The Children and Teens’ Online Privacy Protection Act updates online data privacy rules for children and teens, including restrictions on data collection, targeted advertising, and data retention, while also requiring increased transparency and parental/teen control over personal information.
Edward "Ed" Markey
Senator
MA
The Children and Teens’ Online Privacy Protection Act amends the Children's Online Privacy Protection Act of 1998 to modernize regulations around online data collection, use, and deletion for children and teens. It expands the definition of personal information, requires verifiable consent for data collection and usage, and prohibits individual-specific advertising to children and teens. The Act also mandates FTC reports on mobile app oversight and enforcement, a GAO study on teens' privacy using financial technology, and includes a severability clause.
The Children and Teens' Online Privacy Protection Act is basically a big update to COPPA (the Children's Online Privacy Protection Act), which was getting pretty outdated. This bill aims to give kids and teens – and their parents – way more control over their personal info online.
This bill expands what counts as "personal information." We're not just talking name and address anymore. It now includes stuff like:
This means companies can't just scoop up all this data from kids and teens (ages 13-16) without clear permission. Section 2 of the bill lays this out, updating the definitions to include a wider range of data types that are now common in the digital world.
One of the biggest changes is about how companies get permission to collect and use data. The bill demands "verifiable consent." For kids under 13, that means getting a parent's okay. For teens, it means they have to give explicit permission themselves. This isn't just a checkbox; companies need to make a real effort to explain what they're collecting and why (Section 2).
For example, imagine a teen signing up for a new social media app. Under this bill, the app can't just bury data collection terms in a long legal document. They need to clearly explain what info they're taking, how they'll use it, and who they might share it with. The teen (or their parent, if they're younger) has to actively agree before the app can start collecting their data.
The bill also gives parents and teens the right to see what data a company has collected, ask for it to be deleted, and correct any mistakes (Section 2). This is a big deal for privacy – you're not just stuck with whatever a company decides to keep on you.
Think about a student using an educational app for school. If the app is collecting more data than it needs, or if the data is inaccurate, the student or their parent can request a change. This helps prevent long-term issues that could arise from incorrect or excessive data collection.
The bill puts limits on how long companies can keep data and where they can store it. They can't just hold onto your info forever, and they can't transfer it outside the U.S. without telling you (Section 2). Plus, the Federal Trade Commission (FTC) is tasked with keeping a close eye on things, especially how mobile apps are complying (Section 3). The FTC will issue regular reports on enforcement actions and complaints, so there's some accountability built in.
This bill has the potential to change how kids and teens experience the internet. It means less targeted advertising based on their personal data, more control over their digital footprint, and stronger protections against data breaches. It also recognizes the unique privacy challenges faced by teens using financial technology, prompting a study by the Government Accountability Office (GAO) to look into those issues specifically (Section 4). It's not a perfect solution, and there are potential loopholes, but it's a significant step toward making the online world safer and more private for young people.