Union Calendar No. 15

109TH CONGRESS 

1ST SESSION H. R. 29

[Report No. 109–32] 

To protect users of the Internet from unknowing transmission of their personally identifiable information through spyware programs, and for other 

purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JANUARY 4, 2005

Mrs. BONO (for herself, Mr. TOWNS, Mr. BARTON of Texas, Mr. BUYER, Mr. 

GILLMOR, Mr. HALL, Mr. RADANOVICH, Mr. WALDEN of Oregon, Mr. 

FERGUSON, Mr. WHITFIELD, Mrs. CUBIN, Mr. STEARNS, Mr. BILIRAKIS, 

Mr. TERRY, and Mr. OTTER) introduced the following bill; which was referred to the Committee on Energy and Commerce 

APRIL 12, 2005

Additional sponsors: Mr. UPTON, Mr. GENE GREEN of Texas, Mr. BAKER, 

Ms. JACKSON-LEE of Texas, Mr. BUTTERFIELD, Mr. GORDON, Ms. 

SCHAKOWSKY, Mr. WAMP, Mr. HAYWORTH, Mr. SULLIVAN, Mr. CALVERT, Mr. EHLERS, Mr. PUTNAM, Mr. MARKEY, Mr. ISRAEL, Mr. GONZALEZ, Ms. SOLIS, Ms. WATSON, Mr. ENGEL, Mr. WYNN, Mr. ABERCROMBIE, Mr. DOOLITTLE, Ms. ESHOO, Mrs. DAVIS of California, Mr. 

STUPAK, Mr. RUSH, Mr. RYAN of Ohio, Mr. LINCOLN DIAZ-BALART of 

Florida, Mr. BOUCHER, Mr. BASS, Mr. SAM JOHNSON of Texas, Mr. 

LEWIS of Georgia, Mr. DUNCAN, Mr. BACHUS, Mr. INSLEE, Mr. SHAW, 

Mr. DINGELL, Mr. DOYLE, Mrs. MYRICK, Mr. MURPHY, Mrs. 

BLACKBURN, Mr. ROSS, Mr. ROTHMAN, Mr. SHADEGG, Mr. EDWARDS, 

Mr. MOORE of Kansas, and Mr. MCCAUL of Texas 

APRIL 12, 2005

Reported with an amendment, committed to the Committee of the Whole 

House on the State of the Union, and ordered to be printed 
2

•HR 29 RH 

[Strike out all after the enacting clause and insert the part printed in italic] 

[For text of introduced bill, see copy of bill as introduced on January 4, 2005] 

A BILL

To protect users of the Internet from unknowing transmission of their personally identifiable information 

through spyware programs, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Securely Protect Yourself 

5 Against Cyber Trespass Act’’ or the ‘‘Spy Act’’. 

6 SEC. 2. PROHIBITION OF DECEPTIVE ACTS OR PRACTICES 

7 RELATING TO SPYWARE. 

8 (a) PROHIBITION.—It is unlawful for any person, who 

9 is not the owner or authorized user of a protected computer, 

10 to engage in deceptive acts or practices that involve any 

11 of the following conduct with respect to the protected com12 puter: 

13 (1) Taking control of the computer by—

14 (A) utilizing such computer to send unsolic15 ited information or material from the computer 

16 to others; 
3

•HR 29 RH 

1 (B) diverting the Internet browser of the 

2 computer, or similar program of the computer 

3 used to access and navigate the Internet—

4 (i) without authorization of the owner 

5 or authorized user of the computer; and 

6 (ii) away from the site the user in7 tended to view, to one or more other Web 

8 pages, such that the user is prevented from 

9 viewing the content at the intended Web 

10 page, unless such diverting is otherwise au11 thorized; 

12 (C) accessing, hijacking, or otherwise using 

13 the modem, or Internet connection or service, for 

14 the computer and thereby causing damage to the 

15 computer or causing the owner or authorized 

16 user or a third party defrauded by such conduct 

17 to incur charges or other costs for a service that 

18 is not authorized by such owner or authorized 

19 user; 

20 (D) using the computer as part of an activ21 ity performed by a group of computers that 

22 causes damage to another computer; or 

23 (E) delivering advertisements that a user of 

24 the computer cannot close without turning off the 
4

•HR 29 RH 

1 computer or closing all sessions of the Internet 

2 browser for the computer. 

3 (2) Modifying settings related to use of the com4 puter or to the computer’s access to or use of the 

5 Internet by altering—

6 (A) the Web page that appears when the 

7 owner or authorized user launches an Internet 

8 browser or similar program used to access and 

9 navigate the Internet; 

10 (B) the default provider used to access or 

11 search the Internet, or other existing Internet 

12 connections settings; 

13 (C) a list of bookmarks used by the com14 puter to access Web pages; or 

15 (D) security or other settings of the com16 puter that protect information about the owner 

17 or authorized user for the purposes of causing 

18 damage or harm to the computer or owner or 

19 user. 

20 (3) Collecting personally identifiable information 

21 through the use of a keystroke logging function. 

22 (4) Inducing the owner or authorized user of the 

23 computer to disclose personally identifiable informa24 tion by means of a Web page that—
5

•HR 29 RH 

1 (A) is substantially similar to a Web page 

2 established or provided by another person; and 

3 (B) misleads the owner or authorized user 

4 that such Web page is provided by such other 

5 person. 

6 (5) Inducing the owner or authorized user to in7 stall a component of computer software onto the com8 puter, or preventing reasonable efforts to block the in9 stallation or execution of, or to disable, a component 

10 of computer software by—

11 (A) presenting the owner or authorized user 

12 with an option to decline installation of such a 

13 component such that, when the option is selected 

14 by the owner or authorized user or when the 

15 owner or authorized user reasonably attempts to 

16 decline the installation, the installation neverthe17 less proceeds; or 

18 (B) causing such a component that the 

19 owner or authorized user has properly removed 

20 or disabled to automatically reinstall or reac21 tivate on the computer. 

22 (6) Misrepresenting that installing a separate 

23 component of computer software or providing log-in 

24 and password information is necessary for security or 

25 privacy reasons, or that installing a separate compo-
6

•HR 29 RH 

1 nent of computer software is necessary to open, view, 

2 or play a particular type of content. 

3 (7) Inducing the owner or authorized user to in4 stall or execute computer software by misrepresenting 

5 the identity or authority of the person or entity pro6 viding the computer software to the owner or user. 

7 (8) Inducing the owner or authorized user to 

8 provide personally identifiable, password, or account 

9 information to another person—

10 (A) by misrepresenting the identity of the 

11 person seeking the information; or 

12 (B) without the authority of the intended 

13 recipient of the information. 

14 (9) Removing, disabling, or rendering inoper15 ative a security, anti-spyware, or anti-virus tech16 nology installed on the computer. 

17 (10) Installing or executing on the computer one 

18 or more additional components of computer software 

19 with the intent of causing a person to use such com20 ponents in a way that violates any other provision of 

21 this section. 

22 (b) GUIDANCE.—The Commission shall issue guidance 

23 regarding compliance with and violations of this section. 

24 This subsection shall take effect upon the date of the enact25 ment of this Act. 
7

•HR 29 RH 

1 (c) EFFECTIVE DATE.—Except as provided in sub2 section (b), this section shall take effect upon the expiration 

3 of the 6-month period that begins on the date of the enact4 ment of this Act. 

5 SEC. 3. PROHIBITION OF COLLECTION OF CERTAIN INFOR6 MATION WITHOUT NOTICE AND CONSENT. 

7 (a) OPT-IN REQUIREMENT.—Except as provided in 

8 subsection (e), it is unlawful for any person—

9 (1) to transmit to a protected computer, which 

10 is not owned by such person and for which such per11 son is not an authorized user, any information collec12 tion program, unless—

13 (A) such information collection program 

14 provides notice in accordance with subsection (c) 

15 before execution of any of the information collec16 tion functions of the program; and 

17 (B) such information collection program in18 cludes the functions required under subsection 

19 (d); or 

20 (2) to execute any information collection pro21 gram installed on such a protected computer unless—

22 (A) before execution of any of the informa23 tion collection functions of the program, the 

24 owner or an authorized user of the protected 

25 computer has consented to such execution pursu-
8

•HR 29 RH 

1 ant to notice in accordance with subsection (c); 

2 and 

3 (B) such information collection program in4 cludes the functions required under subsection 

5 (d). 

6 (b) INFORMATION COLLECTION PROGRAM.—

7 (1) IN GENERAL.—For purposes of this section, 

8 the term ‘‘information collection program’’ means 

9 computer software that performs either of the fol10 lowing functions: 

11 (A) COLLECTION OF PERSONALLY IDENTIFI12 ABLE INFORMATION.—The computer software—

13 (i) collects personally identifiable in14 formation; and 

15 (ii)(I) sends such information to a per16 son other than the owner or authorized user 

17 of the computer, or 

18 (II) uses such information to deliver 

19 advertising to, or display advertising on, 

20 the computer. 

21 (B) COLLECTION OF INFORMATION REGARD22 ING WEB PAGES VISITED TO DELIVER ADVER23 TISING.—The computer software—

24 (i) collects information regarding the 

25 Web pages accessed using the computer; and 
9

•HR 29 RH 

1 (ii) uses such information to deliver 

2 advertising to, or display advertising on, 

3 the computer. 

4 (2) EXCEPTION FOR SOFTWARE COLLECTING IN5 FORMATION REGARDING WEB PAGES VISITED WITHIN

6 A PARTICULAR WEB SITE.—Computer software that 

7 otherwise would be considered an information collec8 tion program by reason of paragraph (1)(B) shall not 

9 be considered such a program if—

10 (A) the only information collected by the 

11 software regarding Web pages that are accessed 

12 using the computer is information regarding 

13 Web pages within a particular Web site; 

14 (B) such information collected is not sent to 

15 a person other than—

16 (i) the provider of the Web site 

17 accessed; or 

18 (ii) a party authorized to facilitate the 

19 display or functionality of Web pages with20 in the Web site accessed; and 

21 (C) the only advertising delivered to or dis22 played on the computer using such information 

23 is advertising on Web pages within that par24 ticular Web site. 

25 (c) NOTICE AND CONSENT.—
10

•HR 29 RH 

1 (1) IN GENERAL.—Notice in accordance with this 

2 subsection with respect to an information collection 

3 program is clear and conspicuous notice in plain lan4 guage, set forth as the Commission shall provide, that 

5 meets all of the following requirements: 

6 (A) The notice clearly distinguishes such no7 tice from any other information visually pre8 sented contemporaneously on the computer. 

9 (B) The notice contains one of the following 

10 statements, as applicable, or a substantially 

11 similar statement: 

12 (i) With respect to an information col13 lection program described in subsection 

14 (b)(1)(A): ‘‘This program will collect and 

15 transmit information about you. Do you ac16 cept?’’. 

17 (ii) With respect to an information col18 lection program described in subsection 

19 (b)(1)(B): ‘‘This program will collect infor20 mation about Web pages you access and 

21 will use that information to display adver22 tising on your computer. Do you accept?’’. 

23 (iii) With respect to an information 

24 collection program that performs the actions 

25 described in both subparagraphs (A) and 
11

•HR 29 RH 

1 (B) of subsection (b)(1): ‘‘This program will 

2 collect and transmit information about you 

3 and will collect information about Web 

4 pages you access and use that information 

5 to display advertising on your computer. 

6 Do you accept?’’. 

7 (C) The notice provides for the user—

8 (i) to grant or deny consent referred to 

9 in subsection (a) by selecting an option to 

10 grant or deny such consent; and 

11 (ii) to abandon or cancel the trans12 mission or execution referred to in sub13 section (a) without granting or denying 

14 such consent. 

15 (D) The notice provides an option for the 

16 user to select to display on the computer, before 

17 granting or denying consent using the option re18 quired under subparagraph (C), a clear descrip19 tion of—

20 (i) the types of information to be col21 lected and sent (if any) by the information 

22 collection program; 

23 (ii) the purpose for which such infor24 mation is to be collected and sent; and 
12

•HR 29 RH 

1 (iii) in the case of an information col2 lection program that first executes any of 

3 the information collection functions of the 

4 program together with the first execution of 

5 other computer software, the identity of any 

6 such software that is an information collec7 tion program. 

8 (E) The notice provides for concurrent dis9 play of the information required under subpara10 graphs (B) and (C) and the option required 

11 under subparagraph (D) until the user—

12 (i) grants or denies consent using the 

13 option required under subparagraph (C)(i); 

14 (ii) abandons or cancels the trans15 mission or execution pursuant to subpara16 graph (C)(ii); or 

17 (iii) selects the option required under 

18 subparagraph (D). 

19 (2) SINGLE NOTICE.—The Commission shall pro20 vide that, in the case in which multiple information 

21 collection programs are provided to the protected com22 puter together, or as part of a suite of functionally re23 lated software, the notice requirements of paragraphs 

24 (1)(A) and (2)(A) of subsection (a) may be met by 

25 providing, before execution of any of the information 
13

•HR 29 RH 

1 collection functions of the programs, clear and con2 spicuous notice in plain language in accordance with 

3 paragraph (1) of this subsection by means of a single 

4 notice that applies to all such information collection 

5 programs, except that such notice shall provide the 

6 option under subparagraph (D) of paragraph (1) of 

7 this subsection with respect to each such information 

8 collection program. 

9 (3) CHANGE IN INFORMATION COLLECTION.—If 

10 an owner or authorized user has granted consent to 

11 execution of an information collection program pur12 suant to a notice in accordance with this subsection: 

13 (A) IN GENERAL.—No subsequent such no14 tice is required, except as provided in subpara15 graph (B). 

16 (B) SUBSEQUENT NOTICE.—The person who 

17 transmitted the program shall provide another 

18 notice in accordance with this subsection and ob19 tain consent before such program may be used to 

20 collect or send information of a type or for a 

21 purpose that is materially different from, and 

22 outside the scope of, the type or purpose set forth 

23 in the initial or any previous notice. 

24 (4) REGULATIONS.—The Commission shall issue 

25 regulations to carry out this subsection. 
14

•HR 29 RH 

1 (d) REQUIRED FUNCTIONS.—The functions required 

2 under this subsection to be included in an information col3 lection program that executes any information collection 

4 functions with respect to a protected computer are as fol5 lows: 

6 (1) DISABLING FUNCTION.—With respect to any 

7 information collection program, a function of the pro8 gram that allows a user of the program to remove the 

9 program or disable operation of the program with re10 spect to such protected computer by a function that—

11 (A) is easily identifiable to a user of the 

12 computer; and 

13 (B) can be performed without undue effort 

14 or knowledge by the user of the protected com15 puter. 

16 (2) IDENTITY FUNCTION.—

17 (A) IN GENERAL.—With respect only to an 

18 information collection program that uses infor19 mation collected in the manner described in sub20 paragraph (A)(ii)(II) or (B)(ii) of subsection 

21 (b)(1) and subject to subparagraph (B) of this 

22 paragraph, a function of the program that pro23 vides that each display of an advertisement di24 rected or displayed using such information, when 

25 the owner or authorized user is accessing a Web 
15

•HR 29 RH 

1 page or online location other than of the provider 

2 of the computer software, is accompanied by the 

3 name of the information collection program, a 

4 logogram or trademark used for the exclusive 

5 purpose of identifying the program, or a state6 ment or other information sufficient to clearly 

7 identify the program. 

8 (B) EXEMPTION FOR EMBEDDED ADVER9 TISEMENTS.—The Commission shall, by regula10 tion, exempt from the applicability of subpara11 graph (A) the embedded display of any advertise12 ment on a Web page that contemporaneously dis13 plays other information. 

14 (3) RULEMAKING.—The Commission may issue 

15 regulations to carry out this subsection. 

16 (e) LIMITATION ON LIABILITY.—A telecommunications 

17 carrier, a provider of information service or interactive 

18 computer service, a cable operator, or a provider of trans19 mission capability shall not be liable under this section to 

20 the extent that the carrier, operator, or provider—

21 (1) transmits, routes, hosts, stores, or provides 

22 connections for an information collection program 

23 through a system or network controlled or operated by 

24 or for the carrier, operator, or provider; or 
16

•HR 29 RH 

1 (2) provides an information location tool, such 

2 as a directory, index, reference, pointer, or hypertext 

3 link, through which the owner or user of a protected 

4 computer locates an information collection program. 

5 SEC. 4. ENFORCEMENT. 

6 (a) UNFAIR OR DECEPTIVE ACT OR PRACTICE.—This 

7 Act shall be enforced by the Commission under the Federal 

8 Trade Commission Act (15 U.S.C. 41 et seq.). A violation 

9 of any provision of this Act or of a regulation issued under 

10 this Act shall be treated as an unfair or deceptive act or 

11 practice violating a rule promulgated under section 18 of 

12 the Federal Trade Commission Act (15 U.S.C. 57a). 

13 (b) PENALTY FOR PATTERN OR PRACTICE VIOLA14 TIONS.—

15 (1) IN GENERAL.—Notwithstanding subsection 

16 (a) and the Federal Trade Commission Act, in the 

17 case of a person who engages in a pattern or practice 

18 that violates section 2 or 3, the Commission may, in 

19 its discretion, seek a civil penalty for such pattern or 

20 practice of violations in an amount, as determined by 

21 the Commission, of not more than—

22 (A) $3,000,000 for each violation of section 

23 2; and 

24 (B) $1,000,000 for each violation of section 

25 3. 
17

•HR 29 RH 

1 (2) TREATMENT OF SINGLE ACTION OR CON2 DUCT.—In applying paragraph (1)—

3 (A) any single action or conduct that vio4 lates section 2 or 3 with respect to multiple pro5 tected computers shall be treated as a single vio6 lation; and 

7 (B) any single action or conduct that vio8 lates more than one paragraph of section 2(a) 

9 shall be considered multiple violations, based on 

10 the number of such paragraphs violated. 

11 (c) REQUIRED SCIENTER.—Civil penalties sought 

12 under this section for any action may not be granted by 

13 the Commission or any court unless the Commission or 

14 court, respectively, establishes that the action was com15 mitted with actual knowledge or knowledge fairly implied 

16 on the basis of objective circumstances that such act is un17 fair or deceptive or violates this Act. 

18 (d) FACTORS IN AMOUNT OF PENALTY.—In deter19 mining the amount of any penalty pursuant to subsection 

20 (a) or (b), the court shall take into account the degree of 

21 culpability, any history of prior such conduct, ability to 

22 pay, effect on ability to continue to do business, and such 

23 other matters as justice may require. 

24 (e) EXCLUSIVENESS OF REMEDIES.—The remedies in 

25 this section (including remedies available to the Commis-
18

•HR 29 RH 

1 sion under the Federal Trade Commission Act) are the ex2 clusive remedies for violations of this Act. 

3 (f) EFFECTIVE DATE.—To the extent only that this sec4 tion applies to violations of section 2(a), this section shall 

5 take effect upon the expiration of the 6-month period that 

6 begins on the date of the enactment of this Act. 

7 SEC. 5. LIMITATIONS. 

8 (a) LAW ENFORCEMENT AUTHORITY.—Sections 2 and 

9 3 shall not apply to—

10 (1) any act taken by a law enforcement agent in 

11 the performance of official duties; or 

12 (2) the transmission or execution of an informa13 tion collection program in compliance with a law en14 forcement, investigatory, national security, or regu15 latory agency or department of the United States or 

16 any State in response to a request or demand made 

17 under authority granted to that agency or depart18 ment, including a warrant issued under the Federal 

19 Rules of Criminal Procedure, an equivalent State 

20 warrant, a court order, or other lawful process. 

21 (b) EXCEPTION RELATING TO SECURITY.—Nothing in 

22 this Act shall apply to—

23 (1) any monitoring of, or interaction with, a 

24 subscriber’s Internet or other network connection or 

25 service, or a protected computer, by a telecommuni-
19

•HR 29 RH 

1 cations carrier, cable operator, computer hardware or 

2 software provider, or provider of information service 

3 or interactive computer service, to the extent that such 

4 monitoring or interaction is for network or computer 

5 security purposes, diagnostics, technical support, or 

6 repair, or for the detection or prevention of fraudulent 

7 activities; or 

8 (2) a discrete interaction with a protected com9 puter by a provider of computer software solely to de10 termine whether the user of the computer is author11 ized to use such software, that occurs upon—

12 (A) initialization of the software; or 

13 (B) an affirmative request by the owner or 

14 authorized user for an update of, addition to, or 

15 technical service for, the software. 

16 (c) GOOD SAMARITAN PROTECTION.—No provider of 

17 computer software or of interactive computer service may 

18 be held liable under this Act on account of any action volun19 tarily taken, or service provided, in good faith to remove 

20 or disable a program used to violate section 2 or 3 that 

21 is installed on a computer of a customer of such provider, 

22 if such provider notifies the customer and obtains the con23 sent of the customer before undertaking such action or pro24 viding such service. 
20

•HR 29 RH 

1 (d) LIMITATION ON LIABILITY.—A manufacturer or re2 tailer of computer equipment shall not be liable under this 

3 Act to the extent that the manufacturer or retailer is pro4 viding third party branded computer software that is in5 stalled on the equipment the manufacturer or retailer is 

6 manufacturing or selling. 

7 SEC. 6. EFFECT ON OTHER LAWS. 

8 (a) PREEMPTION OF STATE LAW.—

9 (1) PREEMPTION OF SPYWARE LAWS.—This Act 

10 supersedes any provision of a statute, regulation, or 

11 rule of a State or political subdivision of a State that 

12 expressly regulates—

13 (A) deceptive conduct with respect to com14 puters similar to that described in section 2(a); 

15 (B) the transmission or execution of a com16 puter program similar to that described in sec17 tion 3; or 

18 (C) the use of computer software that dis19 plays advertising content based on the Web pages 

20 accessed using a computer. 

21 (2) ADDITIONAL PREEMPTION.—

22 (A) IN GENERAL.—No person other than the 

23 Attorney General of a State may bring a civil 

24 action under the law of any State if such action 
21

•HR 29 RH 

1 is premised in whole or in part upon the defend2 ant violating any provision of this Act. 

3 (B) PROTECTION OF CONSUMER PROTEC4 TION LAWS.—This paragraph shall not be con5 strued to limit the enforcement of any State con6 sumer protection law by an Attorney General of 

7 a State. 

8 (3) PROTECTION OF CERTAIN STATE LAWS.—

9 This Act shall not be construed to preempt the appli10 cability of—

11 (A) State trespass, contract, or tort law; or 

12 (B) other State laws to the extent that those 

13 laws relate to acts of fraud. 

14 (b) PRESERVATION OF FTC AUTHORITY.—Nothing in 

15 this Act may be construed in any way to limit or affect 

16 the Commission’s authority under any other provision of 

17 law, including the authority to issue advisory opinions 

18 (under part 1 of volume 16 of the Code of Federal Regula19 tions), policy statements, or guidance regarding this Act. 

20 SEC. 7. ANNUAL FTC REPORT. 

21 For the 12-month period that begins upon the effective 

22 date under section 11(a) and for each 12-month period 

23 thereafter, the Commission shall submit a report to the Con24 gress that—
22

•HR 29 RH 

1 (1) specifies the number and types of actions 

2 taken during such period to enforce sections 2(a) and 

3 section 3, the disposition of each such action, any 

4 penalties levied in connection with such actions, and 

5 any penalties collected in connection with such ac6 tions; and 

7 (2) describes the administrative structure and 

8 personnel and other resources committed by the Com9 mission for enforcement of this Act during such pe10 riod. 

11 Each report under this subsection for a 12-month period 

12 shall be submitted not later than 90 days after the expira13 tion of such period. 

14 SEC. 8. FTC REPORT ON COOKIES. 

15 (a) IN GENERAL.—Not later than the expiration of the 

16 6-month period that begins on the date of the enactment 

17 of this Act, the Commission shall submit a report to the 

18 Congress regarding the use of cookies, including tracking 

19 cookies, in the delivery or display of advertising to the own20 ers and users of computers. The report shall examine and 

21 describe the methods by which cookies and the Web sites that 

22 place them on computers function separately and together, 

23 and shall compare the use of cookies with the use of infor24 mation collection programs (as such term is defined in sec25 tion 3) to determine the extent to which such uses are simi-
23

•HR 29 RH 

1 lar or different. The report may include such recommenda2 tions as the Commission considers necessary and appro3 priate, including treatment of cookies under this Act or 

4 other laws. 

5 (b) DEFINITION.—For purposes of this section, the 

6 term ‘‘tracking cookie’’ means a cookie or similar text or 

7 data file used alone or in conjunction with one or more 

8 Web sites to transmit or convey personally identifiable in9 formation of a computer owner or user, or information re10 garding Web pages accessed by the owner or user, to a party 

11 other than the intended recipient, for the purpose of—

12 (1) delivering or displaying advertising to the 

13 owner or user; or 

14 (2) assisting the intended recipient to deliver or 

15 display advertising to the owner, user, or others. 

16 (c) EFFECTIVE DATE.—This section shall take effect 

17 on the date of the enactment of this Act. 

18 SEC. 9. REGULATIONS. 

19 (a) IN GENERAL.—The Commission shall issue the reg20 ulations required by this Act not later than the expiration 

21 of the 6-month period beginning on the date of the enact22 ment of this Act. In exercising its authority to issue any 

23 regulation under this Act, the Commission shall determine 

24 that the regulation is consistent with the public interest and 

25 the purposes of this Act. Any regulations issued pursuant 
24

•HR 29 RH 

1 to this Act shall be issued in accordance with section 553 

2 of title 5, United States Code. 

3 (b) EFFECTIVE DATE.—This section shall take effect 

4 on the date of the enactment of this Act. 

5 SEC. 10. DEFINITIONS. 

6 For purposes of this Act: 

7 (1) CABLE OPERATOR.—The term ‘‘cable oper8 ator’’ has the meaning given such term in section 602 

9 of the Communications Act of 1934 (47 U.S.C. 522). 

10 (2) COLLECT.—The term ‘‘collect’’, when used 

11 with respect to information and for purposes only of 

12 section 3(b)(1)(A), does not include obtaining of the 

13 information by a party who is intended by the owner 

14 or authorized user of a protected computer to receive 

15 the information pursuant to the owner or authorized 

16 user—

17 (A) transferring the information to such in18 tended recipient using the protected computer; or 

19 (B) storing the information on the protected 

20 computer in a manner so that it is accessible by 

21 such intended recipient. 

22 (3) COMPUTER; PROTECTED COMPUTER.—The 

23 terms ‘‘computer’’ and ‘‘protected computer’’ have the 

24 meanings given such terms in section 1030(e) of title 

25 18, United States Code. 
25

•HR 29 RH 

1 (4) COMPUTER SOFTWARE.—

2 (A) IN GENERAL.—Except as provided in 

3 subparagraph (B), the term ‘‘computer software’’ 

4 means a set of statements or instructions that 

5 can be installed and executed on a computer for 

6 the purpose of bringing about a certain result. 

7 (B) EXCEPTION.—Such term does not in8 clude computer software that is placed on the 

9 computer system of a user by an Internet service 

10 provider, interactive computer service, or Inter11 net Web site solely to enable the user subse12 quently to use such provider or service or to ac13 cess such Web site. 

14 (C) RULE OF CONSTRUCTION REGARDING

15 COOKIES.—This paragraph may not be con16 strued to include, as computer software—

17 (i) a cookie; or 

18 (ii) any other type of text or data file 

19 that solely may be read or transferred by a 

20 computer. 

21 (5) COMMISSION.—The term ‘‘Commission’’ 

22 means the Federal Trade Commission. 

23 (6) DAMAGE.—The term ‘‘damage’’ has the 

24 meaning given such term in section 1030(e) of title 

25 18, United States Code. 
26

•HR 29 RH 

1 (7) DECEPTIVE ACTS OR PRACTICES.—The term 

2 ‘‘deceptive acts or practices’’ has the meaning appli3 cable to such term for purposes of section 5 of the 

4 Federal Trade Commission Act (15 U.S.C. 45). 

5 (8) DISABLE.—The term ‘‘disable’’ means, with 

6 respect to an information collection program, to per7 manently prevent such program from executing any 

8 of the functions described in section 3(b)(1) that such 

9 program is otherwise capable of executing (including 

10 by removing, deleting, or disabling the program), un11 less the owner or operator of a protected computer 

12 takes a subsequent affirmative action to enable the 

13 execution of such functions. 

14 (9) INFORMATION COLLECTION FUNCTIONS.—The 

15 term ‘‘information collection functions’’ means, with 

16 respect to an information collection program, the 

17 functions of the program described in subsection 

18 (b)(1) of section 3. 

19 (10) INFORMATION SERVICE.—The term ‘‘infor20 mation service’’ has the meaning given such term in 

21 section 3 of the Communications Act of 1934 (47 

22 U.S.C. 153). 

23 (11) INTERACTIVE COMPUTER SERVICE.—The 

24 term ‘‘interactive computer service’’ has the meaning 
27

•HR 29 RH 

1 given such term in section 230(f) of the Communica2 tions Act of 1934 (47 U.S.C. 230(f)). 

3 (12) INTERNET.—The term ‘‘Internet’’ means 

4 collectively the myriad of computer and telecommuni5 cations facilities, including equipment and operating 

6 software, which comprise the interconnected world7 wide network of networks that employ the Trans8 mission Control Protocol/Internet Protocol, or any 

9 predecessor or successor protocols to such protocol, to 

10 communicate information of all kinds by wire or 

11 radio. 

12 (13) PERSONALLY IDENTIFIABLE INFORMA13 TION.—

14 (A) IN GENERAL.—The term ‘‘personally 

15 identifiable information’’ means the following in16 formation, to the extent only that such informa17 tion allows a living individual to be identified 

18 from that information: 

19 (i) First and last name of an indi20 vidual. 

21 (ii) A home or other physical address 

22 of an individual, including street name, 

23 name of a city or town, and zip code. 

24 (iii) An electronic mail address. 

25 (iv) A telephone number. 
28

•HR 29 RH 

1 (v) A social security number, tax iden2 tification number, passport number, driver’s 

3 license number, or any other government4 issued identification number. 

5 (vi) A credit card number. 

6 (vii) Any access code, password, or ac7 count number, other than an access code or 

8 password transmitted by an owner or au9 thorized user of a protected computer to the 

10 intended recipient to register for, or log 

11 onto, a Web page or other Internet service 

12 or a network connection or service of a sub13 scriber that is protected by an access code or 

14 password. 

15 (viii) Date of birth, birth certificate 

16 number, or place of birth of an individual, 

17 except in the case of a date of birth trans18 mitted or collected for the purpose of com19 pliance with the law. 

20 (B) RULEMAKING.—The Commission may, 

21 by regulation, add to the types of information 

22 described in subparagraph (A) that shall be con23 sidered personally identifiable information for 

24 purposes of this Act, except that such additional 

25 types of information shall be considered person-
29

•HR 29 RH 

1 ally identifiable information only to the extent 

2 that such information allows living individuals, 

3 particular computers, particular users of com4 puters, or particular email addresses or other lo5 cations of computers to be identified from that 

6 information. 

7 (14) SUITE OF FUNCTIONALLY RELATED SOFT8 WARE.—The term suite of ‘‘functionally related soft9 ware’’ means a group of computer software programs 

10 distributed to an end user by a single provider, which 

11 programs are necessary to enable features or 

12 functionalities of an integrated service offered by the 

13 provider. 

14 (15) TELECOMMUNICATIONS CARRIER.—The term 

15 ‘‘telecommunications carrier’’ has the meaning given 

16 such term in section 3 of the Communications Act of 

17 1934 (47 U.S.C. 153). 

18 (16) TRANSMIT.—The term ‘‘transmit’’ means, 

19 with respect to an information collection program, 

20 transmission by any means. 

21 (17) WEB PAGE.—The term ‘‘Web page’’ means 

22 a location, with respect to the World Wide Web, that 

23 has a single Uniform Resource Locator or another 

24 single location with respect to the Internet, as the 

25 Federal Trade Commission may prescribe. 
30

•HR 29 RH 

1 (18) WEB SITE.—The term ‘‘web site’’ means a 

2 collection of Web pages that are presented and made 

3 available by means of the World Wide Web as a single 

4 Web site (or a single Web page so presented and made 

5 available), which Web pages have such characteristics 

6 in relation to each other as the Commission may pre7 scribe, which may include—

8 (A) a common domain name; 

9 (B) a common theme or topic; 

10 (C) common ownership, management, or 

11 registration; and 

12 (D) relationship to a common intended be13 ginning file or home page or other means of ac14 cessing or linking the pages together. 

15 SEC. 11. APPLICABILITY AND SUNSET. 

16 (a) EFFECTIVE DATE.—Except as specifically pro17 vided otherwise in this Act, this Act shall take effect upon 

18 the expiration of the 12-month period that begins on the 

19 date of the enactment of this Act. 

20 (b) APPLICABILITY.—Section 3 shall not apply to an 

21 information collection program installed on a protected 

22 computer before the effective date under subsection (a) of 

23 this section. 

24 (c) SUNSET.—This Act shall not apply after December 

25 31, 2010. 

Union Calendar No. 15

109TH CONGRESS 

1ST SESSION H. R. 29

[Report No. 109–32] 

A BILL

To protect users of the Internet from unknowing 

purposes. mation through spyware programs, and for other transmission of their personally identifiable inforAPRIL 12, 2005

Reported with an amendment, committed to the Comand ordered to be printed mittee of the Whole House on the State of the Union,