Do Not Track Online Act of 2015

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Do Not Track Online Act of 2015''.

SEC. 2. REGULATIONS RELATING TO ``DO-NOT-TRACK'' MECHANISMS.

    (a) In General.--Not later than 1 year after the date of the 
enactment of this Act, the Federal Trade Commission shall promulgate--
            (1) regulations that establish standards for the 
        implementation of a mechanism by which an individual can simply 
        and easily indicate whether the individual prefers to have 
        personal information collected by providers of online services, 
        including by providers of mobile applications and services; and
            (2) rules that prohibit, except as provided in subsection 
        (b), such providers from--
                    (A) collecting personal information on individuals 
                who have expressed, via a mechanism that meets the 
                standards promulgated under paragraph (1), a preference 
                not to have such information collected; and
                    (B) discriminating against individuals described in 
                subparagraph (A).
    (b) Exception.--The rules promulgated under paragraph (2) of 
subsection (a) shall allow for the collection and use of personal 
information on an individual described in such paragraph, 
notwithstanding the expressed preference of the individual via a 
mechanism that meets the standards promulgated under paragraph (1) of 
such subsection, to the extent--
            (1) necessary to provide a service requested by the 
        individual, including with respect to such service, basic 
        functionality and effectiveness, so long as such information is 
        anonymized or deleted upon the provision of such service; or
            (2) the individual--
                    (A) receives clear, conspicuous, and accurate 
                notice on the collection and use of such information; 
                and
                    (B) affirmatively consents to such collection and 
                use.
    (c) Factors.--In promulgating standards and rules under subsection 
(a), the Federal Trade Commission shall consider and take into account 
the following:
            (1) The appropriate scope of such standards and rules, 
        including the conduct to which such rules shall apply and the 
        persons required to comply with such rules.
            (2) The technical feasibility and costs of--
                    (A) implementing mechanisms that would meet such 
                standards; and
                    (B) complying with such rules.
            (3) Mechanisms that--
                    (A) have been developed or used before the date of 
                the enactment of this Act; and
                    (B) are for individuals to indicate simply and 
                easily whether the individuals prefer to have personal 
                information collected by providers of online services, 
                including by providers of mobile applications and 
                services.
            (4) The experience of individuals using the mechanisms 
        regarding the ease of use and practicality of the mechanisms, 
        including the universality, persistence, and stability of 
        preferences expressed through the mechanisms.
            (5) How mechanisms that meet such standards should be 
        publicized and offered to individuals.
            (6) Whether and how information can be collected and used 
        on an anonymous basis so that the information--
                    (A) cannot be reasonably linked or identified with 
                a person or device, both on its own and in combination 
                with other information; and
                    (B) does not qualify as personal information 
                subject to the rules promulgated under subsection 
                (a)(2).
            (7) The standards under which personal information may be 
        collected and used, subject to the anonymization or deletion 
        requirements of subsection (b)(1)--
                    (A) to fulfill the basic functionality and 
                effectiveness of an online service, including a mobile 
                application or service;
                    (B) to provide the content or services requested by 
                individuals who have otherwise expressed, via a 
                mechanism that meets the standards promulgated under 
                subsection (a)(1), a preference not to have personal 
                information collected; and
                    (C) for such other purposes as the Commission 
                determines substantially facilitates the functionality 
                and effectiveness of the online service, or mobile 
                application or service, in a manner that does not 
                undermine an individual's preference, expressed via 
                such mechanism, not to collect such information.
    (d) Personal Information.--In this section, the term ``personal 
information'' includes persistent identifiers such as Internet Protocol 
(IP) addresses, media access control (MAC) addresses, and other unique 
device identifiers.
    (e) Rulemaking.--The Federal Trade Commission shall promulgate the 
standards and rules required by subsection (a) in accordance with 
section 553 of title 5, United States Code.

SEC. 3. ENFORCEMENT OF ``DO-NOT-TRACK'' MECHANISMS.

    (a) Enforcement by Federal Trade Commission.--
            (1) Unfair or deceptive acts or practices.--A violation of 
        a rule promulgated under section 2(a)(2) shall be treated as an 
        unfair and deceptive act or practice in violation of a 
        regulation under section 18(a)(1)(B) of the Federal Trade 
        Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or 
        deceptive acts or practices.
            (2) Powers of commission.--
                    (A) In general.--Except as provided in subparagraph 
                (C), the Federal Trade Commission shall enforce this 
                Act in the same manner, by the same means, and with the 
                same jurisdiction, powers, and duties as though all 
                applicable terms and provisions of the Federal Trade 
                Commission Act (15 U.S.C. 41 et seq.) were incorporated 
                into and made a part of this Act.
                    (B) Privileges and immunities.--Except as provided 
                in subparagraph (C), any person who violates this Act 
                shall be subject to the penalties and entitled to the 
                privileges and immunities provided in the Federal Trade 
                Commission Act (15 U.S.C. 41 et seq.).
                    (C) Nonprofit organizations.--The Federal Trade 
                Commission shall enforce this Act with respect to an 
                organization that is not organized to carry on business 
                for its own profit or that of its members as if such 
                organization were a person over which the Commission 
                has authority pursuant to section 5(a)(2) of the 
                Federal Trade Commission Act (15 U.S.C. 45(a)(2)).
    (b) Enforcement by States.--
            (1) In general.--In any case in which the attorney general 
        of a State has reason to believe that an interest of the 
        residents of the State has been or is threatened or adversely 
        affected by the engagement of any person subject to a rule 
        promulgated under section 2(a)(2) in a practice that violates 
        the rule, the attorney general of the State may, as parens 
        patriae, bring a civil action on behalf of the residents of the 
        State in an appropriate district court of the United States--
                    (A) to enjoin further violation of such rule by 
                such person;
                    (B) to compel compliance with such rule;
                    (C) to obtain damages, restitution, or other 
                compensation on behalf of such residents;
                    (D) to obtain such other relief as the court 
                considers appropriate; or
                    (E) to obtain civil penalties in the amount 
                determined under paragraph (2).
            (2) Civil penalties.--
                    (A) Calculation.--Subject to subparagraph (B), for 
                purposes of imposing a civil penalty under paragraph 
                (1)(E) with respect to a person that violates a rule 
                promulgated under section 2(a)(2), the amount 
                determined under this paragraph is the amount 
                calculated by multiplying the number of days that the 
                person is not in compliance with the rule by an amount 
                not greater than $16,000.
                    (B) Maximum total liability.--The total amount of 
                civil penalties that may be imposed with respect to a 
                person that violates a rule promulgated under section 
                2(a)(2) shall not exceed $15,000,000 for all civil 
                actions brought against such person under paragraph (1) 
                for such violation.
                    (C) Adjustment for inflation.--Beginning on the 
                date on which the Bureau of Labor Statistics first 
                publishes the Consumer Price Index after the date that 
                is 1 year after the date of the enactment of this Act, 
                and annually thereafter, the amounts specified in 
                subparagraphs (A) and (B) shall be increased by the 
                percentage increase in the Consumer Price Index 
                published on that date from the Consumer Price Index 
                published the previous year.
            (3) Rights of federal trade commission.--
                    (A) Notice to federal trade commission.--
                            (i) In general.--Except as provided in 
                        clause (iii), the attorney general of a State 
                        shall notify the Federal Trade Commission in 
                        writing that the attorney general intends to 
                        bring a civil action under paragraph (1) before 
                        initiating the civil action.
                            (ii) Contents.--The notification required 
                        by clause (i) with respect to a civil action 
                        shall include a copy of the complaint to be 
                        filed to initiate the civil action.
                            (iii) Exception.--If it is not feasible for 
                        the attorney general of a State to provide the 
                        notification required by clause (i) before 
                        initiating a civil action under paragraph (1), 
                        the attorney general shall notify the Federal 
                        Trade Commission immediately upon instituting 
                        the civil action.
                    (B) Intervention by federal trade commission.--The 
                Federal Trade Commission may--
                            (i) intervene in any civil action brought 
                        by the attorney general of a State under 
                        paragraph (1); and
                            (ii) upon intervening--
                                    (I) be heard on all matters arising 
                                in the civil action; and
                                    (II) file petitions for appeal of a 
                                decision in the civil action.
            (4) Investigatory powers.--Nothing in this subsection may 
        be construed to prevent the attorney general of a State from 
        exercising the powers conferred on the attorney general by the 
        laws of the State to conduct investigations, to administer 
        oaths or affirmations, or to compel the attendance of witnesses 
        or the production of documentary or other evidence.
            (5) Preemptive action by federal trade commission.--If the 
        Federal Trade Commission institutes a civil action or an 
        administrative action with respect to a violation of a rule 
        promulgated under section 2(a)(2), the attorney general of a 
        State may not, during the pendency of such action, bring a 
        civil action under paragraph (1) against any defendant named in 
        the complaint of the Commission for the violation with respect 
        to which the Commission instituted such action.
            (6) Venue; service of process.--
                    (A) Venue.--Any action brought under paragraph (1) 
                may be brought in--
                            (i) the district court of the United States 
                        that meets applicable requirements relating to 
                        venue under section 1391 of title 28, United 
                        States Code; or
                            (ii) another court of competent 
                        jurisdiction.
                    (B) Service of process.--In an action brought under 
                paragraph (1), process may be served in any district in 
                which the defendant--
                            (i) is an inhabitant; or
                            (ii) may be found.
            (7) Actions by other state officials.--
                    (A) In general.--In addition to civil actions 
                brought by attorneys general under paragraph (1), any 
                other officer of a State who is authorized by the State 
                to do so may bring a civil action under paragraph (1), 
                subject to the same requirements and limitations that 
                apply under this subsection to civil actions brought by 
                attorneys general.
                    (B) Savings provision.--Nothing in this subsection 
                may be construed to prohibit an authorized official of 
                a State from initiating or continuing any proceeding in 
                a court of the State for a violation of any civil or 
                criminal law of the State.
    (c) Private Right of Action.--
            (1) In general.--A person may, if otherwise permitted by 
        the laws or rules of court of a State, bring in an appropriate 
        court of that State--
                    (A) an action based on a violation of a rule 
                promulgated under section 2(a)(2) to enjoin such 
                violation;
                    (B) an action to recover for actual monetary loss 
                from such a violation, or to receive $500 in damages 
                for each such violation, whichever is greater; or
                    (C) both such actions.
            (2) Increased penalties.--If the court finds that the 
        defendant willfully or knowingly violated a rule promulgated 
        under section 2(a)(2), the court may, in its discretion, 
        increase the amount of the award to an amount equal to not more 
        than 3 times the amount available under paragraph (1)(B).

SEC. 4. BIENNIAL REVIEW AND ASSESSMENT.

    Not later than 2 years after the effective date of the regulations 
initially promulgated under section 2, the Federal Trade Commission 
shall--
            (1) review the implementation of this Act;
            (2) assess the effectiveness of such regulations, including 
        how such regulations define or interpret the term ``personal 
        information'' as such term is used in section 2;
            (3) assess the effect of such regulations on online 
        commerce; and
            (4) submit to Congress a report on the results of the 
        review and assessments required by this section.

Summary: Do Not Track Online Act of 2015 This bill requires the Federal Trade Commission (FTC) to promulgate: (1) regulations that establish standards for the implementation of a mechanism by which individuals can indicate whether they prefer to have personal information collected by providers of online services, including by providers of mobile applications and services. And (2) rules that prohibit such providers from collecting personal information on, and from discriminating against, individuals who have expressed a preference not to have such information collected. Personal information includes IP addresses, media access control addresses, and other unique device identifiers. The rules must allow for the collection and use of personal information, notwithstanding the expressed preference of the individual, if: (1) the information is necessary to provide a service requested by the individual so long as identifying particulars are removed or the information is deleted upon the provision of such service. Or (2) the individual receives clear, conspicuous, and accurate notice on, and consents to, such collection and use. The bill provides for FTC and state enforcement of such rules and regulations. If permitted under state law, a person may bring a private action to enjoin a violation or to receive monetary damages.