HB3880 - Children's Privacy Protection and Parental Empowerment Act

• Requires businesses providing online services, products, or features likely to be accessed by children to complete a Data Protection Impact Assessment identifying risks to children's physical health, mental health, well-being, and privacy before launch.

• Mandates businesses conduct biennial reviews of assessments and mitigate identified risks through documented action plans before services become accessible to children.

• Prohibits businesses from using children's personal information in materially detrimental ways, profiling children by default without safeguards, collecting unnecessary personal information, using dark patterns to manipulate children, or collecting precise geolocation data without explicit necessity.

• Establishes default privacy settings at high levels of protection for children and requires clear, age-appropriate privacy policies and accessible tools for children and parents to exercise privacy rights.

• Imposes civil penalties up to $2,500 per affected child for negligent violations and up to $7,500 per affected child for intentional violations, enforceable only by the Attorney General; creates a Children's Data Protection Working Group to report on implementation best practices by January 1, 2024.