Determination of whether a covered entity knows that an individual is a child or teen

(a) Rule of construction For purposes of determining whether a covered entity knows that an individual is a child or teen, the Commission or attorney general of a State shall rely on competent and reliable evidence, taking into account the totality of circumstances, including whether a reasonable and prudent person under the circumstances would have known that the individual is a child or teen. (b) Protections for privacy Nothing in this Act, including a determination described in subsection (a), shall be construed to require a covered entity to— (1) implement an age gating or age verification functionality; or (2) affirmatively collect any personal data with respect to the age of any individual that the covered entity is not already collecting in the normal course of business. (c) Restriction on use and retention of personal data If a covered entity (or a third party acting on behalf of a covered entity) voluntarily collects personal data for the purpose of complying with this Act, the covered entity (or third party) shall not— (1) use any personal data collected for a purpose other than for sole compliance with the requirements of this Act; or (2) retain any personal data collected for longer than is necessary to comply with the requirements of this Act or than is minimally necessary to demonstrate such compliance.