H.R. 7757 — KIDS Act

This section defines terms used in the subtitle, including a child as an individual under age 13, a teen as an individual aged 13 to under 17, compulsive usage as persistent and repetitive covered platform use that substantially limits one or more major life activities, direct messaging feature and ephemeral messaging feature with specified inclusions and exclusions, geolocation information as data sufficient to identify a street name and city or town, and unapproved contact as a user who has not initiated a direct message conversation.

This section requires providers of covered platforms to establish, implement, maintain, and enforce reasonable policies addressing harms to minors from severe threats of physical violence that impact a major life activity, sexual exploitation and abuse, distribution or use of narcotic drugs, tobacco, cannabis, alcohol, or gambling, and financial harm from deceptive practices. Policies must be appropriate to the platform's size and complexity and may not impose a duty of care or restrict minors from independently accessing content or harm-prevention resources.

This section requires providers of covered platforms to furnish users or visitors known to be minors with readily accessible safeguards that limit communications from others, block profile recommendations to non-minors, hide online status, restrict compulsive design features, limit geolocation sharing with third parties, and allow control over personalized recommendation systems, with all such safeguards defaulting to the most protective settings. It mandates parental tools enabling parents of known minor users to view and manage privacy settings, restrict purchases and time spent, receive notifications of new messaging requests, and disable messaging features for children, along with required notices to parents and minors. It further directs platforms to provide teens with controls to approve or deny direct or ephemeral messaging from unapproved contacts.

This section requires providers of covered platforms to furnish users and visitors a readily accessible reporting tool for harms to minors, an electronic point of contact specific to such matters, and confirmation of each report with a substantive response no later than 10 days after receipt (or promptly for imminent safety threats).

This section requires providers of covered platforms to give known minor users and visitors clear notice of their safeguards for minors and how to access those safeguards, parental tools, and teen messaging controls before any registration or purchase. It also requires providers to notify parents of such users about the safeguards and parental tools, permits consolidation of these notices with obligations under the Children’s Online Privacy Protection Act of 1998, and deems COPPA-compliant reasonable efforts sufficient to satisfy the parental notice requirement.

This section requires providers of covered platforms to display clear, conspicuous, and easy-to-understand labels or linked disclosures on advertisements that feature endorsements of products, services, or brands made for commercial consideration by other users, when the provider knows the recipient is a minor.

This section prohibits providers of covered platforms from facilitating the advertising of narcotic drugs, cannabis products, tobacco products, gambling, or alcohol to any user or visitor the provider knows is a minor.

This section requires providers of covered platforms to obtain an independent third-party audit within 18 months of enactment and annually thereafter. The audit must assess minor access and usage, quantify exercise of safeguards, parental tools, and teen messaging controls, detail harm reports and responses, and describe data collection and design processes affecting minors. Providers must submit results to the Commission within 30 days and issue a public report within 45 days.

This section clarifies that requirements to restrict user features or provide messaging controls for direct or ephemeral messaging on covered platforms may not override protections for encrypted communications, and requires providers to comply to the maximum extent technically feasible without compromising strong encryption.

This section prohibits providers of covered platforms from conducting market or product-focused research on users or visitors they know are minors, except when used solely to improve privacy, security, transparency, or safety or when necessary for compliance with federal or state law. It clarifies that the subtitle does not restrict processing personal information solely to measure or report advertising or content performance, reach, or frequency.

This section defines terms for the subtitle, including fentanyl to encompass any analogue or fentanyl-related substance; fentanyl-related substance by reference to the Controlled Substances Act; relevant congressional committees as the House Committee on Energy and Commerce and the Senate Committee on Commerce, Science, and Transportation; and social media platform as a public-facing website or application that primarily provides user-generated content, excluding broadband providers and electronic mail.

This section establishes the Kids Internet Safety Partnership within 1 year of enactment, headed by a Director appointed by the Secretary of Commerce. The Partnership must coordinate with agencies and listed stakeholders to identify online risks and benefits for minors and evidence-based best practices by age; publish biennial public reports on those findings and on adoption of safeguards and parental tools; issue a public playbook within 2 years covering age verification, design features, default settings, reporting tools, and related topics; and terminate after 5 years.

This section expands the definition of child to an individual under age 14 (from 13) and broadens the definition of operator to cover any person operating a website, online service, online application, or mobile application that collects personal information for commercial purposes in interstate or foreign commerce. It revises the definition of disclosure to apply to children or teens, replace actual knowledge with knowledge, and include online applications and mobile applications. It expands the definition of personal information to include persistent identifiers, photographs, videos, audio files, geolocation information, and biometric data, while excluding certain voice audio files and defining support for internal operations.

This section requires the Federal Trade Commission to submit a report within 3 years of enactment to the Senate Committee on Commerce, Science, and Transportation and the House Committee on Energy and Commerce on the processes platforms use to ensure mobile and online applications directed to children comply with this subtitle and with FTC regulations on unfair or deceptive marketing practices. It also requires annual enforcement reports beginning 1 year after enactment that detail the number and outcomes of COPPA actions, total and open investigations, complaints received, and policy recommendations to strengthen protections for children and teens.

This section requires the Comptroller General to study the types of financial technology products used by teens, the resulting risks to their privacy and mental health, and whether existing laws adequately address those risks, and to report findings and any recommended legislative or administrative actions to Congress within one year.

This section provides that if any provision of this subtitle or any amendment made by this subtitle is determined to be unenforceable or invalid, the remaining provisions and amendments shall remain in effect.

This section defines a covered data broker as an entity that, for payment, sells, licenses, rents, trades, transfers, or otherwise provides personal data of a minor that it did not collect directly from the individual to another entity not acting as a service provider. It excludes entities transmitting data at an individual's request, offering products where data access is not the service, reporting news, or acting as service providers. It sets "knows" to mean actual knowledge or willful disregard, "minor" as an individual under age 18, and "service provider" as an entity collecting or processing data on behalf of the minor, a parent, a government, or another covered entity or service provider.

This section requires covered data brokers to register annually with the Commission within 12 months of enactment by paying a fee and submitting their legal name, contact details, categories of personal data sold, use of a purchaser credentialing process, and descriptions of any reported data breaches from the prior year along with affected consumers if known. It directs the Commission to maintain a public searchable registry of all registered brokers within 18 months of enactment and authorizes an annual registration fee of at least $22,500, adjusted each January for the Consumer Price Index.