Section 1 Short title
This Act may be cited as the “Do Not Track Kids Act of 2013”.
Do Not Track Kids Act of 2013
A BILL
To amend the Children’s Online Privacy Protection Act of 1998 to extend, enhance, and revise the provisions relating to collection, use, and disclosure of personal information of children, to establish certain other protections for personal information of children and minors, and for other purposes.
Sec. 2 Findings
Congress finds the following:
Since the enactment of the Children’s Online Privacy Protection Act of 1998, the World Wide Web has changed dramatically, with the creation of tens of millions of websites, the proliferation of entirely new media platforms, and the emergence of a diverse ecosystem of services, devices, and applications that enable users to connect wirelessly within an online environment without being tethered to a desktop computer.
The explosive growth of the Internet ecosystem has unleashed a wide array of opportunities to learn, communicate, participate in civic life, access entertainment, and engage in commerce.
In addition to these significant benefits, the Internet also presents challenges, particularly with respect to the efforts of entities to track the online activities of children and minors and to collect, use, and disclose personal information about them, including their geolocation, for commercial purposes.
Children and teens are visiting numerous companies’ websites, and marketers are using multimedia games, online quizzes, and mobile phone and tablet applications to create ties to children and teens.
According to a study by the Wall Street Journal in 2010, websites directed to children and teens were more likely to use cookies and other tracking tools than sites directed to a general audience.
This study examined 50 popular websites for children and teens in the United States and found that these 50 sites placed 4,123 cookies, beacons, and other tracking tools on the test computer used for the study.
This is 30 percent greater than the number of such tracking tools that were placed on the test computer in a similar study of the 50 overall most popular websites in the United States, which are generally directed to adults.
Children and teens lack the cognitive ability to distinguish advertising from program content and to understand that the purpose of advertising is to persuade them, making them unable to activate the defenses on which adults rely.
Children and teens are less able than adults to understand the potential long-term consequences of having their information available to third parties, including advertisers, and other individuals.
According to Common Sense Media and the Center for Digital Democracy, 90 percent of teens have used some form of social media, 75 percent have a social networking site, and 51 percent check their social networking site at least once a day.
Ninety-one percent of parents and 91 percent of adults believe it is not okay for advertisers to collect information about a child’s location from that child’s mobile phone.
Ninety-four percent of parents and 91 percent of adults agree that advertisers should receive the parent’s permission before putting tracking software on a child’s computer.
Ninety-six percent of parents and 94 percent of adults expressed disapproval when asked if it is “okay for a website to ask children for personal information about their friends”.
Eighty-eight percent of parents would support a law that requires search engines and social networking sites to get users’ permission before using their personal information.
A Commonsense Media/Zogby poll found that 94 percent of parents and 94 percent of adults believe individuals should have the ability to request the deletion, after a specific period of time, of all of their personal information held by an online search engine, social networking site, or marketing company.
According to a Pew/Berkman Center poll, 69 percent of parents of teens who engage in online activity are concerned about how that activity might affect their children’s future academic or employment opportunities.
Eighty-one percent of parents of teens who engage in online activity say they are concerned about how much information advertisers can learn about their children’s online activity.
Sec. 3 Online collection, use, and disclosure of personal information of children
Definitions— Section 1302 of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501) is amended—
by amending paragraph (2) to read as follows:
“(2) Operator—The term operator—
“(A) means any person who, for commercial purposes, in interstate or foreign commerce, operates or provides a website on the Internet, online service, online application, or mobile application, and who—
“(i) collects or maintains, either directly or through a service provider, personal information from or about the users of such website, service, or application;
“(ii) allows another person to collect personal information directly from users of such website, service, or application (in which case the operator is deemed to have collected the information); or
“(iii) allows users of such website, service, or application to publicly disclose personal information (in which case the operator is deemed to have collected the information); and
“(B) does not include any nonprofit entity that would otherwise be exempt from coverage under section 5 of the Federal Trade Commission Act (15 U.S.C. 45).”
in paragraph (4)—
by amending subparagraph (A) to read as follows:
“(A) the release of personal information for any purpose, except where such information is provided to a person other than an operator who provides support for the internal operations of the website, online service, online application, or mobile application of the operator and does not disclose or use that information for any other purpose; and”
in subparagraph (B), by striking “website or online service” and inserting “website, online service, online application, or mobile application”;
in paragraph (8)—
by amending subparagraph (G) to read as follows:
“(G) information concerning a child or the parents of that child (including any unique or substantially unique identifier, such as a customer number) that an operator collects online from the child and combines with an identifier described in subparagraphs (A) through (G).”
by redesignating subparagraphs (F) and (G) as subparagraphs (G) and (H), respectively; and
by inserting after subparagraph (E) the following new subparagraph:
“(F) information (including an Internet protocol address) that permits the identification of an individual, the computer of an individual, or any other device used by an individual to access the Internet or an online service, online application, or mobile application;”
by striking paragraph (10) and redesignating paragraphs (11) and (12) as paragraphs (10) and (11), respectively; and
by adding at the end the following new paragraph:
“(12) Online, online service, online application, mobile application, directed to children—The terms online, online service, online application, mobile application, and directed to children shall have the meanings given such terms by the Commission by regulation. Not later than 1 year after the date of the enactment of the Do Not Track Kids Act of 2013, the Commission shall promulgate, under section 553 of title 5, United States Code, regulations that define such terms broadly enough so that they are not limited to current technology, consistent with the principles articulated by the Commission regarding the definition of the term Internet in its statement of basis and purpose on the final rule under this title promulgated on November 3, 1999 (64 Fed. Reg. 59891). The definition of the term online service in such regulations shall include broadband Internet access service (as defined in the Report and Order of the Federal Communications Commission relating to the matter of preserving the open Internet and broadband industry practices (FCC 10–201, adopted by the Commission on December 21, 2010)).”
Online collection, use, and disclosure of personal information of children— Section 1303 of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6502) is amended—
by striking the heading and inserting the following: “Online collection, use, and disclosure of personal information of children.”;
in subsection (a)—
by amending paragraph (1) to read as follows:
“(1) In general—It is unlawful for an operator of a website, online service, online application, or mobile application directed to children, or an operator having actual knowledge that personal information being collected is from a child, to collect personal information from a child in a manner that violates the regulations prescribed under subsection (b).”
in paragraph (2)—
by striking “of such a website or online service”; and
by striking “subsection (b)(1)(B)(iii)” and inserting “subsection (b)(1)(C)(iii)”; and
in subsection (b)—
by amending paragraph (1) to read as follows:
“(1) In general—Not later than 1 year after the date of the enactment of the Do Not Track Kids Act of 2013, the Commission shall promulgate, under section 553 of title 5, United States Code, regulations to require an operator of a website, online service, online application, or mobile application directed to children, or an operator having actual knowledge that personal information being collected is from a child—
“(A) to provide clear and conspicuous notice in clear and plain language of the types of personal information the operator collects, how the operator uses such information, whether the operator discloses such information, and the procedures or mechanisms the operator uses to ensure that personal information is not collected from children except in accordance with the regulations promulgated under this paragraph;
“(B) to obtain verifiable parental consent for the collection, use, or disclosure of personal information of a child;
“(C) to provide to a parent whose child has provided personal information to the operator, upon request by and proper identification of the parent—
“(i) a description of the specific types of personal information collected from the child by the operator;
“(ii) the opportunity at any time to refuse to permit the further use or maintenance in retrievable form, or future collection, by the operator of personal information collected from the child; and
“(iii) a means that is reasonable under the circumstances for the parent to obtain any personal information collected from the child, if such information is available to the operator at the time the parent makes the request;
“(D) not to condition participation in a game, or use of a website, service, or application, by a child on the provision by the child of more personal information than is reasonably required to participate in the game or use the website, service, or application; and
“(E) to establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children.”
in paragraph (2)—
in the matter preceding subparagraph (A), by striking “paragraph (1)(A)(ii)” and inserting “paragraph (1)(B)”; and
in subparagraph (A), by inserting “or to contact a different child” after “to recontact the child”;
by amending paragraph (3) to read as follows:
“(3) Continuation of service—The regulations shall prohibit an operator from discontinuing service provided to a child on the basis of refusal by the parent of the child, under the regulations prescribed under paragraph (1)(C)(ii), to permit the further use or maintenance in retrievable form, or future collection, by the operator of personal information collected from the child, to the extent that the operator is capable of providing such service without such information.”
by adding at the end the following:
“(4) Rule for treatment of users of websites, services, and applications directed to children—An operator of a website, online service, online application, or mobile application that is directed to children shall treat all users of such website, service, or application as children for purposes of this title, except as permitted by the Commission by a regulation promulgated under this title.”
Administration and applicability of Act— Section 1306 of the Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6505) is amended—
in subsection (b)—
in paragraph (1), by striking “, in the case of” and all that follows and inserting the following: “by the appropriate Federal banking agency with respect to any insured depository institution (as such terms are defined in section 3 of such Act (12 U.S.C. 1813));”; and
by striking paragraph (2) and redesignating paragraphs (3) through (6) as paragraphs (2) through (5), respectively; and
by adding at the end the following new subsection:
“(f) Telecommunications carriers and cable operators
“(1) Enforcement by FTC—Notwithstanding section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)), compliance with the requirements imposed under this title shall be enforced by the Commission with respect to any telecommunications carrier (as defined in section 3 of the Communications Act of 1934 (47 U.S.C. 153)).
“(2) Relationship to other law—To the extent that sections 222, 338(i), and 631 of the Communications Act of 1934 (47 U.S.C. 222; 338(i); 551) are inconsistent with this title, this title controls.”
Sec. 4 Targeted marketing to children or minors
Acts prohibited— It is unlawful for—
an operator of a website, online service, online application, or mobile application directed to children, or an operator having actual knowledge that personal information being collected is from a child, to use, disclose to third parties, or compile personal information for targeted marketing purposes without verifiable parental consent; or
an operator of a website, online service, online application, or mobile application directed to minors, or an operator having actual knowledge that personal information being collected is from a minor, to use, disclose to third parties, or compile personal information for targeted marketing purposes without the consent of the minor.
Regulations— Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate, under section 553 of title 5, United States Code, regulations to implement this section.
Sec. 5 Digital Marketing Bill of Rights for Teens and Fair Information Practices Principles
Acts prohibited— It is unlawful for an operator of a website, online service, online application, or mobile application directed to minors, or an operator having actual knowledge that personal information being collected is from a minor, to collect personal information from a minor unless such operator has adopted and complies with a Digital Marketing Bill of Rights for Teens that is consistent with the Fair Information Practices Principles described in subsection (b).
Fair Information Practices Principles— The Fair Information Practices Principles described in this subsection are the following:
Collection limitation principle— Except as provided in paragraph (3), personal information should be collected from a minor only when collection of the personal information is—
consistent with the context of a particular transaction or service or the relationship of the minor with the operator, including collection necessary to fulfill a transaction or provide a service requested by the minor; or
required or specifically authorized by law.
Data quality principle— The personal information of a minor should be accurate, complete, and kept up-to-date to the extent necessary to fulfill the purposes described in subparagraphs (A) through (D) of paragraph (3).
Purpose specification principle— The purposes for which personal information is collected should be specified to the minor not later than at the time of the collection of the information. The subsequent use or disclosure of the information should be limited to—
fulfillment of the transaction or service requested by the minor;
support for the internal operations of the website, service, or application, as described in section 312.2 of title 16, Code of Federal Regulations;
compliance with legal process or other purposes expressly authorized under specific legal authority; or
other purposes—
that are specified in a notice to the minor; and
to which the minor has consented under paragraph (7) before the information is used or disclosed for such other purposes.
Retention limitation principle— The personal information of a minor should not be retained for longer than is necessary to fulfill a transaction or provide a service requested by the minor or such other purposes specified in subparagraphs (A) through (D) of paragraph (3). The operator should implement a reasonable and appropriate data disposal policy based on the nature and sensitivity of such personal information.
Security safeguards principle— The personal information of a minor should be protected by reasonable and appropriate security safeguards against risks such as loss or unauthorized access, destruction, use, modification, or disclosure.
Openness principle—
In general— The operator should maintain a general policy of openness about developments, practices, and policies with respect to the personal information of a minor. The operator should provide each minor using the website, online service, online application, or mobile application of the operator with a clear and prominent means—
to identify and contact the operator, by, at a minimum, disclosing, clearly and prominently, the identity of the operator and—
in the case of an operator who is an individual, the address of the principal residence of the operator and an email address and telephone number for the operator; or
in the case of any other operator, the address of the principal place of business of the operator and an email address and telephone number for the operator;
to determine whether the operator possesses any personal information of the minor, the nature of any such information, and the purposes for which the information was collected and is being retained;
to obtain any personal information of the minor that is in the possession of the operator from the operator, or from a person specified by the operator, within a reasonable time after making a request, at a charge (if any) that is not excessive, in a reasonable manner, and in a form that is readily intelligible to the minor;
to challenge the accuracy of personal information of the minor that is in the possession of the operator; and
if the minor establishes the inaccuracy of personal information in a challenge under clause (iv), to have such information erased, corrected, completed, or otherwise amended.
Limitation— Nothing in this paragraph shall be construed to permit an operator to erase or otherwise modify personal information requested by a law enforcement agency pursuant to legal authority.
Individual participation principle— The operator should—
obtain consent from a minor before using or disclosing the personal information of the minor for any purpose other than the purposes described in subparagraphs (A) through (C) of paragraph (3); and
obtain affirmative express consent from a minor before using or disclosing previously collected personal information of the minor for purposes that constitute a material change in practice from the original purposes specified to the minor under paragraph (3).
Regulations— Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate, under section 553 of title 5, United States Code, regulations to implement this section, including regulations further defining the Fair Information Practices Principles described in subsection (b).
Sec. 6 Online collection of geolocation information of children and minors
Acts prohibited—
In general— It is unlawful for an operator of a website, online service, online application, or mobile application directed to children or minors, or an operator having actual knowledge that geolocation information being collected is from a child or minor, to collect geolocation information from a child or minor in a manner that violates the regulations prescribed under subsection (b).
Disclosure to parent or minor protected— Notwithstanding paragraph (1), neither an operator nor the operator’s agent shall be held to be liable under any Federal or State law for any disclosure made in good faith and following reasonable procedures in responding to a request for disclosure of geolocation information under subparagraph (C)(ii)(III) or (D)(ii)(III) of subsection (b)(1).
Regulations—
In general— Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate, under section 553 of title 5, United States Code, regulations that require an operator of a website, online service, online application, or mobile application directed to children or minors, or an operator having actual knowledge that geolocation information being collected is from a child or minor—
to provide clear and conspicuous notice in clear and plain language of any geolocation information the operator collects, how the operator uses such information, and whether the operator discloses such information;
to establish procedures or mechanisms to ensure that geolocation information is not collected from children or minors except in accordance with regulations promulgated under this paragraph;
in the case of collection of geolocation information from a child—
prior to collecting such information, to obtain verifiable parental consent; and
after collecting such information, to provide to the parent of the child, upon request by and proper identification of the parent—
a description of the geolocation information collected from the child by the operator;
the opportunity at any time to refuse to permit the further use or maintenance in retrievable form, or future collection, by the operator of geolocation information from the child; and
a means that is reasonable under the circumstances for the parent to obtain any geolocation information collected from the child, if such information is available to the operator at the time the parent makes the request; and
in the case of collection of geolocation information from a minor—
prior to collecting such information, to obtain affirmative express consent from such minor; and
after collecting such information, to provide to the minor, upon request—
a description of the geolocation information collected from the minor by the operator;
the opportunity at any time to refuse to permit the further use or maintenance in retrievable form, or future collection, by the operator of geolocation information from the minor; and
a means that is reasonable under the circumstances for the minor to obtain any geolocation information collected from the minor, if such information is available to the operator at the time the minor makes the request.
When consent not required— The regulations promulgated under paragraph (1) shall provide that verifiable parental consent under subparagraph (C)(i) of such paragraph or affirmative express consent under subparagraph (D)(i) of such paragraph is not required when the collection of the geolocation information of a child or minor is necessary, to the extent permitted under other provisions of law, to provide information to law enforcement agencies or for an investigation on a matter related to public safety.
Continuation of service— The regulations promulgated under paragraph (1) shall prohibit an operator from discontinuing service provided to—
a child on the basis of refusal by the parent of the child, under subparagraph (C)(ii)(II) of such paragraph, to permit the further use or maintenance in retrievable form, or future online collection, of geolocation information from the child by the operator, to the extent that the operator is capable of providing such service without such information; or
a minor on the basis of refusal by the minor, under subparagraph (D)(ii)(II) of such paragraph, to permit the further use or maintenance in retrievable form, or future online collection, of geolocation information from the minor by the operator, to the extent that the operator is capable of providing such service without such information.
Inconsistent State law— No State or local government may impose any liability for commercial activities or actions by operators in interstate or foreign commerce in connection with an activity or action described in this section that is inconsistent with the treatment of those activities or actions under this section.
Sec. 7 Removal of content
Acts prohibited— It is unlawful for an operator of a website, online service, online application, or mobile application to make publicly available through the website, service, or application content or information that contains or displays personal information of children or minors in a manner that violates the regulations prescribed under subsection (b).
Regulations—
In general— Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate, under section 553 of title 5, United States Code, regulations that require an operator—
to the extent technologically feasible, to implement mechanisms that permit a user of the website, service, or application of the operator to erase or otherwise eliminate content or information submitted to the website, service, or application by such user that is publicly available through the website, service, or application and contains or displays personal information of children or minors; and
to take appropriate steps to make users aware of such mechanisms and to provide notice to users that such mechanisms do not necessarily provide comprehensive removal of the content or information submitted by such users.
Exception— The regulations promulgated under paragraph (1) may not require an operator or third party to erase or otherwise eliminate content or information that—
any other provision of Federal or State law requires the operator or third party to maintain; or
was submitted to the website, service, or application of the operator by any person other than the user who is attempting to erase or otherwise eliminate such content or information, including content or information submitted by such user that was republished or resubmitted by another person.
Limitation— Nothing in this section shall be construed to limit the authority of a law enforcement agency to obtain any content or information from an operator as authorized by law or pursuant to an order of a court of competent jurisdiction.
Sec. 8 Enforcement and applicability
Enforcement by the Commission—
In general— Except as otherwise provided, this Act and the regulations prescribed under this Act shall be enforced by the Commission under the Federal Trade Commission Act (15 U.S.C. 41 et seq.).
Unfair or deceptive acts or practices— Subject to subsection (b), a violation of this Act or a regulation prescribed under this Act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
Actions by the Commission— Subject to subsection (b), and except as provided in subsection (d)(1), the Commission shall prevent any person from violating this Act or a regulation prescribed under this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act, and any person who violates this Act or such regulation shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act.
Enforcement by certain other agencies— Notwithstanding subsection (a), compliance with the requirements imposed under this Act shall be enforced as follows:
Under section 8 of the Federal Deposit Insurance Act (12 U.S.C. 1818) by the appropriate Federal banking agency, with respect to an insured depository institution (as such terms are defined in section 3 of such Act (12 U.S.C. 1813)).
Under the Federal Credit Union Act (12 U.S.C. 1751 et seq.) by the National Credit Union Administration Board, with respect to any Federal credit union.
Under part A of subtitle VII of title 49, United States Code, by the Secretary of Transportation, with respect to any air carrier or foreign air carrier subject to such part.
Under the Packers and Stockyards Act, 1921 (7 U.S.C. 181 et seq.) (except as provided in section 406 of such Act (7 U.S.C. 226; 227)) by the Secretary of Agriculture, with respect to any activities subject to such Act.
Under the Farm Credit Act of 1971 (12 U.S.C. 2001 et seq.) by the Farm Credit Administration, with respect to any Federal land bank, Federal land bank association, Federal intermediate credit bank, or production credit association.
Enforcement by State attorneys general—
In General—
Civil actions— In any case in which the attorney general of a State has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the engagement of any person in a practice that violates this Act or a regulation prescribed under this Act, the State, as parens patriae, may bring a civil action on behalf of the residents of the State in a district court of the United States of appropriate jurisdiction to—
enjoin that practice;
enforce compliance with this Act or such regulation;
obtain damages, restitution, or other compensation on behalf of residents of the State; or
obtain such other relief as the court may consider to be appropriate.
Notice—
In general— Before filing an action under subparagraph (A), the attorney general of the State involved shall provide to the Commission—
written notice of that action; and
a copy of the complaint for that action.
Exemption—
In general— Clause (i) shall not apply with respect to the filing of an action by an attorney general of a State under this paragraph, if the attorney general determines that it is not feasible to provide the notice described in that clause before the filing of the action.
Notification— In an action described in subclause (I), the attorney general of a State shall provide notice and a copy of the complaint to the Commission at the same time as the attorney general files the action.
Intervention—
In general— On receiving notice under paragraph (1)(B), the Commission shall have the right to intervene in the action that is the subject of the notice.
Effect of intervention— If the Commission intervenes in an action under paragraph (1), it shall have the right—
to be heard with respect to any matter that arises in that action; and
to file a petition for appeal.
Construction— For purposes of bringing any civil action under paragraph (1), nothing in this Act shall be construed to prevent an attorney general of a State from exercising the powers conferred on the attorney general by the laws of that State to—
conduct investigations;
administer oaths or affirmations; or
compel the attendance of witnesses or the production of documentary and other evidence.
Actions by the Commission— In any case in which an action is instituted by or on behalf of the Commission for violation of this Act or a regulation prescribed under this Act, no State may, during the pendency of that action, institute an action under paragraph (1) against any defendant named in the complaint in the action instituted by or on behalf of the Commission for that violation.
Venue; Service of Process—
Venue— Any action brought under paragraph (1) may be brought in the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code.
Service of process— In an action brought under paragraph (1), process may be served in any district in which the defendant—
is an inhabitant; or
may be found.
Telecommunications carriers and cable operators—
Enforcement by FTC— Notwithstanding section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)), compliance with the requirements imposed under this Act shall be enforced by the Commission with respect to any telecommunications carrier (as defined in section 3 of the Communications Act of 1934 (47 U.S.C. 153)).
Relationship to other law— To the extent that sections 222, 338(i), and 631 of the Communications Act of 1934 (47 U.S.C. 222; 338(i); 551) are inconsistent with this Act, this Act controls.
Sec. 9 Rule for treatment of users of websites, services, and applications directed to children or minors
An operator of a website, online service, online application, or mobile application that is directed to children or minors shall treat all users of such website, service, or application as children or minors (as the case may be) for purposes of this Act, except as permitted by the Commission by a regulation promulgated under this Act.
Sec. 10 Definitions
In general— In this Act:
Minor— The term minor means an individual over the age of 12 and under the age of 16.
Targeted marketing— The term targeted marketing means advertising or other efforts to market a product or service that are directed to a specific individual or device—
based on the personal information of the individual or a unique identifier of the device; and
as a result of use by the individual, or access by the device, of a website, online service, online application, or mobile application.
Terms defined by Commission— In this Act, the terms directed to minors and geolocation information shall have the meanings given such terms by the Commission by regulation. Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate, under section 553 of title 5, United States Code, regulations that define such terms broadly enough so that they are not limited to current technology, consistent with the principles articulated by the Commission regarding the definition of the term Internet in its statement of basis and purpose on the final rule under the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501 et seq.) promulgated on November 3, 1999 (64 Fed. Reg. 59891).
Other definitions— The definitions set forth in section 1302 of the Children’s Online Privacy Protection Act of 1998 (15 U.S.C. 6501), as amended by section 3(a), shall apply in this Act, except to the extent the Commission provides otherwise by regulations issued under section 553 of title 5, United States Code.
Sec. 11 Effective dates
In general— Except as provided in subsections (b) and (c), this Act and the amendments made by this Act shall take effect on the date that is 1 year after the date of the enactment of this Act.
Authority To promulgate regulations— The following shall take effect on the date of the enactment of this Act:
The amendments made by subsections (a)(5) and (b)(3)(A) of section 3.
Sections 4(b), 5(c), 6(b), and 7(b).
Subsections (b) and (c) of section 10.
Digital Marketing Bill of Rights for Teens— Section 5, except for subsection (c) of such section, shall take effect on the date that is 180 days after the promulgation of regulations under such subsection.