A108

An Act concerning the protection of privacy of adolescents' personal information on the Internet and supplementing chapter 8 of Title 56 of the Revised Statutes.

Be It Enacted by the Senate and General Assembly of the State of New Jersey:

1. This act shall be known as and may be cited as the "Adolescents' Online Privacy Protection Act."

2. As used in this act:

"Adolescent" means a natural person between the ages of 13 and 17, inclusive.

"Disclosure" means, with respect to personal information, the release of personal information collected in identifiable form by an operator for any purpose, except where such information is provided to a person other than the operator who provides support for the internal operation of the website and does not disclose or use that information for any other purpose.

"Division" means the Division of Consumer Affairs in the Department of Law and Public Safety.

"Internet" means collectively the myriad of computer and telecommunications facilities, including equipment and operating software, which comprise the interconnected world-wide network of networks that employ the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocols to such protocol, to communicate information of all kinds by wire or radio.

"Online contact information" means an e-mail address or another substantially similar identifier that permits direct contact with a person online.

"Operator" means any person who operates a website located on the Internet or an online service which collects or maintains personal information from or about the users of or visitors to that website or online service, or on whose behalf such information is collected or maintained, where that website or online service is operated for commercial purposes, but does not include a person properly registered with the division pursuant to the "Charitable Registration and Investigation Act," P.L.1994, c.16 (C.45:17A-18 et seq.).

"Parent" includes a legal guardian.

"Personal information" means information collected online from an individual that identifies that individual, including first and last name, home and other physical address, E-mail address, social security number, telephone number, and any other identifier the division determines permits the physical or online contacting of a specific individual, or information concerning an adolescent or parents of an adolescent that the website collects online from the adolescent and combines with an identifier described above.

"Verifiable parental consent" means any reasonable effort, taking into consideration available technology, including a request for authorization for future collection, use and disclosure described in the notice, to ensure that a parent of an adolescent receives notice of the operator's personal information collection, use and disclosure practices, and authorizes the collection, use and disclosure, as applicable, of personal information and the subsequent use of that information before that information is collected from that adolescent.

"Website or online service directed at adolescents" means a commercial website or online service that is targeted at adolescents or that portion of a commercial website or online service that is targeted at adolescents, but a commercial website or online service, or portion thereof, shall not be deemed directed at adolescents solely for referring or linking to a commercial website or online service directed at adolescents using information tools, including a directory, index, reference, pointer or hypertext link.

3. The division shall adopt regulations:

a. Requiring the operator of any website or online service directed at adolescents that collects personal information from adolescents or the operator of a website or online service that has actual knowledge that it is collecting personal information from an adolescent:

(1) to provide notice on the website of what information is collected from adolescents by the operator, how the operator uses that information and the operator's disclosure practices for that information; and

(2) to obtain verifiable parental consent for the collection, use and disclosure of personal information from adolescents.

b. Requiring the operator of any website or online service directed at adolescents that collects personal information from adolescents or the operator of a website or online service that has actual knowledge that it is collecting personal information from an adolescent to provide, upon request of a parent whose adolescent has provided personal information to that website or online service, upon proper identification of that parent, to the parent:

(1) a description of the specific types of personal information collected from the adolescent by that operator;

(2) the opportunity at any time to refuse to permit the operator's further use or maintenance in retrievable form, or future online collection of personal information from that adolescent: and

(3) notwithstanding any other provision of law, a means that is reasonable under the circumstances for the parent to obtain any personal information collected from that adolescent.

c. Prohibiting the operator of any website or online service directed at adolescents that collects personal information from adolescents or the operator of a website or online service that has actual knowledge that it is collecting personal information from an adolescent from conditioning an adolescent's participation in a game, the offering of a prize, or another activity on the adolescent's disclosing more personal information than is reasonably necessary to participate in the activity.

d. Requiring the operator of any website or online service directed at adolescents that collects personal information from adolescents or the operator of a website or online service that has actual knowledge that it is collecting personal information from an adolescent to establish and maintain reasonable procedures to protect the confidentiality, security and integrity of personal information collected from adolescents.

e. The regulations adopted pursuant to subsection a. of this section shall provide that verifiable parental consent shall not be required in the case of:

(1) online contact information collected from an adolescent that is used only to respond directly on a one-time basis to a specific request from the adolescent and is not used to recontact the adolescent and is not maintained in retrievable form by the operator;

(2) a request for the name or online contact information of a parent or adolescent that is used for the sole purpose of obtaining parental consent or providing notice under this section and where that information is not maintained in retrievable form by the operator if parental consent is not obtained after a reasonable time;

(3) online contact information collected from an adolescent that is used only to respond more than once directly to a specific request from the adolescent and is not used to recontact the adolescent beyond the scope of that request

(a) if, before any additional response after the initial response to the adolescent, the operator uses reasonable efforts to provide a parent notice of the online contact information collected from the adolescent, the purposes for which it is to be used, and an opportunity for the parent to request that the operator make no further use of the information and that it not be maintained in retrievable form; or

(b) without notice to the parent in such circumstances as the division may determine are appropriate, taking into consideration the benefits to the adolescent of access to information and services, and risks to the security and privacy of the adolescent, pursuant to regulation adopted by the division;

(4) the name of the adolescent and online contact information, to the extent reasonably necessary to protect the safety of an adolescent participant on the site, when the name is:

(a) used only for the purpose of protecting the adolescent's safety; (b) not used to recontact the adolescent or for any other purpose; and

if the operator uses reasonable efforts to provide a parent notice of the name and online contact information collected from the adolescent, the purposes for which it is to be used, and an opportunity for the parent to request that the operator make no further use of the information and that it not be maintained in retrievable from; or

(5) the collection, use or dissemination of personal information by the operator of a website or online is necessary to:

(a) protect the security and integrity of its website;

(b) take precautions against liability;

(d) provide, to the extent permitted under other provisions of law, information to law enforcement agencies or for an investigation on a matter related to public safety.

The regulations shall permit the operator of a website or an online service to terminate service provided to an adolescent whose parent has refused, under the regulations adopted pursuant to subsection a. of this section, to permit the operator's further use or maintenance in retrievable form, or future online collection, of personal information from that adolescent.

4. It shall be an unlawful practice for an operator of a website or online service to collect, use or disclose personal information in a manner that violates the regulations adopted pursuant to section 3 of this act.

5. An operator of a website or online service shall not be held liable under this act for any disclosure made in good faith and following reasonable procedures in responding to a request for disclosure of personal information pursuant to subsection b. of section 3 of this act to the parent of an adolescent.

6. Nothing in this act shall be interpreted to require an operator to collect or maintain any data that would not otherwise be collected or maintained.

7. This act shall take effect on the 180th day after enactment, but the division may take such anticipatory administrative action in advance as shall be necessary for the implementation of this act.

STATEMENT

This bill, the "Adolescents' Online Privacy Protection Act," would regulate the disclosure of personal information collected from adolescents by an operator of a website or online service. The bill would apply to personal information of individuals over the age of 13 but under the age of 18. This bill is modeled on the federal "Children's Online Privacy Protection Act," 15 U.S.C.A.s.6501 et seq., which applies only to children under the age of 13.

Under the provisions of the bill, it would be an unlawful practice under the State's consumer fraud act, P.L.1960, c.39 (C.56:8-1 et seq.) to collect, use or disclose an adolescent's personal information in a manner that violates regulations to be adopted by the Division of Consumer Affairs in the Department of Law and Public Safety concerning collection and disclosure of personal information.

The division would be required to adopt regulations requiring the operator of a website or an online service that collects personal information from adolescents to provide notice on the website of what information is collected from adolescents, how that information is used by the operator and the operator's disclosure practices.

Further, the bill would require the operator to obtain verifiable parental consent for the use and disclosure of personal information from adolescents. The bill provides that verifiable parental consent would not be required in certain limited circumstances.

The regulations would provide parental access to the personal information about an adolescent. The regulations would also prohibit an operator from conditioning an adolescent's participation in a game, the offering of a prize or another activity on the adolescent's disclosing more personal information than is reasonably necessary to participate in the activity.

The regulations would permit an operator of a website or online service to terminate service to an adolescent whose parents have refused to permit the operator's further use or maintenance in retrievable form, or future online collection of, personal information from that adolescent.

A person who violates the provisions of the consumer fraud act is liable to a penalty of not more than $7,500 for the first offense and not more than $15,000 for the second and each subsequent offense.