I 

109TH CONGRESS 

1ST SESSION H. R. 29

To protect users of the Internet from unknowing transmission of their personally identifiable information through spyware programs, and for other 

purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JANUARY 4, 2005

Mrs. BONO (for herself, Mr. TOWNS, Mr. BARTON of Texas, Mr. BUYER, Mr. 

GILLMOR, Mr. HALL, Mr. RADANOVICH, Mr. WALDEN of Oregon, Mr. 

FERGUSON, Mr. WHITFIELD, Mrs. CUBIN, Mr. STEARNS, Mr. BILIRAKIS, 

Mr. TERRY, and Mr. OTTER) introduced the following bill; which was referred to the Committee on Energy and Commerce 

A BILL

To protect users of the Internet from unknowing transmission of their personally identifiable information 

through spyware programs, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Securely Protect Your5 self Against Cyber Trespass Act’’ or the ‘‘SPY ACT’’. 
2

•HR 29 IH 

1 SEC. 2. PROHIBITION OF DECEPTIVE ACTS OR PRACTICES 

2 RELATING TO SPYWARE. 

3 (a) PROHIBITION.—It is unlawful for any person, 

4 who is not the owner or authorized user of a protected 

5 computer, to engage in deceptive acts or practices that in6 volve any of the following conduct with respect to the pro7 tected computer: 

8 (1) Taking control of the computer by—

9 (A) utilizing such computer to send unso10 licited information or material from the pro11 tected computer to others; 

12 (B) diverting the Internet browser of the 

13 computer, or similar program of the computer 

14 used to access and navigate the Internet—

15 (i) without authorization of the owner 

16 or authorized user of the computer; and 

17 (ii) away from the site the user in18 tended to view, to one or more other Web 

19 pages, such that the user is prevented from 

20 viewing the content at the intended Web 

21 page, unless such diverting is otherwise au22 thorized; 

23 (C) accessing or using the modem, or 

24 Internet connection or service, for the computer 

25 and thereby causing damage to the computer or 
3

•HR 29 IH 

1 causing the owner or authorized user to incur 

2 unauthorized financial charges; 

3 (D) using the computer as part of an ac4 tivity performed by a group of computers that 

5 causes damage to another computer; or 

6 (E) delivering advertisements that a user 

7 of the computer cannot close without turning 

8 off the computer or closing all sessions of the 

9 Internet browser for the computer. 

10 (2) Modifying settings related to use of the 

11 computer or to the computer’s access to or use of 

12 the Internet by altering—

13 (A) the Web page that appears when the 

14 owner or authorized user launches an Internet 

15 browser or similar program used to access and 

16 navigate the Internet; 

17 (B) the default provider used to access or 

18 search the Internet, or other existing Internet 

19 connections settings; 

20 (C) a list of bookmarks used by the com21 puter to access Web pages; or 

22 (D) security or other settings of the com23 puter that protect information about the owner 

24 or authorized user for the purposes of causing 
4

•HR 29 IH 

1 damage or harm to the computer or owner or 

2 user. 

3 (3) Collecting personally identifiable informa4 tion through the use of a keystroke logging function. 

5 (4) Inducing the owner or authorized user to 

6 install a computer software component onto the 

7 computer, or preventing reasonable efforts to block 

8 the installation or execution of, or to disable, a com9 puter software component by—

10 (A) presenting the owner or authorized 

11 user with an option to decline installation of a 

12 software component such that, when the option 

13 is selected by the owner or authorized user, the 

14 installation nevertheless proceeds; or 

15 (B) causing a computer software compo16 nent that the owner or authorized user has 

17 properly removed or disabled to automatically 

18 reinstall or reactivate on the computer. 

19 (5) Misrepresenting that installing a separate 

20 software component or providing log-in and pass21 word information is necessary for security or privacy 

22 reasons, or that installing a separate software com23 ponent is necessary to open, view, or play a par24 ticular type of content. 
5

•HR 29 IH 

1 (6) Inducing the owner or authorized user to 

2 install or execute computer software by misrepre3 senting the identity or authority of the person or en4 tity providing the computer software to the owner or 

5 user. 

6 (7) Inducing the owner or authorized user to 

7 provide personally identifiable, password, or account 

8 information to another person—

9 (A) by misrepresenting the identity of the 

10 person seeking the information; or 

11 (B) without the authority of the intended 

12 recipient of the information. 

13 (8) Removing, disabling, or rendering inoper14 ative a security, anti-spyware, or anti-virus tech15 nology installed on the computer. 

16 (9) Installing or executing on the computer one 

17 or more additional computer software components 

18 with the intent of causing a person to use such com19 ponents in a way that violates any other provision of 

20 this section. 

21 (b) GUIDANCE.—The Commission shall issue guid22 ance regarding compliance with and violations of this sec23 tion. This subsection shall take effect upon the date of 

24 the enactment of this Act. 
6

•HR 29 IH 

1 (c) EFFECTIVE DATE.—Except as provided in sub2 section (b), this section shall take effect upon the expira3 tion of the 6-month period that begins on the date of the 

4 enactment of this Act. 

5 SEC. 3. PROHIBITION OF COLLECTION OF CERTAIN INFOR6 MATION WITHOUT NOTICE AND CONSENT. 

7 (a) OPT-IN REQUIREMENT.—Except as provided in 

8 subsection (e), it is unlawful for any person—

9 (1) to transmit to a protected computer, which 

10 is not owned by such person and for which such per11 son is not an authorized user, any information col12 lection program, unless—

13 (A) such information collection program 

14 provides notice in accordance with subsection 

15 (c) before execution of any of the information 

16 collection functions of the program; and 

17 (B) such information collection program 

18 includes the functions required under sub19 section (d); or 

20 (2) to execute any information collection pro21 gram installed on such a protected computer un22 less—

23 (A) before execution of any of the informa24 tion collection functions of the program, the 

25 owner or an authorized user of the protected 
7

•HR 29 IH 

1 computer has consented to such execution pur2 suant to notice in accordance with subsection 

3 (c); and 

4 (B) such information collection program 

5 includes the functions required under sub6 section (d). 

7 (b) INFORMATION COLLECTION PROGRAM.—For pur8 poses of this section, the term ‘‘information collection pro9 gram’’ means computer software that—

10 (1)(A) collects personally identifiable informa11 tion; and 

12 (B)(i) sends such information to a person other 

13 than the owner or authorized user of the computer, 

14 or 

15 (ii) uses such information to deliver advertising 

16 to, or display advertising, on the computer; or 

17 (2)(A) collects information regarding the Web 

18 pages accessed using the computer; and 

19 (B) uses such information to deliver advertising 

20 to, or display advertising on, the computer. 

21 (c) NOTICE AND CONSENT.—

22 (1) IN GENERAL.—Notice in accordance with 

23 this subsection with respect to an information collec24 tion program is clear and conspicuous notice in plain 
8

•HR 29 IH 

1 language, set forth as the Commission shall provide, 

2 that meets all of the following requirements: 

3 (A) The notice clearly distinguishes such 

4 notice from any other information visually pre5 sented contemporaneously on the protected 

6 computer. 

7 (B) The notice contains one of the fol8 lowing statements, as applicable, or a substan9 tially similar statement: 

10 (i) With respect to an information col11 lection program described in subsection 

12 (b)(1): ‘‘This program will collect and 

13 transmit information about you. Do you 

14 accept?’’. 

15 (ii) With respect to an information 

16 collection program described in subsection 

17 (b)(2): ‘‘This program will collect informa18 tion about Web pages you access and will 

19 use that information to display advertising 

20 on your computer. Do you accept?’’. 

21 (iii) With respect to an information 

22 collection program that performs the ac23 tions described in both paragraphs (1) and 

24 (2) of subsection (b): ‘‘This program will 

25 collect and transmit information about you 
9

•HR 29 IH 

1 and your computer use and will collect in2 formation about Web pages you access and 

3 use that information to display advertising 

4 on your computer. Do you accept?’’. 

5 (C) The notice provides for the user—

6 (i) to grant or deny consent referred 

7 to in subsection (a) by selecting an option 

8 to grant or deny such consent; and 

9 (ii) to abandon or cancel the trans10 mission or execution referred to in sub11 section (a) without granting or denying 

12 such consent. 

13 (D) The notice provides an option for the 

14 user to select to display on the computer, before 

15 granting or denying consent using the option 

16 required under subparagraph (C), a clear de17 scription of—

18 (i) the types of information to be col19 lected and sent (if any) by the information 

20 collection program; 

21 (ii) the purpose for which such infor22 mation is to be collected and sent; and 

23 (iii) in the case of an information col24 lection program that first executes any of 

25 the information collection functions of the 
10

•HR 29 IH 

1 program together with the first execution 

2 of other computer software, the identity of 

3 any such software that is an information 

4 collection program. 

5 (E) The notice provides for concurrent dis6 play of the information required under subpara7 graphs (B) and (C) and the option required 

8 under subparagraph (D) until the user—

9 (i) grants or denies consent using the 

10 option required under subparagraph (C)(i); 

11 (ii) abandons or cancels the trans12 mission or execution pursuant to subpara13 graph (C)(ii); or 

14 (ii) selects the option required under 

15 subparagraph (D). 

16 (2) SINGLE NOTICE.—The Commission shall 

17 provide that, in the case in which multiple informa18 tion collection programs are provided to the pro19 tected computer together, or as part of a suite of 

20 functionally-related software, the notice require21 ments of paragraphs (1)(A) and (2)(A) of subsection 

22 (a) may be met by providing, before execution of any 

23 of the information collection functions of the pro24 grams, clear and conspicuous notice in plain lan25 guage in accordance with paragraph (1) of this sub-
11

•HR 29 IH 

1 section by means of a single notice that applies to 

2 all such information collection programs, except that 

3 such notice shall provide the option under subpara4 graph (D) of paragraph (1) of this subsection with 

5 respect to each such information collection program. 

6 (3) CHANGE IN INFORMATION COLLECTION.—If 

7 an owner or authorized user has granted consent to 

8 execution of an information collection program pur9 suant to a notice in accordance with this subsection: 

10 (A) IN GENERAL.—No subsequent such 

11 notice is required, except as provided in sub12 paragraph (B). 

13 (B) SUBSEQUENT NOTICE.—The person 

14 who transmitted the program shall provide an15 other notice in accordance with this subsection 

16 and obtain consent before such program may be 

17 used to collect or send information of a type or 

18 for a purpose that is materially different from, 

19 and outside the scope of, the type or purpose 

20 set forth in the initial or any previous notice. 

21 (4) REGULATIONS.—The Commission shall 

22 issue regulations to carry out this subsection. 

23 (d) REQUIRED FUNCTIONS.—The functions required 

24 under this subsection to be included in an information col25 lection program that executes any information collection 
12

•HR 29 IH 

1 functions with respect to a protected computer are as fol2 lows: 

3 (1) DISABLING FUNCTION.—With respect to 

4 any information collection program, a function of 

5 the program that allows a user of the program to re6 move the program or disable operation of the pro7 gram with respect to such protected computer by a 

8 function that—

9 (A) is easily identifiable to a user of the 

10 computer; and 

11 (B) can be performed without undue effort 

12 or knowledge by the user of the protected com13 puter. 

14 (2) IDENTITY FUNCTION.—With respect only to 

15 an information collection program that uses informa16 tion collected in the manner described in paragraph 

17 (1)(B)(ii) or (2)(B) of subsection (b), a function of 

18 the program that provides that each display of an 

19 advertisement directed or displayed using such infor20 mation when the owner or authorized user is access21 ing a Web page or online location other than of the 

22 provider of the software is accompanied by the name 

23 of the information collection program, a logogram or 

24 trademark used for the exclusive purpose of identi-
13

•HR 29 IH 

1 fying the program, or a statement or other informa2 tion sufficient to clearly identify the program. 

3 (3) RULEMAKING.—The Commission may issue 

4 regulations to carry out this subsection. 

5 (e) LIMITATION ON LIABILITY.—A telecommuni6 cations carrier, a provider of information service or inter7 active computer service, a cable operator, or a provider 

8 of transmission capability shall not be liable under this 

9 section to the extent that the carrier, operator, or pro10 vider—

11 (1) transmits, routes, hosts, stores, or provides 

12 connections for an information collection program 

13 through a system or network controlled or operated 

14 by or for the carrier, operator, or provider; or 

15 (2) provides an information location tool, such 

16 as a directory, index, reference, pointer, or hypertext 

17 link, through which the owner or user of a protected 

18 computer locates an information collection program. 

19 SEC. 4. ENFORCEMENT. 

20 (a) UNFAIR OR DECEPTIVE ACT OR PRACTICE.—

21 This Act shall be enforced by the Commission under the 

22 Federal Trade Commission Act (15 U.S.C. 41 et seq.). 

23 A violation of any provision of this Act or of a regulation 

24 issued under this Act committed with actual knowledge 

25 or knowledge fairly implied on the basis of objective cir-
14

•HR 29 IH 

1 cumstances that such act is unfair or deceptive or violates 

2 this Act shall be treated as an unfair or deceptive act or 

3 practice violating a rule promulgated under section 18 of 

4 the Federal Trade Commission Act (15 U.S.C. 57a). 

5 (b) PENALTY FOR PATTERN OR PRACTICE VIOLA6 TIONS.—

7 (1) IN GENERAL.—Notwithstanding subsection 

8 (a) and the Federal Trade Commission Act, in the 

9 case of a person who engages in a pattern or prac10 tice that violates section 2 or 3, the Commission 

11 may, in its discretion, seek a civil penalty for such 

12 pattern or practice of violations in an amount, as de13 termined by the Commission, of not more than—

14 (A) $3,000,000 for each violation of sec15 tion 2; and 

16 (B) $1,000,000 for each violation of sec17 tion 3. 

18 (2) TREATMENT OF SINGLE ACTION OR CON19 DUCT.—In applying paragraph (1)—

20 (A) any single action or conduct that vio21 lates section 2 or 3 with respect to multiple 

22 protected computers shall be treated as a single 

23 violation; and 

24 (B) any single action or conduct that vio25 lates more than one paragraph of section 2(a) 
15

•HR 29 IH 

1 shall be considered multiple violations, based on 

2 the number of such paragraphs violated. 

3 (c) EXCLUSIVENESS OF REMEDIES.—The remedies 

4 in this section (including remedies available to the Com5 mission under the Federal Trade Commission Act) are the 

6 exclusive remedies for violations of this Act. 

7 (d) EFFECTIVE DATE.—This section shall take effect 

8 on the date of the enactment of this Act, but only to the 

9 extent that this section applies to violations of section 

10 2(a). 

11 SEC. 5. LIMITATIONS. 

12 (a) LAW ENFORCEMENT AUTHORITY.—Sections 2 

13 and 3 of this Act shall not apply to—

14 (1) any act taken by a law enforcement agent 

15 in the performance of official duties; or 

16 (2) the transmission or execution of an infor17 mation collection program in compliance with a law 

18 enforcement, investigatory, national security, or reg19 ulatory agency or department of the United States 

20 or any State in response to a request or demand 

21 made under authority granted to that agency or de22 partment, including a warrant issued under the Fed23 eral Rules of Criminal Procedure, an equivalent 

24 State warrant, a court order, or other lawful proc25 ess. 
16

•HR 29 IH 

1 (b) EXCEPTION RELATING TO SECURITY.—Nothing 

2 in this Act shall apply to—

3 (1) any monitoring of, or interaction with, a 

4 subscriber’s Internet or other network connection or 

5 service, or a protected computer, by a telecommuni6 cations carrier, cable operator, computer hardware 

7 or software provider, or provider of information serv8 ice or interactive computer service, to the extent that 

9 such monitoring or interaction is for network or 

10 computer security purposes, diagnostics, technical 

11 support, or repair, or for the detection or prevention 

12 of fraudulent activities; or 

13 (2) a discrete interaction with a protected com14 puter by a provider of computer software solely to 

15 determine whether the user of the computer is au16 thorized to use such software, that occurs upon—

17 (A) initialization of the software; or 

18 (B) an affirmative request by the owner or 

19 authorized user for an update of, addition to, or 

20 technical service for, the software. 

21 (c) GOOD SAMARITAN PROTECTION.—No provider of 

22 computer software or of interactive computer service may 

23 be held liable under this Act on account of any action vol24 untarily taken, or service provided, in good faith to remove 

25 or disable a program used to violate section 2 or 3 that 
17

•HR 29 IH 

1 is installed on a computer of a customer of such provider, 

2 if such provider notifies the customer and obtains the con3 sent of the customer before undertaking such action or 

4 providing such service. 

5 (d) LIMITATION ON LIABILITY.—A manufacturer or 

6 retailer of computer equipment shall not be liable under 

7 this Act to the extent that the manufacturer or retailer 

8 is providing third party branded software that is installed 

9 on the equipment the manufacturer or retailer is manufac10 turing or selling. 

11 SEC. 6. EFFECT ON OTHER LAWS. 

12 (a) PREEMPTION OF STATE LAW.—

13 (1) PREEMPTION OF SPYWARE LAWS.—This 

14 Act supersedes any provision of a statute, regula15 tion, or rule of a State or political subdivision of a 

16 State that expressly regulates—

17 (A) deceptive conduct with respect to com18 puters similar to that described in section 2(a); 

19 (B) the transmission or execution of a 

20 computer program similar to that described in 

21 section 3; or 

22 (C) the use of computer software that dis23 plays advertising content based on the Web 

24 pages accessed using a computer. 

25 (2) ADDITIONAL PREEMPTION.—
18

•HR 29 IH 

1 (A) IN GENERAL.—No person other than 

2 the Attorney General of a State may bring a 

3 civil action under the law of any State if such 

4 action is premised in whole or in part upon the 

5 defendant violating any provision of this Act. 

6 (B) PROTECTION OF CONSUMER PROTEC7 TION LAWS.—This paragraph shall not be con8 strued to limit the enforcement of any State 

9 consumer protection law by an Attorney Gen10 eral of a State. 

11 (3) PROTECTION OF CERTAIN STATE LAWS.—

12 This Act shall not be construed to preempt the ap13 plicability of—

14 (A) State trespass, contract, or tort law; or 

15 (B) other State laws to the extent that 

16 those laws relate to acts of fraud. 

17 (b) PRESERVATION OF FTC AUTHORITY.—Nothing 

18 in this Act may be construed in any way to limit or affect 

19 the Commission’s authority under any other provision of 

20 law, including the authority to issue advisory opinions 

21 (under Part 1 of Volume 16 of the Code of Federal Regu22 lations), policy statements, or guidance regarding this Act. 

23 SEC. 7. ANNUAL FTC REPORT. 

24 For the 12-month period that begins upon the effec25 tive date under section 11(a) and for each 12-month pe-
19

•HR 29 IH 

1 riod thereafter, the Commission shall submit a report to 

2 the Congress that—

3 (1) specifies the number and types of actions 

4 taken during such period to enforce sections 2(a) 

5 and 3, the disposition of each such action, any pen6 alties levied in connection with such actions, and any 

7 penalties collected in connection with such actions; 

8 and 

9 (2) describes the administrative structure and 

10 personnel and other resources committed by the 

11 Commission for enforcement of this Act during such 

12 period. 

13 Each report under this subsection for a 12-month period 

14 shall be submitted not later than 90 days after the expira15 tion of such period. 

16 SEC. 8. FTC REPORT ON COOKIES. 

17 (a) IN GENERAL.—Not later than the expiration of 

18 the 6-month period that begins on the date of the enact19 ment of this Act, the Commission shall submit a report 

20 to the Congress regarding the use of tracking cookies in 

21 the delivery or display of advertising to the owners and 

22 users of computers. The report shall examine and describe 

23 the methods by which such tracking cookies and the 

24 websites that place them on computers function separately 

25 and together, and the extent to which they are covered 
20

•HR 29 IH 

1 or affected by this Act. The report may include such rec2 ommendations as the Commission considers necessary and 

3 appropriate, including treatment of tracking cookies under 

4 this Act or other laws. 

5 (b) DEFINITION.—For purposes of this section, the 

6 term ‘‘tracking cookie’’ means a cookie or similar text or 

7 data file used alone or in conjunction with one or more 

8 websites to transmit or convey personally identifiable in9 formation of a computer owner or user, or information re10 garding Web pages accessed by the owner or user, to a 

11 party other than the intended recipient, for the purpose 

12 of—

13 (1) delivering or displaying advertising to the 

14 owner or user; or 

15 (2) assisting the intended recipient to deliver or 

16 display advertising to the owner, user, or others. 

17 (c) EFFECTIVE DATE.—This section shall take effect 

18 on the date of the enactment of this Act. 

19 SEC. 9. REGULATIONS. 

20 (a) IN GENERAL.—The Commission shall issue the 

21 regulations required by this Act not later than the expira22 tion of the 6-month period beginning on the date of the 

23 enactment of this Act. Any regulations issued pursuant 

24 to this Act shall be issued in accordance with section 553 

25 of title 5, United States Code. 
21

•HR 29 IH 

1 (b) EFFECTIVE DATE.—This section shall take effect 

2 on the date of the enactment of this Act. 

3 SEC. 10. DEFINITIONS. 

4 For purposes of this Act: 

5 (1) CABLE OPERATOR.—The term ‘‘cable oper6 ator’’ has the meaning given such term in section 

7 602 of the Communications Act of 1934 (47 U.S.C. 

8 522). 

9 (2) COLLECT.—The term ‘‘collect’’, when used 

10 with respect to information and for purposes only of 

11 section 3, does not include obtaining of the informa12 tion by a party who is intended by the owner or au13 thorized user of a protected computer to receive the 

14 information pursuant to the owner or authorized 

15 user—

16 (A) transferring the information to such 

17 intended recipient using the protected com18 puter; or 

19 (B) storing the information on the pro20 tected computer in a manner so that it is acces21 sible by such intended recipient. 

22 (3) COMPUTER; PROTECTED COMPUTER.—The 

23 terms ‘‘computer’’ and ‘‘protected computer’’ have 

24 the meanings given such terms in section 1030(e) of 

25 title 18, United States Code. 
22

•HR 29 IH 

1 (4) COMPUTER SOFTWARE.—

2 (A) IN GENERAL.—Except as provided in 

3 subparagraph (B), the term ‘‘computer soft4 ware’’ means a set of statements or instructions 

5 that can be installed and executed on a com6 puter for the purpose of bringing about a cer7 tain result. 

8 (B) EXCEPTION FOR COOKIES.—Such term 

9 does not include—

10 (i) a cookie or other text or data file 

11 that is placed on the computer system of 

12 a user by an Internet service provider, 

13 interactive computer service, or Internet 

14 website to return information to such pro15 vider, service, or website; or 

16 (ii) computer software that is placed 

17 on the computer system of a user by an 

18 Internet service provider, interactive com19 puter service, or Internet website solely to 

20 enable the user subsequently to use such 

21 provider or service or to access such 

22 website. 

23 (5) COMMISSION.—The term ‘‘Commission’’ 

24 means the Federal Trade Commission. 
23

•HR 29 IH 

1 (6) DAMAGE.—The term ‘‘damage’’ has the 

2 meaning given such term in section 1030(e) of title 

3 18, United States Code. 

4 (7) DECEPTIVE ACTS OR PRACTICES.—The 

5 term ‘‘deceptive acts or practices’’ has the meaning 

6 applicable to such term for purposes of section 5 of 

7 the Federal Trade Commission Act (15 U.S.C. 45). 

8 (8) DISABLE.—The term ‘‘disable’’ means, with 

9 respect to an information collection program, to per10 manently prevent such program from executing any 

11 of the functions described in section 3(b) that such 

12 program is otherwise capable of executing (including 

13 by removing, deleting, or disabling the program), un14 less the owner or operator of a protected computer 

15 takes a subsequent affirmative action to enable the 

16 execution of such functions. 

17 (9) INFORMATION COLLECTION FUNCTIONS.—

18 The term ‘‘information collection functions’’ means, 

19 with respect to an information collection program, 

20 the functions of the program described in subsection 

21 (b) of section 3. 

22 (10) INFORMATION SERVICE.—The term ‘‘infor23 mation service’’ has the meaning given such term in 

24 section 3 of the Communications Act of 1934 (47 

25 U.S.C. 153). 
24

•HR 29 IH 

1 (11) INTERACTIVE COMPUTER SERVICE.—The 

2 term ‘‘interactive computer service’’ has the meaning 

3 given such term in section 230(f) of the Communica4 tions Act of 1934 (47 U.S.C. 230(f)). 

5 (12) INTERNET.—The term ‘‘Internet’’ means 

6 collectively the myriad of computer and tele7 communications facilities, including equipment and 

8 operating software, which comprise the inter9 connected world-wide network of networks that em10 ploy the Transmission Control Protocol/Internet 

11 Protocol, or any predecessor or successor protocols 

12 to such protocol, to communicate information of all 

13 kinds by wire or radio. 

14 (13) PERSONALLY IDENTIFIABLE INFORMA15 TION.—

16 (A) IN GENERAL.—The term ‘‘personally 

17 identifiable information’’ means the following 

18 information, to the extent only that such infor19 mation allows a living individual to be identified 

20 from that information: 

21 (i) First and last name of an indi22 vidual. 

23 (ii) A home or other physical address 

24 of an individual, including street name, 

25 name of a city or town, and zip code. 
25

•HR 29 IH 

1 (iii) An electronic mail address. 

2 (iv) A telephone number. 

3 (v) A social security number, tax iden4 tification number, passport number, driv5 er’s license number, or any other govern6 ment-issued identification number. 

7 (vi) A credit card number. 

8 (vii) Any access code, password, or ac9 count number, other than an access code 

10 or password transmitted by an owner or 

11 authorized user of a protected computer to 

12 the intended recipient to register for, or 

13 log onto, a Web page or other Internet 

14 service or a network connection or service 

15 of a subscriber that is protected by an ac16 cess code or password. 

17 (viii) Date of birth, birth certificate 

18 number, or place of birth of an individual, 

19 except in the case of a date of birth trans20 mitted or collected for the purpose of com21 pliance with the law. 

22 (B) RULEMAKING.—The Commission may, 

23 by regulation, add to the types of information 

24 specified under paragraph (1) that shall be con25 sidered personally identifiable information for 
26

•HR 29 IH 

1 purposes of this Act, except that such informa2 tion may not include any record of aggregate 

3 data that does not identify particular persons, 

4 particular computers, particular users of com5 puters, or particular email addresses or other 

6 locations of computers with respect to the 

7 Internet. 

8 (14) SUITE OF FUNCTIONALLY RELATED SOFT9 WARE.—The term ‘suite of functionally related software‘ 

10 means a group of computer software programs dis11 tributed to an end user by a single provider, which 

12 programs are necessary to enable features or 

13 functionalities of an integrated service offered by the 

14 provider. 

15 (15) TELECOMMUNICATIONS CARRIER.—The 

16 term ‘‘telecommunications carrier’’ has the meaning 

17 given such term in section 3 of the Communications 

18 Act of 1934 (47 U.S.C. 153). 

19 (16) TRANSMIT.—The term ‘‘transmit’’ means, 

20 with respect to an information collection program, 

21 transmission by any means. 

22 (17) WEB PAGE.—The term ‘‘Web page’’ means 

23 a location, with respect to the World Wide Web, that 

24 has a single Uniform Resource Locator or another 
27

•HR 29 IH 

1 single location with respect to the Internet, as the 

2 Federal Trade Commission may prescribe. 

3 SEC. 11. APPLICABILITY AND SUNSET. 

4 (a) EFFECTIVE DATE.—Except as specifically pro5 vided otherwise in this Act, this Act shall take effect upon 

6 the expiration of the 12-month period that begins on the 

7 date of the enactment of this Act. 

8 (b) APPLICABILITY.—Section 3 shall not apply to an 

9 information collection program installed on a protected 

10 computer before the effective date under subsection (a) of 

11 this section. 

12 (c) SUNSET.—This Act shall not apply after Decem13 ber 31, 2010.

Æ