; and (iii) the changing business arrangements of the operator. (D) Submission of policies to the FTC An operator of a children’s service shall submit the policies, practices, and procedures established by the operator under subparagraph (A) to the Commission in conjunction with a notification of a breach of security required by any Federal or State statute or regulation or upon request of the Commission. (b) Rulemaking regarding requirements for digital services likely To be accessed by children or teenagers (1) In general The Commission shall promulgate regulations under section 553 of title 5, United States Code, that contain requirements for operators of digital services that are not children’s services but are likely to be accessed by children or teenagers, which shall be based on the requirements of subsection (a) but modified as the Commission considers appropriate given a risk-based approach to determine age and to determine and mitigate privacy risks and security risks to the child or teenager, and given differing developmental needs and cognitive capacities of children or teenagers. The Commission may include in such regulations different requirements for operators of different types of such services. (2) Best interests of child or teenager The regulations promulgated under paragraph (1) shall require an operator to make the best interests of children and teenagers a primary design consideration when designing its service, including by conducting a privacy and security impact assessment and mitigation for the service. (3) Risk-based approach to determining age of user (A) In general The regulations promulgated under paragraph (1) shall require a risk-based approach to determining the age of a specific user of a digital service under which higher privacy risks and security risks from the processing of covered information require a higher certainty of age assurance. (B) Age assurance The regulations promulgated under paragraph (1) shall require an operator to conduct an age assurance to determine the age