• by Wendy Davis  @wendyndavis, January 30, 2020

A bill proposed Thursday by a House Democrat would allow parents to sue online companies that track their children.

The Protecting the Information of our Vulnerable Children and Youth Act (Kids PRIVCY Act), unveiled by Rep. Kathy Castor (D-Florida), would also prohibit companies from using behavioral targeting techniques on children younger than 13.

The measure would significantly broaden the federal Children's Online Privacy Protection Act, a 1998 law that effectively requires companies to obtain parental consent before tracking children 12 and younger for ad targeting purposes. That law bans companies from collecting personal information -- including IP addresses, data stored on tracking cookies and other information used for ad targeting -- from children under 13, without parental permission.

Castor's proposal expands that law in several ways, including by requiring companies to obtain opt-in consent from users between 13 and 17 before collecting, transferring or using their data. 

The current law provides for enforcement by the Federal Trade Commission and state attorneys general, but doesn't allow for private lawsuits. Castor's proposed bill would allow parents to sue over any violations of the children's privacy rules.

Castor isn't the only lawmaker who wants to toughen children's privacy laws.

Earlier this month, Reps. Bobby L. Rush (D-Illinois) and Tim Walberg (R-Michican) introduced the “Preventing Real Online Threats Endangering Children Today (PROTECT) Kids Act,” which would curb companies' ability to serve behaviorally targeted ads to anyone younger than 16. That measure would also create an “eraser button” enabling parents to delete personal information of their children.

Last year, Sens. Ed Markey (D-Massachusetts) and Josh Hawley (R-Missouri) also proposed updating the children's privacy law. Their proposed “Digital Marketing Bill of Rights for Minors” would require companies to obtain explicit consent from teens between the ages of 13 and 15 before collecting their personal information or location data.