; (3) the extent to which the device minimizes the collection, retention, and use of information from a child or minor; (4) the location of privacy policies; (5) the type of personal information the connected device may collect; and (6) any other information as the Commission considers appropriate. (c) Regulations Not later than 1 year after the date of enactment of this Act, the Commission shall promulgate, under section 553 of title 5, United States Code, regulations to implement this section. 9. Prohibition on sale of connected devices for children and minors that fail to meet appropriate cybersecurity and data security standards (a) Prohibition Beginning 1 year after the date of enactment of this Act, or such earlier date as the Commission considers appropriate, no person may sell a connected device unless the connected device meets appropriate cybersecurity and data security standards established by the Commission. (b) Cybersecurity and data security standards (1) In general The Commission shall promulgate, under section 553 of title 5, United States Code, cybersecurity and data security standards described in subsection (a). (2) Considerations In promulgating cybersecurity and data security standards under paragraph (1), the Commission shall— (A) create cybersecurity and data security standards for different subsets of connected devices based on the varying degrees of— (i) cybersecurity and data security risk associated with each subset of connected device; (ii) sensitivity of information collected, stored, or transmitted by each subset of connected device; and (iii) functionality of each subset of connected device; (B) consider incorporating, to the extent practicable, existing cybersecurity and data security standards; and (C) ensure that the cybersecurity and data security standards— (i) are consistent with Fair Information Practice Principles described in section 4