GUARDIAN Act
- Sponsor
- Rep. Houchin, Erin [R-IN-9]
- Committees
- Energy and Commerce Committee (primary)
- Last action
- Sep 1, 2026
Bottom line
The GUARDIAN Act mandates verifiable parental consent for online platforms to process the personal data of users under 16, aiming to enhance child data privacy and parental control over minors' online experiences.
What it actually does
This bill, known as the GUARDIAN Act, prohibits online platforms from processing the personal data of users under the age of 16 (covered minors) without first obtaining verifiable consent from a parent or legal guardian. It defines 'covered platforms' as publicly available online services that facilitate user-generated content, promote engagement through design features, and use personal information for recommendations or advertising. The bill outlines specific requirements for age determination, parental consent, data deletion upon account termination or the minor reaching age 16, and data portability.
Proponents argue
Proponents argue that the bill is a critical step to protect children and teenagers from exploitative data practices and potentially harmful design features on social media and other online platforms. They contend that parents should have the ultimate authority over their children's data and online interactions, especially given the increasing complexity of digital environments and the documented negative impacts of excessive screen time and targeted content on youth mental health. The bill empowers parents and provides necessary safeguards for minors who may not fully understand the implications of data sharing.
Opponents contend
Opponents may argue that the bill places an undue burden on online platforms, particularly smaller ones, due to the technical and financial challenges of implementing robust age verification and verifiable parental consent systems. They might also raise concerns about potential impacts on minors' access to educational or beneficial online content, or the privacy implications of requiring more personal data for age verification. Some critics could also argue that the bill's broad definitions of 'covered platform' and 'design feature' could stifle innovation and lead to unintended consequences for online services not primarily targeting minors.
The bill is relatively short and clearly structured, making it accessible for an informed reader to understand its core provisions within a reasonable timeframe, likely less than 20 minutes.
Section 2(2)
Definition of 'Covered Platform'
This provision defines which online services are subject to the bill. A 'covered platform' is a publicly available website, software, application, or electronic service that allows users to create searchable profiles, facilitates sharing of user-generated content as its primary purpose, uses design features to promote engagement, and uses personal information for advertising or content recommendations. This specific definition is crucial for determining the scope of the bill's applicability.
Supporters argue
Proponents argue that this definition is carefully crafted to target platforms that pose the greatest risk to minors due to their engagement-driving features and data monetization practices, while avoiding overreach to other online services. They contend that focusing on platforms that actively use personal data for recommendations and advertising ensures that the bill addresses the core issues of data exploitation.
Critics contend
Opponents may argue that the definition is too broad or too narrow, potentially capturing platforms not intended to be regulated or allowing others to evade regulation through minor design changes. They might also contend that the criteria for 'design feature' or 'primary purpose' are subjective and could lead to inconsistent enforcement or stifle innovation.
Tradeoffs
The tension lies in balancing comprehensive protection for minors with avoiding over-regulation of the internet and ensuring clarity for platforms. A broad definition risks unintended consequences for diverse online services, while a narrow one might leave loopholes for platforms to exploit.
Section 3(a)
Parental Consent Requirement for Data Processing
This is the central prohibition of the bill, stating that a covered platform cannot process the personal data of a covered minor (a user under 16 who the platform knows or should have known is a minor) without obtaining verifiable consent from their parent. 'Processing' includes collection, use, storage, disclosure, analysis, deletion, or modification of personal data. This means platforms must implement systems to identify minors and secure parental permission before engaging in any data activities.
Section 3(b)
Exception for Age Determination
This provision creates a narrow exception to the parental consent rule, allowing platforms to process personal data solely for the purpose of determining a user's age. This processing is subject to strict conditions: data must be deleted promptly after age determination, clear notice must be given to the user, strong data security practices must be employed, and any third-party age verification services must also adhere to these standards and provide written assurances.
Section 3(d)
Withdrawal of Parental Consent
This provision grants parents the right to withdraw their consent for a covered minor's data processing at any time. The method for withdrawal must be at least as easy as the method by which consent was granted. Upon withdrawal, the platform must terminate the minor's account and delete all associated personal data within 10 days, adhering to the data deletion obligations outlined in Section 5.
Section 5(b)
Data Deletion Upon Minor's 16th Birthday ('Graduation')
This provision mandates that covered platforms generally cannot retain the personal data associated with a covered minor's account after the minor turns 16. However, there is an exception: if a parent submits a request to the platform to retain the data after the minor reaches 16, the platform may do so. This means that without explicit parental instruction, a minor's data is automatically deleted upon reaching adulthood (as defined by the bill).
Section 7
Enforcement by Federal Trade Commission and States
This section grants enforcement authority for the Act to the Federal Trade Commission (FTC) and State Attorneys General. Violations are treated as unfair or deceptive acts under the FTC Act, allowing the FTC to use its full range of powers. States can bring civil actions on behalf of their residents to enjoin violations, enforce compliance, or obtain damages, but must notify the FTC and cannot proceed if a federal action is already pending against the same defendant for the same violation.
Section 8
Relationship to State Laws (Preemption)
This section addresses how the Act interacts with existing and future state laws. It states that the Act preempts state laws only to the extent they conflict with its provisions. However, it explicitly carves out exceptions, stating that the Act does not preempt state laws related to contract, tort, or product liability, nor does it prohibit states from enacting or enforcing laws that provide greater protection to minors than the GUARDIAN Act itself.
Excludes emancipated minors from the definition of 'covered minor'.
Section 2(3)(B)
Why it matters:This is standard legislative practice to include specific exclusions within definitions to clarify scope, rather than in the main operative text.
Case for: The case for this exclusion is that emancipated minors are legally considered adults and therefore should not be subject to parental consent requirements for their personal data. It respects their legal autonomy.
Case against: No significant case against this specific exclusion is typically raised, as it aligns with existing legal principles regarding emancipated minors.
Estimated impact: Impacts a very small, specific subset of minors, ensuring their legal status is recognized in the context of data privacy.
Provides a 'Right to Cure' for platforms, allowing them to avoid liability for violating the parental consent requirement if they rectify the issue within five days of identification or notification.
Section 4
Why it matters:This is a common legislative mechanism to provide flexibility and encourage compliance rather than immediate punitive action, often placed separately from core definitions and prohibitions.
Case for: Proponents argue that the 'Right to Cure' is a practical and fair provision, acknowledging that platforms may inadvertently process minor's data without consent. It incentivizes quick corrective action and reduces the likelihood of punitive measures for good-faith errors, promoting a cooperative regulatory environment.
Case against: Critics might argue that a five-day cure period is too long, potentially allowing platforms to continue processing minor's data for a short period after discovery of a violation. They might also contend it could reduce the deterrent effect of the law if platforms view it as a grace period rather than a strict liability standard.
Estimated impact: Significantly impacts platform liability, potentially reducing the number of enforcement actions for initial or accidental non-compliance, while still requiring prompt corrective action.
States that nothing in the Act shall be construed to impose liability on a platform based on the viewpoint, subject matter, or content of user-generated content or a minor's access to or dissemination of any particular category of speech.
Section 6(a)
Why it matters:This type of clause is typically included to preemptively address potential First Amendment challenges or concerns about content moderation, clarifying that the bill's intent is data privacy, not content regulation.
Case for: Proponents argue this clause is essential to protect free speech and ensure the bill is not misinterpreted as a content moderation mandate. It clarifies that the focus is on data processing practices, not on what content minors can access or create.
Case against: Some critics might argue that while well-intentioned, this clause doesn't fully insulate the bill from First Amendment challenges, especially if platforms respond to data processing requirements by broadly restricting access to content for minors. Others might argue it could be used by platforms to avoid responsibility for harmful content if they claim their actions are solely related to data processing.
Estimated impact: Crucially shapes the legal interpretation of the bill, aiming to prevent challenges based on free speech and content regulation, thereby narrowing the scope of potential legal battles.