UNOFFICIAL COPPA 2.0 Statutory Text

• 6501. Definitions

In this chapter:

(1) Child

The term “child” means an individual under the age of 13.

(2) Operator

The term “operator”—

• means any person—
• who, for commercial purposes, in interstate or foreign commerce operates or provides a website on the internet, an online service, an online application, or a mobile application; and
• who—
• collects or maintains, either directly or through a service provider, personal information from or about the users of that website, service, or application;
• allows another person to collect personal information directly from users of that website, service, or application (in which case, the operator is deemed to have collected the information); or
• allows users of that website, service, or application to publicly disclose personal information (in which case, the operator is deemed to have collected the information); and

(B)  does not include any nonprofit entity that would otherwise be exempt from coverage under section 5 of the Federal Trade Commission Act (15 U.S.C. 45).

(3) Commission

The term “Commission” means the Federal Trade Commission.

(4) Disclosure

The term “disclosure” means, with respect to personal information—

• the release of personal information collected from a child or teen for any purpose, except where the personal information is provided to a person other than the operator who—
• provides support for the internal operations of the website, online service, online application, or mobile application of the operator, excluding any activity relating to individual-specific advertising to children or teens; and
• does not disclose or use that personal information for any other purpose; and
• making personal information collected from a child or teen by a website, online service, online application, or mobile application directed to children or with actual knowledge that such information was collected from a child or teen, publicly available in identifiable form, by any means including by a public posting, through the Internet, or through—
• a home page of a website;
• a pen pal service;
• an electronic mail service;
• a message board; or
• a chat room.

(5) Federal agency

The term “Federal agency” means an agency, as that term is defined in section 551(1) of title 5.

(6) Internet

The term “Internet” means collectively the myriad of computer and telecommunications facilities, including equipment and operating software, which comprise the interconnected world-wide network of networks that employ the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocols to such protocol, to communicate information of all kinds by wire or radio.

(7) Parent

The term “parent” includes a legal guardian.

(8) Personal information

(A) PERSONAL INFORMATION. —

• IN GENERAL. —The term “personal information” means individually identifiable information about an individual collected online, including—
• a first and last name;
• a home or other physical address including street name and name of a city or town;
• an e-mail address;
• a telephone number;
• a Social Security number;
• any other identifier that the Commission determines permits the physical or online contacting of a specific individual;
• geolocation information
• information generated from the measurement or technological processing of an individual’s biological, physical, or physiological characteristics that is used to identify an individual, including—
• fingerprints;
• voice prints;
• iris or retina imagery scans;
• facial templates;
• deoxyribonucleic (DNA) information; or
• gait;
• information linked or reasonably linkable to a child or teen; or
• information linked or reasonably linkable to a child or teen or the parents of that child or teen (including any unique identifier) that an operator collects online from the child or teen and combines with an identifier described in this paragraph.

(B)  EXCLUSION. —The term “personal information” shall not include an audio file that contains a child’s or teen’s voice so long as the operator—

(i)        does not request information via voice that would otherwise be considered personal information under this paragraph;

(ii)       provides clear notice of its collection and use of the audio file and its deletion policy in its privacy policy;

• only uses the voice within the audio file solely as a replacement for written words, to perform a task, or engage with a website, online service, online application, or mobile application, such as to perform a search or fulfill a verbal instruction or request; and
• only maintains the audio file long enough to complete the stated purpose and then immediately deletes the audio file and does not make any other use of the audio file prior to deletion.

(9) Verifiable consent

The term “verifiable consent” means any reasonable effort (taking into consideration available technology), including a request for authorization for future collection, use, and disclosure described in the notice, to ensure that, in the case of a child, a parent of the child, or, in the case of a teen, the teen—

• receives specific notice of the personal information collection, use, and disclosure practices of the operator; and
• before the personal information of the child or teen is collected, freely and unambiguously authorizes—
• the collection, use, and disclosure, as applicable, of personal information and
• any subsequent use of that personal information.

(10) Website, online service, online application, or mobile application directed to children

(A) In general

The term “website, online service, online application, or mobile application directed to children” means—

(i) a commercial website, online service, online application, or mobile application that is targeted to children; or

(ii) that portion of a commercial website, online service, online application, or mobile application that is targeted to children.

(B) Limitation

A commercial website, online service, online application, or mobile application, or a portion of a commercial website, online service, online application, or mobile application, shall not be deemed directed to children solely for referring or linking to a commercial website, online service, online application, or mobile application directed to children by using information location tools, including a directory, index, reference, pointer, or hypertext link.

• Rule of Construction.

In considering whether a website, online service, online application, or mobile application is directed to children, the Commission shall, using competent and reliable empirical evidence, apply a totality of circumstances test to consider the intended audience of the website, online service, online application, or mobile application, as a whole.

(11) Person

The term “person” means any individual, partnership, corporation, trust, estate, cooperative, association, or other entity.

(12) Online contact information

The term “online contact information” means an e-mail address or another substantially similar identifier that permits direct contact with a person online.

 

(13) Connected Device.

The term “connected device” means a device that is capable of connecting to the internet, directly or indirectly, or to another connected device.

 

(14) Online Application.

The term “online application”—

(A) means an internet-connected software program; and

(B) includes a service or application offered via a connected device.

 

(15) Mobile Application.

The term “mobile application”—

• means a software program that runs on the operating system of
• a cellular telephone;
• a tablet computer; or
• a similar portable computing device that transmits data over a wireless connection; and
• includes a service or application offered via a connected device.

 

(16) Geolocation information.

The term “geolocation information” means information sufficient to identify a street name and name of a city or town.

 

(17) Teen.

The term “teen” means an individual over the age of 12 and under the age of 17.

 

(18) Individual-specific advertising to children or teens.

(A) In general

The term “individual-specific advertising to children or teens” means advertising or any other effort to market a product or service that is directed to a specific child or teen or a device that is linked or reasonably linkable to a child or teen

• based on—
• the personal information of

(aa)  the child or teen; or

(bb) a group of children or teens who are similar in sex, age,

income level, race, or ethnicity to the specific child or teen to whom the product or service is marketed;

• psychological profiling of a child or teen or group of children or teens; or
• a unique identifier of the device; or
• as a result of use by the child or teen, access by any device of the child or teen, or use by a group of children or teens who are similar to the specific child or teen, of more than a single
• website;
• online service;
• online application;
• mobile application; or
• connected device.

(B) Exclusions

The term “individual specific advertising to children or teens” shall not include

• advertising or marketing to an individual or the device of an individual in response to the individual’s specific request for information or feedback, such as a child’s or teen’s current search query;
•      contextual advertising, such as when an advertisement is displayed based on the content of the website, online service, online application, mobile application, or connected device in which the advertisement appears and does not vary based on personal information related to the viewer; or
• processing personal information solely for measuring or reporting advertising or content performance, reach, or frequency, including independent measurement.
• Rule of Construction

Nothing in subparagraph (A) shall be construed to prohibit an operator with actual knowledge or knowledge fairly implied on the basis of objective circumstances that an individual is under the age of 17 from delivering advertising or marketing that is age-appropriate and intended for a child or teen audience, so long as the operator does not use any personal information other than whether the user is under the age of 17.

(a) Acts prohibited

(1) In general

It is unlawful for an operator of a website, online service, online application, or mobile application directed to children, or for any operator of a website, online service, online application, or mobile application with actual knowledge or knowledge fairly implied on the basis of objective circumstances—

(A)  to collect personal information from a child in a manner that violates the regulations prescribed under subsection (b);

(B)    to collect, use, disclose to third parties, or compile personal information of a child or teen for purposes of individual-specific advertising to children or teens (or to allow another person to collect, use, disclose, or compile such information for such purpose);

(C)    to collect the personal information of a child or teen except ·when the collection of the personal information is—

(i)        consistent with the context of a particular or service or the relationship of the child or teen with the operator, including collection necessary to fulfill a transaction or provide a product or service requested by the child or teen; or

(ii)       required or specifically authorized by Federal or State law; or

(D)   to retain the personal information of a child or teen for longer than is reasonably necessary to fulfill a transaction or provide a service requested by the child or teen except as required or specifically authorized by Federal or State law.

(2) Disclosure to parent protected

Notwithstanding paragraph (1)(A), neither an operator nor the operator’s agent shall be held to be liable under any Federal or State law for any disclosure made in good faith and following reasonable procedures in responding to a request for disclosure of personal information under subsection (b)(1)(B)(iii) to the parent of a child or under subsection (b)(1)(C)(iii) to a teen.

(b) Regulations

(1) In general

Not later than 1 year after October 21, 1998, the Commission shall promulgate under section 553 of title 5 regulations that—

(A)  require the operator of a website, online service, online application, or mobile application directed to children or that has actual knowledge or knowledge fairly implied on the basis of objective circumstances that it is collecting personal information from children or teens—

(i)       to provide clear and conspicuous notice of what information is collected from children or teens by the operator, how the operator uses such information, the operator’s disclosure practices for such information, the rights and opportunities available to the parent of the child or teen under subparagraphs (B) and (C), and the procedures or mechanisms the operator uses to ensure that personal information is not collected from children or teens except in accordance with the regulations promulgated under this paragraph;

(ii)       to obtain verifiable consent for the collection, use, or disclosure of personal information from children or teens; and

(iii)      to obtain verifiable consent from a parent of a child or a teen before using or disclosing personal information of the child or teen for any purpose that is a material change from the original purposes and disclosure practices specified to the parent of the child or the teen under clause (i);

(B)  require the operator to provide, upon request of a parent under this subparagraph whose child has provided personal information to that operator, upon proper identification of that parent, to such parent—

(i)        a description of the specific types of personal information collected from the child by that operator and the method by which the operator obtained the personal information, and the purposes for which the operator collects, uses, discloses, and retains the personal in information;

(ii)     the opportunity at any time to delete personal information collected from the child or content or information submitted by the child to a website, online service, online application, or mobile application and to refuse to permit the operator’s further use or maintenance in retrievable form, or future online collection, of personal information from that child;

(iii)     the opportunity to challenge the accuracy of the personal information and, if the parent of the child establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected;

(iv)     notwithstanding any other provision of law, a means that is reasonable under the circumstances for the parent to obtain any personal information collected from that child if such information is available to the operator at the time the parent makes the request;

(C)    require the operator to provide, upon the request of a teen under this subparagraph who has provided personal information to the operator, upon proper identification of that teen—

• a description of the specific types of personal information collected from the teen by the operator, the method by which the operator obtained the personal information, and the purposes for which the operator collects, uses, discloses, and retains the personal information;
• the opportunity at any time to delete personal information collected from the teen or content or information submitted by the teen to a website, online service, online application, or mobile application and to refuse further use or collection of personal information from the teen;
• the opportunity to challenge the accuracy of the personal information and if the parent of the child establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected; and
• a means that is reasonable under the circumstances for the teen to obtain any personal information collected from the teen, if such information is available to the operator at the time the teen makes the request;
• prohibit conditioning a child’s participation in a game, the offering of a prize, or another activity on the child disclosing more personal information than is reasonably necessary to participate in such activity; and

(E)    require the operator to establish, implement, and maintain reasonable security practices to protect the confidentiality, integrity, and accessibility of personal information of children or teens collected by the operator, and to protect such personal information against unauthorized access.

(2) When consent not required

The regulations shall provide that verifiable consent under paragraph (1)(A)(ii) is not required in the case of—

(A)  online contact information collected from a child or teen that is used only to respond directly on a one-time basis to a specific request from the child or teen and is not used to recontact the child or teen or to contact another child or teen and is not maintained in retrievable form by the operator;

(B)  a request for the name or online contact information of a parent or teen that is used for the sole purpose of obtaining verifiable  consent or providing notice under this section and where such information is not maintained in retrievable form by the operator if verifiable consent is not obtained after a reasonable time;

(C)  online contact information collected from a child or teen that is used only to respond more than once directly to a specific request from the child or teen and is not used to recontact the child or teen beyond the scope of that request—

(i)       if, before any additional response after the initial response to the child or teen, the operator uses reasonable efforts to provide a parent or teen, as applicable, notice of the online contact information collected from the child or teen, the purposes for which it is to be used, and an opportunity for the parent or teen, as applicable, to request that the operator make no further use of the information and that it not be maintained in retrievable form; or

(ii)      without notice to the parent in such circumstances as the Commission may determine are appropriate, taking into consideration the benefits to the child or teen of access to information and services, and risks to the security and privacy of the child or teen, in regulations promulgated under this subsection;

(D)   the name of the child or teen and online contact information (to the extent reasonably necessary to protect the safety of a child or teen participant on the site)—

(i)       used only for the purpose of protecting such safety;

(ii)      not used to recontact the child or teen or for any other purpose; and

(iii)     not disclosed on the site,

if the operator uses reasonable efforts to provide a parent or teen, as applicable, notice of the name and online contact information collected from the child or teen, the purposes for which it is to be used, and an opportunity for the parent or teen, as applicable, to request that the operator make no further use of the information and that it not be maintained in retrievable form; or

(E)    the collection, use, or dissemination of such information by the operator of such a website or online service necessary—

(i)       to protect the security or integrity of its website;

(ii)      to take precautions against liability;

(iii)     to respond to judicial process; or

(iv)     to the extent permitted under other provisions of law, to provide information to law enforcement agencies or for an investigation on a matter related to public safety.

(3) Termination of service

The regulations shall permit the operator of a website or an online service to terminate service provided to a child whose parent has refused, under the regulations prescribed under paragraph (1)(B)(ii), to permit the operator’s further use or maintenance in retrievable form, or future online collection, of personal information from that child.

(4) Continuation of Service

The regulations shall prohibit an  operator from discontinuing service provided to a child or teen on the basis of a request by the parent of the child or by the teen, under the regulations prescribed under subparagraph (B) or (C) or paragraph (1), respectively, to delete personal information collected from the child or teen, to the extent that the operator is capable of providing such service without such information.

(5) Rule of Construction

A request made pursuant to subparagraph (B) or (C) of paragraph (1) to delete personal information of a child or teen shall not be construed—

• to limit the authority of a law enforcement agency to obtain any content or information from an operator pursuant to a lawfully executed warrant or an order of a court of competent jurisdiction;
• to require an operator or third party delete information that—
  • any other provision of Federal or State law requires the operator or third party to maintain; or
  • was submitted to the website, online service, online application, or mobile application of the operator by any person other than the user who is attempting to erase or otherwise eliminate the content or information, including content or information submitted by the user that was republished or resubmitted by another person.

(c) Enforcement

Subject to sections 6503 and 6505 of this title, a violation of subparagraph (B), (C), or (D) of subsection (a)(1), or a of a regulation prescribed under subparagraph (A) of such subsection shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 57a(a)(1)(B) of this title.

(d) Inconsistent State law

No State or local government may impose any liability for commercial activities or actions by operators in interstate or foreign commerce in connection with an activity or action described in this chapter that is inconsistent with the treatment of those activities or actions under this section.

(a) Guidelines

An operator may satisfy the requirements of regulations issued under section 6502(b) of this title by following a set of self-regulatory guidelines, issued by representatives of the marketing or online industries, or by other persons, approved under subsection (b).

(b) Incentives

(1) Self-regulatory incentives

In prescribing regulations under section 6502 of this title, the Commission shall provide incentives for self-regulation by operators to implement the protections afforded children and teens under the regulatory requirements described in subsection (b) of that section.

(2) Deemed compliance

Such incentives shall include provisions for ensuring that a person will be deemed to be in compliance with the requirements of the regulations under section 6502 of this title if that person complies with guidelines that, after notice and comment, are approved by the Commission upon making a determination that the guidelines meet the requirements of the regulations issued under section 6502 of this title.

(3) Expedited response to requests

The Commission shall act upon requests for safe harbor treatment within 180 days of the filing of the request, and shall set forth in writing its conclusions with regard to such requests.

(c) Appeals

Final action by the Commission on a request for approval of guidelines, or the failure to act within 180 days on a request for approval of guidelines, submitted under subsection (b) may be appealed to a district court of the United States of appropriate jurisdiction as provided for in section 706 of title 5.

(d) Publication

(1) In general

The Commission shall publish on the internet website of the Commission any report or documentation required by regulation to be submitted to the Commission to carry out this section.

(2) Restrictions on publication

The restrictions described in subsection (f) of section 6 of the Federal Trade Commission Act (15 U.S.C. 46(f)) applicable to the publication of information obtained by the Commission through investigations conducted under such section shall apply in same manner to the publication under this subsection of information obtained by the Commission from a report or documentation described in paragraph (1).

(a) In general

(1) Civil actions

In any case in which the attorney general of a State has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the engagement of any person in a practice that violates any regulation of the Commission prescribed under section 6502(b) of this title, the State, as parens patriae, may bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction to—

(A) enjoin that practice;

(B) enforce compliance with the regulation;

(C) obtain damage, restitution, or other compensation on behalf of residents of the State; or

(D) obtain such other relief as the court may consider to be appropriate.

(2) Notice

(A) In general

Before filing an action under paragraph (1), the attorney general of the State involved shall provide to the Commission—

(i) written notice of that action; and

(ii) a copy of the complaint for that action.

(B) Exemption

(i) In general

Subparagraph (A) shall not apply with respect to the filing of an action by an attorney general of a State under this subsection, if the attorney general determines that it is not feasible to provide the notice described in that subparagraph before the filing of the action.

(ii) Notification

In an action described in clause (i), the attorney general of a State shall provide notice and a copy of the complaint to the Commission at the same time as the attorney general files the action.

(b) Intervention

(1) In general

On receiving notice under subsection (a)(2), the Commission shall have the right to intervene in the action that is the subject of the notice.

(2) Effect of intervention

If the Commission intervenes in an action under subsection (a), it shall have the right—

(A) to be heard with respect to any matter that arises in that action; and

(B) to file a petition for appeal.

(3) Amicus curiae

Upon application to the court, a person whose self-regulatory guidelines have been approved by the Commission and are relied upon as a defense by any defendant to a proceeding under this section may file amicus curiae in that proceeding.

(c) Construction

For purposes of bringing any civil action under subsection (a), nothing in this chapter shall be construed to prevent an attorney general of a State from exercising the powers conferred on the attorney general by the laws of that State to—

(1) conduct investigations;

(2) administer oaths or affirmations; or

(3) compel the attendance of witnesses or the production of documentary and other evidence.

(d) Actions by Commission

In any case in which an action is instituted by or on behalf of the Commission for violation of any regulation prescribed under section 6502 of this title, no State may, during the pendency of that action, institute an action under subsection (a) against any defendant named in the complaint in that action for violation of that regulation.

(e) Venue; service of process

(1) Venue

Any action brought under subsection (a) may be brought in the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28.

(2) Service of process

In an action brought under subsection (a), process may be served in any district in which the defendant—

(A) is an inhabitant; or

(B) may be found.

(a) In general

Except as otherwise provided, this chapter shall be enforced by the Commission under the Federal Trade Commission Act (15 U.S.C. 41 et seq.).

(b) Provisions

Compliance with the requirements imposed under this chapter shall be enforced under—

(1) section 8 of the Federal Deposit Insurance Act (12 U.S.C. 1818), by the appropriate Federal banking agency, with respect to any insured depository institution (as those terms are defined in section 3 of that Act (12 U.S.C. 1813));

(2) the Federal Credit Union Act (12 U.S.C. 1751 et seq.) by the National Credit Union Administration Board with respect to any Federal credit union;

(3) part A of subtitle VII of title 49 by the Secretary of Transportation with respect to any air carrier or foreign air carrier subject to that part;

(4) the Packers and Stockyards Act, 1921 (7 U.S.C. 181 et. seq.) (except as provided in section 406 of that Act (7 U.S.C. 226, 227)), by the Secretary of Agriculture with respect to any activities subject to that Act; and

(5) the Farm Credit Act of 1971 (12 U.S.C. 2001 et seq.) by the Farm Credit Administration with respect to any Federal land bank, Federal land bank association, Federal intermediate credit bank, or production credit association.

(c) Exercise of certain powers

For the purpose of the exercise by any agency referred to in subsection (a)[1] of its powers under any Act referred to in that subsection, a violation of any requirement imposed under this chapter shall be deemed to be a violation of a requirement imposed under that Act. In addition to its powers under any provision of law specifically referred to in subsection (a),[2]² each of the agencies referred to in that subsection may exercise, for the purpose of enforcing compliance with any requirement imposed under this chapter, any other authority conferred on it by law.

(d) Actions by Commission

The Commission shall prevent any person from violating a rule of the Commission under section 6502 of this title in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this chapter. Any entity that violates such rule shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act in the same manner, by the same means, and with the same jurisdiction, power, and duties as though all applicable terms and provisions of the Federal Trade Commission Act were incorporated into and made a part of this chapter.

(e) Effect on other laws

Nothing contained in this chapter shall be construed to limit the authority of the Commission under any other provisions of law.

(f) Determination of whether an operator has knowledge fairly implied on the basis of objective circumstances

 (1) Rule of construction

For purposes of enforcing this Act or a regulation promulgated under this Act, in making a determination as to whether an operator has knowledge fairly implied on the basis of objective circumstances that a user is a child or teen, the Commission shall rely on competent and reliable empirical evidence, taking into account the totality of the circumstances, including consideration of whether the operator, using available technology, exercised reasonable care.

(2) Protections for privacy

Nothing in the Commission’s determination under paragraph (1) shall be construed to require an operator to—

• affirmatively collect any personal information with respect to the age of a child or teen that an operator is not already collecting in the normal course of business; or
• implement an age gating or age verification functionality.

(3) Commission guidance

(A) In general

Within 180 days of enactment, the Commission shall issue guidance to provide information, including best practices and examples for operators to understand the Commission’s determination of whether an operator has knowledge fairly implied on the basis of objective circumstances.

(B) Limitation

No guidance issued by the Commission with respect to this Act shall confer any rights on any person, State, or locality, nor shall operate to bind the Commission or any person to the approach recommended in such guidance. In any enforcement action brought pursuant to this Act, the Commission shall allege a specific violation of a provision of this Act. The Commission may not base an enforcement action on, or execute a consent order based on, practices that are alleged to be inconsistent with any such guidance, unless the practices allegedly violate this Act.

(g) Additional requirement

Any regulations issued under this Act shall include a description and analysis of the impact of proposed and final Rules on small entities per the Regulatory Flexibility Act of 1980 (5 U.S.C. 601 et seq.).

[1]           So in original. Probably should be subsection “(b)”.

[2]           So in original. Probably should be subsection “(b)”.

Not later than 5 years after the effective date of the regulations initially issued under section 6502 of this title, the Commission shall—

(1) review the implementation of this chapter, including the effect of the implementation of this chapter on practices relating to the collection and disclosure of information relating to children, children’s ability to obtain access to information of their choice online, and on the availability of websites directed to children; and

(2) prepare and submit to Congress a report on the results of the review under paragraph (1).

• Oversight report

Not later than 3 years after the date of enactment of this Act, the Federal Trade Commission shall submit to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Energy and Commerce of the House of Representatives a report on the processes of platforms that offer mobile and online applications for ensuring that, of those applications that are websites, online services, online applications, or mobile applications directed to children, the applications operate in accordance with—

(1)  this Act, the amendments made by this Act, and rules promulgated under this Act; and

(2)  rules promulgated by the Commission under section 5 of the Federal Trade Commission Act (15 U.S.C. 45) relating to unfair or deceptive acts or18 practices in marketing.

• Enforcement report

Not later than 1 year after the date of enactment of this Act, and each year thereafter, the Federal Trade Commission shall submit to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Energy and Commerce of the House of Representatives a report that addresses, at a minimum—

(1) the number of actions brought by the Commission during the reporting year to enforce the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501) (referred to in this subsection as the “Act” ) and the outcome of each such action;

(2) the total number of investigations or inquiries into potential violations of the Act; during the reporting year;

(3) the total number of open investigations or inquiries into potential violations of the Act as of the time the report is submitted;

(4) the number and nature of complaints received by the Commission relating to an allegation of a violation of the Act during the reporting year; and

(5) policy or legislative recommendations to strengthen online protections for children and teens.

(a) Study

The Comptroller General of the United States (in this section referred to as the “Comptroller General”) shall conduct a study on the privacy of teens who use financial technology products. Such study shall—

(1) identify the type of financial technology products that teens are using;

(2) identify the potential risks to teens’ privacy from using such financial technology products; and

(3) determine whether existing laws are sufficient to address such risks to teens’ privacy.

(b) Report

Not later than 1 year after the date of enactment of this section, the Comptroller General shall submit to Congress a report containing the results of the 8 study conducted under subsection (a), together with recommendations for such legislation