On January 30, House Rep. Kathy Castor (D-FL) introduced the Protecting the Information of our Vulnerable Children and Youth (“PRIVCY”) Act, a bill that promises to be a significant overhaul of the Children’s Online Privacy Protection Act (“COPPA”).

Currently, COPPA applies only to personal information collected from children under 13 years old.  The PRIVCY Act would greatly expand COPPA’s scope by making any personal information – including biometric, geolocation, and inferred information, whether collected from the child or not – subject to the law’s requirements.  It also brings a new group of “young consumers” – individuals aged 12 to 18 years old – under the law’s umbrella.  The PRIVCY Act would obligate online sites and services that have actual or constructive knowledge that they “process” personal information about children or young consumers to provide notice to, and obtain consent from, those children’s parents or from those young consumers.  The bill also provides for rights to access, correction, and deletion of children’s and young consumers’ personal information, and it imposes limits on the ability of operators to disclose personal information to third parties.

Additionally, the privacy bill would completely repeal COPPA’s safe harbor provision, which enables covered operators to rely on a safe harbor if their privacy practices have been certified by FTC-approved organizations.  Currently, seven safe harbor organizations have been approved by the FTC.

The measure would allow the FTC to pursue civil penalties that are 50% higher than the current maximum per violation as well as to pursue punitive damages.  Separately, it would allow parents of children and young consumers to pursue a private right of action against operators that violate the bill’s provisions.

Castor’s PRIVCY Act joins other pending bills in Congress that seek to rewrite COPPA.  In early January, House Representatives Tim Walberg (R-MI) and Bobby Rush (D-IL) introduced the “Preventing Real Online Threats Endangering Children Today” (“PROTECT”) Kids Act, which would amend the definition of “children” to include individuals up to the age of 16.  And earlier last year, Sens. Josh Hawley (R-MO) and Ed Markey (D-MA) introduced the so-called “COPPA 2.0” bill, which would also raise the age of children covered by the law and would offer parents an “eraser button” to remove their children’s data from particular services.  However, unlike the PRIVCY Act, neither bill would give parents the right to file suit over privacy violations.

The FTC also is currently reviewing the present COPPA Rule, after holding a public workshop last fall and receiving comments on the Rule last December.