GUARDIAN Act

(a) Prohibition. A provider of a covered platform may not process the personal data of a covered minor without obtaining the verifiable consent of a parent of the covered minor.

(b) Age determination. Notwithstanding subsection (a), a provider of a covered platform may process the personal data of a covered minor if—

(1) the provider of the covered platform processes such personal data for the sole purpose of determining the age of a user;

(2) the provider of the covered platform does not retain such personal data any longer than the period strictly necessary to determine the age of the user and deletes such personal data promptly upon determining the age of the user;

(3) prior to processing any personal data for the purpose of determining the age of the user, the provider of the covered platform provides the user with clear and conspicuous notice that such personal data is processed for determining the age of the user;

(4) the provider of the covered platform employs reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data processed for determining the age of the user and such security practices are appropriate to the volume, sensitivity, and nature of such personal data;

(5) the provider of the covered platform reasonably determines that any product, service, method, or third party used for determining the age of the user is likely to provide reasonably accurate results as to the age of the user; and

(6) in the case that the provider of the covered platform discloses such personal data to a third party to determine the age of the user, the provider of the covered platform takes reasonable steps to determine the third party is capable of maintaining the confidentiality, integrity, and accessibility of such personal data, including by obtaining written assurances that such third party will employ reasonable administrative, technical, and physical data security practices to do so, will not process such personal data for any purpose other than determining the age of the user, and will delete the personal data promptly after determining the age of the user.

(c) Written confirmation. Upon obtaining verifiable consent from a parent of a covered minor, the provider of a covered platform shall provide the parent of such covered minor with written or electronic confirmation of the consent and a description of the account and data practices to which it applies.

(d) Withdrawal of parental consent

(1) In general. A parent may withdraw consent for a covered minor at any time through a method that is at least as easy to use as the method by which consent was granted.

(2) Termination required. Not later than 10 days after withdrawal, the provider of a covered platform shall terminate the covered minor’s account and comply with the deletion obligations of section 5.

(e) Re-Consent. A provider of a covered platform shall obtain renewed verifiable parental consent upon a material change to the covered platform’s design features or data practices the covered minor’s transition across an age band, if a tiered structure is adopted every 24 months.