14842 Federal Register / Vol. 89, No. 41 / Thursday, February 29, 2024 / Notices 

2 Id. at ¶¶ 18–30. 

3For example, the complaint charges that Avast 

stated that its software would ‘‘[s]hield your 

privacy. Stop anyone and everyone from getting to 

your computer.’’ It similarly claimed that some of 

its products would allow users to ‘‘[r]eclaim your 

browser. Get rid of unwanted extensions and 

hackers making money off your searches.’’ Avast 

also represented that the Avast Secure Browser is 

‘‘Anti-Tracking’’ and ‘‘[p]rotects your privacy by 

preventing websites, advertising companies, and 

other web services from tracking your online 

activity.’’ (Id. at ¶¶ 16–37). In reality, ‘‘many of the 

Jumpshot products (or ‘data feeds’) provided thirdparty data buyers with extraordinary detail 

regarding how users navigated the internet, 

including each web page visited, precise timestamp, 

the type of device and browser, and the city, state, 

and country. Most of the data feeds included a 

unique and persistent device identifier associated 

with each particular browser allowing Jumpshot 

and the third-party buyer to trace individuals across 

multiple domains over time.’’ Id. at ¶ 21. 

4 Id. at ¶ 30. 

5See Press Release, Fed. Trade Comm’n, FTC 

Sues Kochava for Selling Data That Tracks People 

at Reproductive Health Clinics, Places of Worship, 

and Other Sensitive Locations (Aug. 29, 2022), 

https://www.ftc.gov/news-events/news/pressreleases/2022/08/ftc-sues-kochava-selling-datatracks-people-reproductive-health-clinics-placesworship-other; Press Release, Fed. Trade Comm’n, 

FTC Order Prohibits Data Broker X-Mode Social 

and Outlogic from Selling Sensitive Location Data 

(Jan. 9, 2024), https://www.ftc.gov/news-events/ 

news/press-releases/2024/01/ftc-order-prohibitsdata-broker-x-mode-social-outlogic-sellingsensitive-location-data; Press Release, Fed. Trade 

Comm’n, FTC Order Will Ban InMarket From 

Selling Precise Consumer Location Data (Jan. 18, 

2024), https://www.ftc.gov/news-events/news/pressreleases/2024/01/ftc-order-will-ban-inmarketselling-precise-consumer-location-data. 

6See Press Release, Fed. Trade Comm’n, Rite Aid 

Banned From Using AI Facial Recognition After 

FTC Says Retailer Deployed Technology Without 

Reasonable Safeguards (Dec. 19, 2023), https://

www.ftc.gov/news-events/news/press-releases/2023/ 

12/rite-aid-banned-using-ai-facial-recognition-afterftc-says-retailer-deployed-technology-without; Press 

Release, Fed. Trade Comm’n, FTC and DOJ Charge 

Amazon with Violating Children’s Privacy Law by 

Keeping Kids’ Alexa Voice Recordings Forever and 

Undermining Parents’ Deletion Requests (May 31, 

2023), https://www.ftc.gov/news-events/news/pressreleases/2023/05/ftc-doj-charge-amazon-violatingchildrens-privacy-law-keeping-kids-alexa-voicerecordings-forever. 

7See Press Release, Fed. Trade Comm’n, FTC 

Enforcement Action to Bar GoodRx from Sharing 

Consumers’ Sensitive Health Info for Advertising 

(Feb. 1, 2023), https://www.ftc.gov/news-events/ 

news/press-releases/2023/02/ftc-enforcementaction-bar-goodrx-sharing-consumers-sensitivehealth-info-advertising; Press Release, Fed. Trade 

Comm’n, FTC Gives Final Approval to Order 

Banning BetterHelp from Sharing Sensitive Health 

Data for Advertising, Requiring It to Pay $7.8 

Million (July 14, 2023), https://www.ftc.gov/newsevents/news/press-releases/2023/07/ftc-gives-finalapproval-order-banning-betterhelp-sharingsensitive-health-data-advertising; Press Release, 

Fed. Trade Comm’n, Ovulation Tracking App 

Premom Will be Barred from Sharing Health Data 

for Advertising Under Proposed FTC Order (May 

17, 2023), https://www.ftc.gov/news-events/news/ 

press-releases/2023/05/ovulation-tracking-apppremom-will-be-barred-sharing-health-dataadvertising-under-proposed-ftc. 

and then, through its subsidiary 

Jumpshot, sold those browsing records 

to over a hundred clients, including 

major advertising firms. Avast also 

released this data in individualized, reidentifiable form, allowing these 

browsing histories to be traced back to 

specific people—in direct contravention 

of what Avast had promised.2 While the 

FTC’s privacy lawsuits routinely take on 

firms that misrepresent their data 

practices, Avast’s decision to expressly 

market its products as safeguarding 

people’s browsing records and 

protecting data from tracking only to 

then sell those records is especially 

galling.3 Moreover, the volume of data 

Avast released is staggering: the 

complaint alleges that by 2020 Jumpshot 

had amassed ‘‘more than eight petabytes 

of browsing information dating back to 

2014.’’ Indeed, one advertising firm 

received detailed browsing information 

on 50 percent of Avast’s entire user base 

world-wide, spanning the United States, 

United Kingdom, Mexico, Australia, 

Canada, and Germany.4

The FTC charges that Avast’s conduct 

here was not only deceptive, but also an 

unfair practice, violating Section 5 of 

the FTC Act. Exposing people’s detailed 

browsing data in ways that can be traced 

back to them marks an invasion of 

privacy and is likely to cause substantial 

injury. Because it is intrinsically 

sensitive, browsing data warrants 

heightened protection. Businesses that 

sell or share browser history data 

without affirmatively obtaining people’s 

permission may be in violation of the 

law. 

Today’s action against Avast further 

builds out the Commission’s work 

establishing that sensitive data triggers 

heightened privacy obligations and a 

default presumption against its sharing 

or sale. Through a series of cases, the 

FTC has been expounding on how firms 

are legally required to safeguard 

sensitive data. Kochava, X-Mode, and 

InMarket highlighted the sensitivity of 

precise geolocation data.5 In Rite Aid 

and Alexa, the FTC highlighted the 

sensitivity of biometric data, such as 

facial attributes and voice recordings of 

children.6 And in GoodRx, BetterHelp, 

and Premom, we underscored the 

heightened sensitivity of people’s health 

information.7 Today, we underscore the 

sensitivity of yet another type of 

information: people’s browsing records. 

Across these cases, we have 

established that businesses by default 

cannot sell people’s sensitive data or 

disclose it to third parties for 

advertising purposes. We have also 

pursued bright-line bans. In Rite Aid, 

where we alleged that Rite Aid used 

unfair and discriminatory facial 

recognition software, we are seeking to 

ban its use of facial recognition for five 

years. In a trio of matters, GoodRx, 

BetterHelp, and Premom—all cases 

where health apps promised to keep 

secure users’ highly personal health 

information but then turned around and 

sold that data to third parties for 

advertising purposes—we banned those 

companies from selling consumers’ 

health information for such purposes. 

Here, we have obtained a similar ban, 

for the first time, with respect to a nonhealth service. Today’s order also 

secures $16.5 million in relief—the 

highest monetary remedy in a de novo 

privacy violation case. 

I am very grateful to the Division of 

Privacy and Identity Protection for their 

terrific work to protect Americans from 

privacy invasions and commercial 

surveillance, especially as it concerns 

their most sensitive data. 

[FR Doc. 2024–04257 Filed 2–28–24; 8:45 am] 

BILLING CODE 6750–01–P 

GENERAL SERVICES 

ADMINISTRATION 

[OMB Control No. 3090–0291; Docket No. 

2024–0001; Sequence No. 3] 

Information Collection; Federal 

Funding Accountability and 

Transparency Act Sub-Award 

Reporting System Registration 

Requirements for Prime Grant 

Awardees 

AGENCY: Office of the Integrated Award 

Environment, General Services 

Administration (GSA). 

ACTION: Notice of request for public 

comments regarding an extension to an 

existing OMB clearance. 

SUMMARY: Under the provisions of the 

Paperwork Reduction Act of 1995, the 

Regulatory Secretariat Division will be 

submitting to the Office of Management 

and Budget (OMB) a request to review 

and approve a renewal of the currently 

approved information collection 

requirement regarding FSRS 

Registration Requirements for Prime 

Grant Awardees. 

DATES: Submit comments on or before 

April 29, 2024. 

ADDRESSES: Submit comments 

identified by Information Collection 

3090–0291, FSRS Registration 

Requirements for Prime Grant Awardees 

to http://www.regulations.gov. Submit 

comments via the Federal eRulemaking 

portal by searching OMB control 

number 3090–0291. Select the link 

‘‘Comment Now’’ that corresponds with 

‘‘Information Collection 3090–0291, 

FSRS Registration Requirements for 

Prime Grant Awardees.’’ Follow the 


khammond on DSKJM1Z7X2PROD with NOTICES
Federal Register / Vol. 89, No. 41 / Thursday, February 29, 2024 / Notices 14843 

instructions provided at the ‘‘Submit a 

Comment’’ screen. Please include your 

name, company name (if any), and 

‘‘Information Collection 3090–0291, 

FSRS Registration Requirements for 

Prime Grant Awardees on your attached 

document. If your comment cannot be 

submitted using regulations.gov, call or 

email the points of contact in the FOR

FURTHER INFORMATION CONTACT section of 

this document for alternate instructions. 

Instructions: Please submit comments 

only and cite Information Collection 

3090–0291, FSRS Registration 

Requirements for Prime Grant 

Awardees, in all correspondence related 

to this collection. Comments received 

generally will be posted without change 

to regulations.gov, including any 

personal and/or business confidential 

information provided. To confirm 

receipt of your comment(s), please 

check regulations.gov, approximately 

two-to-three days after submission to 

verify posting. 

FOR FURTHER INFORMATION CONTACT: Ms. 

Salomeh Ghorbani, Director, IAE 

Outreach and Stakeholder Engagement 

Division, at 703–605–3467 or IAE_

Admin@gsa.gov. 

SUPPLEMENTARY INFORMATION: 

A. Purpose

The Federal Funding Accountability

and Transparency Act (Pub. L. 109–282, 

as amended by section 6202(a) of Pub. 

L. 110–252), known as FFATA or the

Transparency Act, requires information

disclosure of entities receiving Federal

financial assistance through Federal

awards such as Federal contracts, subcontracts, grants and sub-grants, FFATA

2(a),(2),(i),(ii). The system that collects

this information is called the FFATA

Sub-award Reporting System (FSRS,

www.fsrs.gov). This information

collection requires information

necessary for prime awardee registration

in FSRS to create a user log-in and

enable sub-award reporting for their

entity. To register in FSRS for a user login, an entity is required to provide their

Unique Entity Identifier (UEI). FSRS

then pulls core data about the entity

from their System for Award

Management (SAM) registration to

include the legal business name,

physical address, mailing address and

Commercial and Government Entity

(CAGE) code. The entity completes the

FSRS registration by providing contact

information within the entity for

approval.

If a prime awardee has already 

registered in FSRS to report contractsrelated Transparency Act financial data, 

a new log-in will not be required. In 

addition, if a prime awardee had a user 

account in the Electronic Subcontract 

Reporting System (eSRS), a new log-in 

will not be required. 

B. Annual Reporting Burden

Respondents: 2,488.

Responses per Respondent: 1.

Total Annual Responses: 2,488.

Hours per Response: .5.

Total Burden Hours: 1,244.

C. Public Comments

Public comments are particularly

invited on: Whether this collection of 

information is necessary, whether it will 

have practical utility; whether our 

estimate of the public burden of this 

collection of information is accurate, 

and based on valid assumptions and 

methodology; ways to enhance the 

quality, utility, and clarity of the 

information to be collected; and ways in 

which we can minimize the burden of 

the collection of information on those 

who are to respond, through the use of 

appropriate technological collection 

techniques or other forms of information 

technology. 

Obtaining Copies of Proposals: 

Requesters may obtain a copy of the 

information collection documents from 

the General Services Administration, 

Regulatory Secretariat Division (MVCB), 

1800 F Street NW, Washington, DC 

20405, telephone 202–501–4755. Please 

cite OMB Control No. 3090–0291, FSRS 

Registration Requirements for Prime 

Grant Awardees, in all correspondence. 

Joanne Sosa, 

Acting Director, Regulatory Secretariat 

Division, General Services Administration. 

[FR Doc. 2024–04260 Filed 2–28–24; 8:45 am] 

BILLING CODE 6820–WY–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Disease Control and 

Prevention 

Notice of Closed Meeting 

Pursuant to 5 U.S.C. 1009(d), notice is 

hereby given of the following meeting. 

The meeting will be closed to the 

public in accordance with the 

provisions set forth in sections 

552b(c)(4) and 552b(c)(6), Title 5 U.S.C., 

as amended, and the Determination of 

the Director, Office of Strategic Business 

Initiatives, Office of the Chief Operating 

Officer, CDC, pursuant to Public Law 

92–463. The grant applications and the 

discussions could disclose confidential 

trade secrets or commercial property 

such as patentable material, and 

personal information concerning 

individuals associated with the grant 

applications, the disclosure of which 

would constitute a clearly unwarranted 

invasion of personal privacy. 

Name of Committee: Disease, 

Disability, and Injury Prevention and 

Control Special Emphasis Panel (SEP)— 

RFA–OH–24–001, National Center for 

Construction Safety and Health 

Research and Translation. 

Dates and Times: May 13, 2024, 11 

a.m.–6 p.m., EDT; and May 14, 2024, 1

p.m.–6 p.m., EDT.

Place: Video-Assisted Meeting.

Agenda: To review and evaluate grant

applications. 

For Further Information Contact: Dan 

Hartley, Ed.D., Scientific Review 

Officer, Office of Extramural Programs, 

National Institute for Occupational 

Safety and Health, Centers for Disease 

Control and Prevention, 1095 

Willowdale Road, Morgantown, West 

Virginia 26505. Telephone: (304) 285– 

5812; Email: DHartley@cdc.gov. 

The Director, Office of Strategic 

Business Initiatives, Office of the Chief 

Operating Officer, Centers for Disease 

Control and Prevention, has been 

delegated the authority to sign Federal 

Register notices pertaining to 

announcements of meetings and other 

committee management activities, for 

both the Centers for Disease Control and 

Prevention and the Agency for Toxic 

Substances and Disease Registry. 

Kalwant Smagh, 

Director, Office of Strategic Business 

Initiatives, Office of the Chief Operating 

Officer, Centers for Disease Control and 

Prevention. 

[FR Doc. 2024–04211 Filed 2–28–24; 8:45 am] 

BILLING CODE 4163–18–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Disease Control and 

Prevention 

Notice of Closed Meeting 

Pursuant to 5 U.S.C. 1009(d), notice is 

hereby given of the following meeting. 

The meeting will be closed to the 

public in accordance with the 

provisions set forth in sections 

552b(c)(4) and 552b(c)(6), title 5 U.S.C., 

as amended, and the Determination of 

the Director, Office of Strategic Business 

Initiatives, Office of the Chief Operating 

Officer, CDC, pursuant to Public Law 

92–463. The grant applications and the 

discussions could disclose confidential 

trade secrets or commercial property 

such as patentable material, and 

personal information concerning 

individuals associated with the grant 

applications, the disclosure of which 


khammond on DSKJM1Z7X2PROD with NOTICES