II 

108TH CONGRESS 

2D SESSION H. R. 2929 

IN THE SENATE OF THE UNITED STATES 

OCTOBER 6, 2004 

Received 

AN ACT 

To protect users of the Internet from unknowing transmission of their personally identifiable information 

through spyware programs, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 
2 

HR 2929 RDS 

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Securely Protect Your3 self Against Cyber Trespass Act’’ or the ‘‘SPY ACT’’. 

4 SEC. 2. PROHIBITION OF DECEPTIVE ACTS OR PRACTICES 

5 RELATING TO SPYWARE. 

6 (a) PROHIBITION.—It is unlawful for any person, 

7 who is not the owner or authorized user of a protected 

8 computer, to engage in deceptive acts or practices that in9 volve any of the following conduct with respect to the pro10 tected computer: 

11 (1) Taking control of the computer by— 

12 (A) utilizing such computer to send unso13 licited information or material from the pro14 tected computer to others; 

15 (B) diverting the Internet browser of the 

16 computer, or similar program of the computer 

17 used to access and navigate the Internet— 

18 (i) without authorization of the owner 

19 or authorized user of the computer; and 

20 (ii) away from the site the user in21 tended to view, to one or more other Web 

22 pages, such that the user is prevented from 

23 viewing the content at the intended Web 

24 page, unless such diverting is otherwise au25 thorized; 
3 

HR 2929 RDS 

1 (C) accessing or using the modem, or 

2 Internet connection or service, for the computer 

3 and thereby causing damage to the computer or 

4 causing the owner or authorized user to incur 

5 unauthorized financial charges; 

6 (D) using the computer as part of an ac7 tivity performed by a group of computers that 

8 causes damage to another computer; or 

9 (E) delivering advertisements that a user 

10 of the computer cannot close without turning 

11 off the computer or closing all sessions of the 

12 Internet browser for the computer. 

13 (2) Modifying settings related to use of the 

14 computer or to the computer’s access to or use of 

15 the Internet by altering— 

16 (A) the Web page that appears when the 

17 owner or authorized user launches an Internet 

18 browser or similar program used to access and 

19 navigate the Internet; 

20 (B) the default provider used to access or 

21 search the Internet, or other existing Internet 

22 connections settings; 

23 (C) a list of bookmarks used by the com24 puter to access Web pages; or 
4 

HR 2929 RDS 

1 (D) security or other settings of the com2 puter that protect information about the owner 

3 or authorized user for the purposes of causing 

4 damage or harm to the computer or owner or 

5 user. 

6 (3) Collecting personally identifiable informa7 tion through the use of a keystroke logging function. 

8 (4) Inducing the owner or authorized user to 

9 install a computer software component onto the 

10 computer, or preventing reasonable efforts to block 

11 the installation or execution of, or to disable, a com12 puter software component by— 

13 (A) presenting the owner or authorized 

14 user with an option to decline installation of a 

15 software component such that, when the option 

16 is selected by the owner or authorized user, the 

17 installation nevertheless proceeds; or 

18 (B) causing a computer software compo19 nent that the owner or authorized user has 

20 properly removed or disabled to automatically 

21 reinstall or reactivate on the computer. 

22 (5) Misrepresenting that installing a separate 

23 software component or providing log-in and pass24 word information is necessary for security or privacy 

25 reasons, or that installing a separate software com-
5 

HR 2929 RDS 

1 ponent is necessary to open, view, or play a par2 ticular type of content. 

3 (6) Inducing the owner or authorized user to 

4 install or execute computer software by misrepre5 senting the identity or authority of the person or en6 tity providing the computer software to the owner or 

7 user. 

8 (7) Inducing the owner or authorized user to 

9 provide personally identifiable, password, or account 

10 information to another person— 

11 (A) by misrepresenting the identity of the 

12 person seeking the information; or 

13 (B) without the authority of the intended 

14 recipient of the information. 

15 (8) Removing, disabling, or rendering inoper16 ative a security, anti-spyware, or anti-virus tech17 nology installed on the computer. 

18 (9) Installing or executing on the computer one 

19 or more additional computer software components 

20 with the intent of causing a person to use such com21 ponents in a way that violates any other provision of 

22 this section. 

23 (b) GUIDANCE.—The Commission shall issue guid24 ance regarding compliance with and violations of this sec-
6 

HR 2929 RDS 

1 tion. This subsection shall take effect upon the date of 

2 the enactment of this Act. 

3 (c) EFFECTIVE DATE.—Except as provided in sub4 section (b), this section shall take effect upon the expira5 tion of the 6-month period that begins on the date of the 

6 enactment of this Act. 

7 SEC. 3. PROHIBITION OF COLLECTION OF CERTAIN INFOR8 MATION WITHOUT NOTICE AND CONSENT. 

9 (a) OPT-IN REQUIREMENT.—Except as provided in 

10 subsection (e), it is unlawful for any person— 

11 (1) to transmit to a protected computer, which 

12 is not owned by such person and for which such per13 son is not an authorized user, any information col14 lection program, unless— 

15 (A) such information collection program 

16 provides notice in accordance with subsection 

17 (c) before execution of any of the information 

18 collection functions of the program; and 

19 (B) such information collection program 

20 includes the functions required under sub21 section (d); or 

22 (2) to execute any information collection pro23 gram installed on such a protected computer un24 less— 
7 

HR 2929 RDS 

1 (A) before execution of any of the informa2 tion collection functions of the program, the 

3 owner or an authorized user of the protected 

4 computer has consented to such execution pur5 suant to notice in accordance with subsection 

6 (c); and 

7 (B) such information collection program 

8 includes the functions required under sub9 section (d). 

10 (b) INFORMATION COLLECTION PROGRAM.—For pur11 poses of this section, the term ‘‘information collection pro12 gram’’ means computer software that— 

13 (1)(A) collects personally identifiable informa14 tion; and 

15 (B)(i) sends such information to a person other 

16 than the owner or authorized user of the computer, 

17 or 

18 (ii) uses such information to deliver advertising 

19 to, or display advertising, on the computer; or 

20 (2)(A) collects information regarding the Web 

21 pages accessed using the computer; and 

22 (B) uses such information to deliver advertising 

23 to, or display advertising on, the computer. 

24 (c) NOTICE AND CONSENT.— 
8 

HR 2929 RDS 

1 (1) IN GENERAL.—Notice in accordance with 

2 this subsection with respect to an information collec3 tion program is clear and conspicuous notice in plain 

4 language, set forth as the Commission shall provide, 

5 that meets all of the following requirements: 

6 (A) The notice clearly distinguishes such 

7 notice from any other information visually pre8 sented contemporaneously on the protected 

9 computer. 

10 (B) The notice contains one of the fol11 lowing statements, as applicable, or a substan12 tially similar statement: 

13 (i) With respect to an information col14 lection program described in subsection 

15 (b)(1): ‘‘This program will collect and 

16 transmit information about you. Do you 

17 accept?’’. 

18 (ii) With respect to an information 

19 collection program described in subsection 

20 (b)(2): ‘‘This program will collect informa21 tion about Web pages you access and will 

22 use that information to display advertising 

23 on your computer. Do you accept?’’. 

24 (iii) With respect to an information 

25 collection program that performs the ac-
9 

HR 2929 RDS 

1 tions described in both paragraphs (1) and 

2 (2) of subsection (b): ‘‘This program will 

3 collect and transmit information about you 

4 and your computer use and will collect in5 formation about Web pages you access and 

6 use that information to display advertising 

7 on your computer. Do you accept?’’. 

8 (C) The notice provides for the user— 

9 (i) to grant or deny consent referred 

10 to in subsection (a) by selecting an option 

11 to grant or deny such consent; and 

12 (ii) to abandon or cancel the trans13 mission or execution referred to in sub14 section (a) without granting or denying 

15 such consent. 

16 (D) The notice provides an option for the 

17 user to select to display on the computer, before 

18 granting or denying consent using the option 

19 required under subparagraph (C), a clear de20 scription of— 

21 (i) the types of information to be col22 lected and sent (if any) by the information 

23 collection program; 

24 (ii) the purpose for which such infor25 mation is to be collected and sent; and 
10 

HR 2929 RDS 

1 (iii) in the case of an information col2 lection program that first executes any of 

3 the information collection functions of the 

4 program together with the first execution 

5 of other computer software, the identity of 

6 any such software that is an information 

7 collection program. 

8 (E) The notice provides for concurrent dis9 play of the information required under subpara10 graphs (B) and (C) and the option required 

11 under subparagraph (D) until the user— 

12 (i) grants or denies consent using the 

13 option required under subparagraph (C)(i); 

14 (ii) abandons or cancels the trans15 mission or execution pursuant to subpara16 graph (C)(ii); or 

17 (ii) selects the option required under 

18 subparagraph (D). 

19 (2) SINGLE NOTICE.—The Commission shall 

20 provide that, in the case in which multiple informa21 tion collection programs are provided to the pro22 tected computer together, or as part of a suite of 

23 functionally-related software, the notice require24 ments of paragraphs (1)(A) and (2)(A) of subsection 

25 (a) may be met by providing, before execution of any 
11 

HR 2929 RDS 

1 of the information collection functions of the pro2 grams, clear and conspicuous notice in plain lan3 guage in accordance with paragraph (1) of this sub4 section by means of a single notice that applies to 

5 all such information collection programs, except that 

6 such notice shall provide the option under subpara7 graph (D) of paragraph (1) of this subsection with 

8 respect to each such information collection program. 

9 (3) CHANGE IN INFORMATION COLLECTION.—If 

10 an owner or authorized user has granted consent to 

11 execution of an information collection program pur12 suant to a notice in accordance with this subsection: 

13 (A) IN GENERAL.—No subsequent such 

14 notice is required, except as provided in sub15 paragraph (B). 

16 (B) SUBSEQUENT NOTICE.—The person 

17 who transmitted the program shall provide an18 other notice in accordance with this subsection 

19 and obtain consent before such program may be 

20 used to collect or send information of a type or 

21 for a purpose that is materially different from, 

22 and outside the scope of, the type or purpose 

23 set forth in the initial or any previous notice. 

24 (4) REGULATIONS.—The Commission shall 

25 issue regulations to carry out this subsection. 
12 

HR 2929 RDS 

1 (d) REQUIRED FUNCTIONS.—The functions required 

2 under this subsection to be included in an information col3 lection program that executes any information collection 

4 functions with respect to a protected computer are as fol5 lows: 

6 (1) DISABLING FUNCTION.—With respect to 

7 any information collection program, a function of 

8 the program that allows a user of the program to re9 move the program or disable operation of the pro10 gram with respect to such protected computer by a 

11 function that— 

12 (A) is easily identifiable to a user of the 

13 computer; and 

14 (B) can be performed without undue effort 

15 or knowledge by the user of the protected com16 puter. 

17 (2) IDENTITY FUNCTION.—With respect only to 

18 an information collection program that uses informa19 tion collected in the manner described in paragraph 

20 (1)(B)(ii) or (2)(B) of subsection (b), a function of 

21 the program that provides that each display of an 

22 advertisement directed or displayed using such infor23 mation when the owner or authorized user is access24 ing a Web page or online location other than of the 

25 provider of the software is accompanied by the name 
13 

HR 2929 RDS 

1 of the information collection program, a logogram or 

2 trademark used for the exclusive purpose of identi3 fying the program, or a statement or other informa4 tion sufficient to clearly identify the program. 

5 (3) RULEMAKING.—The Commission may issue 

6 regulations to carry out this subsection. 

7 (e) LIMITATION ON LIABILITY.—A telecommuni8 cations carrier, a provider of information service or inter9 active computer service, a cable operator, or a provider 

10 of transmission capability shall not be liable under this 

11 section to the extent that the carrier, operator, or pro12 vider— 

13 (1) transmits, routes, hosts, stores, or provides 

14 connections for an information collection program 

15 through a system or network controlled or operated 

16 by or for the carrier, operator, or provider; or 

17 (2) provides an information location tool, such 

18 as a directory, index, reference, pointer, or hypertext 

19 link, through which the owner or user of a protected 

20 computer locates an information collection program. 

21 SEC. 4. ENFORCEMENT. 

22 (a) UNFAIR OR DECEPTIVE ACT OR PRACTICE.— 

23 This Act shall be enforced by the Commission under the 

24 Federal Trade Commission Act (15 U.S.C. 41 et seq.). 

25 A violation of any provision of this Act or of a regulation 
14 

HR 2929 RDS 

1 issued under this Act committed with actual knowledge 

2 or knowledge fairly implied on the basis of objective cir3 cumstances that such act is unfair or deceptive or violates 

4 this Act shall be treated as an unfair or deceptive act or 

5 practice violating a rule promulgated under section 18 of 

6 the Federal Trade Commission Act (15 U.S.C. 57a). 

7 (b) PENALTY FOR PATTERN OR PRACTICE VIOLA8 TIONS.— 

9 (1) IN GENERAL.—Notwithstanding subsection 

10 (a) and the Federal Trade Commission Act, in the 

11 case of a person who engages in a pattern or prac12 tice that violates section 2 or 3, the Commission 

13 may, in its discretion, seek a civil penalty for such 

14 pattern or practice of violations in an amount, as de15 termined by the Commission, of not more than— 

16 (A) $3,000,000 for each violation of sec17 tion 2; and 

18 (B) $1,000,000 for each violation of sec19 tion 3. 

20 (2) TREATMENT OF SINGLE ACTION OR CON21 DUCT.—In applying paragraph (1)— 

22 (A) any single action or conduct that vio23 lates section 2 or 3 with respect to multiple 

24 protected computers shall be treated as a single 

25 violation; and 
15 

HR 2929 RDS 

1 (B) any single action or conduct that vio2 lates more than one paragraph of section 2(a) 

3 shall be considered multiple violations, based on 

4 the number of such paragraphs violated. 

5 (c) EXCLUSIVENESS OF REMEDIES.—The remedies 

6 in this section (including remedies available to the Com7 mission under the Federal Trade Commission Act) are the 

8 exclusive remedies for violations of this Act. 

9 (d) EFFECTIVE DATE.—This section shall take effect 

10 on the date of the enactment of this Act, but only to the 

11 extent that this section applies to violations of section 

12 2(a). 

13 SEC. 5. LIMITATIONS. 

14 (a) LAW ENFORCEMENT AUTHORITY.—Sections 2 

15 and 3 of this Act shall not apply to— 

16 (1) any act taken by a law enforcement agent 

17 in the performance of official duties; or 

18 (2) the transmission or execution of an infor19 mation collection program in compliance with a law 

20 enforcement, investigatory, national security, or reg21 ulatory agency or department of the United States 

22 or any State in response to a request or demand 

23 made under authority granted to that agency or de24 partment, including a warrant issued under the Fed25 eral Rules of Criminal Procedure, an equivalent 
16 

HR 2929 RDS 

1 State warrant, a court order, or other lawful proc2 ess. 

3 (b) EXCEPTION RELATING TO SECURITY.—Nothing 

4 in this Act shall apply to— 

5 (1) any monitoring of, or interaction with, a 

6 subscriber’s Internet or other network connection or 

7 service, or a protected computer, by a telecommuni8 cations carrier, cable operator, computer hardware 

9 or software provider, or provider of information serv10 ice or interactive computer service, to the extent that 

11 such monitoring or interaction is for network or 

12 computer security purposes, diagnostics, technical 

13 support, or repair, or for the detection or prevention 

14 of fraudulent activities; or 

15 (2) a discrete interaction with a protected com16 puter by a provider of computer software solely to 

17 determine whether the user of the computer is au18 thorized to use such software, that occurs upon— 

19 (A) initialization of the software; or 

20 (B) an affirmative request by the owner or 

21 authorized user for an update of, addition to, or 

22 technical service for, the software. 

23 (c) GOOD SAMARITAN PROTECTION.—No provider of 

24 computer software or of interactive computer service may 

25 be held liable under this Act on account of any action vol-
17 

HR 2929 RDS 

1 untarily taken, or service provided, in good faith to remove 

2 or disable a program used to violate section 2 or 3 that 

3 is installed on a computer of a customer of such provider, 

4 if such provider notifies the customer and obtains the con5 sent of the customer before undertaking such action or 

6 providing such service. 

7 (d) LIMITATION ON LIABILITY.—A manufacturer or 

8 retailer of computer equipment shall not be liable under 

9 this Act to the extent that the manufacturer or retailer 

10 is providing third party branded software that is installed 

11 on the equipment the manufacturer or retailer is manufac12 turing or selling. 

13 SEC. 6. EFFECT ON OTHER LAWS. 

14 (a) PREEMPTION OF STATE LAW.— 

15 (1) PREEMPTION OF SPYWARE LAWS.—This 

16 Act supersedes any provision of a statute, regula17 tion, or rule of a State or political subdivision of a 

18 State that expressly regulates— 

19 (A) deceptive conduct with respect to com20 puters similar to that described in section 2(a); 

21 (B) the transmission or execution of a 

22 computer program similar to that described in 

23 section 3; or 
18 

HR 2929 RDS 

1 (C) the use of computer software that dis2 plays advertising content based on the Web 

3 pages accessed using a computer. 

4 (2) ADDITIONAL PREEMPTION.— 

5 (A) IN GENERAL.—No person other than 

6 the Attorney General of a State may bring a 

7 civil action under the law of any State if such 

8 action is premised in whole or in part upon the 

9 defendant violating any provision of this Act. 

10 (B) PROTECTION OF CONSUMER PROTEC11 TION LAWS.—This paragraph shall not be con12 strued to limit the enforcement of any State 

13 consumer protection law by an Attorney Gen14 eral of a State. 

15 (3) PROTECTION OF CERTAIN STATE LAWS.— 

16 This Act shall not be construed to preempt the ap17 plicability of— 

18 (A) State trespass, contract, or tort law; or 

19 (B) other State laws to the extent that 

20 those laws relate to acts of fraud. 

21 (b) PRESERVATION OF FTC AUTHORITY.—Nothing 

22 in this Act may be construed in any way to limit or affect 

23 the Commission’s authority under any other provision of 

24 law, including the authority to issue advisory opinions 
19 

HR 2929 RDS 

1 (under Part 1 of Volume 16 of the Code of Federal Regu2 lations), policy statements, or guidance regarding this Act. 

3 SEC. 7. ANNUAL FTC REPORT. 

4 For the 12-month period that begins upon the effec5 tive date under section 11(a) and for each 12-month pe6 riod thereafter, the Commission shall submit a report to 

7 the Congress that— 

8 (1) specifies the number and types of actions 

9 taken during such period to enforce sections 2(a) 

10 and 3, the disposition of each such action, any pen11 alties levied in connection with such actions, and any 

12 penalties collected in connection with such actions; 

13 and 

14 (2) describes the administrative structure and 

15 personnel and other resources committed by the 

16 Commission for enforcement of this Act during such 

17 period. 

18 Each report under this subsection for a 12-month period 

19 shall be submitted not later than 90 days after the expira20 tion of such period. 

21 SEC. 8. FTC REPORT ON COOKIES. 

22 (a) IN GENERAL.—Not later than the expiration of 

23 the 6-month period that begins on the date of the enact24 ment of this Act, the Commission shall submit a report 

25 to the Congress regarding the use of tracking cookies in 
20 

HR 2929 RDS 

1 the delivery or display of advertising to the owners and 

2 users of computers. The report shall examine and describe 

3 the methods by which such tracking cookies and the 

4 websites that place them on computers function separately 

5 and together, and the extent to which they are covered 

6 or affected by this Act. The report may include such rec7 ommendations as the Commission considers necessary and 

8 appropriate, including treatment of tracking cookies under 

9 this Act or other laws. 

10 (b) DEFINITION.—For purposes of this section, the 

11 term ‘‘tracking cookie’’ means a cookie or similar text or 

12 data file used alone or in conjunction with one or more 

13 websites to transmit or convey personally identifiable in14 formation of a computer owner or user, or information re15 garding Web pages accessed by the owner or user, to a 

16 party other than the intended recipient, for the purpose 

17 of— 

18 (1) delivering or displaying advertising to the 

19 owner or user; or 

20 (2) assisting the intended recipient to deliver or 

21 display advertising to the owner, user, or others. 

22 (c) EFFECTIVE DATE.—This section shall take effect 

23 on the date of the enactment of this Act. 
21 

HR 2929 RDS 

1 SEC. 9. REGULATIONS. 

2 (a) IN GENERAL.—The Commission shall issue the 

3 regulations required by this Act not later than the expira4 tion of the 6-month period beginning on the date of the 

5 enactment of this Act. Any regulations issued pursuant 

6 to this Act shall be issued in accordance with section 553 

7 of title 5, United States Code. 

8 (b) EFFECTIVE DATE.—This section shall take effect 

9 on the date of the enactment of this Act. 

10 SEC. 10. DEFINITIONS. 

11 For purposes of this Act: 

12 (1) CABLE OPERATOR.—The term ‘‘cable oper13 ator’’ has the meaning given such term in section 

14 602 of the Communications Act of 1934 (47 U.S.C. 

15 522). 

16 (2) COLLECT.—The term ‘‘collect’’, when used 

17 with respect to information and for purposes only of 

18 section 3, does not include obtaining of the informa19 tion by a party who is intended by the owner or au20 thorized user of a protected computer to receive the 

21 information pursuant to the owner or authorized 

22 user— 

23 (A) transferring the information to such 

24 intended recipient using the protected com25 puter; or 
22 

HR 2929 RDS 

1 (B) storing the information on the pro2 tected computer in a manner so that it is acces3 sible by such intended recipient. 

4 (3) COMPUTER; PROTECTED COMPUTER.—The 

5 terms ‘‘computer’’ and ‘‘protected computer’’ have 

6 the meanings given such terms in section 1030(e) of 

7 title 18, United States Code. 

8 (4) COMPUTER SOFTWARE.— 

9 (A) IN GENERAL.—Except as provided in 

10 subparagraph (B), the term ‘‘computer soft11 ware’’ means a set of statements or instructions 

12 that can be installed and executed on a com13 puter for the purpose of bringing about a cer14 tain result. 

15 (B) EXCEPTION FOR COOKIES.—Such term 

16 does not include— 

17 (i) a cookie or other text or data file 

18 that is placed on the computer system of 

19 a user by an Internet service provider, 

20 interactive computer service, or Internet 

21 website to return information to such pro22 vider, service, or website; or 

23 (ii) computer software that is placed 

24 on the computer system of a user by an 

25 Internet service provider, interactive com-
23 

HR 2929 RDS 

1 puter service, or Internet website solely to 

2 enable the user subsequently to use such 

3 provider or service or to access such 

4 website. 

5 (5) COMMISSION.—The term ‘‘Commission’’ 

6 means the Federal Trade Commission. 

7 (6) DAMAGE.—The term ‘‘damage’’ has the 

8 meaning given such term in section 1030(e) of title 

9 18, United States Code. 

10 (7) DECEPTIVE ACTS OR PRACTICES.—The 

11 term ‘‘deceptive acts or practices’’ has the meaning 

12 applicable to such term for purposes of section 5 of 

13 the Federal Trade Commission Act (15 U.S.C. 45). 

14 (8) DISABLE.—The term ‘‘disable’’ means, with 

15 respect to an information collection program, to per16 manently prevent such program from executing any 

17 of the functions described in section 3(b) that such 

18 program is otherwise capable of executing (including 

19 by removing, deleting, or disabling the program), un20 less the owner or operator of a protected computer 

21 takes a subsequent affirmative action to enable the 

22 execution of such functions. 

23 (9) INFORMATION COLLECTION FUNCTIONS.— 

24 The term ‘‘information collection functions’’ means, 

25 with respect to an information collection program, 
24 

HR 2929 RDS 

1 the functions of the program described in subsection 

2 (b) of section 3. 

3 (10) INFORMATION SERVICE.—The term ‘‘infor4 mation service’’ has the meaning given such term in 

5 section 3 of the Communications Act of 1934 (47 

6 U.S.C. 153). 

7 (11) INTERACTIVE COMPUTER SERVICE.—The 

8 term ‘‘interactive computer service’’ has the meaning 

9 given such term in section 230(f) of the Communica10 tions Act of 1934 (47 U.S.C. 230(f)). 

11 (12) INTERNET.—The term ‘‘Internet’’ means 

12 collectively the myriad of computer and tele13 communications facilities, including equipment and 

14 operating software, which comprise the inter15 connected world-wide network of networks that em16 ploy the Transmission Control Protocol/Internet 

17 Protocol, or any predecessor or successor protocols 

18 to such protocol, to communicate information of all 

19 kinds by wire or radio. 

20 (13) PERSONALLY IDENTIFIABLE INFORMA21 TION.— 

22 (A) IN GENERAL.—The term ‘‘personally 

23 identifiable information’’ means the following 

24 information, to the extent only that such infor-
25 

HR 2929 RDS 

1 mation allows a living individual to be identified 

2 from that information: 

3 (i) First and last name of an indi4 vidual. 

5 (ii) A home or other physical address 

6 of an individual, including street name, 

7 name of a city or town, and zip code. 

8 (iii) An electronic mail address. 

9 (iv) A telephone number. 

10 (v) A social security number, tax iden11 tification number, passport number, driv12 er’s license number, or any other govern13 ment-issued identification number. 

14 (vi) A credit card number. 

15 (vii) Any access code, password, or ac16 count number, other than an access code 

17 or password transmitted by an owner or 

18 authorized user of a protected computer to 

19 the intended recipient to register for, or 

20 log onto, a Web page or other Internet 

21 service or a network connection or service 

22 of a subscriber that is protected by an ac23 cess code or password. 

24 (viii) Date of birth, birth certificate 

25 number, or place of birth of an individual, 
26 

HR 2929 RDS 

1 except in the case of a date of birth trans2 mitted or collected for the purpose of com3 pliance with the law. 

4 (B) RULEMAKING.—The Commission may, 

5 by regulation, add to the types of information 

6 specified under paragraph (1) that shall be con7 sidered personally identifiable information for 

8 purposes of this Act, except that such informa9 tion may not include any record of aggregate 

10 data that does not identify particular persons, 

11 particular computers, particular users of com12 puters, or particular email addresses or other 

13 locations of computers with respect to the 

14 Internet. 

15 (14) SUITE OF FUNCTIONALLY RELATED SOFT16 WARE.—The term ‘suite of functionally related 

17 software‘ means a group of computer software pro18 grams distributed to an end user by a single pro19 vider, which programs are necessary to enable fea20 tures or functionalities of an integrated service of21 fered by the provider. 

22 (15) TELECOMMUNICATIONS CARRIER.—The 

23 term ‘‘telecommunications carrier’’ has the meaning 

24 given such term in section 3 of the Communications 

25 Act of 1934 (47 U.S.C. 153). 
27 

HR 2929 RDS 

1 (16) TRANSMIT.—The term ‘‘transmit’’ means, 

2 with respect to an information collection program, 

3 transmission by any means. 

4 (17) WEB PAGE.—The term ‘‘Web page’’ means 

5 a location, with respect to the World Wide Web, that 

6 has a single Uniform Resource Locator or another 

7 single location with respect to the Internet, as the 

8 Federal Trade Commission may prescribe. 

9 SEC. 11. APPLICABILITY AND SUNSET. 

10 (a) EFFECTIVE DATE.—Except as specifically pro11 vided otherwise in this Act, this Act shall take effect upon 

12 the expiration of the 12-month period that begins on the 

13 date of the enactment of this Act. 

14 (b) APPLICABILITY.—Section 3 shall not apply to an 

15 information collection program installed on a protected 

16 computer before the effective date under subsection (a) of 

17 this section. 

18 (c) SUNSET.—This Act shall not apply after Decem19 ber 31, 2009. 

Passed the House of Representatives October 5, 

2004. 

Attest: JEFF TRANDAHL, 

Clerk.