S. 836 · Passed Senate · Commerce

Children and Teens’ Online Privacy Protection Act

What it does

Amends the definition of 'operator' under COPPA to include websites, online services, online applications, and mobile applications that collect or maintain personal information from children and teens for commercial purposes in interstate or foreign commerce.
Expands the definition of 'personal information' to include persistent identifiers (cookies, IP addresses, device serial numbers), biometric data (fingerprints, voice prints, facial templates, DNA), geolocation information, and audio/video files containing a child's or teen's image or voice.
Restricts the sharing of children's and teens' personal information, except where necessary for internal operations of the website, online service, online application, or mobile application, and prohibits disclosure or use for any other purpose by service providers.
Requires verifiable consent from a parent (for children) or the teen themselves before any personal information is collected, and requires direct notice of collection, use, and disclosure practices by the operator.
Excludes audio files containing a child's voice from the definition of personal information if the operator does not request voice-based personal information, provides clear notice, uses the audio only for task completion, and deletes the file immediately after use.

Mar 16, 2026: Held at the desk.

Committee: Senate Commerce, Science, and Transportation