I 

115TH CONGRESS 

2D SESSION H. R. 5815 

To require the Federal Trade Commission to establish privacy protections 

for customers of online edge providers, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

MAY 15, 2018 

Mr. CAPUANO introduced the following bill; which was referred to the 

Committee on Energy and Commerce 

A BILL 

To require the Federal Trade Commission to establish privacy protections for customers of online edge providers, 

and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Customer Online Noti5 fication for Stopping Edge-provider Network Trans6 gressions’’ or the ‘‘CONSENT Act’’. 

7 SEC. 2. PRIVACY OF CUSTOMERS OF EDGE PROVIDERS. 

8 (a) DEFINITIONS.—In this section— 

9 (1) the term ‘‘breach of security’’ means any in10 stance in which a person, without authorization or in 


pbinns on DSK79D2C42PROD with BILLS
2 

•HR 5815 IH

1 violation of any authorization provided to the person, 

2 gains access to, uses, or discloses sensitive customer 

3 proprietary information; 

4 (2) the term ‘‘Commission’’ means the Federal 

5 Trade Commission; 

6 (3) the term ‘‘customer’’ means— 

7 (A) an individual who is a customer of an 

8 edge provider; and 

9 (B) an individual who is a user of an edge 

10 service provided by an edge provider; 

11 (4) the term ‘‘edge provider’’ means a person 

12 that provides an edge service, but only to the extent 

13 to which the person provides that service; 

14 (5) the term ‘‘edge service’’— 

15 (A) means a service that is provided over 

16 the Internet— 

17 (i) for which the edge provider re18 quires the customer to subscribe or estab19 lish an account in order to use the service; 

20 (ii) that the customer purchases from 

21 the edge provider without a subscription or 

22 account; 

23 (iii) through which a program 

24 searches for and identifies items in a dataVerDate Sep 11 2014 01:06 May 31, 2018 Jkt 079200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H5815.IH H5815

pbinns on DSK79D2C42PROD with BILLS
3 

•HR 5815 IH

1 base that correspond to keywords or char2 acters specified by the customer; or 

3 (iv) through which a customer di4 vulges sensitive customer proprietary infor5 mation of the customer; and 

6 (B) includes any service that is provided— 

7 (i) through a software program, in8 cluding a mobile application; or 

9 (ii) over the Internet, directly or indi10 rectly, through a connected device; 

11 (6) the term ‘‘opt-in consent’’ means a method 

12 by which an edge provider may obtain from a cus13 tomer affirmative, express consent to use, disclose, 

14 or permit access to the sensitive customer propri15 etary information of the customer after the customer 

16 has received explicit notification of the request of the 

17 edge provider with respect to that information; 

18 (7) the term ‘‘personally identifiable informa19 tion’’ means any information that is linked, or rea20 sonably may be linked, to a specific individual or de21 vice; and 

22 (8) the term ‘‘sensitive customer proprietary in23 formation’’ includes— 

24 (A) financial information; 

25 (B) health information; 


pbinns on DSK79D2C42PROD with BILLS
4 

•HR 5815 IH

1 (C) information pertaining to children; 

2 (D) Social Security numbers; 

3 (E) precise geolocation information; 

4 (F) content of communications; 

5 (G) call detail information; 

6 (H) web browsing history, application 

7 usage history, and the functional equivalents of 

8 either; and 

9 (I) any other personally identifiable infor10 mation that the Commission determines to be 

11 sensitive. 

12 (b) PRIVACY OF CUSTOMERS OF EDGE PRO13 VIDERS.— 

14 (1) ACT PROHIBITED.—It is unlawful for an 

15 edge provider to violate the privacy of a customer in 

16 a manner that violates a regulation prescribed under 

17 paragraph (2). 

18 (2) REGULATIONS.— 

19 (A) IN GENERAL.—In carrying out this 

20 Act, the Commission shall— 

21 (i) not later than 1 year after the date 

22 of enactment of this Act, promulgate, 

23 under section 553 of title 5, United States 

24 Code, regulations to protect the privacy of 

25 customers of edge providers; and 


pbinns on DSK79D2C42PROD with BILLS
5 

•HR 5815 IH

1 (ii) ensure that the regulations pro2 mulgated under clause (i) take effect not 

3 later than 180 days after the date on 

4 which the regulations are promulgated. 

5 (B) REQUIREMENTS UNDER REGULA6 TIONS.—In promulgating regulations under 

7 subparagraph (A), the Commission shall— 

8 (i) require an edge provider to notify 

9 a customer about the collection, use, and 

10 sharing of the sensitive customer propri11 etary information of the customer, includ12 ing by— 

13 (I) notifying the customer about 

14 the types of sensitive customer propri15 etary information the edge provider 

16 collects; 

17 (II) specifying how and for what 

18 purposes the edge provider uses and 

19 shares sensitive customer proprietary 

20 information; and 

21 (III) identifying the types of enti22 ties with which the edge provider 

23 shares sensitive customer proprietary 

24 information; 

25 (ii) require an edge provider to— 


pbinns on DSK79D2C42PROD with BILLS
6 

•HR 5815 IH

1 (I) supply the information de2 scribed in clause (i) when a customer 

3 initially subscribes to, establishes an 

4 account for, purchases, or begins re5 ceiving an edge service; and 

6 (II) update a customer when the 

7 policies of the edge provider relating 

8 to the information described in clause 

9 (i) change in a significant way; 

10 (iii) require an edge provider to obtain 

11 opt-in consent from a customer to use, 

12 share, or sell the sensitive customer propri13 etary information of the customer; 

14 (iv) implement strong protection for 

15 sensitive customer proprietary information 

16 that has been de-identified to prevent the 

17 restoration of any personally identifiable 

18 information that has been previously re19 moved, including by— 

20 (I) requiring an edge provider to 

21 alter the customer information so that 

22 the customer information cannot be 

23 reasonably linked to a specific indi24 vidual or device; 


pbinns on DSK79D2C42PROD with BILLS
7 

•HR 5815 IH

1 (II) requiring an edge provider to 

2 publically commit to maintain and use 

3 sensitive customer proprietary infor4 mation in an unidentifiable format 

5 and to not attempt to restore any per6 sonally identifiable information that 

7 has been previously removed from the 

8 sensitive customer proprietary infor9 mation; and 

10 (III) requiring an edge provider 

11 to contractually prohibit the practice 

12 of restoring any personally identifiable 

13 information that has been previously 

14 removed from sensitive customer pro15 prietary information; 

16 (v) determine on a case-by-case basis 

17 the reasonableness of any program that re18 lates the price of an edge service to the 

19 privacy protections afforded to customers, 

20 and require an edge provider to fully dis21 close plans that provide discounts or other 

22 incentives in exchange for a express affirm23 ative consent of the customer to the use 

24 and sharing of the sensitive customer pro25 prietary information of the customer; 


pbinns on DSK79D2C42PROD with BILLS
8 

•HR 5815 IH

1 (vi) prohibit an edge provider from re2 fusing to serve a customer who does not 

3 consent to the use and sharing of the cus4 tomer proprietary information of the cus5 tomer for commercial purposes (commonly 

6 known as a ‘‘take-it-or-leave-it offer’’) on 

7 the basis of that refusal to consent by the 

8 customer; and 

9 (vii) require an edge provider to— 

10 (I) develop reasonable data secu11 rity practices; and 

12 (II) notify a customer if a breach 

13 of security has occurred if the edge 

14 provider determines that an unauthor15 ized disclosure of the sensitive cus16 tomer proprietary information of the 

17 customer has occurred and harm is 

18 reasonably likely to occur. 

19 (c) ENFORCEMENT BY THE COMMISSION.— 

20 (1) IN GENERAL.—Except as otherwise pro21 vided, this Act and the regulations prescribed under 

22 this Act shall be enforced by the Commission under 

23 the Federal Trade Commission Act (15 U.S.C. 41 et 

24 seq.). 


pbinns on DSK79D2C42PROD with BILLS
9 

•HR 5815 IH

1 (2) UNFAIR OR DECEPTIVE ACTS OR PRAC2 TICES.—Subject to subsection (d), a violation of this 

3 Act or a regulation prescribed under this Act shall 

4 be treated as a violation of a rule defining an unfair 

5 or deceptive act or practice prescribed under section 

6 18(a)(1)(B) of the Federal Trade Commission Act 

7 (15 U.S.C. 57a(a)(1)(B)). 

8 (3) ACTIONS BY THE COMMISSION.—Subject to 

9 subsection (d), and except as provided in subsection 

10 (f)(1), the Commission shall prevent any person 

11 from violating this Act or a regulation prescribed 

12 under this Act in the same manner, by the same 

13 means, and with the same jurisdiction, powers, and 

14 duties as though all applicable terms and provisions 

15 of the Federal Trade Commission Act (15 U.S.C. 41 

16 et seq.) were incorporated into and made a part of 

17 this Act, and any person who violates this Act or 

18 such regulation shall be subject to the penalties and 

19 entitled to the privileges and immunities provided in 

20 the Federal Trade Commission Act (15 U.S.C. 41 et 

21 seq.). 

22 (d) ENFORCEMENT BY CERTAIN OTHER AGEN23 CIES.—Compliance with the requirements imposed under 

24 this Act shall be enforced as follows: 


pbinns on DSK79D2C42PROD with BILLS
10 

•HR 5815 IH

1 (1) Under section 8 of the Federal Deposit In2 surance Act (12 U.S.C. 1818) by the appropriate 

3 Federal banking agency, with respect to an insured 

4 depository institution (as those terms are defined in 

5 section 3 of that Act (12 U.S.C. 1813)). 

6 (2) Under the Federal Credit Union Act (12 

7 U.S.C. 1751 et seq.) by the National Credit Union 

8 Administration Board, with respect to any Federal 

9 credit union. 

10 (3) Under part A of subtitle VII of title 49, 

11 United States Code, by the Secretary of Transpor12 tation, with respect to any air carrier or foreign air 

13 carrier subject to that part. 

14 (4) Under the Packers and Stockyards Act, 

15 1921 (7 U.S.C. 181 et seq.) (except as provided in 

16 section 406 of that Act (7 U.S.C. 226; 227)) by the 

17 Secretary of Agriculture, with respect to any activi18 ties subject to that Act. 

19 (5) Under the Farm Credit Act of 1971 (12 

20 U.S.C. 2001 et seq.) by the Farm Credit Adminis21 tration, with respect to any Federal land bank, Fed22 eral land bank association, Federal intermediate 

23 credit bank, or production credit association. 

24 (e) ENFORCEMENT BY STATE ATTORNEYS GEN25 ERAL.— 


pbinns on DSK79D2C42PROD with BILLS
11 

•HR 5815 IH

1 (1) IN GENERAL.— 

2 (A) CIVIL ACTIONS.—In any case in which 

3 the attorney general of a State has reason to 

4 believe that an interest of the residents of that 

5 State has been or is threatened or adversely af6 fected by the engagement of any person in a 

7 practice that violates this Act or a regulation 

8 prescribed under this Act, the State, as parens 

9 patriae, may bring a civil action on behalf of 

10 the residents of the State in a district court of 

11 the United States of appropriate jurisdiction 

12 to— 

13 (i) enjoin that practice; 

14 (ii) enforce compliance with this Act 

15 or such regulation; 

16 (iii) obtain damages, restitution, or 

17 other compensation on behalf of residents 

18 of the State; or 

19 (iv) obtain such other relief as the 

20 court may consider to be appropriate. 

21 (B) NOTICE.— 

22 (i) IN GENERAL.—Before filing an ac23 tion under subparagraph (A), the attorney 

24 general of the State involved shall provide 

25 to the Commission— 


pbinns on DSK79D2C42PROD with BILLS
12 

•HR 5815 IH

1 (I) written notice of that action; 

2 and 

3 (II) a copy of the complaint for 

4 that action. 

5 (ii) EXEMPTION.— 

6 (I) IN GENERAL.—Clause (i) 

7 shall not apply with respect to the fil8 ing of an action by an attorney gen9 eral of a State under this paragraph 

10 if the attorney general determines 

11 that it is not feasible to provide the 

12 notice described in that clause before 

13 the filing of the action. 

14 (II) NOTIFICATION.—In an ac15 tion described in subclause (I), the at16 torney general of a State shall provide 

17 notice and a copy of the complaint to 

18 the Commission at the same time as 

19 the attorney general files the action. 

20 (2) INTERVENTION.— 

21 (A) IN GENERAL.—On receiving notice 

22 under paragraph (1)(B), the Commission shall 

23 have the right to intervene in the action that is 

24 the subject of the notice. 


pbinns on DSK79D2C42PROD with BILLS
13 

•HR 5815 IH

1 (B) EFFECT OF INTERVENTION.—If the 

2 Commission intervenes in an action under para3 graph (1), it shall have the right— 

4 (i) to be heard with respect to any 

5 matter that arises in that action; and 

6 (ii) to file a petition for appeal. 

7 (3) CONSTRUCTION.—For purposes of bringing 

8 any civil action under paragraph (1), nothing in this 

9 Act shall be construed to prevent an attorney gen10 eral of a State from exercising the powers conferred 

11 on the attorney general by the laws of that State 

12 to— 

13 (A) conduct investigations; 

14 (B) administer oaths or affirmations; or 

15 (C) compel the attendance of witnesses or 

16 the production of documentary and other evi17 dence. 

18 (4) ACTIONS BY THE COMMISSION.—In any 

19 case in which an action is instituted by or on behalf 

20 of the Commission for violation of this Act or a reg21 ulation prescribed under this Act, no State may, 

22 during the pendency of that action, institute an ac23 tion under paragraph (1) against any defendant 

24 named in the complaint in the action instituted by 

25 or on behalf of the Commission for that violation. 


pbinns on DSK79D2C42PROD with BILLS
14 

•HR 5815 IH

1 (5) VENUE; SERVICE OF PROCESS.— 

2 (A) VENUE.—Any action brought under 

3 paragraph (1) may be brought in the district 

4 court of the United States that meets applicable 

5 requirements relating to venue under section 

6 1391 of title 28, United States Code. 

7 (B) SERVICE OF PROCESS.—In an action 

8 brought under paragraph (1), process may be 

9 served in any district in which the defendant— 

10 (i) is an inhabitant; or 

11 (ii) may be found. 

12 (f) TELECOMMUNICATIONS CARRIERS.— 

13 (1) DEFINITION.—In this subsection, the term 

14 ‘‘telecommunications carrier’’ has the meaning given 

15 the term in section 3 of the Communications Act of 

16 1934 (47 U.S.C. 153). 

17 (2) ENFORCEMENT BY THE COMMISSION.—Not18 withstanding section 5(a)(2) of the Federal Trade 

19 Commission Act (15 U.S.C. 45(a)(2)), compliance 

20 with the requirements imposed under this Act shall 

21 be enforced by the Commission with respect to any 

22 telecommunications carrier, but only to the extent 

23 that the telecommunications carrier is operating as 

24 an edge provider. 


pbinns on DSK79D2C42PROD with BILLS
15 

•HR 5815 IH

1 (3) RELATIONSHIP TO OTHER LAW.—To the ex2 tent that the applicability of section 222, 338(i), or 

3 631 of the Communications Act of 1934 (47 U.S.C. 

4 222, 338(i), 551) to a telecommunications carrier is 

5 inconsistent with this Act, this Act shall supersede 

6 those sections only to the extent that the tele7 communications carrier is operating as an edge pro8 vider. 

Æ 


pbinns on DSK79D2C42PROD with BILLS