Children and Teens' Online Privacy

Summary#

This bill updates the Children's Online Privacy Protection Act (COPPA). It adds protections for "teens" (defined as age 13 through 16), expands the kinds of online services covered (including online and mobile applications and connected devices), and broadens the list of "personal information" to include persistent identifiers, photos, geolocation, and biometric data. The bill generally bars collection, use, disclosure, or retention of children’s or teens’ personal information for "individual-specific advertising" and limits transfers or storage of such data outside the United States unless notice is given.

Operators must give clear, conspicuous notices about what information they collect, how they use it, and how long they retain it. The bill requires verifiable consent from a parent for a child or from a teen before personal information is collected or reused for new purposes. Teens are given direct rights to receive descriptions of data collected about them, to delete that data, and to correct inaccuracies. Operators must maintain reasonable security practices.

The bill allows written agreements between operators and educational agencies for educational-only data uses, with conditions to limit collection and permit review or deletion. It directs the Federal Trade Commission (FTC) to assess feasibility of a common verifiable consent mechanism, to report annually on enforcement activity, and to report within 3 years on platform oversight of apps directed to children. The Comptroller General must study teens’ use of financial technology products and report within 1 year.

The bill also clarifies state preemption: a State law is preempted only to the extent it conflicts with this title, and States may enact stronger protections.

What it means for you#

• If you are a parent of a child under 13: the bill keeps and updates parental notice and verifiable consent requirements and extends some protections to educational settings with specific written agreements. You continue to have rights to review, delete, or correct your child's personal information where allowed by the rules in the bill.
• If you are a teen (age 13–16): you can receive clear notice about data collection, give verifiable consent for use of your personal information, request descriptions of what was collected, delete data you provided, and ask for corrections.
• If you operate a website, online service, online app, or mobile app: the bill broadens who is an "operator," expands covered data types, limits use of data for individual-specific advertising to children and teens, requires security measures, sets limits on retention and cross-border transfers, and may require new notices and procedures. Educational contracts with schools can change consent requirements if they meet conditions.

Expenses#

No publicly available information on costs, budgetary effects, or estimated expenses is included in the bill text or provided metadata.

Proponents' View#

No publicly available information about proponents' stated views or legislative findings is included in the bill text or provided metadata.

Opponents' View#

No publicly available information about opponents' stated views or objections is included in the bill text or provided metadata.