IIB 

109TH CONGRESS 

1ST SESSION H. R. 29

IN THE SENATE OF THE UNITED STATES 

MAY 24, 2005

Received; read twice and referred to the Committee on Commerce, Science, 

and Transportation 

AN ACT

To protect users of the Internet from unknowing transmission of their personally identifiable information 

through spyware programs, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,
2

HR 29 RFS 

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Securely Protect Your3 self Against Cyber Trespass Act’’ or the ‘‘Spy Act’’. 

4 SEC. 2. PROHIBITION OF [UNFAIR OR] DECEPTIVE ACTS OR 

5 PRACTICES RELATING TO SPYWARE. 

6 (a) PROHIBITION.—It is unlawful for any person, 

7 who is not the owner or authorized user of a protected 

8 computer, to engage in unfair or deceptive acts or prac9 tices that involve any of the following conduct with respect 

10 to the protected computer: 

11 (1) Taking control of the computer by—

12 (A) utilizing such computer to send unso13 licited information or material from the com14 puter to others; 

15 (B) diverting the Internet browser of the 

16 computer, or similar program of the computer 

17 used to access and navigate the Internet—

18 (i) without authorization of the owner 

19 or authorized user of the computer; and 

20 (ii) away from the site the user in21 tended to view, to one or more other Web 

22 pages, such that the user is prevented from 

23 viewing the content at the intended Web 
3

HR 29 RFS 

1 page, unless such diverting is otherwise au2 thorized; 

3 (C) accessing, hijacking, or otherwise using 

4 the modem, or Internet connection or service, 

5 for the computer and thereby causing damage 

6 to the computer or causing the owner or au7 thorized user or a third party defrauded by 

8 such conduct to incur charges or other costs for 

9 a service that is not authorized by such owner 

10 or authorized user; 

11 (D) using the computer as part of an ac12 tivity performed by a group of computers that 

13 causes damage to another computer; or 

14 (E) delivering advertisements that a user 

15 of the computer cannot close without undue ef16 fort or knowledge by the user or without turn17 ing off the computer or closing all sessions of 

18 the Internet browser for the computer. 

19 (2) Modifying settings related to use of the 

20 computer or to the computer’s access to or use of 

21 the Internet by altering—

22 (A) the Web page that appears when the 

23 owner or authorized user launches an Internet 

24 browser or similar program used to access and 

25 navigate the Internet; 
4

HR 29 RFS 

1 (B) the default provider used to access or 

2 search the Internet, or other existing Internet 

3 connections settings; 

4 (C) a list of bookmarks used by the com5 puter to access Web pages; or 

6 (D) security or other settings of the com7 puter that protect information about the owner 

8 or authorized user for the purposes of causing 

9 damage or harm to the computer or owner or 

10 user. 

11 (3) Collecting personally identifiable informa12 tion through the use of a keystroke logging function. 

13 (4) Inducing the owner or authorized user of 

14 the computer to disclose personally identifiable infor15 mation by means of a Web page that—

16 (A) is substantially similar to a Web page 

17 established or provided by another person; and 

18 (B) misleads the owner or authorized user 

19 that such Web page is provided by such other 

20 person. 

21 (5) Inducing the owner or authorized user to 

22 install a component of computer software onto the 

23 computer, or preventing reasonable efforts to block 

24 the installation or execution of, or to disable, a com25 ponent of computer software by—
5

HR 29 RFS 

1 (A) presenting the owner or authorized 

2 user with an option to decline installation of 

3 such a component such that, when the option is 

4 selected by the owner or authorized user or 

5 when the owner or authorized user reasonably 

6 attempts to decline the installation, the installa7 tion nevertheless proceeds; or 

8 (B) causing such a component that the 

9 owner or authorized user has properly removed 

10 or disabled to automatically reinstall or reac11 tivate on the computer. 

12 (6) Misrepresenting that installing a separate 

13 component of computer software or providing log-in 

14 and password information is necessary for security 

15 or privacy reasons, or that installing a separate com16 ponent of computer software is necessary to open, 

17 view, or play a particular type of content. 

18 (7) Inducing the owner or authorized user to 

19 install or execute computer software by misrepre20 senting the identity or authority of the person or en21 tity providing the computer software to the owner or 

22 user. 

23 (8) Inducing the owner or authorized user to 

24 provide personally identifiable, password, or account 

25 information to another person—
6

HR 29 RFS 

1 (A) by misrepresenting the identity of the 

2 person seeking the information; or 

3 (B) without the authority of the intended 

4 recipient of the information. 

5 (9) Removing, disabling, or rendering inoper6 ative a security, anti-spyware, or anti-virus tech7 nology installed on the computer. 

8 (10) Installing or executing on the computer 

9 one or more additional components of computer soft10 ware with the intent of causing a person to use such 

11 components in a way that violates any other provi12 sion of this section. 

13 (b) GUIDANCE.—The Commission shall issue guid14 ance regarding compliance with and violations of this sec15 tion. This subsection shall take effect upon the date of 

16 the enactment of this Act. 

17 (c) EFFECTIVE DATE.—Except as provided in sub18 section (b), this section shall take effect upon the expira19 tion of the 6-month period that begins on the date of the 

20 enactment of this Act. 

21 SEC. 3. PROHIBITION OF COLLECTION OF CERTAIN INFOR22 MATION WITHOUT NOTICE AND CONSENT. 

23 (a) OPT-IN REQUIREMENT.—Except as provided in 

24 subsection (e), it is unlawful for any person—
7

HR 29 RFS 

1 (1) to transmit to a protected computer, which 

2 is not owned by such person and for which such per3 son is not an authorized user, any information col4 lection program, unless—

5 (A) such information collection program 

6 provides notice in accordance with subsection 

7 (c) before execution of any of the information 

8 collection functions of the program; and 

9 (B) such information collection program 

10 includes the functions required under sub11 section (d); or 

12 (2) to execute any information collection pro13 gram installed on such a protected computer un14 less—

15 (A) before execution of any of the informa16 tion collection functions of the program, the 

17 owner or an authorized user of the protected 

18 computer has consented to such execution pur19 suant to notice in accordance with subsection 

20 (c); and 

21 (B) such information collection program 

22 includes the functions required under sub23 section (d). 

24 (b) INFORMATION COLLECTION PROGRAM.—
8

HR 29 RFS 

1 (1) IN GENERAL.—For purposes of this section, 

2 the term ‘‘information collection program’’ means 

3 computer software that performs either of the fol4 lowing functions: 

5 (A) COLLECTION OF PERSONALLY IDENTI6 FIABLE INFORMATION.—The computer soft7 ware—

8 (i) collects personally identifiable in9 formation; and 

10 (ii)(I) sends such information to a 

11 person other than the owner or authorized 

12 user of the computer, or 

13 (II) uses such information to deliver 

14 advertising to, or display advertising on, 

15 the computer. 

16 (B) COLLECTION OF INFORMATION RE17 GARDING WEB PAGES VISITED TO DELIVER AD18 VERTISING.—The computer software—

19 (i) collects information regarding the 

20 Web pages accessed using the computer; 

21 and 

22 (ii) uses such information to deliver 

23 advertising to, or display advertising on, 

24 the computer. 
9

HR 29 RFS 

1 (2) EXCEPTION FOR SOFTWARE COLLECTING

2 INFORMATION REGARDING WEB PAGES VISITED

3 WITHIN A PARTICULAR WEB SITE.—Computer soft4 ware that otherwise would be considered an informa5 tion collection program by reason of paragraph 

6 (1)(B) shall not be considered such a program if—

7 (A) the only information collected by the 

8 software regarding Web pages that are accessed 

9 using the computer is information regarding 

10 Web pages within a particular Web site; 

11 (B) such information collected is not sent 

12 to a person other than—

13 (i) the provider of the Web site 

14 accessed; or 

15 (ii) a party authorized to facilitate the 

16 display or functionality of Web pages with17 in the Web site accessed; and 

18 (C) the only advertising delivered to or dis19 played on the computer using such information 

20 is advertising on Web pages within that par21 ticular Web site. 

22 (c) NOTICE AND CONSENT.—

23 (1) IN GENERAL.—Notice in accordance with 

24 this subsection with respect to an information collec25 tion program is clear and conspicuous notice in plain 
10

HR 29 RFS 

1 language, set forth as the Commission shall provide, 

2 that meets all of the following requirements: 

3 (A) The notice clearly distinguishes such 

4 notice from any other information visually pre5 sented contemporaneously on the computer. 

6 (B) The notice contains one of the fol7 lowing statements, as applicable, or a substan8 tially similar statement: 

9 (i) With respect to an information col10 lection program described in subsection 

11 (b)(1)(A): ‘‘This program will collect and 

12 transmit information about you. Do you 

13 accept?’’. 

14 (ii) With respect to an information 

15 collection program described in subsection 

16 (b)(1)(B): ‘‘This program will collect infor17 mation about Web pages you access and 

18 will use that information to display adver19 tising on your computer. Do you accept?’’. 

20 (iii) With respect to an information 

21 collection program that performs the ac22 tions described in both subparagraphs (A) 

23 and (B) of subsection (b)(1): ‘‘This pro24 gram will collect and transmit information 

25 about you and will collect information 
11

HR 29 RFS 

1 about Web pages you access and use that 

2 information to display advertising on your 

3 computer. Do you accept?’’. 

4 (C) The notice provides for the user—

5 (i) to grant or deny consent referred 

6 to in subsection (a) by selecting an option 

7 to grant or deny such consent; and 

8 (ii) to abandon or cancel the trans9 mission or execution referred to in sub10 section (a) without granting or denying 

11 such consent. 

12 (D) The notice provides an option for the 

13 user to select to display on the computer, before 

14 granting or denying consent using the option 

15 required under subparagraph (C), a clear de16 scription of—

17 (i) the types of information to be col18 lected and sent (if any) by the information 

19 collection program; 

20 (ii) the purpose for which such infor21 mation is to be collected and sent; and 

22 (iii) in the case of an information col23 lection program that first executes any of 

24 the information collection functions of the 

25 program together with the first execution 
12

HR 29 RFS 

1 of other computer software, the identity of 

2 any such software that is an information 

3 collection program. 

4 (E) The notice provides for concurrent dis5 play of the information required under subpara6 graphs (B) and (C) and the option required 

7 under subparagraph (D) until the user—

8 (i) grants or denies consent using the 

9 option required under subparagraph (C)(i); 

10 (ii) abandons or cancels the trans11 mission or execution pursuant to subpara12 graph (C)(ii); or 

13 (iii) selects the option required under 

14 subparagraph (D). 

15 (2) SINGLE NOTICE.—The Commission shall 

16 provide that, in the case in which multiple informa17 tion collection programs are provided to the pro18 tected computer together, or as part of a suite of 

19 functionally related software, the notice require20 ments of paragraphs (1)(A) and (2)(A) of subsection 

21 (a) may be met by providing, before execution of any 

22 of the information collection functions of the pro23 grams, clear and conspicuous notice in plain lan24 guage in accordance with paragraph (1) of this sub25 section by means of a single notice that applies to 
13

HR 29 RFS 

1 all such information collection programs, except that 

2 such notice shall provide the option under subpara3 graph (D) of paragraph (1) of this subsection with 

4 respect to each such information collection program. 

5 (3) CHANGE IN INFORMATION COLLECTION.—If 

6 an owner or authorized user has granted consent to 

7 execution of an information collection program pur8 suant to a notice in accordance with this subsection: 

9 (A) IN GENERAL.—No subsequent such 

10 notice is required, except as provided in sub11 paragraph (B). 

12 (B) SUBSEQUENT NOTICE.—The person 

13 who transmitted the program shall provide an14 other notice in accordance with this subsection 

15 and obtain consent before such program may be 

16 used to collect or send information of a type or 

17 for a purpose that is materially different from, 

18 and outside the scope of, the type or purpose 

19 set forth in the initial or any previous notice. 

20 (4) REGULATIONS.—The Commission shall 

21 issue regulations to carry out this subsection. 

22 (d) REQUIRED FUNCTIONS.—The functions required 

23 under this subsection to be included in an information col24 lection program that executes any information collection 
14

HR 29 RFS 

1 functions with respect to a protected computer are as fol2 lows: 

3 (1) DISABLING FUNCTION.—With respect to 

4 any information collection program, a function of 

5 the program that allows a user of the program to re6 move the program or disable operation of the pro7 gram with respect to such protected computer by a 

8 function that—

9 (A) is easily identifiable to a user of the 

10 computer; and 

11 (B) can be performed without undue effort 

12 or knowledge by the user of the protected com13 puter. 

14 (2) IDENTITY FUNCTION.—

15 (A) IN GENERAL.—With respect only to an 

16 information collection program that uses infor17 mation collected in the manner described in 

18 subparagraph (A)(ii)(II) or (B)(ii) of subsection 

19 (b)(1) and subject to subparagraph (B) of this 

20 paragraph, a function of the program that pro21 vides that each display of an advertisement di22 rected or displayed using such information, 

23 when the owner or authorized user is accessing 

24 a Web page or online location other than of the 

25 provider of the computer software, is accom-
15

HR 29 RFS 

1 panied by the name of the information collec2 tion program, a logogram or trademark used 

3 for the exclusive purpose of identifying the pro4 gram, or a statement or other information suffi5 cient to clearly identify the program. 

6 (B) EXEMPTION FOR EMBEDDED ADVER7 TISEMENTS.—The Commission shall, by regula8 tion, exempt from the applicability of subpara9 graph (A) the embedded display of any adver10 tisement on a Web page that contempora11 neously displays other information. 

12 (3) RULEMAKING.—The Commission may issue 

13 regulations to carry out this subsection. 

14 (e) LIMITATION ON LIABILITY.—A telecommuni15 cations carrier, a provider of information service or inter16 active computer service, a cable operator, or a provider 

17 of transmission capability shall not be liable under this 

18 section to the extent that the carrier, operator, or pro19 vider—

20 (1) transmits, routes, hosts, stores, or provides 

21 connections for an information collection program 

22 through a system or network controlled or operated 

23 by or for the carrier, operator, or provider; or 

24 (2) provides an information location tool, such 

25 as a directory, index, reference, pointer, or hypertext 
16

HR 29 RFS 

1 link, through which the owner or user of a protected 

2 computer locates an information collection program. 

3 SEC. 4. ENFORCEMENT. 

4 (a) UNFAIR OR DECEPTIVE ACT OR PRACTICE.—

5 This Act shall be enforced by the Commission under the 

6 Federal Trade Commission Act (15 U.S.C. 41 et seq.). 

7 A violation of any provision of this Act or of a regulation 

8 issued under this Act shall be treated as an unfair or de9 ceptive act or practice violating a rule promulgated under 

10 section 18 of the Federal Trade Commission Act (15 

11 U.S.C. 57a). 

12 (b) PENALTY FOR PATTERN OR PRACTICE VIOLA13 TIONS.—

14 (1) IN GENERAL.—Notwithstanding subsection 

15 (a) and the Federal Trade Commission Act, in the 

16 case of a person who engages in a pattern or prac17 tice that violates section 2 or 3, the Commission 

18 may, in its discretion, seek a civil penalty for such 

19 pattern or practice of violations in an amount, as de20 termined by the Commission, of not more than—

21 (A) $3,000,000 for each violation of sec22 tion 2; and 

23 (B) $1,000,000 for each violation of sec24 tion 3. 
17

HR 29 RFS 

1 (2) TREATMENT OF SINGLE ACTION OR CON2 DUCT.—In applying paragraph (1)—

3 (A) any single action or conduct that vio4 lates section 2 or 3 with respect to multiple 

5 protected computers shall be treated as a single 

6 violation; and 

7 (B) any single action or conduct that vio8 lates more than one paragraph of section 2(a) 

9 shall be considered multiple violations, based on 

10 the number of such paragraphs violated. 

11 (c) REQUIRED SCIENTER.—Civil penalties sought 

12 under this section for any action may not be granted by 

13 the Commission or any court unless the Commission or 

14 court, respectively, establishes that the action was com15 mitted with actual knowledge or knowledge fairly implied 

16 on the basis of objective circumstances that such act is 

17 unfair or deceptive or violates this Act. 

18 (d) FACTORS IN AMOUNT OF PENALTY.—In deter19 mining the amount of any penalty pursuant to subsection 

20 (a) or (b), the court shall take into account the degree 

21 of culpability, any history of prior such conduct, ability 

22 to pay, effect on ability to continue to do business, and 

23 such other matters as justice may require. 

24 (e) EXCLUSIVENESS OF REMEDIES.—The remedies 

25 in this section (including remedies available to the Com-
18

HR 29 RFS 

1 mission under the Federal Trade Commission Act) are the 

2 exclusive remedies for violations of this Act. 

3 (f) EFFECTIVE DATE.—To the extent only that this 

4 section applies to violations of section 2(a), this section 

5 shall take effect upon the expiration of the 6-month period 

6 that begins on the date of the enactment of this Act. 

7 SEC. 5. LIMITATIONS. 

8 (a) LAW ENFORCEMENT AUTHORITY.—Sections 2 

9 and 3 shall not apply to—

10 (1) any act taken by a law enforcement agent 

11 in the performance of official duties; or 

12 (2) the transmission or execution of an infor13 mation collection program in compliance with a law 

14 enforcement, investigatory, national security, or reg15 ulatory agency or department of the United States 

16 or any State in response to a request or demand 

17 made under authority granted to that agency or de18 partment, including a warrant issued under the Fed19 eral Rules of Criminal Procedure, an equivalent 

20 State warrant, a court order, or other lawful proc21 ess. 

22 (b) EXCEPTION RELATING TO SECURITY.—Nothing 

23 in this Act shall apply to—

24 (1) any monitoring of, or interaction with, a 

25 subscriber’s Internet or other network connection or 
19

HR 29 RFS 

1 service, or a protected computer, by a telecommuni2 cations carrier, cable operator, computer hardware 

3 or software provider, or provider of information serv4 ice or interactive computer service, to the extent that 

5 such monitoring or interaction is for network or 

6 computer security purposes, diagnostics, technical 

7 support, or repair, or for the detection or prevention 

8 of fraudulent activities; or 

9 (2) a discrete interaction with a protected com10 puter by a provider of computer software solely to 

11 determine whether the user of the computer is au12 thorized to use such software, that occurs upon—

13 (A) initialization of the software; or 

14 (B) an affirmative request by the owner or 

15 authorized user for an update of, addition to, or 

16 technical service for, the software. 

17 (c) GOOD SAMARITAN PROTECTION.—No provider of 

18 computer software or of interactive computer service may 

19 be held liable under this Act on account of any action vol20 untarily taken, or service provided, in good faith to remove 

21 or disable a program used to violate section 2 or 3 that 

22 is installed on a computer of a customer of such provider, 

23 if such provider notifies the customer and obtains the con24 sent of the customer before undertaking such action or 

25 providing such service. 
20

HR 29 RFS 

1 (d) LIMITATION ON LIABILITY.—A manufacturer or 

2 retailer of computer equipment shall not be liable under 

3 this Act to the extent that the manufacturer or retailer 

4 is providing third party branded computer software that 

5 is installed on the equipment the manufacturer or retailer 

6 is manufacturing or selling. 

7 SEC. 6. EFFECT ON OTHER LAWS. 

8 (a) PREEMPTION OF STATE LAW.—

9 (1) PREEMPTION OF SPYWARE LAWS.—This 

10 Act supersedes any provision of a statute, regula11 tion, or rule of a State or political subdivision of a 

12 State that expressly regulates—

13 (A) unfair or deceptive conduct with re14 spect to computers similar to that described in 

15 section 2(a); 

16 (B) the transmission or execution of a 

17 computer program similar to that described in 

18 section 3; or 

19 (C) the use of computer software that dis20 plays advertising content based on the Web 

21 pages accessed using a computer. 

22 (2) ADDITIONAL PREEMPTION.—

23 (A) IN GENERAL.—No person other than 

24 the Attorney General of a State may bring a 

25 civil action under the law of any State if such 
21

HR 29 RFS 

1 action is premised in whole or in part upon the 

2 defendant violating any provision of this Act. 

3 (B) PROTECTION OF CONSUMER PROTEC4 TION LAWS.—This paragraph shall not be con5 strued to limit the enforcement of any State 

6 consumer protection law by an Attorney Gen7 eral of a State. 

8 (3) PROTECTION OF CERTAIN STATE LAWS.—

9 This Act shall not be construed to preempt the ap10 plicability of—

11 (A) State trespass, contract, or tort law; or 

12 (B) other State laws to the extent that 

13 those laws relate to acts of fraud. 

14 (b) PRESERVATION OF FTC AUTHORITY.—Nothing 

15 in this Act may be construed in any way to limit or affect 

16 the Commission’s authority under any other provision of 

17 law, including the authority to issue advisory opinions 

18 (under part 1 of volume 16 of the Code of Federal Regula19 tions), policy statements, or guidance regarding this Act. 

20 SEC. 7. ANNUAL FTC REPORT. 

21 For the 12-month period that begins upon the effec22 tive date under section 12(a) and for each 12-month pe23 riod thereafter, the Commission shall submit a report to 

24 the Congress that—
22

HR 29 RFS 

1 (1) specifies the number and types of actions 

2 taken during such period to enforce section 2(a) and 

3 section 3, the disposition of each such action, any 

4 penalties levied in connection with such actions, and 

5 any penalties collected in connection with such ac6 tions; and 

7 (2) describes the administrative structure and 

8 personnel and other resources committed by the 

9 Commission for enforcement of this Act during such 

10 period. 

11 Each report under this subsection for a 12-month period 

12 shall be submitted not later than 90 days after the expira13 tion of such period. 

14 SEC. 8. FTC REPORT ON COOKIES. 

15 (a) IN GENERAL.—Not later than the expiration of 

16 the 6-month period that begins on the date of the enact17 ment of this Act, the Commission shall submit a report 

18 to the Congress regarding the use of cookies, including 

19 tracking cookies, in the delivery or display of advertising 

20 to the owners and users of computers. The report shall 

21 examine and describe the methods by which cookies and 

22 the Web sites that place them on computers function sepa23 rately and together, and shall compare the use of cookies 

24 with the use of information collection programs (as such 

25 term is defined in section 3) to determine the extent to 
23

HR 29 RFS 

1 which such uses are similar or different. The report may 

2 include such recommendations as the Commission con3 siders necessary and appropriate, including treatment of 

4 cookies under this Act or other laws. 

5 (b) DEFINITION.—For purposes of this section, the 

6 term ‘‘tracking cookie’’ means a cookie or similar text or 

7 data file used alone or in conjunction with one or more 

8 Web sites to transmit or convey, to a party other than 

9 the intended recipient, personally identifiable information 

10 of a computer owner or user, information regarding Web 

11 pages accessed by the owner or user, or information re12 garding advertisements previously delivered to a computer, 

13 for the purpose of—

14 (1) delivering or displaying advertising to the 

15 owner or user; or 

16 (2) assisting the intended recipient to deliver or 

17 display advertising to the owner, user, or others. 

18 (c) EFFECTIVE DATE.—This section shall take effect 

19 on the date of the enactment of this Act. 

20 SEC. 9. FTC REPORT ON INFORMATION COLLECTION PRO21 GRAMS INSTALLED BEFORE EFFECTIVE 

22 DATE. 

23 Not later than the expiration of the 6-month period 

24 that begins on the date of the enactment of this Act, the 

25 Commission shall submit a report to the Congress on the 
24

HR 29 RFS 

1 extent to which there are installed on protected computers 

2 information collection programs that, but for installation 

3 prior to the effective date under section 12(a), would be 

4 subject to the requirements of section 3. The report shall 

5 include recommendations regarding the means of afford6 ing computer users affected by such information collection 

7 programs the protections of section 3, including rec8 ommendations regarding requiring a one-time notice and 

9 consent by the owner or authorized user of a computer 

10 to the continued collection of information by such a pro11 gram so installed on the computer. 

12 SEC. 10. REGULATIONS. 

13 (a) IN GENERAL.—The Commission shall issue the 

14 regulations required by this Act not later than the expira15 tion of the 6-month period beginning on the date of the 

16 enactment of this Act. In exercising its authority to issue 

17 any regulation under this Act, the Commission shall deter18 mine that the regulation is consistent with the public in19 terest and the purposes of this Act. Any regulations issued 

20 pursuant to this Act shall be issued in accordance with 

21 section 553 of title 5, United States Code. 

22 (b) EFFECTIVE DATE.—This section shall take effect 

23 on the date of the enactment of this Act. 

24 SEC. 11. DEFINITIONS. 

25 For purposes of this Act: 
25

HR 29 RFS 

1 (1) CABLE OPERATOR.—The term ‘‘cable oper2 ator’’ has the meaning given such term in section 

3 602 of the Communications Act of 1934 (47 U.S.C. 

4 522). 

5 (2) COLLECT.—The term ‘‘collect’’, when used 

6 with respect to information and for purposes only of 

7 section 3(b)(1)(A), does not include obtaining of the 

8 information by a party who is intended by the owner 

9 or authorized user of a protected computer to receive 

10 the information or by a third party authorized by 

11 such intended recipient to receive the information, 

12 pursuant to the owner or authorized user—

13 (A) transferring the information to such 

14 intended recipient using the protected com15 puter; or 

16 (B) storing the information on the pro17 tected computer in a manner so that it is acces18 sible by such intended recipient. 

19 (3) COMPUTER; PROTECTED COMPUTER.—The 

20 terms ‘‘computer’’ and ‘‘protected computer’’ have 

21 the meanings given such terms in section 1030(e) of 

22 title 18, United States Code. 

23 (4) COMPUTER SOFTWARE.—

24 (A) IN GENERAL.—Except as provided in 

25 subparagraph (B), the term ‘‘computer soft-
26

HR 29 RFS 

1 ware’’ means a set of statements or instructions 

2 that can be installed and executed on a com3 puter for the purpose of bringing about a cer4 tain result. 

5 (B) EXCEPTION.—Such term does not in6 clude computer software that is placed on the 

7 computer system of a user by an Internet serv8 ice provider, interactive computer service, or 

9 Internet Web site solely to enable the user sub10 sequently to use such provider or service or to 

11 access such Web site. 

12 (C) RULE OF CONSTRUCTION REGARDING

13 COOKIES.—This paragraph may not be con14 strued to include, as computer software—

15 (i) a cookie; or 

16 (ii) any other type of text or data file 

17 that solely may be read or transferred by 

18 a computer. 

19 (5) COMMISSION.—The term ‘‘Commission’’ 

20 means the Federal Trade Commission. 

21 (6) DAMAGE.—The term ‘‘damage’’ has the 

22 meaning given such term in section 1030(e) of title 

23 18, United States Code. 

24 (7) DECEPTIVE ACTS OR PRACTICES.—The 

25 term ‘‘deceptive acts or practices’’ has the meaning 
27

HR 29 RFS 

1 applicable to such term for purposes of section 5 of 

2 the Federal Trade Commission Act (15 U.S.C. 45). 

3 (8) DISABLE.—The term ‘‘disable’’ means, with 

4 respect to an information collection program, to per5 manently prevent such program from executing any 

6 of the functions described in section 3(b)(1) that 

7 such program is otherwise capable of executing (in8 cluding by removing, deleting, or disabling the pro9 gram), unless the owner or operator of a protected 

10 computer takes a subsequent affirmative action to 

11 enable the execution of such functions. 

12 (9) INFORMATION COLLECTION FUNCTIONS.—

13 The term ‘‘information collection functions’’ means, 

14 with respect to an information collection program, 

15 the functions of the program described in subsection 

16 (b)(1) of section 3. 

17 (10) INFORMATION SERVICE.—The term ‘‘infor18 mation service’’ has the meaning given such term in 

19 section 3 of the Communications Act of 1934 (47 

20 U.S.C. 153). 

21 (11) INTERACTIVE COMPUTER SERVICE.—The 

22 term ‘‘interactive computer service’’ has the meaning 

23 given such term in section 230(f) of the Communica24 tions Act of 1934 (47 U.S.C. 230(f)). 
28

HR 29 RFS 

1 (12) INTERNET.—The term ‘‘Internet’’ means 

2 collectively the myriad of computer and tele3 communications facilities, including equipment and 

4 operating software, which comprise the inter5 connected world-wide network of networks that em6 ploy the Transmission Control Protocol/Internet 

7 Protocol, or any predecessor or successor protocols 

8 to such protocol, to communicate information of all 

9 kinds by wire or radio. 

10 (13) PERSONALLY IDENTIFIABLE INFORMA11 TION.—

12 (A) IN GENERAL.—The term ‘‘personally 

13 identifiable information’’ means the following 

14 information, to the extent only that such infor15 mation allows a living individual to be identified 

16 from that information: 

17 (i) First and last name of an indi18 vidual. 

19 (ii) A home or other physical address 

20 of an individual, including street name, 

21 name of a city or town, and zip code. 

22 (iii) An electronic mail address. 

23 (iv) A telephone number. 

24 (v) A social security number, tax iden25 tification number, passport number, driv-
29

HR 29 RFS 

1 er’s license number, or any other govern2 ment-issued identification number. 

3 (vi) A credit card number. 

4 (vii) Any access code, password, or ac5 count number, other than an access code 

6 or password transmitted by an owner or 

7 authorized user of a protected computer to 

8 the intended recipient to register for, or 

9 log onto, a Web page or other Internet 

10 service or a network connection or service 

11 of a subscriber that is protected by an ac12 cess code or password. 

13 (viii) Date of birth, birth certificate 

14 number, or place of birth of an individual, 

15 except in the case of a date of birth trans16 mitted or collected for the purpose of com17 pliance with the law. 

18 (B) RULEMAKING.—The Commission may, 

19 by regulation, add to the types of information 

20 described in subparagraph (A) that shall be 

21 considered personally identifiable information 

22 for purposes of this Act, except that such addi23 tional types of information shall be considered 

24 personally identifiable information only to the 

25 extent that such information allows living indi-
30

HR 29 RFS 

1 viduals, particular computers, particular users 

2 of computers, or particular email addresses or 

3 other locations of computers to be identified 

4 from that information. 

5 (14) SUITE OF FUNCTIONALLY RELATED SOFT6 WARE.—The term suite of ‘‘functionally related soft7 ware’’ means a group of computer software pro8 grams distributed to an end user by a single pro9 vider, which programs are necessary to enable fea10 tures or functionalities of an integrated service of11 fered by the provider. 

12 (15) TELECOMMUNICATIONS CARRIER.—The 

13 term ‘‘telecommunications carrier’’ has the meaning 

14 given such term in section 3 of the Communications 

15 Act of 1934 (47 U.S.C. 153). 

16 (16) TRANSMIT.—The term ‘‘transmit’’ means, 

17 with respect to an information collection program, 

18 transmission by any means. 

19 (17) WEB PAGE.—The term ‘‘Web page’’ means 

20 a location, with respect to the World Wide Web, that 

21 has a single Uniform Resource Locator or another 

22 single location with respect to the Internet, as the 

23 Federal Trade Commission may prescribe. 

24 (18) WEB SITE.—The term ‘‘web site’’ means a 

25 collection of Web pages that are presented and made 
31

HR 29 RFS 

1 available by means of the World Wide Web as a sin2 gle Web site (or a single Web page so presented and 

3 made available), which Web pages have any of the 

4 following characteristics: 

5 (A) A common domain name. 

6 (B) Common ownership, management, or 

7 registration. 

8 SEC. 12. APPLICABILITY AND SUNSET. 

9 (a) EFFECTIVE DATE.—Except as specifically pro10 vided otherwise in this Act, this Act shall take effect upon 

11 the expiration of the 12-month period that begins on the 

12 date of the enactment of this Act. 

13 (b) APPLICABILITY.—Section 3 shall not apply to an 

14 information collection program installed on a protected 

15 computer before the effective date under subsection (a) of 

16 this section. 

17 (c) SUNSET.—This Act shall not apply after Decem18 ber 31, 2011.

Passed the House of Representatives May 23, 2005. 

Attest: JEFF TRANDAHL, 

Clerk.