H.R. 10207: Governing Underage Access and Requiring Data Consent In All Networks Act

This bill would require certain online platforms to get a parent’s verifiable consent before collecting, using, sharing, or otherwise processing the personal data of users they know or should know are under 16.

Which platforms are covered

The bill applies to internet-based services that are publicly available and that:

• let users create searchable usernames or profiles that others can follow or access;
• mainly exist to share user-generated content like text, images, video, or audio;
• use engagement-promoting design features; and
• use personal information to advertise, market, or recommend content.

In layman’s terms, this is aimed at many social media-style platforms and similar apps or websites.

What counts as a minor

A “covered minor” is a user under 16, unless that person is legally emancipated. The bill defines “personal data” broadly, using the children’s online privacy law definition.

Parental consent requirements

Before processing a covered minor’s personal data, the platform would need to:

• give the parent direct notice of its data practices;
• get the parent’s clear and unambiguous approval; and
• provide written or electronic confirmation of the consent and what it covers.

Parents could later withdraw consent using a method at least as easy as the one used to give it. If they do, the platform would have to terminate the account within 10 days and delete the child’s data, except for information the law requires it to keep.

Age-checking

The bill allows platforms to collect and use personal data for the limited purpose of determining a user’s age, but only if they:

• delete that data promptly after determining age;
• tell users clearly that the data is being used for age verification;
• use reasonable security protections;
• use a reasonably accurate age-checking method; and
• limit any third-party age-checking provider to that purpose and require deletion afterward.

Ongoing changes and re-consent

If the platform makes a material change to its design features or data practices, or if a child moves into a new age band under a tiered system, the platform would need to get renewed parental consent in some cases.

Right to fix a violation

If a platform discovers or is notified that a user is under 16, it would have five days to avoid liability by either:

• deleting all personal data tied to that account, or
• getting verifiable parental consent.

Data deletion and portability

When a minor’s account is ended, the platform must delete the minor’s personal data, except where other laws require retention. The bill also says the platform generally may not keep a covered minor’s personal data after the minor turns 16, unless a parent asks that it be retained. Before deletion, the parent must be given at least 90 days to download the data in a portable, machine-readable format.

Limits on what the law is about

The bill says it is not meant to regulate content based on viewpoint or subject matter. It is focused on the structure and data practices of covered platforms, not on the speech itself.

Enforcement

The Federal Trade Commission would enforce the law as an unfair or deceptive practices rule. State attorneys general could also bring civil actions on behalf of residents, with notice to the FTC. The FTC could intervene in those cases. The bill also says state laws offering stronger protections for minors would not be blocked, except where they conflict with this act.

Effective date

The bill would take effect 18 months after it becomes law.

Relevant Companies

• META — Meta’s Facebook and Instagram services appear likely to fall within the bill’s covered platform definition and could need to change how they handle data for users under 16.
• SNAP — Snap’s Snapchat platform is likely to be covered and could need parental consent processes and stronger data deletion/age-verification practices for minors.
• PINS — Pinterest may be affected if its service is treated as a covered platform under the bill’s definition, especially in how it handles younger users’ data and recommendations.
• GOOGL — YouTube may be affected to the extent parts of its service are treated as a covered platform with searchable profiles and recommendation systems, though applicability could depend on how the law is interpreted.
• TTD — The Trade Desk could be indirectly affected if advertisers and platforms reduce data use for minors, though the bill is aimed more directly at platforms than ad-tech firms.