S. 836, Children and Teens’ Online Privacy Protection Act

Bill Summary

S. 836 would amend provisions of the Children’s Online Privacy Protection Act (COPPA) to establish new protections for children under the age of 13 and to extend protections to teenagers under the age of 17. Operators of websites, online services, and mobile applications that collect or maintain user data, allow others to collect such data, or allow users to publicly disclose personal information would be subject to the bill’s requirements.

The bill would prohibit operators from collecting, using, maintaining, or disclosing to third parties the personal information of any user under the age of 17 for the purpose of direct advertising. S. 836 also would prohibit operators from storing or transferring such information outside the United States without notification and from retaining such information for longer than reasonably necessary. Operators that fail to meet those requirements could be subject to civil monetary penalties.

Operators also would need to obtain verifiable consent from a parent of any user under the age of 13, or the teenager under the age of 17, before using or disclosing that information for any purpose other than originally disclosed. Upon request, operators would need to provide those parents or teenagers with a means to access the information and an opportunity for the information to be deleted.

S. 836 would direct the Federal Trade Commission (FTC) to study and report on the feasibility of allowing a single operator to obtain verifiable consent from a parent of users under the age of 13, or teenagers under the age of 17, on behalf of multiple operators that provide related services. If the FTC determines that such common, verifiable consent is viable, the commission would be required to issue regulations permitting its use.

The bill would instruct the FTC to report to the Congress, within three years of enactment, on how platforms directed at children under the age of 13 comply with the bill and to report annually on investigations or enforcement undertaken in the prior year.

Finally, S. 836 would require the Government Accountability Office to study and report to the Congress on the effects of the use of financial technology products on the privacy and mental health of teenagers under the age of 17.

Estimated Federal Cost

The estimated budgetary effect of S. 836 is shown in Table 1. The costs of the legislation fall within budget function 370 (commerce and housing credit).

Basis of Estimate

CBO assumes that S. 836 will be enacted in fiscal year 2026.

Revenues

S. 836 would authorize the FTC to collect civil monetary penalties from businesses found to violate the bill’s provisions, along with pursuing other remedies. Civil monetary penalties are generally remitted to the Treasury and recorded as revenues.

The bill would expand the scope of COPPA and nearly double the covered population by adding teenagers under the age of 17, who tend to use online services and applications more intensively than do younger children. CBO estimates, based on a review of past enforcement actions reported by the FTC, that civil monetary penalties ordered for violations of COPPA averaged $50 million per year over the last 10 years. On that basis, and accounting for the estimated number of newly covered online and application users and for anticipated inflation, CBO estimates that the FTC would collect an additional $164 million in revenues from penalties collected over the 2026-2035 period.

Spending Subject to Appropriation

Using information from the FTC and based on the costs of similar activities, CBO estimates that, in total, implementing S. 836 would cost $16 million over the 2026-2030 period. Any related spending would be subject to the availability of appropriated funds. Those costs, detailed below, are based on information from the FTC, including the average cost of an employee in 2026 ($240,000), and account for anticipated inflation.

CBO expects that the FTC would need seven employees in 2026 and 2027 to issue the required rules and guidance at a cost of $2 million.

CBO estimates that the FTC would need 15 new employees to supervise the bill’s implementation and enforce its requirements starting in 2028, at a total cost of $11 million over the 2026‑2030 period.

CBO also estimates that it would cost the FTC and the Government Accountability Office $3 million over the 2026-2030 period to complete the required studies and reports.

CBO cannot determine whether the FTC will consider common, verifiable consent to be feasible, so the costs associated with potential rulemaking for that activity are not reflected in this estimate. If the FTC issues such regulations, CBO expects that the amounts estimated for spending subject to appropriation would be higher than shown here.

Pay-As-You-Go Considerations

The Statutory Pay-As-You-Go Act of 2010 establishes budget-reporting and enforcement procedures for legislation affecting direct spending or revenues. The net changes in revenues that are subject to those pay-as-you-go procedures are shown in Table 1.

Increase in Long-Term Net Direct Spending and Deficits

CBO estimates that enacting S. 836 would not increase net direct spending or on-budget deficits in any of the four consecutive 10-year periods beginning in 2036.

Mandates

S. 836 would impose intergovernmental and private-sector mandates, as defined in the Unfunded Mandates Reform Act (UMRA), on operators of websites, online services, and mobile applications. CBO estimates that the cost of the intergovernmental mandates would not exceed the threshold established in UMRA ($103 million in 2025, adjusted annually for inflation). Because much of the data on users of online services is proprietary, CBO cannot determine if the costs to comply with the private-sector mandates would exceed the UMRA threshold ($206 million in 2025, adjusted annually for inflation).

Preemption of State Laws

S. 836 would impose an intergovernmental mandate by explicitly preempting state laws that conflict with the bill’s provisions unless those laws provide greater protection to people under the age of 17 than would be provided under the bill. Although it would limit the application of state and local laws, CBO estimates that the preemption would impose no costs.

Collection and Storage of Data

The bill would impose private-sector mandates by regulating the collection and storage of some minors’ data by operators of websites, online services, and mobile applications. The bill would expand existing rules for children under the age of 13 to cover teenagers under the age of 17. The bill also would prohibit operators from collecting personal information from those users for the purpose of direct advertising. CBO estimates that the cost for operators to stop collecting the data would be small. Under UMRA, the cost of lost advertising revenue is not considered a direct cost of complying with a mandate.

S. 836 would require operators to implement reasonable security practices to protect the personal information of children and teenagers under the age of 17. Based on discussion with industry experts, CBO expects that the cost for operators to comply with that requirement would be small because the data industry already follows various federal and state laws governing collection and storage of some types of data (such as Social Security numbers and health information). To be competitive in the business of data storage and collection, most operators already follow reasonable security practices.

Finally, the bill would prohibit operators from collecting, storing, or transferring the personal information of children and teenagers under the age of 17 to a site outside of the United States, without notifying a parent of the child or the teenager. More than 200 million websites and mobile applications are available worldwide, but information about where they store data is proprietary as is information about the ages of users and the volume of their interactions with those sites and applications. Because of the significant uncertainty that surrounds the number of users, mobile applications and websites that would be subject to the requirement, CBO cannot determine whether the cost of the required notifications would exceed the threshold established for private-sector mandates.

Estimate Prepared By

Federal Costs: Sean Christensen

Revenues: Jennifer Shand

Mandates: Rachel Austin

Estimate Reviewed By

Justin Humphrey
Chief, Finance, Housing, and Education Cost Estimates Unit

Joshua Shakin
Chief, Revenue Projections Unit

Kathleen FitzGerald 
Chief, Public and Private Mandates Unit

H. Samuel Papenfuss 
Deputy Director of Budget Analysis

Estimate Approved By