GUARDIAN Act

Summary#

This bill, called the GUARDIAN Act, would bar certain online platforms from processing the personal data of users the platform knows or should have known are under 16 unless a parent gives verifiable consent. The bill defines which services are "covered platforms" (publicly available sites or apps that let users create searchable usernames, mainly share user-generated content, use design features to drive engagement, and use personal information for ads or recommendations). It defines covered minors (under 16, except emancipated youth) and lists examples of "design features" such as infinite scrolling, autoplay, rewards, notifications, filters, and personalized recommendation systems.

Platforms may process personal data briefly to determine a user’s age if they follow rules about notice, security, accuracy, and prompt deletion. Platforms that get parental consent must give written or electronic confirmation and a description of account and data practices. Parents may withdraw consent at any time; the platform must terminate the minor’s account and delete the minor’s personal data within 10 days. Platforms must delete a covered minor’s data when the account ends and generally may not keep data after the user turns 16 unless a parent asks the platform to retain it. Providers must offer a way for parents to download the minor’s data at least 90 days before deletion. The bill gives a 5-day “right to cure” for platforms that discover a user is a covered minor: within 5 days they must either delete the minor’s data or get parental consent. The Federal Trade Commission would enforce the law, and states could bring civil actions. The law would take effect 18 months after enactment.

What it means for you#

• If you are a parent: Platforms covered by this bill would need verifiable consent from you before they process your child’s personal data. You would receive confirmation of consent, could withdraw consent at any time, and could request that a platform keep your child’s data after they turn 16. You would be able to download the child’s data before it is deleted.
• If you are a minor under 16: A covered platform could not process your personal data unless a parent gives verifiable consent. If consent is withdrawn, your account would be terminated and your data deleted.
• If you run or work for an online platform: You would need systems to identify covered minors, get and document verifiable parental consent, allow data downloads, delete minors’ data when required, follow strict rules for age checks, and comply with FTC enforcement. You might also need to change or document design features and data practices, and obtain renewed parental consent after material changes or certain age transitions if using tiered age bands.

Expenses#

No publicly available information on the costs, budgetary effects, or estimated compliance expenses is included in the provided bill text or metadata.

Proponents' View#

The bill’s provisions focus on giving parents control over personal data of children under 16, limiting platforms’ ability to use engagement-driven design features and personalized recommendations for minors, and requiring deletion and portability of minors’ data. Supporters would point to the verifiable consent, deletion rules, age-check limits, and FTC enforcement as ways to protect minors’ personal data and provide parental oversight.

Opponents' View#

No publicly available information.