Children and Teens’ Online Privacy Protection Act
- Bill Number
- H.R. 6291
- Origin Chamber
- House
- Congress
- 119th Congress, Session 1
- Policy Area
- Commerce
- Status
- Introduced
- Latest Action
- 2025-12-11: Forwarded by Subcommittee to Full Committee by the Yeas and Nays: 14 - 10.
- Last Updated
- 2025-12-13T09:07:06Z
AI-Generated Summary
Purpose
The Children and Teens' Online Privacy Protection Act (H.R. 6291) aims to update and strengthen the Children's Online Privacy Protection Act of 1998 (COPPA) by expanding privacy safeguards for the online collection, use, disclosure, and deletion of personal information from children (under 13) and teens (ages 13-16). It seeks to protect minors from targeted advertising, unauthorized data practices, and risks like data breaches, while promoting parental and teen control over personal data.
Key Provisions
- Expanded Definitions:
- "Operator" includes any commercial website, online service, app, or mobile app that collects, maintains, or allows public disclosure of personal information from children or teens (excludes tax-exempt nonprofits).
- "Personal information" now broadly covers names, addresses, emails, phone numbers, persistent identifiers (e.g., cookies, IP addresses, device IDs), photos/videos/audio of minors, geolocation data, biometric data (e.g., fingerprints, facial scans, DNA), and any data linkable to a minor.
- "Teen" defined as ages 13-16; "high-impact social media company" as large platforms (e.g., over $3 billion revenue, 300 million monthly users) focused on user-generated content.
- "Knowledge" of a user's age varies: actual knowledge for most operators, but broader (including willful disregard) for high-impact companies.
- "Individual-specific advertising" banned if based on personal data or profiling of children/teens (excludes contextual ads or age-appropriate general ads).
- Prohibitions and Requirements:
- Operators cannot collect personal information from children/teens without verifiable consent from a parent (for children) or teen (for teens), except for essential transaction-related uses or legal requirements.
- Bans use of minors' data for targeted (behavioral) advertising; limits retention to what's necessary for services.
- Requires clear, conspicuous notices about data practices, rights to access/delete/correct data, and mechanisms to prevent unauthorized access.
- Teens (or parents) can request data deletion, correction, or refusal of further collection; operators must provide reasonable security and delete data upon request (with exceptions for legal retention or security needs).
- Data storage, transfer, or access in "covered nations" (e.g., certain foreign countries posing security risks, as defined in U.S. law) requires notice to parents/teens.
- Special rules for educational partnerships: Consent may not be needed if operators limit data use to education, provide notices, and allow review/deletion via schools.
- Operators cannot terminate services solely for data deletion requests if service can continue without the data.
- FTC to study and potentially allow a "common verifiable consent mechanism" for joint services.
- Enforcement and Oversight:
- States can enforce violations alongside FTC.
- FTC must issue reports on enforcement actions, investigations, complaints, and high-impact companies' compliance (within 1-3 years of enactment).
- Safe harbors for self-regulatory programs; all FTC reports on operators must be publicly published (with confidentiality protections).
- Regulations must analyze impacts on small businesses.
- Preemption and Severability:
- Federal law preempts conflicting state/local rules.
- If any part is invalidated, the rest remains effective.
Significant Changes to Existing Law
- Extends COPPA's scope from only children under 13 to include teens up to 16, with direct rights for teens to consent, access, and delete their data (previously, only parental consent for under-13s).
- Broadens "personal information" to include biometrics, geolocation, and linkable data; adds exclusions for certain voice data used temporarily (e.g., in voice assistants) with notice and deletion.
- Introduces outright ban on targeted advertising to minors using their data, unlike prior rules allowing it with consent.
- Shifts from "actual knowledge" of age to broader "knowledge" for large platforms; requires totality-of-circumstances test for determining if a site targets children.
- Adds data minimization (collect only what's necessary), deletion rights, and restrictions on foreign data handling; permits educational exemptions without parental consent under strict conditions.
- Mandates FTC feasibility study for streamlined consent across operators and annual enforcement reporting (not in original COPPA).
Potential Impacts
- On Citizens: Enhances privacy for children and teens by limiting data collection and advertising, giving families tools to review/delete data, and reducing risks of profiling or foreign data exposure; may improve online safety but could limit personalized services.
- On Government Agencies: Increases FTC workload for rulemaking, enforcement, investigations, and reporting; empowers states to sue violators, potentially leading to more coordinated oversight.
- On Businesses/Operators: Imposes stricter compliance costs (e.g., consent mechanisms, security, notices) especially for social media giants; bans targeted ads could reduce revenue from minor users, but allows contextual ads; small businesses get regulatory impact analysis.
- On International Relations: Restricts data flows to "covered nations" (e.g., adversaries like China, per U.S. defense law), potentially straining ties with those countries and affecting global tech operations; promotes U.S. standards for child privacy that could influence international norms.
Main Stakeholders Affected
- Children and Teens: Direct beneficiaries with expanded privacy rights and protections from exploitative data practices.
- Parents: Gain stronger notification, consent, and control over children's data; can request reviews/deletions on teens' behalf.
- Online Operators and Tech Companies: Especially high-impact social media (e.g., Meta, TikTok) face new bans, consent rules, and penalties; smaller apps must adapt collection practices.
- Educational Agencies/Institutions: Can partner with operators for ed-tech without parental consent if conditions met, but must provide public notices and handle parent requests.
- Federal Trade Commission (FTC): Primary enforcer, responsible for rules, reports, and oversight; states as co-enforcers.
- Nonprofits and Small Businesses: Exempt or analyzed for impacts, reducing burden compared to commercial entities.
Notable Legal, Constitutional, or Political Implications
- Legal: Strengthens federal privacy framework by preempting state laws, potentially reducing patchwork regulation but limiting state innovation; clarifies verifiable consent (reasonable efforts using tech) and adds severability to preserve the law if challenged. Increases civil penalties for violations, enabling more FTC/state actions.
- Constitutional: Balances First Amendment (free speech in ads/content) by allowing age-appropriate advertising while banning data-driven targeting; supports parental rights under privacy doctrines without mandating speech restrictions. May face challenges on vagueness (e.g., "knowledge" standards) or overreach in foreign data rules.
- Political: Bipartisan bill (introduced by Reps. Walberg and Lee) reflects growing consensus on child online safety amid concerns over social media harms; could set precedent for broader youth privacy laws, influencing debates on tech regulation without partisan divides.
This summary was generated by AI and may contain inaccuracies. Refer to the official source document for the authoritative text.
Sponsor
Cosponsors (1)
Recent Actions
- 2025-12-11: Forwarded by Subcommittee to Full Committee by the Yeas and Nays: 14 - 10.
- 2025-12-11: Subcommittee Consideration and Mark-up Session Held
- 2025-11-25: Referred to the Subcommittee on Commerce, Manufacturing, and Trade.
- 2025-11-25: Referred to the House Committee on Energy and Commerce.
- 2025-11-25: Introduced in House
- 2025-11-25: Introduced in House
Bill Versions
- Children and Teens’ Online Privacy Protection Act — issued 2025-11-25 — PDF (39 pages)