SB63

The federal Children's Online Privacy Protection Act establishes certain requirements relating to the collection, use and disclosure of the personal information of children on the Internet. (15 U.S.C. §§ 6501 et seq.) Existing federal regulations adopted pursuant to that Act require certain operators of Internet websites to: (1) establish and maintain reasonable procedures to protect the confidentiality, security and integrity of personal information collected from children; and (2) obtain verifiable parental consent before the operator collects, uses or discloses any personal information of a child. (16 C.F.R. §§ 312.5, 312.8) Sections 24-35 of this bill enact certain additional requirements relating to the collection and processing of personal data collected from children on the Internet by controllers. Section 27 defines “controller” to mean any person who: (1) operates or provides any online service, product or feature targeted to persons in this State; and (2) determines the purpose and means of processing personal data. Sections 25-26 and 28-31.9 define certain other terms, and section 24 establishes the applicability of those definitions to sections 24-35. Section 32 exempts certain entities, types of data and activities from the requirements of sections 24-35. Section 32.5 requires a controller that is in possession of de-identified data to take certain actions with respect to such data, including committing to not re-identify such data and con