(b) Criteria for approval of self-regulatory program guidelines. Proposed safe harbor programs must demonstrate that they meet the following performance standards:

1. (1) Program requirements that ensure operators subject to the self-regulatory program guidelines (“subject operators”) provide substantially the same or greater protections for children as those contained in §§ 312.2 through 312.8, and 312.10.
2. (2) An effective, mandatory mechanism for the independent assessment of subject operators' compliance with the self-regulatory program guidelines. At a minimum, this mechanism must include a comprehensive review by the safe harbor program, to be conducted not less than annually, of each subject operator's information privacy and security policies, practices, and representations. The assessment mechanism required under this paragraph can be provided by an independent enforcement program, such as a seal program.

3. (3) Disciplinary actions for subject operators' non-compliance with self-regulatory program guidelines. This performance standard may be satisfied by:

   1. (i) Mandatory, public reporting of any action taken against subject operators by the industry group issuing the self-regulatory guidelines;
   2. (ii) Consumer redress;
   3. (iii) Voluntary payments to the United States Treasury in connection with an industry-directed program for violators of the self-regulatory guidelines;
   4. (iv) Referral to the Commission of operators who engage in a pattern or practice of violating the self-regulatory guidelines; or
   5. (v) Any other equally effective action.

(c) Request for Commission approval of self-regulatory program guidelines. A proposed safe harbor program's request for approval shall be accompanied by the following:

1. (1) A detailed explanation of the applicant's business model, and the technological capabilities and mechanisms that will be used for initial and continuing assessment of subject operators' fitness for membership in the safe harbor program;
2. (2) A copy of the full text of the guidelines for which approval is sought and any accompanying commentary;
3. (3) A comparison of each provision of §§ 312.2 through 312.8, and 312.10 with the corresponding provisions of the guidelines; and

4. (4) A statement explaining:

   1. (i) How the self-regulatory program guidelines, including the applicable assessment mechanisms, meet the requirements of this part; and
   2. (ii) How the assessment mechanisms and compliance consequences required under paragraphs (b)(2) and (b)(3) of this section provide effective enforcement of the requirements of this part.

(d) Reporting and recordkeeping requirements. Approved safe harbor programs shall:

1. (1) By October 22, 2025, and annually thereafter, submit a report to the Commission that identifies each subject operator and all approved websites or online services, as well as any subject operators that have left the safe harbor program. The report must also contain, at a minimum:

   1. (i) a narrative description of the safe harbor program's business model, including whether it provides additional services such as training to subject operators;
   2. (ii) copies of each consumer complaint related to each subject operator's violation of a safe harbor program's guidelines;
   3. (iii) an aggregated summary of the results of the independent assessments conducted under paragraph (b)(2) of this section;
   4. (iv) a description of each disciplinary action taken against any subject operator under paragraph (b)(3) of this section, as well as a description of the process for determining whether a subject operator is subject to discipline; and
   5. (v) a description of any approvals of member operators' use of a parental consent mechanism, pursuant to § 312.5(b)(3);
2. (2) Promptly respond to Commission requests for additional information;

3. (3) Maintain for a period not less than three years, and upon request make available to the Commission for inspection and copying:

   1. (i) Consumer complaints alleging violations of the guidelines by subject operators;
   2. (ii) Records of disciplinary actions taken against subject operators; and
   3. (iii) Results of the independent assessments of subject operators' compliance required under paragraph (b)(2) of this section; and
4. (4) No later than July 21, 2025, publicly post on each of the approved safe harbor program's websites and online services a list of all current subject operators and, for each such operator, list each certified website or online service. Approved safe harbor programs shall update this list every six months thereafter to reflect any changes to the approved safe harbor programs' subject operators or their applicable websites and online services.