Congressman Castor Reintroduces Kids PRIVACY Act

Rep. Kathy Castor (D-FL) reintroduced the Protecting the Information of our Vulnerable Adolescents, Children, and Youth Act, or the Kids (PRIVACY) Act, which would update the Children’s Online Privacy Protection Act with safeguards to keep children and teenagers safe online and hold Big Tech companies who surveil and target children accountable. The bill includes strong provisions to build on COPPA's strengths and expand privacy protections for children and teenagers as well as directives to operators to make the best interests of children and teenagers a primary design consideration. The legislation performs the following:

• Banning Companies from Providing Targeted Advertisements to Children and Teenagers: Prohibits companies from targeting children and teenagers based on their personal information and behavior.
• Best Interests of Children and Teenagers: Requires an operator to make the best interests of children and teenagers a primary design consideration when designing its service.
• Requiring Opt-In Consent for all Individuals Under 18: Companies must obtain specific, informed, and unambiguous opt-in consent before collecting, retaining, selling, sharing, or using a young consumer or child’s personal information.
• Creating a Right to Access, Correct, and Delete Personal Information: Companies must provide individuals the opportunity to access, correct, or delete their personal information at any time.
• Protecting Additional Types of Information: Expands the type of information explicitly covered to include physical characteristics, biometric information, health information, education information, contents of messages and calls, browsing and search history, geolocation information, and latent audio or visual recordings.
• Requiring User-Friendly Privacy Policies: Companies must make publicly available privacy policies that are clear, easily understood, and written in plain and concise language.
• Creating a Protected Class of “Teenagers” Ages 13-17: The bill provides protection for teenagers 13-17, allowing them to control who collects their personal information and what companies can do with it.
• Expands Coverage of Companies: This applies to all sites likely to be accessed by children and teens, not just child-directed services.
• Limiting Disclosure to Third Parties: The bill prohibits companies from sharing personal information without consent.
• Requiring Reasonable Data Security Policies, Practices, and Procedures: Requires companies to have a written security policy, point of contact for information security management and processes to identify, assess, and mitigate vulnerabilities.
• Prohibiting Industry Self-Regulation: Repeals dangerous safe harbor provisions that allow for lax enforcement and rubberstamping of potentially unlawful practices.
• Strengthening FTC Enforcement: Raises the maximum allowable civil penalty per violation by 50 percent and allows the FTC to pursue punitive damages. Also establishes a Youth Privacy and Marketing Division at the FTC.
• Providing for Parental Enforcement: Parents will be able to bring civil actions to help enforce the bill and any resulting regulations
• Banning Forced Arbitration: In a much-needed reversal of current law, companies will no longer be able force their consumers to waive their right to sue.