# Plain Language Summary: Kids PRIVACY Act

This bill updates and strengthens the rules protecting children and teenagers from having their personal information collected and misused online. Right now, there's a law from 1998 that only covers kids under 13, but this bill expands protection to teenagers up to age 18 and makes the rules much stricter for how companies can handle their data.

The bill defines "covered information" very broadly to include almost anything a company could collect about a young person—their name, location, browsing history, what they buy, their health information, their face through facial recognition, even their private messages. It also includes information companies create by analyzing this data to figure out what a teenager likes, how they think, or what they might do next. The key change is that companies now need to get clear permission from teenagers themselves (not just parents) before collecting most of this information, and that permission has to be genuine—not hidden in confusing terms or tricked out of them through manipulative design tricks.

Companies that operate websites, apps, and online services now have to conduct detailed "privacy and security impact assessments" before launching services or making major changes. These assessments must identify risks to young people's safety and well-being, consider input from kids, parents, and child development experts, and explain how the company is protecting them. The bill also creates a new division at the Federal Trade Commission specifically focused on youth privacy and gives people the right to sue companies that violate these rules, not just rely on government enforcement.

Kids PRIVACY Act

Castor, Kathy

Protecting the Information of our Vulnerable Adolescents, Children, and Youth Act or the Kids PRIVACY Act This bill expands the requirements for digital services when handling the personal information of children. The bill establishes requirements for digital services directed to children and digital services likely to be accessed by children or teenagers. Specifically, the bill requires children's digital services to obtain express, affirmative consent that is specific, informed, and unambiguous before processing certain personal information of a child or teenager under the age of 18. The bill also prohibits the operator of a children's service from using information in a harmful manner or in a way that has been shown to be detrimental to the well-being of children and teenagers. Teenagers or the parents of children are allowed to access, correct, or delete personal information. A service likely to be used by children or teenagers is prohibited from using information for the purpose of targeted advertisements or marketing to a specific child or teenager (or group of children or teenagers) based on specified information or behavior. Regulations promulgated under the bill must require an operator to consider the best interests of children and teenagers when designing a service likely to be used by children or teenagers. The bill increases the civil penalty for violations of children's online privacy protections and provides for enforcement by the Federal Trade Commission and a private right of action.