II 

115TH CONGRESS 

2D SESSION S. 2639 

To require the Federal Trade Commission to establish privacy protections 

for customers of online edge providers, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

APRIL 10, 2018 

Mr. MARKEY (for himself and Mr. BLUMENTHAL) introduced the following 

bill; which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To require the Federal Trade Commission to establish privacy protections for customers of online edge providers, 

and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Customer Online Noti5 fication for Stopping Edge-provider Network Trans6 gressions’’ or the ‘‘CONSENT Act’’. 

7 SEC. 2. PRIVACY OF CUSTOMERS OF EDGE PROVIDERS. 

8 (a) DEFINITIONS.—In this section— 


rfrederick on DSKBCBPHB2PROD with BILLS
2 

•S 2639 IS

1 (1) the term ‘‘breach of security’’ means any in2 stance in which a person, without authorization or in 

3 violation of any authorization provided to the person, 

4 gains access to, uses, or discloses sensitive customer 

5 proprietary information; 

6 (2) the term ‘‘Commission’’ means the Federal 

7 Trade Commission; 

8 (3) the term ‘‘customer’’ means— 

9 (A) an individual who is a customer of an 

10 edge provider; and 

11 (B) an individual who is a user of an edge 

12 service provided by an edge provider; 

13 (4) the term ‘‘edge provider’’ means a person 

14 that provides an edge service, but only to the extent 

15 to which the person provides that service; 

16 (5) the term ‘‘edge service’’— 

17 (A) means a service that is provided over 

18 the Internet— 

19 (i) for which the edge provider re20 quires the customer to subscribe or estab21 lish an account in order to use the service; 

22 (ii) that the customer purchases from 

23 the edge provider without a subscription or 

24 account; 


rfrederick on DSKBCBPHB2PROD with BILLS
3 

•S 2639 IS

1 (iii) through which a program 

2 searches for and identifies items in a data3 base that correspond to keywords or char4 acters specified by the customer; or 

5 (iv) through which a customer di6 vulges sensitive customer proprietary infor7 mation of the customer; and 

8 (B) includes any service that is provided— 

9 (i) through a software program, in10 cluding a mobile application; or 

11 (ii) over the Internet, directly or indi12 rectly, through a connected device; 

13 (6) the term ‘‘opt-in consent’’ means a method 

14 by which an edge provider may obtain from a cus15 tomer affirmative, express consent to use, disclose, 

16 or permit access to the sensitive customer propri17 etary information of the customer after the customer 

18 has received explicit notification of the request of the 

19 edge provider with respect to that information; 

20 (7) the term ‘‘personally identifiable informa21 tion’’ means any information that is linked, or rea22 sonably may be linked, to a specific individual or de23 vice; and 

24 (8) the term ‘‘sensitive customer proprietary in25 formation’’ includes— 


rfrederick on DSKBCBPHB2PROD with BILLS
4 

•S 2639 IS

1 (A) financial information; 

2 (B) health information; 

3 (C) information pertaining to children; 

4 (D) Social Security numbers; 

5 (E) precise geolocation information; 

6 (F) content of communications; 

7 (G) call detail information; 

8 (H) web browsing history, application 

9 usage history, and the functional equivalents of 

10 either; and 

11 (I) any other personally identifiable infor12 mation that the Commission determines to be 

13 sensitive. 

14 (b) PRIVACY OF CUSTOMERS OF EDGE PRO15 VIDERS.— 

16 (1) ACT PROHIBITED.—It is unlawful for an 

17 edge provider to violate the privacy of a customer in 

18 a manner that violates a regulation prescribed under 

19 paragraph (2). 

20 (2) REGULATIONS.— 

21 (A) IN GENERAL.—In carrying out this 

22 Act, the Commission shall— 

23 (i) not later than 1 year after the date 

24 of enactment of this Act, promulgate, 

25 under section 553 of title 5, United States 


rfrederick on DSKBCBPHB2PROD with BILLS
5 

•S 2639 IS

1 Code, regulations to protect the privacy of 

2 customers of edge providers; and 

3 (ii) ensure that the regulations pro4 mulgated under clause (i) take effect not 

5 later than 180 days after the date on 

6 which the regulations are promulgated. 

7 (B) REQUIREMENTS UNDER REGULA8 TIONS.—In promulgating regulations under 

9 subparagraph (A), the Commission shall— 

10 (i) require an edge provider to notify 

11 a customer about the collection, use, and 

12 sharing of the sensitive customer propri13 etary information of the customer, includ14 ing by— 

15 (I) notifying the customer about 

16 the types of sensitive customer propri17 etary information the edge provider 

18 collects; 

19 (II) specifying how and for what 

20 purposes the edge provider uses and 

21 shares sensitive customer proprietary 

22 information; and 

23 (III) identifying the types of enti24 ties with which the edge provider 


rfrederick on DSKBCBPHB2PROD with BILLS
6 

•S 2639 IS

1 shares sensitive customer proprietary 

2 information; 

3 (ii) require an edge provider to— 

4 (I) supply the information de5 scribed in clause (i) when a customer 

6 initially subscribes to, establishes an 

7 account for, purchases, or begins re8 ceiving an edge service; and 

9 (II) update a customer when the 

10 policies of the edge provider relating 

11 to the information described in clause 

12 (i) change in a significant way; 

13 (iii) require an edge provider to obtain 

14 opt-in consent from a customer to use, 

15 share, or sell the sensitive customer propri16 etary information of the customer; 

17 (iv) implement strong protection for 

18 sensitive customer proprietary information 

19 that has been de-identified to prevent the 

20 restoration of any personally identifiable 

21 information that has been previously re22 moved, including by— 

23 (I) requiring an edge provider to 

24 alter the customer information so that 

25 the customer information cannot be 


rfrederick on DSKBCBPHB2PROD with BILLS
7 

•S 2639 IS

1 reasonably linked to a specific indi2 vidual or device; 

3 (II) requiring an edge provider to 

4 publically commit to maintain and use 

5 sensitive customer proprietary infor6 mation in an unidentifiable format 

7 and to not attempt to restore any per8 sonally identifiable information that 

9 has been previously removed from the 

10 sensitive customer proprietary infor11 mation; and 

12 (III) requiring an edge provider 

13 to contractually prohibit the practice 

14 of restoring any personally identifiable 

15 information that has been previously 

16 removed from sensitive customer pro17 prietary information; 

18 (v) determine on a case-by-case basis 

19 the reasonableness of any program that re20 lates the price of an edge service to the 

21 privacy protections afforded to customers, 

22 and require an edge provider to fully dis23 close plans that provide discounts or other 

24 incentives in exchange for a express affirm25 ative consent of the customer to the use 


rfrederick on DSKBCBPHB2PROD with BILLS
8 

•S 2639 IS

1 and sharing of the sensitive customer pro2 prietary information of the customer; 

3 (vi) prohibit an edge provider from re4 fusing to serve a customer who does not 

5 consent to the use and sharing of the cus6 tomer proprietary information of the cus7 tomer for commercial purposes (commonly 

8 known as a ‘‘take-it-or-leave-it offer’’) on 

9 the basis of that refusal to consent by the 

10 customer; and 

11 (vii) require an edge provider to— 

12 (I) develop reasonable data secu13 rity practices; and 

14 (II) notify a customer if a breach 

15 of security has occurred if the edge 

16 provider determines that an unauthor17 ized disclosure of the sensitive cus18 tomer proprietary information of the 

19 customer has occurred and harm is 

20 reasonably likely to occur. 

21 (c) ENFORCEMENT BY THE COMMISSION.— 

22 (1) IN GENERAL.—Except as otherwise pro23 vided, this Act and the regulations prescribed under 

24 this Act shall be enforced by the Commission under 


rfrederick on DSKBCBPHB2PROD with BILLS
9 

•S 2639 IS

1 the Federal Trade Commission Act (15 U.S.C. 41 et 

2 seq.). 

3 (2) UNFAIR OR DECEPTIVE ACTS OR PRAC4 TICES.—Subject to subsection (d), a violation of this 

5 Act or a regulation prescribed under this Act shall 

6 be treated as a violation of a rule defining an unfair 

7 or deceptive act or practice prescribed under section 

8 18(a)(1)(B) of the Federal Trade Commission Act 

9 (15 U.S.C. 57a(a)(1)(B)). 

10 (3) ACTIONS BY THE COMMISSION.—Subject to 

11 subsection (d), and except as provided in subsection 

12 (f)(1), the Commission shall prevent any person 

13 from violating this Act or a regulation prescribed 

14 under this Act in the same manner, by the same 

15 means, and with the same jurisdiction, powers, and 

16 duties as though all applicable terms and provisions 

17 of the Federal Trade Commission Act (15 U.S.C. 41 

18 et seq.) were incorporated into and made a part of 

19 this Act, and any person who violates this Act or 

20 such regulation shall be subject to the penalties and 

21 entitled to the privileges and immunities provided in 

22 the Federal Trade Commission Act (15 U.S.C. 41 et 

23 seq.). 


rfrederick on DSKBCBPHB2PROD with BILLS
10 

•S 2639 IS

1 (d) ENFORCEMENT BY CERTAIN OTHER AGEN2 CIES.—Compliance with the requirements imposed under 

3 this Act shall be enforced as follows: 

4 (1) Under section 8 of the Federal Deposit In5 surance Act (12 U.S.C. 1818) by the appropriate 

6 Federal banking agency, with respect to an insured 

7 depository institution (as those terms are defined in 

8 section 3 of that Act (12 U.S.C. 1813)). 

9 (2) Under the Federal Credit Union Act (12 

10 U.S.C. 1751 et seq.) by the National Credit Union 

11 Administration Board, with respect to any Federal 

12 credit union. 

13 (3) Under part A of subtitle VII of title 49, 

14 United States Code, by the Secretary of Transpor15 tation, with respect to any air carrier or foreign air 

16 carrier subject to that part. 

17 (4) Under the Packers and Stockyards Act, 

18 1921 (7 U.S.C. 181 et seq.) (except as provided in 

19 section 406 of that Act (7 U.S.C. 226; 227)) by the 

20 Secretary of Agriculture, with respect to any activi21 ties subject to that Act. 

22 (5) Under the Farm Credit Act of 1971 (12 

23 U.S.C. 2001 et seq.) by the Farm Credit Adminis24 tration, with respect to any Federal land bank, FedVerDate Sep 11 2014 02:56 Apr 11, 2018 Jkt 079200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S2639.IS S2639

rfrederick on DSKBCBPHB2PROD with BILLS
11 

•S 2639 IS

1 eral land bank association, Federal intermediate 

2 credit bank, or production credit association. 

3 (e) ENFORCEMENT BY STATE ATTORNEYS GEN4 ERAL.— 

5 (1) IN GENERAL.— 

6 (A) CIVIL ACTIONS.—In any case in which 

7 the attorney general of a State has reason to 

8 believe that an interest of the residents of that 

9 State has been or is threatened or adversely af10 fected by the engagement of any person in a 

11 practice that violates this Act or a regulation 

12 prescribed under this Act, the State, as parens 

13 patriae, may bring a civil action on behalf of 

14 the residents of the State in a district court of 

15 the United States of appropriate jurisdiction 

16 to— 

17 (i) enjoin that practice; 

18 (ii) enforce compliance with this Act 

19 or such regulation; 

20 (iii) obtain damages, restitution, or 

21 other compensation on behalf of residents 

22 of the State; or 

23 (iv) obtain such other relief as the 

24 court may consider to be appropriate. 

25 (B) NOTICE.— 


rfrederick on DSKBCBPHB2PROD with BILLS
12 

•S 2639 IS

1 (i) IN GENERAL.—Before filing an ac2 tion under subparagraph (A), the attorney 

3 general of the State involved shall provide 

4 to the Commission— 

5 (I) written notice of that action; 

6 and 

7 (II) a copy of the complaint for 

8 that action. 

9 (ii) EXEMPTION.— 

10 (I) IN GENERAL.—Clause (i) 

11 shall not apply with respect to the fil12 ing of an action by an attorney gen13 eral of a State under this paragraph 

14 if the attorney general determines 

15 that it is not feasible to provide the 

16 notice described in that clause before 

17 the filing of the action. 

18 (II) NOTIFICATION.—In an ac19 tion described in subclause (I), the at20 torney general of a State shall provide 

21 notice and a copy of the complaint to 

22 the Commission at the same time as 

23 the attorney general files the action. 

24 (2) INTERVENTION.— 


rfrederick on DSKBCBPHB2PROD with BILLS
13 

•S 2639 IS

1 (A) IN GENERAL.—On receiving notice 

2 under paragraph (1)(B), the Commission shall 

3 have the right to intervene in the action that is 

4 the subject of the notice. 

5 (B) EFFECT OF INTERVENTION.—If the 

6 Commission intervenes in an action under para7 graph (1), it shall have the right— 

8 (i) to be heard with respect to any 

9 matter that arises in that action; and 

10 (ii) to file a petition for appeal. 

11 (3) CONSTRUCTION.—For purposes of bringing 

12 any civil action under paragraph (1), nothing in this 

13 Act shall be construed to prevent an attorney gen14 eral of a State from exercising the powers conferred 

15 on the attorney general by the laws of that State 

16 to— 

17 (A) conduct investigations; 

18 (B) administer oaths or affirmations; or 

19 (C) compel the attendance of witnesses or 

20 the production of documentary and other evi21 dence. 

22 (4) ACTIONS BY THE COMMISSION.—In any 

23 case in which an action is instituted by or on behalf 

24 of the Commission for violation of this Act or a reg25 ulation prescribed under this Act, no State may, 


rfrederick on DSKBCBPHB2PROD with BILLS
14 

•S 2639 IS

1 during the pendency of that action, institute an ac2 tion under paragraph (1) against any defendant 

3 named in the complaint in the action instituted by 

4 or on behalf of the Commission for that violation. 

5 (5) VENUE; SERVICE OF PROCESS.— 

6 (A) VENUE.—Any action brought under 

7 paragraph (1) may be brought in the district 

8 court of the United States that meets applicable 

9 requirements relating to venue under section 

10 1391 of title 28, United States Code. 

11 (B) SERVICE OF PROCESS.—In an action 

12 brought under paragraph (1), process may be 

13 served in any district in which the defendant— 

14 (i) is an inhabitant; or 

15 (ii) may be found. 

16 (f) TELECOMMUNICATIONS CARRIERS.— 

17 (1) DEFINITION.—In this subsection, the term 

18 ‘‘telecommunications carrier’’ has the meaning given 

19 the term in section 3 of the Communications Act of 

20 1934 (47 U.S.C. 153). 

21 (2) ENFORCEMENT BY THE COMMISSION.—Not22 withstanding section 5(a)(2) of the Federal Trade 

23 Commission Act (15 U.S.C. 45(a)(2)), compliance 

24 with the requirements imposed under this Act shall 

25 be enforced by the Commission with respect to any 


rfrederick on DSKBCBPHB2PROD with BILLS
15 

•S 2639 IS

1 telecommunications carrier, but only to the extent 

2 that the telecommunications carrier is operating as 

3 an edge provider. 

4 (3) RELATIONSHIP TO OTHER LAW.—To the ex5 tent that the applicability of section 222, 338(i), or 

6 631 of the Communications Act of 1934 (47 U.S.C. 

7 222, 338(i), 551) to a telecommunications carrier is 

8 inconsistent with this Act, this Act shall supersede 

9 those sections only to the extent that the tele10 communications carrier is operating as an edge pro11 vider. 

Æ 


rfrederick on DSKBCBPHB2PROD with BILLS