Senate Approves Bill for Children’s Online Safety and Privacy

On July 30, 2024, the U.S. Senate passed the Kids Online Safety and Privacy Act (the “Bill”) by a vote of 91-3. The Bill, which combines the Kids Online Safety Act (“KOSA”) and the Children and Teens’ Online Privacy Protection Act (“CTOPPA”), seeks to expand online safety and privacy protections to individuals under the age of 17 (“minors”).

Children’s Internet Safety Act

KOSA is an online safety for minors law that would create an affirmative “duty of care” for “any online platform, online video game, messaging application, or video streaming service that connects to the Internet and is used, or is reasonably likely to be used, by a minor” under the age of 17 (“covered platform”). The duty of care implies an obligation to take reasonable steps to mitigate certain harms to minors, including (1) certain mental disorders; (2) physical violence, online bullying, and harassment; (3) sexual exploitation and abuse; and (4) financial harm.

Among other obligations, KOSA would also require a covered platform to provide tools for minors and their parents to configure privacy and security protections, provide parents with tools to manage minors’ use of the platform, and provide a reporting channel to alert the platform to harms to minors. Additionally, a covered platform would be subject to disclosure requirements, including a requirement to notify a known minor of the platform’s policies and practices regarding safeguards for minors, and be required to obtain verifiable parental consent before any person known to the platform to be under 13 first uses the platform. A covered platform with more than 10 million active monthly users would be required to issue an annual public report describing “reasonably foreseeable risks of harm to minors” and assessing the mitigating measures in place to prevent those risks, based on an independent and reasonably conducted third-party audit of the platform.

Children’s and Teenagers’ Online Privacy Act

CTOPPA seeks to modernize the Children’s Online Privacy Protection Act (“COPPA”) by extending COPPA’s online privacy protections for children under 13 to “teens” between the ages of 13 and 16. Under CTOPPA, covered operators of online services must obtain verifiable consent from teens before collecting their personal information, similar to COPPA’s requirement to obtain verifiable parental consent before collecting personal information from children under 13. Similarly, under CTOPPA, teens would have the rights to (1) obtain a description of specific types of personal information collected from them; (2) have a reasonable means of obtaining personal information collected from them; and (3) object to the further use or collection of personal information from them by covered operators, which are rights COPPA provides to parents with respect to personal information collected from their children.

CTOPPA would also create new rights that teens and parents (on behalf of their children) can exercise, namely the right to delete minors’ personal information and to update minors’ personal information that is inaccurate. CTOPPA further proposes (1) an outright ban on “individual-specific advertising” to minors; (2) data minimization requirements to collect and retain personal information only as necessary to complete a transaction or provide a product or service, or as required or specifically authorized by applicable law; and (3) a prohibition on storing or transferring teens’ or children’s personal information outside the U.S. without direct notice to teens or parents, respectively.

The bill, currently before the U.S. House of Representatives, shows growing momentum for federal legislation on online privacy and child safety. President Biden also released a statement shortly after the Senate vote encouraging the House to send the bill to his desk for signature without delay. Whether the House will pass the measure remains unclear, as several industry groups, civil liberties advocates, and other stakeholders have expressed concerns about the bill’s likely far-reaching impact and potential First Amendment concerns. The House has already adjourned for its annual recess in August, and consideration of the bill will not occur until after the session resumes in September.

(View source.)