KIDS Act

(a) Audit required. Not later than 18 months after the date of the enactment of this subtitle, and annually thereafter, a provider of a covered platform shall ensure that an independent, third-party auditor conducts an independent, third-party audit of the covered platform.

(b) Audit specifications

(1) Criteria. In conducting an audit required by subsection (a), an independent, third-party auditor shall do the following:

(A) Consider widely accepted or evidence-based approaches, best practices, frameworks, and methods related to any safeguard described in section 214(a)(1), any parental tool described in section 214(b)(1), and any teen messaging control described in section 214(c)(2).

(B) Consider widely accepted or evidence-based approaches, best practices, frameworks, and methods related to identifying, preventing, and mitigating the harms to minors described in section 213(a).

(C) Consult with parents (including parents with relevant experience), public health and mental health nonprofit organizations, health and development organizations, and experts in freedom of expression about methods to identify, prevent, and mitigate such harms.

(2) Contents. An audit required by subsection (a) shall include the following:

(A) An assessment of the extent to which the relevant covered platform is likely to be accessed by minors, including with respect to any difference between children and teens.

(B) An accounting of the following:

(i) The number of users using such covered platform who the provider of such covered platform knows to be minors located in the United States.

(ii) The median and mean amounts of time spent on such covered platform by such users during the year in which such audit is conducted.

(iii) A description of the policies, practices, and procedures implemented to address the harms to minors described in section 213(a).

(iv) The number of times that any safeguard described in section 214(a)(1) has been exercised during the year in which such audit is conducted.

(v) The number of times that any parental tool described in section 214(b)(1) has been exercised during the year in which such audit is conducted.

(vi) The number of times that any teen messaging control described in section 214(c)(2) has been exercised during the year in which such audit is conducted.

(vii) The number of reports, categorized by types of harms to a minor, received by such covered platform through the reporting mechanism described in section 215(a)(1) during the year in which such audit is conducted.

(C) A description of such safeguards for minors and parental tools that are available to minors and parents on such covered platform.

(D) A description of how such covered platform handles reports received through such reporting mechanism, including the rate of response to such a report and the timeliness and substantiveness of any such response.

(E) A description of whether, how, and for what purpose such covered platform collects or processes categories of personal information of minors.

(F) If the covered platform has a process used to create, implement, or evaluate the impact of a design feature of the covered platform used by minors, a description of such process.

(3) Cooperation by covered platform. A provider of a covered platform shall facilitate an audit of the covered platform required by subsection (a) by doing the following:

(A) Providing or otherwise making available to the independent, third-party auditor that conducts such audit any information or material in the possession, custody, or control of such covered platform relevant to such audit.

(B) Providing or otherwise making available to such auditor access to any network, system, or asset relevant to such audit.

(C) Disclosing any material fact to such auditor and not misrepresenting any material fact.

(c) Report to Commission. Not later than 30 days after the date on which an audit required by subsection (a) is completed, the provider of the relevant covered platform shall submit to the Commission the results of the audit.

(d) Public report. Not later than 45 days after the date on which an audit required by subsection (a) is completed, the provider of the relevant covered platform shall issue a public report that—

(1) includes the information required by clauses (i), (ii), (iv), (v), and (vi) of subsection (b)(2)(B); and

(2) notwithstanding paragraph (1), may include any other information required by this section.