or disclosure of personal information from
children;
(B) require the operator to provide, upon request of a
parent under this subparagraph whose child has provided
personal information to that website or online service, upon
proper identification of that parent, to such parent--
(i) a description of the specific types of personal
information collected from the child by that operator;
(ii) the opportunity at any time to refuse to permit the
operator's further use or maintenance in retrievable form, or
future online collection, of personal information from that
child; and
(iii) notwithstanding any other provision of law, a means
that is reasonable under the circumstances for the parent to
obtain any personal information collected from that child;
(C) prohibit conditioning a child's participation in a
game, the offering of a prize, or another activity on the
child disclosing more personal information than is reasonably
necessary to participate in such activity; and
(D) require the operator of such a website or online
service to establish and maintain reasonable procedures to
protect the confidentiality, security, and integrity of
personal information collected from children.
(2) When consent not required.--The regulations shall
provide that verifiable parental consent under paragraph
(1)(A)(ii) is not required in the case of--
(A) online contact information collected from a child that
is used only to respond directly on a one-time basis to a
specific request from the child and is not used to recontact
the child and is not maintained in retrievable form by the
operator;
(B) a request for the name or online contact information of
a parent or child that is used for the sole purpose of
obtaining parental consent or providing notice under this
section and where such information is not maintained in
retrievable form by the operator if parental consent is not
obtained after a reasonable time;
(C) online contact information collected from a child that
is used only to respond more than once directly to a specific
request from the child and is not used to recontact the child
beyond the scope of that request--
(i) if, before any additional response after the initial
response to the child, the operator uses reasonable efforts
to provide a parent notice of the online contact information
collected from the child, the purposes for which it is to be
used, and an opportunity for the parent to request that the
operator make no further use of the information and that it
not be maintained in retrievable form; or
(ii) without notice to the parent in such circumstances as
the Commission may determine are appropriate, taking into
consideration the benefits to the child of access to
information and services, and risks to the security and
privacy of the child, in regulations promulgated under this
subsection;
(D) the name of the child and online contact information
(to the extent reasonably necessary to protect the safety of
a child participant on the site)--
(i) used only for the purpose of protecting such safety;
(ii) not used to recontact the child or for any other
purpose; and
(iii) not disclosed on the site,
if the operator uses reasonable efforts to provide a parent
notice of the name and online contact information collected
from the child, the purposes for which it is to be used, and
an opportunity for the parent to request that the operator
make no further use of the information and that it not be
maintained in retrievable form; or
(E) the collection, use, or dissemination of such
information by the operator of such a website or online
service necessary--
(i) to protect the security or integrity of its website;
(ii) to take precautions against liability;
(iii) to respond to judicial process; or
(iv) to the extent permitted under other provisions of law,
to provide information to law enforcement agencies or for an
investigation on a matter related to public safety.
(3) Termination of service.--The regulations shall permit
the operator of a website or an online service to terminate
service provided to a child whose parent has refused, under
the regulations prescribed under paragraph (1)(B)(ii), to
permit the operator's further use or maintenance in
retrievable form, or future online collection, of personal
information from that child.
(c) Enforcement.--Subject to sections 1304 and 1306, a
violation of a regulation prescribed under subsection (a)
shall be treated as a violation of a rule defining an unfair
or deceptive act or practice prescribed under section
18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C.
57a(a)(1)(B)).
(d) Inconsistent State Law.--No State or local government may
impose any liability for commercial activities or actions by
operators in interstate or foreign commerce in connection
with an activity or action described in this title that is
inconsistent with the treatment of those activities or
actions under this section.
SEC. 1304. SAFE HARBORS.
(a) Guidelines.--An operator may satisfy the requirements of
regulations issued under section 1303(b) by following a set
of self-regulatory guidelines, issued by representatives of
the marketing or online industries, or by other persons,
approved under subsection (b).
(b) Incentives.--
(1) Self-regulatory incentives.--In prescribing regulations
under section 1303, the Commission shall provide incentives
for self-regulation by operators to implement the protections
afforded children under the regulatory requirements described
in subsection (b) of that section.
(2) Deemed compliance.--Such incentives shall include
provisions for ensuring that a person will be deemed to be in
compliance with the requirements of the regulations under
section 1303 if that person complies with guidelines that,
after notice and comment, are approved by the Commission upon
making a determination that the guidelines meet the
requirements of the regulations issued under section 1303.
(3) Expedited response to requests.--The Commission shall
act upon requests for safe harbor treatment within 180 days
of the filing of the request, and shall set forth in writing
its conclusions with regard to such requests.
(c) Appeals.--Final action by the Commission on a request for
approval of guidelines, or the failure to act within 180 days
on a request for approval of guidelines, submitted under
subsection (b) may be appealed to a district court of the
United States of appropriate jurisdiction as provided for
in section 706 of title 5, United States Code.
SEC. 1305. ACTIONS BY STATES.
(a) In General.--
(1) Civil actions.--In any case in which the attorney
general of a State has reason to believe that an interest of
the residents of that State has been or is threatened or
adversely affected by the engagement of any person in a
practice that violates any regulation of the Commission
prescribed under section 1303(b), the State, as parens
patriae, may bring a civil action on behalf of the residents
of the State in a district court of the United States of
appropriate jurisdiction to--
(A) enjoin that practice;
(B) enforce compliance with the regulation;
(C) obtain damage, restitution, or other compensation on
behalf of residents of the State; or
(D) obtain such other relief as the court may consider to
be appropriate.
(2) Notice.--
(A) In general.--Before filing an action under paragraph
(1), the attorney general of the State involved shall provide
to the Commission--
(i) written notice of that action; and
(ii) a copy of the complaint for that action.
(B) Exemption.--
(i) In general.--Subparagraph (A) shall not apply with
respect to the filing of an action by an attorney general of
a State under this subsection, if the attorney general
determines that it is not feasible to provide the notice
described in that subparagraph before the filing of the
action.
(ii) Notification.--In an action described in clause (i),
the attorney general of a State shall provide notice and a
copy of the complaint to the Commission at the same time as
the attorney general files the action.
(b) Intervention.--
(1) In general.--On receiving notice under subsection
(a)(2), the Commission shall have the right to intervene in
the action that is the subject of the notice.
(2) Effect of intervention.--If the Commission intervenes
in an action under subsection (a), it shall have the right--
(A) to be heard with respect to any matter that arises in
that action; and
(B) to file a petition for appeal.
(3) Amicus curiae.--Upon application to the court, a person
whose self-regulatory guidelines have been approved by the
Commission and are relied upon as a defense by any defendant
to a proceeding under this section may file amicus curiae in
that proceeding.
(c) Construction.--For purposes of bringing any civil
action under subsection (a), nothing in this title shall be
construed to prevent an attorney general of a State from
exercising the powers conferred on the attorney general by
the laws of that State to--
(1) conduct investigations;
(2) administer oaths or affirmations; or
(3) compel the attendance of witnesses or the production of
documentary and other evidence.
(d) Actions by the Commission.--In any case in which an
action is instituted by or on behalf of the Commission for
violation of any regulation prescribed under section 1303, no
State may, during the pendency of that action, institute an
action under subsection (a) against any defendant named in
the complaint in that action for violation of that
regulation.
(e) Venue; Service of Process.--
(1) Venue.--Any action brought under subsection (a) may be
brought in the district court of the United States that meets
applicable requirements relating to venue under section 1391
of title 28, United States Code.
(2) Service of process.--In an action brought under
subsection (a), process may be served in any district in
which the defendant--
(A) is an inhabitant; or
(B) may be found.
SEC. 1306. ADMINISTRATION AND APPLICABILITY OF ACT.
(a) In General.--Except as otherwise provided, this title
shall be enforced by the Commission under the Federal Trade
Commission Act (15 U.S.C. 41 et seq.).
(b) Provisions.--Compliance with the requirements imposed
under this title shall be enforced under--
(1) section 8 of the Federal Deposit Insurance Act (12
U.S.C. 1818), in the case of--
(A) national banks, and Federal branches and Federal
agencies of foreign banks, by the Office of the Comptroller
of the Currency;
(B) member banks of the Federal Reserve System (other than
national banks), branches and agencies of foreign banks
(other than Federal branches, Federal agencies, and insured
State
[[Page H11242]]
branches of foreign banks), commercial lending companies
owned or controlled by foreign banks, and organizations
operating under section 25 or 25(a) of the Federal Reserve
Act (12 U.S.C. 601 et seq. and 611 et seq.), by the Board;
and
(C) banks insured by the Federal Deposit Insurance
Corporation (other than members of the Federal Reserve
System) and insured State branches of foreign banks, by the
Board of Directors of the Federal Deposit Insurance
Corporation;
(2) section 8 of the Federal Deposit Insurance Act (12
U.S.C. 1818), by the Director of the Office of Thrift
Supervision, in the case of a savings association the
deposits of which are insured by the Federal Deposit
Insurance Corporation;
(3) the Federal Credit Union Act (12 U.S.C. 1751 et seq.)
by the National Credit Union Administration Board with
respect to any Federal credit union;
(4) part A of subtitle VII of title 49, United States Code,
by the Secretary of Transportation with respect to any air
carrier or foreign air carrier subject to that part;
(5) the Packers and Stockyards Act, 1921 (7 U.S.C. 181 et
seq.) (except as provided in section 406 of that Act (7
U.S.C. 226, 227)), by the Secretary of Agriculture with
respect to any activities subject to that Act; and
(6) the Farm Credit Act of 1971 (12 U.S.C. 2001 et seq.) by
the Farm Credit Administration with respect to any Federal
land bank, Federal land bank association, Federal
intermediate credit bank, or production credit association.
(c) Exercise of Certain Powers.--For the purpose of the
exercise by any agency referred to in subsection (a) of its
powers under any Act referred to in that subsection, a
violation of any requirement imposed under this title shall
be deemed to be a violation of a requirement imposed under
that Act. In addition to its powers under any provision of
law specifically referred to in subsection (a), each of the
agencies referred to in that subsection may exercise, for the
purpose of enforcing compliance with any requirement imposed
under this title, any other authority conferred on it by law.
(d) Actions by the Commission.--The Commission shall
prevent any person from violating a rule of the Commission
under section 1303 in the same manner, by the same means, and
with the same jurisdiction, powers, and duties as though all
applicable terms and provisions of the Federal Trade
Commission Act (15 U.S.C. 41 et seq.) were incorporated into
and made a part of this title. Any entity that violates such
rule shall be subject to the penalties and entitled to the
privileges and immunities provided in the Federal Trade
Commission Act in the same manner, by the same means, and
with the same jurisdiction, power, and duties as though all
applicable terms and provisions of the Federal Trade
Commission Act were incorporated into and made a part of this
title.
(e) Effect on Other Laws.--Nothing contained in the Act
shall be construed to limit the authority of the Commission
under any other provisions of law.
SEC. 1307. REVIEW.
Not later than 5 years after the effective date of the
regulations initially issued under section 1303, the
Commission shall--
(1) review the implementation of this title, including the
effect of the implementation of this title on practices
relating to the collection and disclosure of information
relating to children, children's ability to obtain access to
information of their choice online, and on the availability
of websites directed to children; and
(2) prepare and submit to Congress a report on the results
of the review under paragraph (1).
SEC. 1308. EFFECTIVE DATE.
Sections 1303(a), 1305, and 1306 of this title take effect
on the later of--
(1) the date that is 18 months after the date of enactment
of this Act; or
(2) the date on which the Commission rules on the first
application filed for safe harbor treatment under section
1304 if the Commission does not rule on the first such
application within one year after the date of enactment of
this Act, but in no case later than the date that is 30
months after the date of enactment of this Act.