Comparing Senate KOSPA with House KOSA/COPPA 2.0

On 7/30/24, the Senate passed the Kids Online Safety and Privacy Act (KOSPA), which incorporates two major student and child privacy bills–the Kids Online Safety Act (KOSA) and the Children and Teen’s Online Privacy Protection Act (COPPA 2.0)–into the Eliminate Useless Reports Act of 2024.

Below is our redline comparing KOSPA as it passed the Senate to the House versions of KOSA (as updated in the Amendment in the Nature of a Substitute for KOSA on 6/27) and COPPA 2.0 (as introduced in the House).

Table of Contents
    Add a header to begin generating the table of contents

    Kids Online Safety Act (KOSA) Redline

    TITLE I—KIDS ONLINE SAFETY KEEPING KIDS SAFE ONLINE

    Subtitle A—Kids Online Safety

    SEC. 101. DEFINITIONS.

    In this subtitle:

    (1) CHILD.—The term ‘‘child’’ means an individual who is under the age of 13.

    (2) COMPULSIVE USAGE.—The term ‘‘compulsive usage’’ means a persistent and repetitive use of a covered platform that substantially limits the major life activity of an individual, including eating, sleeping, learning, reading, concentration, thinking, and communicating.any response stimulated by external factors that causes an individual to engage in repetitive behavior reasonably likely to cause psychological distress.

    (3) COVERED PLATFORM.—

    (A) IN GENERAL.—The term ‘‘covered platform’’ means an online platform, online video game, messaging application, or video streaming service that connects to the internet and that is used, or is reasonably likely to be used, by a minor.

    (B) EXCEPTIONS.—The term ‘‘covered platform’’ does not include—

    (i) an entity acting in its capacity as a provider of—

    (I) a common carrier service subject to the Communications Act of 1934 (47 U.S.C. 151 et seq.) and all Acts amendatory thereof and supplementary thereto;

    (II) a broadband internet access service (as such term is defined for purposes of section 8.1(b) of title 47, Code of Federal Regulations, or any successor regulation);

    (III) an email service;

    (IV) a teleconferencing or video conferencing service that allows reception and transmission of audio or video signals for real-time communication, provided that—

    (aa) the service is not an online platform, including a social media service or social network; and

    (bb) the real-time communication is initiated by using a unique link or identifier to facilitate access; or

    (V) a wireless messaging service, including such a service provided through short messaging service or multimedia messaging service protocols, that is not a component of, or linked to, an online platform and where the predominant or exclusive function is direct messaging consisting of the transmission of text, photos or videos that are sent by electronic means, where messages are transmitted from the sender to a recipient, and are not posted within an online platform or publicly;

    (ii) an organization not organized to carry on business for its own profit or that of its members;

    (iii) any public or private preschool, elementary, or secondary school, or any institution of vocational, professional, or higher education;

    (iv) a library (as defined in section 213(1) of the Library Services and Technology Act (20 U.S.C. 9122(1)));

    (v) a news or sports coverage website or app, including sports news and coverage, entertainment news, or other journalistic news coverage where—

    (I) the inclusion of video content on the website or app is related to the website or app’s own gathering, reporting, or publishing of such news content; or sports coverage; and

    (II) the website or app is not otherwise an online platform;

    (vi) a product or service that primarily functions as business-to-business software, a cloud storage, file sharing, or file collaboration service; , provided that the product or service is not an online platform; or

    (vii) a virtual private network or similar service that exists solely to route internet traffic between locations; or .

    (viii) a travel website or app that includes user reviews or other travel information.

    (4) DESIGN FEATURE.—The term ‘‘design feature’’ means any feature or component of a covered platform that will encourage or increase the frequency, time spent, or activity of minors on the covered platform. Design features include but are not limited to—

    (A) infinite scrolling or auto play;

    (B) rewards for time spent on the platform;

    (C) notifications;

    (D) push alerts that urge a user to spend more time engaged with the platform when they are not actively using it;

    (E) badges or other visual award symbols based on elevated levels of engagement with the platform;

    (F D) personalized recommendation systems;

    (G E) in-game purchases; or

    (H F) appearance altering filters.

    (5) HIGH IMPACT ONLINE COMPANY.– The term ‘‘high impact online company’’ means an online platform or online video game that provides any internet-accessible platform where—

    (A) the online platform or online video game constitutes an online product or service that is primarily used by users to access or share, user-generated content; and

    (B) the online platform or online video game—

    (i) generates $1,000,000,000 or more in annual revenue, including the revenue generated by any affiliate of such covered platform; or

    (ii) has 100,000,000 or more global monthly active users for not fewer than 3 of the preceding 12 months on the online product or service of such covered platform.

    (5) GEOLOCATION.—The term ‘‘geolocation’’ has the meaning given the term ‘‘geolocation information’’ in section 1302 of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501), as added by section 201(a).

    (6) KNOW; OR KNOWS.—

    (A) IN GENERAL.–The term ‘‘know’’ or ‘‘knows’’ means with respect to knowledge that an individual is a minor or child means to have actual knowledge or knowledge fairly implied on the basis of objective circumstances.

    (B) RULE OF CONSTRUCTION.—For purposes of enforcing this title or a regulation promulgated under this title, a determination as to whether a covered platform has knowledge fairly implied on the basis of objective circumstances that an individual is a minor or a child shall rely on competent and reliable evidence, taking into account the totality of the circumstances, including whether a reasonable and prudent person under the circumstances would have known that the individual is a minor or child. Nothing in this title, including a determination described in the preceding sentence, shall be construed to require a covered platform to—

    (i) affirmatively collect data with respect to the age of a minor or child that a covered platform is not already collecting in the normal course of business; and

    (ii) implement an age gating or age verification functionality.

    (C) COMMISSION GUIDANCE.—

    (i) IN GENERAL.—Within 180 days after the date of enactment of this Act, the Commission shall issue guidance to provide information, including best practices and examples for covered platforms to understand the Commission’s determination of whether a covered platform has knowledge fairly implied on the basis of objective circumstances that an individual is a minor or child.

    (ii) LIMITATION.—No guidance issued by the Commission with respect to this title shall confer any rights on any person, State, or locality, nor shall operate to bind the Commission or any person to the approach recommended in such guidance. Any enforcement action brought pursuant to this title, by the Commission or State attorney general, as applicable, shall allege a specific violation of a provision of this title and may not base an enforcement action on, or as applicable execute a consent order based on practices that are alleged to be inconsistent with any such guidance, unless the practices allegedly violate this title.

    (7) MENTAL HEALTH DISORDER.—The term ‘‘mental health disorder’’ has the meaning given the term ‘‘mental disorder’’ in the Diagnostic and Statistical Manual of Mental Health Disorders, 5th Edition (or the most current successor edition).

    (7 8) MICROTRANSACTION.—

    (A) IN GENERAL.—The term ‘‘microtransaction’’ means a purchase made in an online video game (including a purchase made using a virtual currency that is purchasable or redeemable using cash or credit or that is included as part of a paid subscription service).

    (B) INCLUSIONS.—Such term includes a purchase involving surprise mechanics, new characters, or in-game items.

    (C) EXCLUSIONS.—Such term does not include—

    (i) a purchase made in an online video game using a virtual currency that is earned through gameplay and is not otherwise purchasable or redeemable using cash or credit or included as part of a paid subscription service; or

    (ii) a purchase of additional levels within the game or an overall expansion of the game.

    (8 9) MINOR.—The term ‘‘minor’’ means an individual who is under the age of 17.

    (9 10) ONLINE PLATFORM.—

    (A) IN GENERAL.–The term ‘‘online platform’’ means any public-facing website, online service, online application, or mobile application that predominantly provides a community forum for user generated content.

    (B) INCLUSIONS.–Such term includes, such as sharing videos, images, games, audio files, or other content, including a social media service, social network, or virtual reality environment.

    (C) EXCLUSIONS.– Such term does not include chats, comments, or other interactive functionalities of the community forum that is incidental to the predominant purpose of the website, online service, online application, or mobile application.

    (10 11) ONLINE VIDEO GAME.—The term ‘‘online video game’’ means a video game, including an educational video game, that connects to the internet and that allows a user to—

    (A) create and upload content other than content that is incidental to gameplay, such as character or level designs created by the user, preselected phrases, or short interactions with other users;

    (B) engage in microtransactions within the game; or

    (C) communicate with other users.

    (11 12) PARENT.—The term ‘‘parent’’ has the meaning given that term in section 1302 of the Children’s Online Privacy Protection Act (15 U.S.C. 6501).

    (12 13) PERSONAL DATA.—The term ‘‘personal data’’ has the same meaning as the term ‘‘personal information’’ as defined in section 1302 of the Children’s Online Privacy Protection Act (15 U.S.C. 6501).

    (13 14) PERSONALIZED RECOMMENDATION SYSTEM.—

    (A) IN GENERAL.–The term ‘‘personalized recommendation system’’ means a fully or partially automated system used to suggest, promote, or rank, or recommend content, including other users, hashtags, or posts, based on the personal data of users.

    (B) EXCLUSIONS.– The term “personalized recommendation system” does not include–

    (i) A recommendation systems that suggests, promotes, or ranks content based solely on the user’s language, city or town, or age; shall not be considered a personalized recommendation system.

    (ii) technical means that do not fully automate or replace human decision-making processes;

    (iii) technical means that are designed to block, detect, identify, or prevent a user from accessing inappropriate, unlawful, or harmful content; or

    (iv) technical means designed to prevent or detect fraud, malicious conduct or other illegal activity, or preserve the integrity or security of systems, products, or services.

    (14 15) SEXUAL EXPLOITATION AND ABUSE.—The term ‘‘sexual exploitation and abuse’’ means any of the following:

    (A) Coercion and enticement, as described in section 2422 of title 18, United States Code.

    (B) Child sexual abuse material, as described in sections 2251, 2252, 2252A, and 2260 of title 18, United States Code.

    (C) Trafficking for the production of images, as described in section 2251A of title 18, United States Code.

    (D) Sex trafficking of children, as described in section 1591 of title 18, United States Code.

    (15 16) USER.—The term ‘‘user’’ means, with respect to a covered platform, an individual who registers an account or creates a profile on the covered platform.

    SEC. 102. DUTY OF CARE.

    (a) PREVENTION OF HARM TO MINORS.—A high impact online company covered platform shall exercise reasonable care in the creation and implementation of any design feature to prevent and mitigate the following harms to minors:

    (1) Consistent with evidence-informed medical information, the following mental health disorders: anxiety, depression, eating disorders, substance use disorders, and suicidal behaviors.

    (2) Patterns of use that indicate or encourage compulsive usage addiction-like behaviors by minors.

    (3) Physical violence (as defined in section 16 of Title 18, United States Code), online cyberbullying, and harassment of a the minor.

    (4) Sexual exploitation and abuse of minors.

    (5) Promotion and marketing of narcotic drugs (as defined in section 102 of the Controlled Substances Act (21 U.S.C. 802)), tobacco products, gambling, or alcohol.

    (6) Predatory, unfair, or deceptive marketing practices, or other financial harms.

    (b) LIMITATION.—Nothing in subsection (a) shall be construed to require a high impact online company covered platform to prevent or preclude any minor from—

    (1) any minor from deliberately and independently searching for, or specifically requesting, content; or

    (2) the high impact online company or individuals on the platform from providing resources for accessing resources and information regarding the prevention or mitigation of the harms described in subsection (a), including evidence-informed information and clinical resources.

    SEC. 103. SAFEGUARDS FOR MINORS.

    (a) SAFEGUARDS FOR MINORS.—

    (1) SAFEGUARDS.—A covered platform shall provide a user or visitor that the covered platform knows is a minor with readily-accessible and easy-to-use safeguards to, as applicable—

    (A) limit the ability of other users or visitors to communicate with the minor;

    (B) prevent other users or visitors, whether registered or not, from viewing the minor’s personal data collected by or shared on the covered platform, in particular restricting public access to personal data;

    (B C) limit design features that encourage or increase the frequency, time spent, or activity of minors on the covered platform, such as infinite scrolling, auto playing, rewards for time spent on the platform, notifications, badges, push alerts, and other interactive elements, design features that result in compulsive usage of the covered platform by the minor;

    (C D) control personalized recommendation systems, including the ability for a minor to have at least 1 of the following options—

    (i) the option of opting in to out of such personalized recommendation systems, while still allowing the display of content based on a chronological format; or

    (ii) the option of limiting types or categories of recommendations from such systems; and

    (E) restrict the sharing of the geolocation of the minor and provide notice regarding the tracking of the minor’s geolocation.

    (D) limit the ability to make in-game purchases, microtransactions, and design features that increase frequency and time spent on online video games, and for such online video games, shall be deemed to comply with section 103(a)(1)(B).

    (2) OPTIONS.—A covered platform shall provide a user that the covered platform knows is a minor with a readily-accessible and easy-to-use options to limit the amount of time spent by the minor on the covered platform.

    (3) DEFAULT SAFEGUARD SETTINGS FOR MINORS.—A covered platform shall provide that, in the case of a user or visitor that the platform knows is a minor, the default setting for any safeguard described under paragraph (1) shall be the option available on the platform that provides the most protective level of control that is offered by the platform over privacy and safety for that user or visitor, unless otherwise enabled by the parent.

    (4) EXCEPTION.—A covered platform shall provide the safeguards described in subsection (a)(1)(C) to the educational agency or institution (as defined in section 444 of the General Education Provisions Act (commonly known as the ‘‘Family Educational Rights and Privacy Act of 1974’’) (20 U.S.C. 1232g(a)(3)), rather than to the user or visitor, when the covered platform is acting on behalf of an educational agency or institution subject to a written contract that complies with the requirements of the Children’s Online Privacy Protection Act (15 U.S.C. 6501 et seq.) and the Family Educational Rights and Privacy Act.

    (b) PARENTAL TOOLS.—

    (1) TOOLS.—A covered platform shall provide readily-accessible and easy-to-use settings for parents to support a user that the platform knows is a minor with respect to the user’s use of the platform.

    (2) REQUIREMENTS.—The parental tools provided by a covered platform shall include—

    (A) the ability to manage a minor’s privacy and account settings, including the safeguards and options established under subsection (a), in a manner that allows parents to—

    (i) view the privacy and account settings; and

    (ii) in the case of a user that the platform knows is a child, change and control the privacy and account settings;

    (B) the ability to restrict purchases and financial transactions by the minor, where applicable; and

    (C) the ability to view metrics of total time spent on the covered platform and restrict time spent on the covered platform by the minor.

    (3) NOTICE TO MINORS.—A covered platform shall provide clear and conspicuous notice to a user when the tools described in this subsection are in effect and what settings or controls have been applied.

    (4) DEFAULT TOOLS.—A covered platform shall provide that, in the case of a user that the platform knows is a child, the tools required under paragraph (1) shall be enabled by default.

    (5) APPLICATION TO EXISTING ACCOUNTS.—If, prior to the effective date of this subsection, a covered platform provided a parent of a user that the platform knows is a child with notice and the ability to enable the parental tools described under this subsection in a manner that would otherwise comply with this subsection, and the parent opted out of enabling such tools, the covered platform is not required to enable such tools with respect to such user by default when this subsection takes effect.

    (c) REPORTING MECHANISM.—

    (1) REPORTS SUBMITTED BY PARENTS, MINORS, AND SCHOOLS.—A covered platform shall provide—

    (A) a readily-accessible and easy-to-use means to submit reports to the covered platform of harms to a minor;

    (B) an electronic point of contact specific to matters involving harms to a minor; and

    (C) confirmation of the receipt of such a report and, within the applicable time period described in paragraph (2), a substantive response to the individual that submitted the report.

    (2) TIMING.—A covered platform shall establish an internal process to receive and substantively respond to such reports in a reasonable and timely manner, but in no case later than—

    (A) 10 days after the receipt of a report, if, for the most recent calendar year, the platform averaged more than 10,000,000 active users on a monthly basis in the United States;

    (B) 21 days after the receipt of a report, if, for the most recent calendar year, the platform averaged less than 10,000,000 active users on a monthly basis in the United States; and

    (C) notwithstanding subparagraphs (A) and (B), if the report involves an imminent threat to the safety of a minor, as promptly as needed to address the reported threat to safety.

    (d) ADVERTISING OF ILLEGAL PRODUCTS.—A covered platform shall not facilitate the advertising of narcotic drugs (as defined in section 102 of the Controlled Substances Act (21 U.S.C. 802)), tobacco products, gambling, or alcohol to an individual that the covered platform knows is a minor.

    (e) RULES OF APPLICATION.—

    (1) ACCESSIBILITY.—With respect to safeguards and parental tools described under subsections (a) and (b), a covered platform shall provide—

    (A) information and control options in a clear and conspicuous manner that takes into consideration the differing ages, capacities, and developmental needs of the minors most likely to access the covered platform and does not encourage minors or parents to weaken or disable safeguards or parental tools;

    (B) readily-accessible and easy-to-use controls to enable or disable safeguards or parental tools, as appropriate; and

    (C) information and control options in the same language, form, and manner as the covered platform provides the product or service used by minors and their parents.

    (2) DARK PATTERNS PROHIBITION.—It shall be unlawful for any covered platform to design, embed, modify, or manipulate a user interface of a covered platform with the purpose or substantial effect of obscuring, subverting, or impairing user autonomy, decision-making, or choice with respect to safeguards or parental tools required under this section.

    (3) TIMING CONSIDERATIONS.—

    (A) NO INTERRUPTION TO GAMEPLAY.— Subsections (a)(1)(B C) and (b)(3) shall not require an online video game to interrupt the natural sequence of game play, such as progressing through game levels or finishing a competition.

    (B) APPLICATION OF CHANGES TO OFFLINE DEVICES OR ACCOUNTS.—If a user’s device or user account does not have access to the internet at the time of a change to parental tools, a covered platform shall apply changes the next time the device or user is connected to the internet.

    (4) RULES OF CONSTRUCTION.—Nothing in this section shall be construed to—

    (A) prevent a covered platform from taking reasonable measures to—

    (i) block, detect, or prevent the distribution of unlawful, obscene, or other harmful material to minors as described in section 102(a); or

    (ii) block or filter spam, prevent criminal activity, or protect the security of a platform or service;

    (B) require the disclosure of a minor’s browsing behavior, search history, messages, contact list, or other content or metadata of their communications;

    (C) prevent a covered platform from using a personalized recommendation system to display content to a minor if the system only uses information on—

    (i) the language spoken by the minor;

    (ii) the city the minor is located in; or

    (iii) the minor’s age; or

    (D) prevent an online video game from disclosing a username or other user identification for the purpose of competitive gameplay or to allow for the reporting of users.

    (f) DEVICE OR CONSOLE CONTROLS.—

    (1) IN GENERAL.—Nothing in this section shall be construed to prohibit a covered platform from integrating its products or service with, or duplicate controls or tools provided by, third-party systems, including operating systems or gaming consoles, to meet the requirements imposed under subsections (a) and (b) relating to safeguards for minors and parental tools, provided that—

    (A) the controls or tools meet such requirements; and

    (B) the minor or parent is provided sufficient notice of the integration and use of the parental tools.

    (2) PRESERVATION OF PROTECTIONS.—In the event of a conflict between the controls or tools of a third-party system, including operating systems or gaming consoles, and a covered platform, the covered platform is not required to override the controls or tools of a third-party system if it would undermine the protections for minors from the safeguards or parental tools imposed under subsections (a) and (b).

    SEC. 104. DISCLOSURE.

    (a) NOTICE.—

    (1) REGISTRATION OR PURCHASE.—Prior to registration or purchase of a covered platform by an individual that the platform knows is a minor, the platform shall provide clear, conspicuous, and easy-to-understand—

    (A) notice of the policies and practices of the covered platform with respect to safeguards for minors; required under section 103;

    (B) information about how to access the safeguards and parental tools required under section 103; and

    (C) notice about whether the covered platform uses or makes available to minors a product, service, or design feature, including any personalized recommendation system, that poses any heightened risk of harm to minors.

    (2) NOTIFICATION.—

    (A) NOTICE AND ACKNOWLEDGMENT.—In the case of an individual that a covered platform knows is a child, the platform shall additionally provide information about the parental tools and safeguards required under section 103 to a parent of the child and obtain verifiable parental consent (as defined in section 1302(9) of the Children’s Online Privacy Protection Act (15 U.S.C. 6501(9))) from the parent prior to the initial use of the covered platform by the child.

    (B) REASONABLE EFFORT.—A covered platform shall be deemed to have satisfied the requirement described in subparagraph (A) if the covered platform is in compliance with the requirements of the Children’s Online Privacy Protection Act (15 U.S.C. 6501 et seq.) to use reasonable efforts (taking into consideration available technology) to provide a parent with the information described in subparagraph (A) and to obtain verifiable parental consent as required.

    (3) CONSOLIDATED NOTICES.—For purposes of this subtitle, a covered platform may consolidate the process for providing information under this subsection and obtaining verifiable parental consent or the consent of the minor involved (as applicable) as required under this subsection with its obligations to provide relevant notice and obtain verifiable consent under the Children’s Online Privacy Protection Act (15 U.S.C. 6501 et seq.).

    (4) GUIDANCE.—The Federal Trade Commission may issue guidance to assist covered platforms in complying with the specific notice requirements of this subsection.

    (b) PERSONALIZED RECOMMENDATION SYSTEM.—A covered platform that operates a personalized recommendation system shall set out in its terms and conditions, in a clear, conspicuous, and easy-to-understand manner—

    (1) an overview of how such personalized recommendation system is used by the covered platform to provide information to minors; and, including how such systems use the personal data of minors; and

    (2) information about options for minors or their parents to opt out of or control the personalized recommendation system (as applicable).

    (c) ADVERTISING AND MARKETING INFORMATION AND LABELS.—

    (1) INFORMATION AND LABELS.—A covered platform shall provide clear, conspicuous, and easy-to-understand labels and information, which can be provided through a link to another web page or disclosure, to minors on advertisements regarding—

    (A) the name of the product, service, or brand and the subject matter of an advertisement; and

    (B) whether particular media displayed to the minor is an advertisement or marketing material, including disclosure of endorsements of products, services, or brands made for commercial consideration by other users of the platform.

    (2) GUIDANCE.—The Federal Trade Commission may issue guidance to assist covered platforms in complying with the requirements of this subsection, including guidance about the minimum level of information and labels for the disclosures required under paragraph (1).

    (c d) RESOURCES FOR PARENTS AND MINORS.—A covered platform shall provide to minors and parents clear, conspicuous, easy-to-understand, and comprehensive information in a prominent location, which may include a link to a web page, regarding—

    (1) its policies and practices with respect to safeguards for minors; and required under section 103; and

    (2) how to access the safeguards and tools required under section 103.

    (e) RESOURCES IN ADDITIONAL LANGUAGES.—A covered platform shall ensure, to the extent practicable, that the disclosures required by this section are made available in the same language, form, and manner as the covered platform provides any product or service used by minors and their parents.

    SEC. 105. TRANSPARENCY.

    (a) IN GENERAL.—Subject to subsection (b), not less frequently than once a year, a covered platform shall issue a public report describing the reasonably foreseeable risks of harms to minors and assessing the prevention and mitigation measures taken to address such risk based on an independent, third-party audit conducted through reasonable inspection of the covered platform.

    (b) SCOPE OF APPLICATION.—The requirements of this section shall apply to a covered platform if—

    (1) for the most recent calendar year, the platform averaged more than 10,000,000 active users on a monthly basis in the United States; and

    (2) the platform predominantly provides a community forum for user-generated content and discussion, including sharing videos, images, games, audio files, discussion in a virtual setting, or other content, such as acting as a social media platform, virtual reality environment, or a social network service.

    (c) CONTENT.—

    (1) TRANSPARENCY.—The public reports required of a covered platform under this section shall include—

    (A) an assessment of the extent to which the platform is likely to be accessed by minors;

    (B) a description of the commercial interests of the covered platform in use by minors;

    (C) an accounting, based on the data held by the covered platform, of—

    (i) the number of users using the covered platform that the platform knows to be minors in the United States;

    (ii) the median and mean amounts of time spent on the platform by users known to be minors in the United States who have accessed the platform during the reporting year on a daily, weekly, and monthly basis; and

    (iii) the amount of content being accessed by users that the platform knows to be minors in the United States that is in English, and the top 5 non-English languages used by users accessing the platform in the United States;

    (D) an accounting of total reports received regarding, and the prevalence (which can be based on scientifically valid sampling methods using the content available to the covered platform in the normal course of business) of content related to, the harms described in section 102(a), disaggregated by category of harm and language, including English and the top 5 non-English languages used by users accessing the platform from the United States (as identified under subparagraph (C)(iii)); and

    (E) a description of any material breaches of parental tools or assurances regarding minors, representations regarding the use of the personal data of minors, and other matters regarding non-compliance with this subtitle.

    (2) REASONABLY FORESEEABLE RISK OF HARM TO MINORS.—The public reports required of a covered platform under this section shall include—

    (A) an assessment of the reasonably foreseeable risk of harms to minors posed by the covered platform, specifically identifying those physical, mental, developmental, or financial harms described in section 102(a);

    (B) a description of whether and how the covered platform uses design features that encourage or increase the frequency, time spent, or activity of minors on the covered platform, such as infinite scrolling, auto playing, rewards for time spent on the platform, notifications, and other design features that result in compulsive usage of the covered platform by the minor;

    (C) a description of whether, how, and for what purpose the platform collects or processes categories of personal data that may cause reasonably foreseeable risk of harms to minors;

    (D) an evaluation of the efficacy of safeguards for minors and parental tools under section 103, and any issues in delivering such safeguards and the associated parental tools;

    (E) an evaluation of any other relevant matters of public concern over risk of harms to minors associated with the use of the covered platform; and

    (F) an assessment of differences in risk of harm to minors across different English and non-English languages and efficacy of safeguards in those languages.

    (3) MITIGATION.—The public reports required of a covered platform under this section shall include, for English and the top 5 non-English languages used by users accessing the platform from the United States (as identified under paragraph (2)(C)(iii)))—

    (A) a description of the safeguards and parental tools available to minors and parents on the covered platform;

    (B) a description of interventions by the covered platform when it had or has reason to believe that harms to minors could occur;

    (C) a description of the prevention and mitigation measures intended to be taken in response to the known and emerging risks identified in its assessment of reasonably foreseeable risks of harms to minors, including steps taken to—

    (i) prevent harms to minors, including adapting or removing design features or addressing through parental tools;

    (ii) provide the most protective level of control over privacy and safety by default; and

    (iii) adapt recommendation systems to mitigate reasonably foreseeable risk of harms to minors, as described in section 102(a);

    (D) a description of internal processes for handling reports and automated detection mechanisms for harms to minors, including the rate, timeliness, and effectiveness of responses under the requirement of section 103(c);

    (E) the status of implementing prevention and mitigation measures identified in prior assessments; and

    (F) a description of the additional measures to be taken by the covered platform to address the circumvention of safeguards for minors and parental tools.

    (d) REASONABLE INSPECTION.—In conducting an inspection of the reasonably foreseeable risk of harm to minors under this section, an independent, third-party auditor shall—

    (1) take into consideration the function of personalized recommendation systems;

    (2) consult parents and youth experts, including youth and families with relevant past or current experience, public health and mental health nonprofit organizations, health and development organizations, and civil society with respect to the prevention of harms to minors;

    (3) conduct research based on experiences of minors that use the covered platform, including reports under section 103(c) and information provided by law enforcement;

    (4) take account of research, including research regarding design features, marketing, or product integrity, industry best practices, or outside research;

    (5) consider indicia or inferences of age of users, in addition to any self-declared information about the age of users; and

    (6) take into consideration differences in risk of reasonably foreseeable harms and effectiveness of safeguards across English and non-English languages.

    (e) COOPERATION WITH INDEPENDENT, THIRD PARTY AUDIT.—To facilitate the report required by subsection (c), a covered platform shall—

    (1) provide or otherwise make available to the independent third-party conducting the audit all information and material in its possession, custody, or control that is relevant to the audit;

    (2) provide or otherwise make available to the independent third-party conducting the audit access to all network, systems, and assets relevant to the audit; and

    (3) disclose all relevant facts to the independent third-party conducting the audit, and not misrepresent in any manner, expressly or by implication, any relevant fact.

    (f) PRIVACY SAFEGUARDS.—

    (1) IN GENERAL.—In issuing the public reports required under this section, a covered platform shall take steps to safeguard the privacy of its users, including ensuring that data is presented in a de-identified, aggregated format such that it is not reasonably linkable to any user.

    (2) RULE OF CONSTRUCTION.—This section shall not be construed to require the disclosure of information that will lead to material vulnerabilities for the privacy of users or the security of a covered platform’s service or create a significant risk of the violation of Federal or State law.

    (3) DEFINITION OF DE-IDENTIFIED.—As used in this subsection, the term ‘‘de-identified’’ means data that does not identify and is not linked or reasonably linkable to a device that is linked or reasonably linkable to an individual, regardless of whether the information is aggregated.

    (g) LOCATION.—The public reports required under this section should be posted by a covered platform on an easy to find location on a publicly-available website.

    SEC. 106. RESEARCH ON SOCIAL MEDIA AND MINORS.

    (a) DEFINITIONS.—In this section:

    (1) COMMISSION.—The term ‘‘Commission’’ means the Federal Trade Commission.

    (2) NATIONAL ACADEMY.—The term ‘‘National Academy’’ means the National Academy of Sciences.

    (3) SECRETARY.—The term ‘‘Secretary’’ means the Secretary of Health and Human Services.

    (b) RESEARCH ON SOCIAL MEDIA HARMS.—Not later than 12 months after the date of enactment of this Act, the Commission shall seek to enter into a contract with the National Academy, under which the National Academy shall conduct no less than 5 scientific, comprehensive studies and reports on the risk of harms to minors by use of social media and other online platforms, including in English and non-English languages.

    (c) MATTERS TO BE ADDRESSED.—In contracting with the National Academy, the Commission, in consultation with the Secretary, shall seek to commission separate studies and reports, using the Commission’s authority under section 6(b) of the Federal Trade Commission Act (15 U.S.C. 46(b)), on the relationship between social media and other online platforms as defined in this subtitle on the following matters:

    (1) Anxiety, depression, eating disorders, and suicidal behaviors.

    (2) Substance use disorders and the use of narcotic drugs, tobacco products, gambling, or alcohol by minors.

    (3) Sexual exploitation and abuse.

    (4) Addiction-like use of social media and design factors that lead to unhealthy and harmful overuse of social media.

    (d) ADDITIONAL STUDY.—Not earlier than 4 years after enactment, the Commission shall seek to enter into a contract with the National Academy under which the National Academy shall conduct an additional study and report covering the matters described in subsection (c) for the purposes of providing additional information, considering new research, and other matters.

    (e) CONTENT OF REPORTS.— The comprehensive studies and reports conducted pursuant to this section shall seek to evaluate impacts and advance understanding, knowledge, and remedies regarding the harms to minors posed by social media and other online platforms, and may include recommendations related to public policy.

    (f) ACTIVE STUDIES.—If the National Academy is engaged in any active studies on the matters described in subsection (c) at the time that it enters into a contract with the Commission to conduct a study under this section, it may base the study to be conducted under this section on the active study, so long as it otherwise incorporates the requirements of this section.

    (g) COLLABORATION.—In designing and conducting the studies under this section, the Commission, the Secretary, and the National Academy shall consult with the Surgeon General and the Kids Online Safety Council.

    (h) ACCESS TO DATA.—

    (1) FACT-FINDING AUTHORITY.—The Commission may issue orders under section 6(b) of the Federal Trade Commission Act (15 U.S.C. 46(b)) to require covered platforms to provide reports, data, or answers in writing as necessary to conduct the studies required under this section.

    (2) SCOPE.—In exercising its authority under paragraph (1), the Commission may issue orders to no more than 5 covered platforms per study under this section.

    (3) CONFIDENTIAL ACCESS.—Notwithstanding section 6(f) or 21 of the Federal Trade Commission Act (15 U.S.C. 46, 57b–2), the Commission shall enter in agreements with the National Academy to share appropriate information received from a covered platform pursuant to an order under such subsection (b) for a comprehensive study under this section in a confidential and secure manner, and to prohibit the disclosure or sharing of such information by the National Academy. Nothing in this paragraph shall be construed to preclude the disclosure of any such information if authorized or required by any other law.

    SEC. 106. 107. MARKET RESEARCH.

    (a) MARKET RESEARCH BY COVERED PLATFORMS.— The Federal Trade Commission, in consultation with the Secretary of Commerce, shall issue guidance for covered platforms seeking to conduct market- and product-focused research on minors. Such guidance shall include—

    (1) a standard consent form that provides minors and their parents a clear, conspicuous, and easy-to-understand explanation of the scope and purpose of the research to be conducted that is available in English and the top 5 non-English languages used in the United States;

    (2) information on how to obtain informed consent from the parent of a minor prior to conducting such market- and product-focused research; and

    (3) recommendations for age-appropriate research practices for studies that may include minors. , disaggregated by the age ranges of 0-5, 6-9, 10-12, and 13-16.

    (b) TIMING.—The Federal Trade Commission shall issue such guidance not later than 18 months after the date of enactment of this Act. In doing so, they shall seek input from members of the public and the representatives of the Kids Online Safety Council established under section 110. 111.

    SEC. 107. 108. AGE VERIFICATION STUDY AND REPORT.

    (a) STUDY.—The Secretary of Commerce, in coordination with the Federal Communications Commission and the Federal Trade Commission, shall conduct a study evaluating the most technologically feasible methods and options for developing systems to verify age at the device or operating system level.

    (b) CONTENTS.—Such study shall consider —

    (1) the benefits of creating a device or operating system level age verification system;

    (2) what information may need to be collected to create this type of age verification system;

    (3) the accuracy of such systems and their impact or steps to improve accessibility, including for individuals with disabilities;

    (4) how such a system or systems could verify age while mitigating risks to user privacy and data security and safeguarding minors’ personal data, emphasizing minimizing the amount of data collected and processed by covered platforms and age verification providers for such a system;

    (5) the technical feasibility, including the need for potential hardware and software changes, including for devices currently in commerce and owned by consumers; and

    (6) the impact of different age verification systems on competition, particularly the risk of different age verification systems creating barriers to entry for small companies.

    (c) REPORT.—Not later than 1 year after the date of enactment of this Act, the agencies described in subsection (a) shall submit a report containing the results of the study conducted under such subsection to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Energy and Commerce of the House of Representatives.

    SEC. 108. 109. GUIDANCE.

    (a) IN GENERAL.—Not later than 18 months after the date of enactment of this Act, the Federal Trade Commission, in consultation with the Kids Online Safety Council established under section 110, 111, shall issue guidance to—

    (1) provide information and examples for covered platforms and auditors regarding, the following, with consideration given to differences across English and non-English languages—

    (A) identifying design features that encourage or increase the frequency, time spent, or activity of minors on the covered platform;

    (B) safeguarding minors against the possible misuse of parental tools;

    (C) best practices in providing minors and parents the most protective level of control over privacy and safety;

    (D) using indicia or inferences of age of users for assessing use of the covered platform by minors;

    (E) methods for evaluating the efficacy of safeguards set forth in this subtitle; and

    (F) providing additional parental tool options that allow parents to address the harms described in section 102(a); and

    (2) outline conduct that does not have the purpose or substantial effect of subverting or impairing user autonomy, decision-making, or choice, or of causing, increasing, or encouraging compulsive usage for a minor, such as—

    (A) de minimis user interface changes derived from testing consumer preferences, including different styles, layouts, or text, where such changes are not done with the purpose of weakening or disabling safeguards or parental tools; and

    (B) algorithms or data outputs outside the control of a covered platform; and

    (B C) establishing default settings that provide enhanced privacy protection to users or otherwise enhance their autonomy and decision-making ability.

    (b) GUIDANCE ON KNOWLEDGE STANDARD.—Not later than 18 months after the date of enactment of this Act, the Federal Trade Commission shall issue guidance to provide information, including best practices and examples, for covered platforms to understand how the Commission would determine whether a covered platform ‘‘had knowledge fairly implied on the basis of objective circumstances’’ for purposes of this subtitle.

    (b) GUIDANCE TO SCHOOLS.–Not later than 18 months after the date of enactment of this Act, the Secretary of Education, in consultation with the Federal Trade Commission and the Kids Online Safety Council established under section 110, shall issue guidance to assist elementary and secondary schools in using the notice, safeguards and tools provided under this Act and providing information on online safety for students and teachers.

    (c) LIMITATION ON FEDERAL TRADE COMMISSION GUIDANCE.—

    (1) EFFECT OF GUIDANCE.—No guidance issued by the Federal Trade Commission with respect to this subtitle shall—

    (A) confer any rights on any person, State, or locality; or

    (B) operate to bind the Federal Trade Commission or any court, person, State, or locality to the approach recommended in such guidance.

    (2) USE IN ENFORCEMENT ACTIONS.—In any enforcement action brought pursuant to this Act, subtitle, the Federal Trade Commission or a State attorney general, as applicable—

    (A) shall allege a violation of a provision of this subtitle; and

    (B) may not base such enforcement action on, or execute a consent order based on, practices that are alleged to be inconsistent with guidance issued by the Federal Trade Commission with respect to this Act, subtitle, unless the practices are alleged to violate a provision of this subtitle. For purposes of enforcing this subtitle, State attorneys general shall take into account any guidance issued by the Commission under subsection (b).

    SEC. 109. 110. ENFORCEMENT.

    (a) ENFORCEMENT BY FEDERAL TRADE COMMISSION.—

    (1) UNFAIR AND DECEPTIVE ACTS OR PRACTICES.—A violation of this subtitle shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).

    (2) POWERS OF THE COMMISSION.—

    (A) IN GENERAL.—The Federal Trade Commission (referred to in this section as the ‘‘Commission’’) shall enforce this subtitle in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this subtitle.

    (B) PRIVILEGES AND IMMUNITIES.—Any person that violates this subtitle shall be subject to the penalties, and entitled to the privileges and immunities, provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).

    (3) AUTHORITY PRESERVED.—Nothing in this subtitle shall be construed to limit the authority of the Commission under any other provision of law.

    (b) ENFORCEMENT BY STATE ATTORNEYS GENERAL.—

    (1) IN GENERAL.—

    (A) CIVIL ACTIONS.—In any case in which the attorney general of a State has reason to believe that a covered platform has violated or is violating section 103, 104, or 105, the State, as parens patriae, may bring a civil action on behalf of the residents of the State in a district court of the United States or a State court of appropriate jurisdiction to—

    (i) enjoin any practice that violates section 103, 104, or 105;

    (ii) enforce compliance with section 103, 104, or 105;

    (iii) on behalf of residents of the State, obtain damages, restitution, or other compensation, each of which shall be distributed in accordance with State law; or

    (iv) obtain such other relief as the court may consider to be appropriate.

    (B) NOTICE.—

    (i) IN GENERAL.—Before filing an action under subparagraph (A), the attorney general of the State involved shall provide to the Commission—

    (I) written notice of that action; and

    (II) a copy of the complaint for that action.

    (ii) EXEMPTION.—

    (I) IN GENERAL.—Clause (i) shall not apply with respect to the filing of an action by an attorney general of a State under this paragraph if the attorney general of the State determines that it is not feasible to provide the notice described in that clause before the filing of the action.

    (II) NOTIFICATION.—In an action described in subclause (I), the attorney general of a State shall provide notice and a copy of the complaint to the Commission at the same time as the attorney general files the action.

    (2) INTERVENTION.—

    (A) IN GENERAL.—On receiving notice under paragraph (1)(B), the Commission shall have the right to intervene in the action that is the subject of the notice.

    (B) EFFECT OF INTERVENTION.—If the Commission intervenes in an action under paragraph (1), it shall have the right—

    (i) to be heard with respect to any matter that arises in that action; and

    (ii) to file a petition for appeal.

    (3) CONSTRUCTION.—For purposes of bringing any civil action under paragraph (1), nothing in this subtitle shall be construed to prevent an attorney general of a State from exercising the powers conferred on the attorney general by the laws of that State to—

    (A) conduct investigations;

    (B) administer oaths or affirmations; or

    (C) compel the attendance of witnesses or the production of documentary and other evidence.

    (4) ACTIONS BY THE COMMISSION.—In any case in which an action is instituted by or on behalf of the Commission for violation of this subtitle, no State may, during the pendency of that action, institute a separate action under paragraph (1) against any defendant named in the complaint in the action instituted by or on behalf of the Commission for that violation.

    (5) VENUE; SERVICE OF PROCESS.—

    (A) VENUE.—Any action brought under paragraph (1) may be brought in—

    (i) the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code; or

    (ii) a State court of competent jurisdiction.

    (B) SERVICE OF PROCESS.—In an action brought under paragraph (1) in a district court of the United States, process may be served wherever defendant—

    (i) is an inhabitant; or

    (ii) may be found.

    (6) LIMITATION.—A violation of section 102 shall not form the basis of liability in any action brought by the attorney general of a State under a State law.

    SEC. 110. 111. KIDS ONLINE SAFETY COUNCIL.

    (a) ESTABLISHMENT.—Not later than 180 days after the date of enactment of this Act, the Secretary of Commerce shall establish and convene the Kids Online Safety Council for the purpose of providing advice on matters related to this subtitle.

    (b) PARTICIPATION.—The Kids Online Safety Council shall include diverse participation from—

    (1) academic experts, health professionals, and members of civil society with expertise in mental health, substance use disorders, and the prevention of harms to minors;

    (2) representatives in academia and civil society with specific expertise in privacy, free expression, access to information, and civil liberties;

    (3) parents and youth representation;

    (4) representatives of covered platforms;

    (5) representatives of the National Telecommunications and Information Administration, the National Institute of Standards and Technology, the Federal Trade Commission, the Department of Justice, and the Department of Health and Human Services;

    (6) State attorneys general or their designees acting in State or local government;

    (7) educators; and

    (8) representatives of communities of socially disadvantaged individuals (as defined in section 8 of the Small Business Act (15 U.S.C. 637)).

    (c) ACTIVITIES.—The matters to be addressed by the Kids Online Safety Council shall include—

    (1) identifying emerging or current risks of harms to minors associated with online platforms;

    (2) recommending measures and methods for assessing, preventing, and mitigating harms to minors online;

    (3) identifying specific design features and recommending best practices to promote the health and safety of minors;

    (4 3) recommending methods and themes for conducting research regarding online harms to minors, including in English and non-English languages; and

    (5 4) recommending best practices and clear, consensus-based technical standards for transparency reports and audits, as required under this subtitle, including methods, criteria, and scope to promote overall accountability.

    (d) NON-APPLICABILITY OF FACA.—The Kids Online Safety Council shall not be subject to chapter 10 of title 5, United States Code (commonly referred to as the ‘‘Federal Advisory Committee Act’’).

    SEC. 111. 112. EFFECTIVE DATE.

    Except as otherwise provided in this subtitle, this subtitle shall take effect on the date that is 18 months after the date of enactment of this Act.

    SEC. 112. 113. RULES OF CONSTRUCTION AND OTHER MATTERS.

    (a) RELATIONSHIP TO OTHER LAWS.—Nothing in this subtitle shall be construed to—

    (1) preempt section 444 of the General Education Provisions Act (20 U.S.C. 1232g, commonly known as the ‘‘Family Educational Rights and Privacy Act of 1974’’) or other Federal or State laws governing student privacy;

    (2) preempt the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501 et seq.) or any rule or regulation promulgated under such Act; or

    (3) authorize any action that would conflict with section 18(h) of the Federal Trade Commission Act (15 U.S.C. 57a(h)). ; or

    (4) expand or limit the scope of section 230 of the Communications Act of 1934 (commonly known as ‘‘section 230 of the Communications Decency Act of 1996’’) (47 U.S.C. 230).

    (b) DETERMINATION OF ‘‘FAIRLY IMPLIED ON THE BASIS OF OBJECTIVE CIRCUMSTANCES’’.—For purposes of enforcing this subtitle, in making a determination as to whether covered platform has knowledge fairly implied on the basis of objective circumstances that a specific user is a minor, the Federal Trade Commission or a State attorney general shall rely on competent and reliable evidence, taking into account the totality of the circumstances, including whether a reasonable and prudent person under the circumstances would have known that the user is a minor.

    (b c) PROTECTIONS FOR PRIVACY.—Nothing in this subtitle, including a determination described in subsection (b), shall be construed to require—

    (1) the affirmative collection of any personal data with respect to the age of users that a covered platform is not already collecting in the normal course of business; or

    (2) a covered platform to implement an age gating or age verification functionality.

    (c d) COMPLIANCE.—Nothing in this subtitle shall be construed to restrict a covered platform’s ability to—

    (1) cooperate with law enforcement agencies regarding activity that the covered platform reasonably and in good faith believes may violate Federal, State, or local laws, rules, or regulations;

    (2) comply with a lawful civil, criminal, or regulatory inquiry, subpoena, or summons by Federal, State, local, or other government authorities; or

    (3) prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity; preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action; or

    (4 3) investigate, establish, exercise, respond to, or defend against legal claims.

    (d e) APPLICATION TO VIDEO STREAMING SERVICES.— A video streaming service shall be deemed to be in compliance with this subtitle if it predominantly consists of news, sports, entertainment, or other video programming content that is preselected by the provider and not user-generated, and—

    (1) any chat, comment, or interactive functionality is provided incidental to, directly related to, or dependent on provision of such content;

    (2) if such video streaming service requires account owner registration and is not predominantly news or sports, the service includes the capability—

    (A) to limit a minor’s access to the service, which may utilize a system of age-rating;

    (B) to limit the automatic playing of on-demand content selected by a personalized recommendation system for an individual that the service knows is a minor;

    (C) to provide an individual that the service knows is a minor with readily-accessible and easy-to-use options to delete an account held by the minor on the service, or, in the case of a service that allows a parent to create a profile for a minor, to allow a parent to delete the minor’s profile;

    (D C) for a parent to manage a minor’s privacy and account settings, and restrict purchases and financial transactions by a minor, where applicable;

    (E D) to provide an electronic point of contact specific to matters described in this paragraph;

    (F E) to offer a clear, conspicuous, and easy-to-understand notice of its policies and practices with respect to the capabilities described in this paragraph; and

    (G F) when providing on-demand content, to employ measures that safeguard against serving advertising for narcotic drugs (as defined in section 102 of the Controlled Substances Act (21 U.S.C. 802)), tobacco products, gambling, or alcohol directly to the account or profile of an individual that the service knows is a minor.

    SEC. 113. SEVERABILITY.

    If any provision of this title, or an amendment made by this title, is determined to be unenforceable or invalid, the remaining provisions of this title and the amendments made by this title shall not be affected.

    TITLE II Subtitle B—Filter Bubble Transparency

    SEC. 201. 120. DEFINITIONS.

    In this subtitle:

    (1) ALGORITHMIC RANKING SYSTEM.—The term ‘‘algorithmic ranking system’’ means a computational process, including one derived from algorithmic decision-making, machine learning, statistical analysis, or other data processing or artificial intelligence techniques, used to determine the selection, order, relative prioritization, or relative prominence of content from a set of information that is provided to a user on an online platform, including the ranking of search results, the provision of content recommendations, the display of social media posts, or any other method of automated content selection.

    (2) APPROXIMATE GEOLOCATION INFORMATION.—The term ‘‘approximate geolocation information’’ means information that identifies the location of an individual, but with a precision of less than 5 miles.

    (3) COMMISSION.—The term ‘‘Commission’’ means the Federal Trade Commission.

    (4) CONNECTED DEVICE.—The term ‘‘connected device’’ means an electronic device that—

    (A) is capable of connecting to the internet, either directly or indirectly through a network, to communicate information at the direction of an individual;

    (B) has computer processing capabilities for collecting, sending, receiving, or analyzing data; and

    (C) is primarily designed for or marketed to consumers.

    (5) INPUT-TRANSPARENT ALGORITHM.—

    (A) IN GENERAL.—The term ‘‘input-transparent algorithm’’ means an algorithmic ranking system that does not use the user-specific data of a user to determine the selection, order, relative prioritization, or relative prominence of information that is furnished to such user on an online platform, unless the user-specific data is expressly provided to the platform by the user for such purpose.

    (B) DATA EXPRESSLY PROVIDED TO THE PLATFORM.—For purposes of subparagraph (A), user-specific data that is provided by a user for the express purpose of determining the selection, order, relative prioritization, or relative prominence of information that is furnished to such user on an online platform—

    (i) shall include user-supplied search terms, filters, speech patterns (if provided for the purpose of enabling the platform to accept spoken input or selecting the language in which the user interacts with the platform), saved preferences, the resumption of a previous search, and the current precise geolocation information that is supplied by the user;

    (ii) shall include the user’s current approximate geolocation information;

    (iii) shall include data submitted to the platform by the user that expresses the user’s desire to receive particular information, such as the social media profiles the user follows, the video channels the user subscribes to, or other content or sources of content on the platform the user has selected;

    (iv) shall not include the history of the user’s connected device, including the user’s history of web searches and browsing, previous geographical locations, physical activity, device interaction, and financial transactions; and

    (v) shall not include inferences about the user or the user’s connected device, without regard to whether such inferences are based on data described in clause (i) or (iii).

    (6) ONLINE PLATFORM.—

    (A) IN GENERAL.–The term ‘‘online platform’’ means any public-facing website, online service, online application, or mobile application that predominantly provides a community forum for user-generated content. , such as

    (B) INCLUSIONS.– Such term includes sharing videos, images, games, audio files, or other content, including a social media service, social network, or virtual reality environment.

    (C) EXCLUSIONS.–Such term does not include–

    (i) chats, comments, or other interactive functionalities of the community forum that is incidental to the predominant purpose of the website, online service, online application, or mobile application; or

    (ii) a product or service that primarily serves to facilitate the sale or provision of commercial products or professional services.

    (7) OPAQUE ALGORITHM.—

    (A) IN GENERAL.—The term ‘‘opaque algorithm’’ means an algorithmic ranking system that determines the selection, order, relative prioritization, or relative prominence of information that is furnished to such user on an online platform based, in whole or part, on user-specific data that was not expressly provided by the user to the platform for such purpose.

    (B) EXCEPTION FOR AGE-APPROPRIATE CONTENT FILTERS.—Such term shall not include an algorithmic ranking system used by an online platform if—

    (i) the only user-specific data (including inferences about the user) that the system uses is information relating to the age of the user; and

    (ii) such information is only used to restrict a user’s access to content on the basis that the individual is not old enough to access such content.

    (8) PRECISE GEOLOCATION INFORMATION.— The term ‘‘precise geolocation information’’ means geolocation information that identifies an individual’s location to within a range of 5 miles or less.

    (9) USER-SPECIFIC DATA.—The term ‘‘user-specific data’’ means information relating to an individual or a specific connected device that would not necessarily be true of every individual or device.

    SEC. 202. 121. REQUIREMENT TO ALLOW USERS TO SEE UNMANIPULATED CONTENT ON INTERNET PLATFORMS.

    (a) IN GENERAL.—Beginning on the date that is 1 year after the date of enactment of this Act, it shall be unlawful for any person to operate an online platform that uses an opaque algorithm unless the person complies with the requirements of subsection (b).

    (b) OPAQUE ALGORITHM REQUIREMENTS.—

    (1) IN GENERAL.—The requirements of this subsection with respect to a person that operates an online platform that uses an opaque algorithm are the following:

    (A) The person provides notice to users of the platformwith the following notices:

    (i) Notice that the platform uses an opaque algorithm that uses user-specific data to select the content the user sees. Such notice shall be presented in a clear and conspicuous manner on the platform whenever the user interacts with an opaque algorithm for the first time, and may be a one-time notice that can be dismissed by the user; and .

    (ii) Notice, to be included in the terms and conditions of the online platform, in a clear, accessible, and easily comprehensible manner that is to be updated whenever the online platform makes a material change to– , of—

    (I) the most salient features, inputs, and parameters used by the algorithm;

    (II) how any user-specific data used by the algorithm is collected or inferred about a user of the platform, and the categories of such data;

    (III) any options that the online platform makes available for a user of the platform to opt out or exercise options under subparagraph (B), modify the profile of the user or to influence the features, inputs, or parameters used by the algorithm; and

    (IV) any quantities, such as time spent using a product or specific measures of engagement or social interaction, that the algorithm is designed to optimize, as well as a general description of the relative importance of each quantity for such ranking.

    (B) The online platform enables users to easily switch between the opaque algorithm and an input-transparent algorithm in their use of the platform.

    (2) RULE OF CONSTRUCTION.—Nothing in this subsection shall be construed to require an online platform to disclose any information, including data or algorithms—

    (A) relating to a trade secret or other protected intellectual property;

    (B) that is confidential business information; or

    (C) that is privileged.

    (3) PROHIBITION ON DIFFERENTIAL PRICING.—An online platform shall not deny, charge different prices or rates for, or condition the provision of a service or product to a user based on the user’s election to use an input-transparent algorithm in their use of the platform, as provided under paragraph (1)(B).

    (4) EXCEPTION.–A person that operates an online platform that uses an opaque algorithm shall provide the requirements described in subsection (b) to the educational agency or institution (as defined in section 444 of the General Education Provisions Act (commonly known as the ‘‘Family Educational Rights and Privacy Act of 1974’’) (20 U.S.C. 1232g(a)(3)), rather than to the user, when the person is acting on behalf of an educational agency or institution subject to a written contract that complies with the requirements of the Children’s Online Privacy Protection Act (15 U.S.C. 6501 et seq.) and the Family Educational Rights and Privacy Act.

    (c) ENFORCEMENT BY FEDERAL TRADE COMMISSION.—

    (1) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.—A violation of this section by an operator of an online platform shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).

    (2) POWERS OF COMMISSION.—

    (A) IN GENERAL.—The Federal Trade Commission shall enforce this section in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this section.

    (B) PRIVILEGES AND IMMUNITIES.—Except as provided in subparagraph (C), any Any person who violates this Act section shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).

    (C) AUTHORITY PRESERVED.—Nothing in this section shall be construed to limit the authority of the Commission under any other provision of law.

    (d) RULE OF CONSTRUCTION TO PRESERVE PERSONALIZED BLOCKS.—Nothing in this section shall be construed to limit or prohibit an online platform’s ability to, at the direction of an individual user or group of users, restrict another user from searching for, finding, accessing, or interacting with such user’s or group’s account, content, data, or online community.

    SEC. 203. SEVERABILITY

    If any provision of this title, or an amendment made by this title, is determined to be unenforceable or invalid, the remaining provisions of this title and the amendments made by this title shall not be affected.

    TITLE III Subtitle C—Relationship to State Laws; Severability

    SEC. 301. 130. RELATIONSHIP TO STATE LAWS.

    The provisions of this Act title shall preempt any State law, rule, or regulation only to the extent that such State law, rule, or regulation conflicts with a provision of this Act. title. Nothing in this Act title shall be construed to prohibit a State from enacting a law, rule, or regulation that provides greater protection to minors than the protection provided by the provisions of this Act. title.

    SEC. 131. SEVERABILITY.

    If any provision of this title, or an amendment made by this title, is determined to be unenforceable or invalid, the remaining provisions of this title and the amendments made by this title shall not be affected.

    Children and Teens' Online Privacy Protection Act (COPPA 2.0) Redline

    §6501. Definitions

    In this chapter:

    (1) Child

    The term "child" means an individual under the age of 13.

    (2) Operator

    The term "operator"—

    (A) means any person–

    (i) who, for commercial purposes, in interstate or foreign commerce operates or provides a website on the Internet, an online service, an online application, or a mobile application; and

    (ii) who–

    (I) collects or maintains, either directly or through a service provider, personal information from or about the users of that website, service, or application;

    (II) allows another person to collect personal information directly from users of that website, service, or application (in which case, the operator is deemed to have collected the information); or

    (III) allows users of that website, service, or application to publicly disclose personal information (in which case, the operator is deemed to have collected the information); and

    (B) does not include any nonprofit entity that would otherwise be exempt from coverage under section 5 of the Federal Trade Commission Act (15 U.S.C. 45).

    (3) Commission

    The term "Commission" means the Federal Trade Commission.

    (4) Disclosure

    The term "disclosure" means, with respect to personal information—

    (A) the release of personal information collected from a child or teen by an operator for any purpose, except where the personal information is provided to a person other than the operator who –

    (i) provides support for the internal operations of the website, online service, online application, or mobile application (as defined in paragraph (8)(C)) of the operator, excluding any activity relating to individual-specific advertising targeted advertising or first-party advertising (as such terms are defined in section 101 of the American Privacy Rights Act of 2024) to children or teens; and

    (ii) does not disclose or use that personal information for any other purpose; and

    (B) making personal information collected from a child or teen by a website, online service, online application, or mobile application directed to children or with actual knowledge or knowledge fairly implied on the basis of objective circumstances that such information was collected from a child or teen, publicly available in identifiable form, by any means including by a public posting, through the Internet, or through—

    (i) a home page of a website;

    (ii) a pen pal service;

    (iii) an electronic mail service;

    (iv) a message board; or

    (v) a chat room.

    (5) Federal agency

    The term "Federal agency" means an agency, as that term is defined in section 551(1) of title 5.

    (6) Internet

    The term "Internet" means collectively the myriad of computer and telecommunications facilities, including equipment and operating software, which comprise the interconnected world-wide network of networks that employ the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocols to such protocol, to communicate information of all kinds by wire or radio.

    (7) Parent

    The term "parent" includes a legal guardian.

    (8) Personal information.--

    (A) In general.--The term `personal information' means individually identifiable information about an individual collected online, including--

    (i) a first and last name;

    (ii) a home or other physical address including street name and name of a city or town;

    (iii) an e-mail address;

    (iv) a telephone number;

    (v) a Social Security number;

    (vi) any other identifier that the Commission determines permits the physical or online contacting of a specific individual;

    (vii) a persistent identifier that can be used to recognize a specific child or teen over time and across different websites, online services, online applications, or mobile applications, including but not limited to a customer number held in a cookie, an Internet Protocol (IP) address, a processor or device serial number, or unique device identifier, but excluding an identifier that is used by an operator solely for providing support for the internal operations of the website, online service, online application, or mobile application;

    (viii) a photograph, video, or audio file where such file contains a specific child's or teen's the image or voice of a specific child;

    (ix) geolocation information;

    (x) information generated from the measurement or technological processing of an individual's biological, physical, or physiological characteristics that is used to identify an individual, including--

    (I) fingerprints;

    (II) voice prints;

    (III) iris or retina imagery scans;

    (IV) facial templates;

    (V) deoxyribonucleic acid (DNA) information; or

    (VI) gait; or

    (xi) information linked or reasonably linkable to a child or teen or the parents of that child or teen (including any unique identifier) that an operator collects online from the child or teen and combines with an identifier described in this subparagraph.

    (B) Exclusion.--The term `personal information' shall not include an audio file that contains a child's or teen's the voice of a child, so long as if the operator–

    (i) does not request information via voice that would otherwise be considered personal information under this paragraph;

    (ii) provides, in the privacy policy of the operator, clear notice of its the collection and use of the audio file and its the deletion policy in its privacy policy of the operator;

    (iii) only uses the voice within the audio file solely as a replacement for written words, to perform a task, or to engage with a website, online service, online application, or mobile application, such as to perform a search or fulfill a verbal instruction or request; and

    (iv) only maintains the audio file long enough to complete the stated purpose and then immediately deletes the audio file and does not make any other use of the audio file prior to deletion.

    (C) Support for the internal operations of a website, online service, online application, or mobile application.--

    (i) In general.--For purposes of subparagraph (A)(vii), the term `support for the internal operations of a website, online service, online application, or mobile application' means those activities necessary to--

    (I) maintain or analyze the functioning of the website, online service, online application, or mobile application;

    (II) perform network communications;

    (III) authenticate users of, or personalize the content on, the website, online service, online application, or mobile application;

    (IV) serve contextual advertising, provided that any persistent identifier is only used as necessary for technical purposes to serve the contextual advertisement, or* cap the frequency of advertising;

    (V) protect the security or integrity of the user, website, online service, online application, or mobile application;

    (VI) ensure legal or regulatory compliance, or

    (VII) fulfill a request of a child or teen as permitted by subparagraphs (A) through (C) of section 1303(b)(2).

    (ii) Condition.--Except as specifically permitted under clause (i), information collected for the activities listed in clause (i) cannot may not be used or disclosed to contact a specific individual, including through individual-specific advertising targeted advertising or first-party advertising (as such terms are defined in section 101 of the American Privacy Rights Act of 2024) to children or teens, to amass a profile on a specific individual, in connection with processes that encourage or prompt use of a website or online service, or for any other purpose.

    (9) Verifiable consent.--The term "verifiable consent" means any reasonable effort (taking into consideration available technology), including a request for authorization for future collection, use, and disclosure described in the notice, to ensure that, in the case of a child, a parent of the child, or, in the case of a teen, the teen

    (A) receives direct notice of the personal information collection, use, and disclosure practices of the operator; and

    (B) before the personal information of the child or teen is collected, freely and unambiguously authorizes–

    (i) the collection, use, and disclosure, as applicable, of that personal information; and

    (ii) any subsequent use of that personal information.

    (10) Website, online service, online application, or mobile application directed to children

    (A) In general

    The term "website, online service, online application, or mobile application directed to children" means—

    (i) a commercial website, online service, online application, or mobile application that is targeted to children; or

    (ii) that portion of a commercial website, online service, online application, or mobile application that is targeted to children.

    (B) Limitation

    A commercial website, online service, online application, or mobile application, or a portion of a commercial website, online service, online application, or mobile application, shall not be deemed directed to children solely for referring or linking to a commercial website, online service, online application, or mobile application directed to children by using information location tools, including a directory, index, reference, pointer, or hypertext link.

    (C) Rule of construction.--In considering whether a website, online service, online application, or mobile application, or portion thereof, is directed to children, the Commission shall apply a totality of circumstances test and will shall also consider competent and reliable empirical evidence regarding audience composition and evidence regarding the intended audience of the website, online service, online application, or mobile application.

    (11) Person

    The term "person" means any individual, partnership, corporation, trust, estate, cooperative, association, or other entity.

    (12) Online contact information

    The term "online contact information" means an e-mail address or another substantially similar identifier that permits direct contact with a person online.

    (13) Connected device.--The term `connected device' means a device that is capable of connecting to the internet, directly or indirectly, or to another connected device has the meaning given such term in section 101 of the American Privacy Rights Act of 2024.

    (14) Online application.--The term `online application'--

    (A) means an internet-connected software program; and

    (B) includes a service or application offered via a connected device.

    (14) EDUCATIONAL AGENCY OR INSTITUTION.—The term ‘educational agency or institution’ means a State educational agency or local educational agency as defined under Federal law, as well as an institutional day or residential school, including a public school, charter school, or private school, that provides elementary or secondary education, as determined under State law.

    (15) Mobile application.--The term `mobile application' has the meaning given such term in section 101 of the American Privacy Rights Act of 2024.--

    (A) means a software program that runs on the operating system of--

    (i) a cellular telephone;

    (ii) a tablet computer; or

    (iii) a similar portable computing device that transmits data over a wireless connection; and

    (B) includes a service or application offered via a connected device.

    (16) Online application.--The term `online application' has the meaning given such term in section 101 of the American Privacy Rights Act of 2024.--

    (A) means an internet-connected software program; and

    (B) includes a service or application offered via a connected device.

    (16 17) Precise Geolocation information.--The term `precise geolocation information' means information sufficient to identify a street name and name of a city or town has the meaning given such term in section 101 of the American Privacy Rights Act of 2024.

    (17) Teen.--The term `teen' means an individual who has attained age 13 and is under the age of 17.

    (18) Individual-specific advertising to children or teens.--

    (A) In general.--The term `individual-specific advertising to children or teens' means advertising or any other effort to market a product or service that is directed to a specific child or teen or a connected device that is linked or reasonably linkable to a child or teen based on--

    (i) the personal information from--

    (I) the child or teen; or

    (II) a group of children or teens who are similar in sex, age, household income level, race, or ethnicity to the specific child or teen to whom the product or service is marketed;

    (ii) profiling of a child or teen or group of children or teens; or

    (iii) a unique identifier of the connected device.

    (B) Exclusions.--The term `individual-specific advertising to children or teens' shall not include--

    (i) advertising or marketing to an individual or the device of an individual in response to the individual's specific request for information or feedback, such as a child's or teen's current search query;

    (ii) contextual advertising, such as when an advertisement is displayed based on the content of the website, online service, online application, mobile application, or connected device in which the advertisement appears and does not vary based on personal information related to the viewer; or

    (iii) processing personal information solely for measuring or reporting advertising or content performance, reach, or frequency, including independent measurement.

    (C) Rule of construction.--Nothing in subparagraph (A) shall be construed to prohibit an operator with actual knowledge or knowledge fairly implied on the basis of objective circumstances that a user is under the age of 17 from delivering advertising or marketing that is age-appropriate and intended for a child or teen audience, so long as the operator does not use any personal information other than whether the user is under the age of 17.

    ​​

    §6502. Online collection, use, disclosure, and deletion of personal information of children and teens.

    (a) Acts prohibited.—

    (1) In general

    It is unlawful for an operator of a website, online service, online application, or mobile application directed to children, or any operator of a website, online service, online application, or mobile application with actual knowledge or knowledge fairly implied on the basis of objective circumstances that a user is a child or teen

    (A 1) to collect personal information from a child or teen in a manner that violates the American Privacy Rights Act of 2024 or the regulations prescribed under subsection (b);

    (B) except as provided in subparagraphs (B) and (C) of section 1302(18), to collect, use, disclose to third parties, or maintain personal information of a child or teen for purposes of individual-specific advertising to children or teens (or to allow another person to collect, use, disclose, or maintain such information for such purpose);

    (C) to collect the personal information of a child or teen except when the collection of the personal information is–

    (i) consistent with the context of a particular transaction or service or the relationship of the child or teen with the operator, including collection necessary to fulfill a transaction or provide a product or service requested by the child or teen; or

    (ii) required or specifically authorized by Federal or State law; or

    (D 2) to store or transfer the personal information of a child or teen outside of the United States, unless

    (A) the operator provides direct notice to the parent of the child, in the case of a child, or to the teen, in the case of a teen, that the child's or teen's personal information of the child is being stored or transferred outside of the United States; or

    (B) with respect to transer, the operator meets the requirements of subsection 102(b) of the American Privacy Rights Act of 2024.

    (E) to retain the personal information of a child or teen for longer than is reasonably necessary to fulfill a transaction or provide a service requested by the child or teen except as required or specifically authorized by Federal or State law.

    (2) Disclosure to ‘parent or teen’ protected

    Notwithstanding paragraph (1)(A), neither an operator nor the operator's agent shall be held to be liable under any Federal or State law for any disclosure made in good faith and following reasonable procedures in responding to a request for disclosure of personal information under subsection (b)(1)(B)(iv) to the parent of a child or under subsection (b)(1)(C)(iv) to a teen.

    (b) Regulations

    (1) In general

    Not later than 1 year after October 21, 1998, the Commission shall promulgate under section 553 of title 5 regulations that—

    (A) require the operator of a website, online service, online application, or mobile application directed to children or that has actual knowledge or knowledge fairly implied on the basis of objective circumstances that a user is a child or teen

    (i) to provide clear and conspicuous notice on the website, service, or application of what information is collected from children or teens by the operator, how the operator uses such information, and the operator's disclosure practices for such information, the rights and opportunities available to the parent of the child or teen under subparagraphs (B) and (C), and the procedures or mechanisms the operator uses to ensure that personal information is not collected from children or teens except in accordance with the regulations promulgated under this Paragraph;

    (ii) to obtain verifiable consent for the collection, use, or disclosure of personal information from children or teens; and

    (iii) to obtain verifiable consent from a parent of a child or from a teen before using or disclosing personal information of the child or teen for any purpose that is a material change from the original purposes and disclosure practices specified to the parent of the child or the teen under clause (i);

    **(B) require the operator to provide, upon request of a parent under this subparagraph whose child has provided personal information to that operator, upon proper identification of that parent, to such parent—

    (i) a description of the specific types of personal information collected from the child by that operator and the method by which the operator obtained the personal information, and the purposes for which the operator collects, uses, discloses, and retains the personal information;

    (ii) the opportunity at any time to delete personal information collected from the child or content or information submitted by the child to a website, online service, online application, or mobile application and to refuse to permit the operator's further use or maintenance in retrievable form, or future online collection, of personal information from that child;

    (iii) the opportunity to challenge the accuracy of the personal information and, if the parent of the child establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected;

    (iv) notwithstanding any other provision of law, a means that is reasonable under the circumstances for the parent to obtain any personal information collected from that child, if such information is available to the operator at the time the parent makes the request;

    (C) require the operator to provide, upon the request of a teen under this subparagraph who has provided personal information to the operator, upon proper identification of that teen–

    (i) a description of the specific types of personal information collected from the teen by the operator, the method by which the operator obtained the personal information, and the purposes for which the operator collects, uses, discloses, and retains the personal information;

    (ii) the opportunity at any time to delete personal information collected from the teen or content or information submitted by the teen to a website, online service, online application, or mobile application and to refuse to permit the operator's further use or maintenance in retrievable form, or online collection, of personal information from the teen;

    (iii) the opportunity to challenge the accuracy of the personal information and, if the teen establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected; and

    (iv) a means that is reasonable under the circumstances for the teen to obtain any personal information collected from the teen, if such information is available to the operator at the time the teen makes the request;

    (B D C) prohibit conditioning a child's or teen’s participation in a game, the offering of a prize, or another activity on the child or teen disclosing more personal information than is reasonably necessary, proportionate, and limited to participate in such activity; and

    (C E D) require the operator to establish, implement, and maintain reasonable security practices procedures to protect the confidentiality, security, and integrity, and accessibility of personal information of collected from children or teens collected by the operator, and to protect such personal information against unauthorized access.

    (2) When consent not required

    The regulations shall provide that verifiable consent under clause (ii) or (iii) of paragraph (1)(A)(ii) is not required in the case of—

    (A) online contact information collected from a child or teen that is used only to respond directly on a one-time basis to a specific request from the child or teen and is not used to recontact the child or teen or to contact another child or teen and is not maintained in retrievable form by the operator;

    (B) a request for the name or online contact information of a parent or teen that is used for the sole purpose of obtaining verifiable consent or providing notice under this section and where such information is not maintained in retrievable form by the operator if verifiable consent is not obtained after a reasonable time;

    (C) online contact information collected from a child or teen that is used only to respond more than once directly to a specific request from the child or teen and is not used to recontact the child or teen beyond the scope of that request—

    (i) if, before any additional response after the initial response to the child or teen, the operator uses reasonable efforts to provide a parent or teen, as applicable, notice of the online contact information collected from the child or teen, the purposes for which it is to be used, and an opportunity for the parent or teen, as applicable, to request that the operator make no further use of the information and that it not be maintained in retrievable form; or

    (ii) without notice to the parent or teen, as applicable, in such circumstances as the Commission may determine are appropriate, taking into consideration the benefits to the child or teen of access to information and services, and risks to the security and privacy of the child or teen, in regulations promulgated under this subsection;

    (D) the name of the child or teen and online contact information (to the extent reasonably necessary, proportionate, and limited to protect the safety of a child or teen participant on the site)—

    (i) used only for the purpose of protecting such safety;

    (ii) not used to recontact the child or teen or for any other purpose; and

    (iii) not disclosed on the site, if the operator uses reasonable efforts to provide a parent or teen, as applicable, notice of the name and online contact information collected from the child or teen, the purposes for which it is to be used, and an opportunity for the parent or teen, as applicable, to request that the operator make no further use of the information and that it not be maintained in retrievable form; or

    (E) the collection, use, or dissemination of such information by the operator of such a website, or online service, online application, or mobile application necessary—

    (i) to protect the security or integrity of its website, service, or application;

    (ii) to take precautions against liability;

    (iii) to respond to judicial process; or

    (iv) to the extent permitted under other provisions of law, to provide information to law enforcement agencies or for an investigation on a matter related to public safety.

    (3) Application to operators acting under agreements with educational agencies or institutions.--The regulations may provide that verifiable consent under clause (ii) or (iii) of paragraph (1)(A)(ii) is not required for an operator that is acting under a written agreement with an educational agency or institution (as defined in section 444 of the General Education Provisions Act (commonly known as the `Family Educational Rights and Privacy Act of 1974') (20 U.S.C. 1232g(a)(3)) that, at a minimum, requires the–

    (A) operator to–

    (i) limit its collection, use, and disclosure of the personal information from a child or teen to solely educational purposes and for no other commercial purposes;

    (ii) provide the educational agency or institution with a notice of the specific types of personal information the operator will collect from the child or teen, the method by which the operator will obtain the personal information, and the purposes for which the operator will collect, use, disclose, and retain the personal information;

    (iii) provide the educational agency or institution with a link to the operator's online notice of information practices as required under subsection (b)(1)(A)(i); and

    (iv) provide the educational agency or institution, upon request, with a means to review the personal information collected from a child or teen, to prevent further use or maintenance or future collection of personal information from a child or teen, and to delete personal information collected from a child or teen or content or information submitted by a child or teen to the operator's website, online service, online application, or mobile application;

    (B) representative of the educational agency or institution to acknowledge and agree that they have authority to authorize the collection, use, and disclosure of personal information from children or teens on behalf of the educational agency or institution, along with such authorization, their name, and title at the educational agency or institution; and

    (C) educational agency or institution to–

    (i) provide on its website a notice that identifies the operator with which it has entered into a written agreement under this subsection and provides a link to the operator's online notice of information practices as required under paragraph (1)(A)(i);

    (ii) provide the operator's notice regarding its information practices, as required under subparagraph (A)(ii), upon request, to a parent, in the case of a child, or a parent or teen, in the case of a teen; and

    (iii) upon the request of a parent, in the case of a child, or a parent or teen, in the case of a teen, request the operator provide a means to review the personal information from the child or teen and provide the parent, in the case of a child, or parent or teen, in the case of the teen, a means to review the personal information.

    (4) Termination of service.--The regulations shall permit the operator of a website, online service, online application, or mobile application to terminate service provided to a child whose parent has refused, under the regulations prescribed under paragraph (1)(B)(ii) and (1)(C)(ii), to permit the operator's further use or maintenance in retrievable form, or future online collection of, personal information from that child or teen requested to delete covered data of the child pursuant to section 105 of the American Privacy Rights Act of 2024.

    (5) Continuation of service.--The regulations shall prohibit an operator from discontinuing service provided to a child or teen on the basis of a request by the parent of the child or by the teen, under the regulations prescribed under subparagraph (B) or (C) of paragraph (1), respectively, to delete personal information collected from the child or teen, to the extent that the operator is capable of providing such service without such information.

    (6) Rule of construction.--A request made pursuant to subparagraph (B) or (C) of paragraph (1) to delete or correct personal information of a child or teen shall not be construed–

    (A) to limit the authority of a law enforcement agency to obtain any content or information from an operator pursuant to a lawfully executed warrant or an order of a court of competent jurisdiction;

    (B) to require an operator or third party delete or correct information that--

    (i) any other provision of Federal or State law requires the operator or third party to maintain; or

    (ii) was submitted to the website, online service, online application, or mobile application of the operator by any person other than the user who is attempting to erase or otherwise eliminate the content or information, including content or information submitted by the user that was republished or resubmitted by another person; or

    (C) to prohibit an operator from--

    (i) retaining a record of the deletion request and the minimum information necessary for the purposes of ensuring compliance with a request made pursuant to subparagraph (B) or (C);

    (ii) preventing, detecting, protecting against, or responding to security incidents, identity theft, or fraud, or reporting those responsible for such actions;

    (iii) protecting the integrity or security of a website, online service, online application or mobile application; or

    (iv) ensuring that the child's or teen's information remains deleted.

    (7 6) Common verifiable consent mechanism.--

    (A) In general.--

    (i) Feasibility of mechanism.--The Commission shall assess the feasibility, with notice and public comment, of allowing operators the option to use a common verifiable consent mechanism that fully meets the requirements of this title.

    (ii) Requirements.--The feasibility assessment described in clause (i) shall consider whether a single operator could use a common verifiable consent mechanism to obtain verifiable consent, as required under this title, from a parent of a child or from a teen on behalf of multiple, listed operators that provide a joint or related service.

    (B) Report.--Not later than 1 year after the date of enactment of this paragraph, the Commission shall submit a report to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Energy and Commerce of the House of Representatives with the findings of the assessment required by subparagraph (A).

    (C) Regulations.--If the Commission finds, in the assessment required by subparagraph (A), that the use of a common verifiable consent mechanism is feasible and would meet the requirements of this title, the Commission shall issue regulations, pursuant to section 553 of title 5, United States Code, to permit the use of a common verifiable consent mechanism in accordance with the findings outlined in such report the report submitted under subparagraph (B).

    (c) Enforcement

    Subject to sections 6503 and 6505 of this title, a violation of a regulation prescribed under subparagraph (B), (C), (D), or (E) of paragraph 2 of subsection (a)(1), or of a regulation prescribed under subsection (b), shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 57a(a)(1)(B) of this title.

    (d) Relationship to State Law.--The provisions of this title shall preempt any State law, rule, or regulation only to the extent that such State law, rule, or regulation conflicts with a provision of this title. Nothing in this title shall be construed to prohibit any State from enacting a law, rule, or regulation that provides greater protection to children or teens than the provisions of this title.

    §6503. Safe harbors

    (a) Guidelines

    An operator may satisfy the requirements of regulations issued under section 6502(b) of this title by following a set of self-regulatory guidelines, issued by representatives of the marketing or online industries, or by other persons, approved under subsection (b).

    (b) Incentives

    (1) Self-regulatory incentives

    In prescribing regulations under section 6502 of this title, the Commission shall provide incentives for self-regulation by operators to implement the protections afforded children and teens under the regulatory requirements described in subsection (b) of that section.

    (2) Deemed compliance

    Such incentives shall include provisions for ensuring that a person will be deemed to be in compliance with the requirements of the regulations under section 6502 of this title if that person complies with guidelines that, after notice and comment, are approved by the Commission upon making a determination that the guidelines meet the requirements of the regulations issued under section 6502 of this title.

    (3) Expedited response to requests

    The Commission shall act upon requests for safe harbor treatment within 180 days of the filing of the request, and shall set forth in writing its conclusions with regard to such requests.

    (c) Appeals

    Final action by the Commission on a request for approval of guidelines, or the failure to act within 180 days on a request for approval of guidelines, submitted under subsection (b) may be appealed to a district court of the United States of appropriate jurisdiction as provided for in section 706 of title 5.

    (d) Publication.--

    (1) In general.--Subject to the restrictions described in paragraph (2), the Commission shall publish on the internet website of the Commission any report or documentation required by regulation to be submitted to the Commission to carry out this section.

    (2) Restrictions on publication.--The restrictions described in section 6(f) and section 21 of the Federal Trade Commission Act (15 U.S.C. 46(f), 57b-2) applicable to the disclosure of information obtained by the Commission shall apply in same manner to the disclosure under this subsection of information obtained by the Commission from a report or documentation described in paragraph (1).

    §6504. Actions by States

    (a) In general

    (1) Civil actions

    In any case in which the attorney general of a State has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the engagement of any person in a practice that violates section 1303(a)(1) or any regulation of the Commission prescribed under section 6502(b) of this title, the State, as parens patriae, may bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction to—

    (A) enjoin that practice;

    (B) enforce compliance with section 1303(a)(1) or the regulation;

    (C) obtain damage, restitution, or other compensation on behalf of residents of the State; or

    (D) obtain such other relief as the court may consider to be appropriate.

    (2) Notice

    (A) In general

    Before filing an action under paragraph (1), the attorney general of the State involved shall provide to the Commission—

    (i) written notice of that action; and

    (ii) a copy of the complaint for that action.

    (B) Exemption

    (i) In general

    Subparagraph (A) shall not apply with respect to the filing of an action by an attorney general of a State under this subsection, if the attorney general determines that it is not feasible to provide the notice described in that subparagraph before the filing of the action.

    (ii) Notification

    In an action described in clause (i), the attorney general of a State shall provide notice and a copy of the complaint to the Commission at the same time as the attorney general files the action.

    (b) Intervention

    (1) In general

    On receiving notice under subsection (a)(2), the Commission shall have the right to intervene in the action that is the subject of the notice.

    (2) Effect of intervention

    If the Commission intervenes in an action under subsection (a), it shall have the right—

    (A) to be heard with respect to any matter that arises in that action; and

    (B) to file a petition for appeal.

    (3) Amicus curiae

    Upon application to the court, a person whose self-regulatory guidelines have been approved by the Commission and are relied upon as a defense by any defendant to a proceeding under this section may file amicus curiae in that proceeding.

    (c) Construction

    For purposes of bringing any civil action under subsection (a), nothing in this chapter shall be construed to prevent an attorney general of a State from exercising the powers conferred on the attorney general by the laws of that State to—

    (1) conduct investigations;

    (2) administer oaths or affirmations; or

    (3) compel the attendance of witnesses or the production of documentary and other evidence.

    (d) Actions by Commission

    In any case in which an action is instituted by or on behalf of the Commission for violation of section 1303(a)(1) or any regulation prescribed under section 6502 of this title, no State may, during the pendency of that action, institute an action under subsection (a) against any defendant named in the complaint in that action for violation of section 1303(a)(1) or that regulation.

    (e) Venue; service of process

    (1) Venue

    Any action brought under subsection (a) may be brought in the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28.

    (2) Service of process

    In an action brought under subsection (a), process may be served in any district in which the defendant—

    (A) is an inhabitant; or

    (B) may be found.

    §6505. Administration and applicability

    (a) In general

    Except as otherwise provided, this chapter shall be enforced by the Commission under the Federal Trade Commission Act (15 U.S.C. 41 et seq.).

    (b) Provisions

    Compliance with the requirements imposed under this chapter shall be enforced under—

    (1) section 8 of the Federal Deposit Insurance Act (12 U.S.C. 1818), by the appropriate Federal banking agency, with respect to any insured depository institution (as those terms are defined in section 3 of that Act (12 U.S.C. 1813));

    (2) the Federal Credit Union Act (12 U.S.C. 1751 et seq.) by the National Credit Union Administration Board with respect to any Federal credit union;

    (3) part A of subtitle VII of title 49 by the Secretary of Transportation with respect to any air carrier or foreign air carrier subject to that part;

    (4) the Packers and Stockyards Act, 1921 (7 U.S.C. 181 et. seq.) (except as provided in section 406 of that Act (7 U.S.C. 226, 227)), by the Secretary of Agriculture with respect to any activities subject to that Act; and

    (5) the Farm Credit Act of 1971 (12 U.S.C. 2001 et seq.) by the Farm Credit Administration with respect to any Federal land bank, Federal land bank association, Federal intermediate credit bank, or production credit association.

    (c) Exercise of certain powers

    For the purpose of the exercise by any agency referred to in subsection (a) of its powers under any Act referred to in that subsection, a violation of any requirement imposed under this chapter shall be deemed to be a violation of a requirement imposed under that Act. In addition to its powers under any provision of law specifically referred to in subsection (a), each of the agencies referred to in that subsection may exercise, for the purpose of enforcing compliance with any requirement imposed under this chapter, any other authority conferred on it by law.

    (d) Actions by Commission

    The Commission shall prevent any person from violating section 1303(a)(1) or a rule of the Commission under section 6502 of this title in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this chapter. Any entity that violates section 1303(a)(1) or a rule of the Commission under section 1303 shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act in the same manner, by the same means, and with the same jurisdiction, power, and duties as though all applicable terms and provisions of the Federal Trade Commission Act were incorporated into and made a part of this chapter.

    (e) Effect on other laws

    Nothing contained in this chapter shall be construed to limit the authority of the Commission under any other provisions of law.

    (f) Determination of Whether an Operator Has Knowledge Fairly Implied on the Basis of Objective Circumstances.--

    (1) Rule of construction.--For purposes of enforcing this title or a regulation promulgated under this title, in making a determination as to whether an operator has knowledge fairly implied on the basis of objective circumstances that a specific user is a child or teen, the Commission or State attorneys general shall rely on competent and reliable evidence, taking into account any guidance issued by the Commission the totality of the circumstances, including whether a reasonable and prudent person under the circumstances would have known that the user is a child or teen. Nothing in this title, including a determination described in the preceding sentence, shall be construed to require an operator to–

    (A) affirmatively collect any personal information with respect to the age of a child or teen that an operator is not already collecting in the normal course of business; or

    (B) implement an age gating or age verification functionality.

    (2) Commission guidance.--

    (A) In general.--Within 180 days of enactment, the Commission shall issue guidance to provide information, including best practices and examples for operators to understand the Commission's determination of whether an operator has knowledge fairly implied on the basis of objective circumstances that a user is a child or teen.

    (B) Limitation.--No guidance issued by the Commission with respect to this title under subparagraph (A) shall confers any rights on any person, State, or locality, nor shall operate to bind the Commission or any person to the approach recommended in such guidance. In any enforcement action brought pursuant to this title, the Commission or State attorney general, as applicable, shall allege a specific violation of a provision of this title. The Commission or State attorney general, as applicable, may not base an enforcement action on, or execute a consent order based on, practices that are alleged to be inconsistent with any such guidance, unless the practices allegedly violate this title. For purposes of enforcing this title or a regulation promulgated under this title, State attorneys general shall take into account any guidance issued by the Commission under subparagraph (A).

    (g) Additional Requirement.--Any regulations issued under this title shall include a description and analysis of the impact of proposed and final Rules on small entities per the Regulatory Flexibility Act of 1980 (5 U.S.C. 601 et seq.) chapter 6 of title 5, United States Code.

    §6506. Review

    Not later than 5 years after the effective date of the regulations initially issued under section 6502 of this title, the Commission shall—

    (1) review the implementation of this chapter, including the effect of the implementation of this chapter on practices relating to the collection and disclosure of information relating to children, children's ability to obtain access to information of their choice online, and on the availability of websites directed to children; and

    (2) prepare and submit to Congress a report on the results of the review under paragraph (1).

    SEC. 202 STUDY AND REPORTS OF MOBILE AND ONLINE APPLICATION
    OVERSIGHT AND ENFORCEMENT.

    (a) Oversight Report.--Not later than 3 years after the date of enactment of this title, the Federal Trade Commission shall submit to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Energy and Commerce of the House of Representatives a report on the processes of platforms that offer mobile and online applications for ensuring that, of those applications that are websites, online services, online applications, or mobile applications directed to children, the applications operate in accordance with--

    (1) this title Act, the amendments made by this title Act, and rules promulgated under this title Act; and

    (2) rules promulgated by the Commission under section 18 of the Federal Trade Commission Act (15 U.S.C. 57a) relating to unfair or deceptive acts or practices in marketing.

    (b) Enforcement Report.--Not later than 1 year after the date of enactment of this Act, and each year annually thereafter, the Federal Trade Commission shall submit to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Energy and Commerce of the House of Representatives a report that addresses, at a minimum--

    (1) the number of actions brought by the Commission during the reporting year to enforce the Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6501) (referred to in this subsection as the "Act'') and the outcome of each such action;

    (2) the total number of investigations or inquiries into potential violations of the such Act; during the reporting year;

    (3) the total number of open investigations or inquiries into potential violations of the such Act as of the time the report is submitted;

    (4) the number and nature of complaints received by the Commission relating to an allegation of a violation of the such Act during the reporting year; and

    (5) policy or legislative recommendations to strengthen online protections for children and teens.

    (c) REPORT BY THE INSPECTOR GENERAL.—

    (1) IN GENERAL.—Not later than 2 years after the date of the enactment of this Act, the Inspector General of the Federal Trade Commission shall submit to the Federal Trade Commission and to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Energy and Commerce of the House of Representatives a report regarding the safe harbor provisions in section 1304 of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6503), which shall include—

    (A) an analysis of whether the safe harbor provisions are—

    (i) operating fairly and effectively; and

    (ii) effectively protecting the interests of children; and

    (B) any proposal or recommendation for policy changes that would improve the effectiveness of the safe harbor provisions.

    (2) PUBLICATION.—Not later than 10 days after the date on which a report is submitted under paragraph (1), the Commission shall publish the report on the website of the Commission.

    SEC. 203. GAO STUDY.

    (a) Study.--The Comptroller General of the United States (in this section referred to as the "Comptroller General'') shall conduct a study on the privacy of teens who use financial technology products. Such study shall--

    (1) identify the type of financial technology products that teens are using;

    (2) identify the potential risks to teens' privacy from using such financial technology products; and

    (3) determine whether existing laws are sufficient to address such risks to teens' privacy.

    (b) Report.--Not later than 1 year after the date of enactment of this section, the Comptroller General shall submit to Congress a report containing the results of the study conducted under subsection (a), together with recommendations for such legislation and administrative action as the Comptroller General determines appropriate.

    SEC. 204. SEVERABILITY.

    If any provision of this title, or an amendment made by this title, is determined to be unenforceable or invalid, the remaining provisions of this title and the amendments made by this title shall not be affected.

    TITLE III—ELIMINATING USELESS REPORTS

    SEC. 301. SUNSETS FOR AGENCY REPORTS.

    (a) IN GENERAL.—Section 1125 of title 31, United States Code, is amended—

    (1) by redesignating subsection (c) as subsection (d);

    (2) by striking subsections (a) and (b) and inserting the following:

    ‘‘(a) DEFINITIONS.—In this section:

    ‘‘(1) BUDGET JUSTIFICATION MATERIALS.—The term ‘budget justification materials’ has the meaning given the term in section 3(b)(2) of the Federal Funding Accountability and Transparency Act of 2006 (31 U.S.C. 6101 note; Public Law 109–282).

    ‘‘(2) PLAN OR REPORT.—The term ‘plan or report’ means any plan or report submitted to Congress, any committee of Congress, or subcommittee thereof, by not less than 1 agency—

    ‘‘(A) in accordance with Federal law; or

    ‘‘(B) at the direction or request of a congressional report.-

    ‘‘(3) RECURRING PLAN OR REPORT.—The term ‘recurring plan or report’ means a plan or report submitted on a recurring basis.

    ‘‘(4) RELEVANT CONGRESSIONAL COMMITTEE.—The term ‘relevant congressional committee’—

    ‘‘(A) means a congressional committee to which a recurring plan or report is required to be submitted; and

    ‘‘(B) does not include any plan or report that is required to be submitted solely to the Committee on Armed Services of the House of Representatives or the Senate.

    ‘‘(b) AGENCY IDENTIFICATION OF UNNECESSARY REPORTS.—

    ‘‘(1) IN GENERAL.—The head of each agency shall include in the budget justification materials of the agency the following:

    ‘‘(A) Subject to paragraphs (2) and (3), the following:

    ‘‘(i) A list of each recurring plan or report submitted by the agency.

    ‘‘(ii) An identification of whether the recurring plan or report listed in clause (i) was included in the most recent report issued by the Clerk of the House of Representatives concerning the reports that any agency is required by law or directed or requested by a committee report to make to Congress, any committee of Congress, or subcommittee thereof.

    ‘‘(iii) If applicable, the unique alphanumeric identifier for the recurring plan or report as required by section 7243(b)(1)(C)(vii) of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023 (Public Law 117–263).

    ‘‘(iv) The identification of any recurring plan or report the head of the agency determines to be outdated or duplicative.

    ‘‘(B) With respect to each recurring plan or report identified in subparagraph (A)(iv), the following:

    ‘‘(i) A recommendation on whether to sunset, modify, consolidate, or reduce the frequency of the submission of the recurring plan or report.

    ‘‘(ii) A citation to each provision of law or directive or request in a congressional report that requires or requests the submission of the recurring plan or report.

    ‘‘(iii) A list of the relevant congressional committees for the recurring plan or report.

    ‘‘(C) A justification explaining, with respect to each recommendation described in subparagraph (B)(i) relating to a recurring plan or report—

    ‘‘(i) why the head of the agency made the recommendation, which may include an estimate of the resources expended by the agency to prepare and submit the recurring plan or report; and

    ‘‘(ii) the understanding of the head of the agency of the purpose of the recurring plan or report.

    ‘‘(2) AGENCY CONSULTATION.—

    ‘‘(A) IN GENERAL.—In preparing the list required under paragraph (1)(A), if, in submitting a recurring plan or report, an agency is required to coordinate or consult with another agency or entity, the head of the agency submitting the recurring plan or report shall consult with the head of each agency or entity with whom consultation or coordination is required.

    ‘‘(B) INCLUSION IN LIST.—If, after a consultation under subparagraph (A), the head of each agency or entity consulted under that subparagraph agrees that a recurring plan or report is outdated or duplicative, the head of the agency required to submit the recurring plan or report shall—

    ‘‘(i) include the recurring plan or report in the list described in paragraph (1)(A); and

    ‘‘(ii) identify each agency or entity with which the head of the agency is required to coordinate or consult in submitting the recurring plan or report.

    ‘‘(C) DISAGREEMENT.—If the head of any agency or entity consulted under subparagraph (A) does not agree that a recurring plan or report is outdated or duplicative, the head of the agency required to submit the recurring plan or report shall not include the recurring plan or report in the list described in paragraph (1)(A).

    ‘‘(3) GOVERNMENT-WIDE OR MULTI-AGENCY PLAN AND REPORT SUBMISSIONS.—With respect to a recurring plan or report required to be submitted by not less than 2 agencies, the Director of the Office of Management and Budget shall—

    ‘‘(A) determine whether the requirement to submit the recurring plan or report is outdated or duplicative; and

    ‘‘(B) make recommendations to Congress accordingly.

    ‘‘(4) PLAN AND REPORT SUBMISSIONS CONFORMITY TO THE ACCESS TO CONGRESSIONALLY MANDATED REPORTS ACT.—With respect to an agency recommendation, citation, or justification made under subparagraph (B) or (C) of paragraph (1) or a recommendation by the Director of the Office of Management and Budget under paragraph (3), the agency or Director, as applicable, shall also provide this information to the Director of the Government Publishing Office in conformity with the agency submission requirements under section 7244(a) of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023 (Public Law 117–263; chapter 41 of title 44 note) in conformity with guidance issued by the Director of the Office of Management and Budget under section 7244(b) of such Act.

    ‘‘(c) RULE OF CONSTRUCTION ON AGENCY REQUIREMENTS.—Nothing in this section shall be construed to exempt the head of an agency from a requirement to submit a recurring plan or report.’’; and

    (3) in subsection (d), as so redesignated, by striking ‘‘in the budget of the United States Government, as provided by section 1105(a)(37)’’ and inserting ‘‘in the budget justification materials of each agency’’.

    (b) BUDGET CONTENTS.—Section 1105(a) of title 31, United States Code, is amended by striking paragraph (39).

    (c) CONFORMITY TO THE ACCESS TO CONGRESSIONALLY MANDATED REPORTS ACT.—

    (1) AMENDMENT.—Subsections (a) and (b) of section 7244 of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023 (Public Law 117–263; chapter 41 of title 44, United States Code, note), are amended to read as follows:

    ‘‘(a) SUBMISSION OF ELECTRONIC COPIES OF REPORTS.—Not earlier than 30 days or later than 60 days after the date on which a congressionally mandated report is submitted to either House of Congress or to any committee of Congress or subcommittee thereof, the head of the Federal agency submitting the congressionally mandated report shall submit to the Director the information required under subparagraphs (A) through (D) of section 7243(b)(1) with respect to the congressionally mandated report. Notwithstanding section 7246, nothing in this subtitle shall relieve a Federal agency of any other requirement to publish the congressionally mandated report on the online portal of the Federal agency or otherwise submit the congressionally mandated report to Congress or specific committees of Congress, or subcommittees thereof.

    ‘‘(b) GUIDANCE.—Not later than 180 days after the date of the enactment of this subsection and periodically thereafter as appropriate, the Director of the Office of Management and Budget, in consultation with the Director, shall issue guidance to agencies on the implementation of this subtitle as well as the requirements of section 1125(b) of title 31, United States Code.’’.

    (2) UPDATED OMB GUIDANCE.—Not later than180 days after the date of the enactment of this Act, the Director of the Office of Management and Budget shall issue updated guidance to agencies to ensure that the requirements under subsections (a) and (b) of section 1125 of title 31, United States Code, as amended by this Act, for agency submissions of recommendations and justifications for plans and reports to sunset, modify, consolidate, or reduce the frequency of the submission of are also submitted as a separate attachment in conformity with the agency submission requirements of electronic copies of reports submitted by agencies under section 7244(a) of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023 (Public Law 117–263; chapter 41 of title 44, United States Code, note) for publication on the online portal established under section 7243 of such Act.