II 

Calendar No. 811

108TH CONGRESS 

2D SESSION S. 2145

To regulate the unauthorized installation of computer software, to require 

clear disclosure to computer users of certain computer software features 

that may pose a threat to user privacy, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

FEBRUARY 27, 2004

Mr. BURNS (for himself, Mr. WYDEN, Mrs. BOXER, and Mrs. CLINTON) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation 

NOVEMBER 19, 2004

Reported by Mr. MCCAIN, with an amendment 

[Strike all after the enacting clause and insert the part printed in italic] 

A BILL

To regulate the unauthorized installation of computer software, to require clear disclosure to computer users of 

certain computer software features that may pose a 

threat to user privacy, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,
2 

•S 2145 RS 

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Software Principles 

3 Yielding Better Levels of Consumer Knowledge Act’’ or 

4 the ‘‘SPY BLOCK Act’’. 

5 SEC. 2. UNAUTHORIZED INSTALLATION OF COMPUTER 

6 SOFTWARE. 

7 (a) NOTICE, CHOICE, AND UNINSTALL PROCE8 DURES.—It is unlawful for any person who is not the user 

9 of a protected computer to install computer software on 

10 that computer, or to authorize, permit, or cause the instal11 lation of computer software on that computer, unless— 

12 (1) the user of the computer has received notice 

13 that satisfies the requirements of section 3; 

14 (2) the user of the computer has granted con15 sent that satisfies the requirements of section 3; and 

16 (3) the computer software’s uninstall proce17 dures satisfy the requirements of section 3. 

18 (b) RED HERRING PROHIBITION.—It is unlawful for 

19 any person who is not the user of a protected computer 

20 to install computer software on that computer, or to au21 thorize, permit, or cause the installation of computer soft22 ware on that computer, if the design or operation of the 

23 computer software is intended, or may reasonably be ex24 pected, to confuse or mislead the user of the computer 

25 concerning the identity of the person or service responsible 
3 

•S 2145 RS 

1 for the functions performed or content displayed by such 

2 computer software. 

3 SEC. 3. NOTICE, CONSENT, AND UNINSTALL REQUIRE4 MENTS. 

5 (a) NOTICE.—For purposes of section 2(a)(1), notice 

6 to the user of a computer shall— 

7 (1) include a clear notification, displayed on the 

8 screen until the user either grants or denies consent 

9 to installation, of the name and general nature of 

10 the computer software that will be installed if the 

11 user grants consent; and 

12 (2) include a separate disclosure, with respect 

13 to each information collection, advertising, distrib14 uted computing, and settings modification feature 

15 contained in the computer software, that— 

16 (A) remains displayed on the screen until 

17 the user either grants or denies consent to that 

18 feature; 

19 (B) in the case of an information collection 

20 feature, provides a clear description of— 

21 (i) the type of personal or network in22 formation to be collected and transmitted 

23 by the computer software; and 
4 

•S 2145 RS 

1 (ii) the purpose for which the personal 

2 or network information is to be collected, 

3 transmitted, and used; 

4 (C) in the case of an advertising feature, 

5 provides— 

6 (i) a representative example of the 

7 type of advertisement that may be deliv8 ered by the computer software; 

9 (ii) a clear description of— 

10 (I) the estimated frequency with 

11 which each type of advertisement may 

12 be delivered; or 

13 (II) the factors on which the fre14 quency will depend; and 

15 (iii) a clear description of how the 

16 user can distinguish each type of advertise17 ment that the computer software delivers 

18 from advertisements generated by other 

19 software, Internet website operators, or 

20 services; 

21 (D) in the case of a distributed computing 

22 feature, provides a clear description of— 

23 (i) the types of information or mes24 sages the computer software will cause the 

25 computer to transmit; 
5 

•S 2145 RS 

1 (ii)(I) the estimated frequency with 

2 which the computer software will cause the 

3 computer to transmit such messages or in4 formation; or 

5 (II) the factors on which the fre6 quency will depend; 

7 (iii) the estimated volume of such in8 formation or messages, and the likely im9 pact, if any, on the processing or commu10 nications capacity of the user’s computer; 

11 and 

12 (iv) the nature, volume, and likely im13 pact on the computer’s processing capacity 

14 of any computational or processing tasks 

15 the computer software will cause the com16 puter to perform in order to generate the 

17 information or messages the computer 

18 software will cause the computer to trans19 mit; 

20 (E) in the case of a settings modification 

21 feature, provides a clear description of the na22 ture of the modification, its function, and any 

23 collateral effects the modification may produce; 

24 and 
6 

•S 2145 RS 

1 (F) provides a clear description of proce2 dures the user may follow to turn off such fea3 ture or uninstall the computer software. 

4 (b) CONSENT.—For purposes of section 2(a)(2), con5 sent requires— 

6 (1) consent by the user of the computer to the 

7 installation of the computer software; and 

8 (2) separate affirmative consent by the user of 

9 the computer to each information collection feature, 

10 advertising feature, distributed computing feature, 

11 and settings modification feature contained in the 

12 computer software. 

13 (c) UNINSTALL PROCEDURES.—For purposes of sec14 tion 2(a)(3), computer software shall— 

15 (1) appear in the ‘‘Add/Remove Programs’’ 

16 menu or any similar feature, if any, provided by 

17 each operating system with which the computer soft18 ware functions; 

19 (2) be capable of being removed completely 

20 using the normal procedures provided by each oper21 ating system with which the computer software func22 tions for removing computer software; and 

23 (3) in the case of computer software with an 

24 advertising feature, include an easily identifiable link 

25 clearly associated with each advertisement that the 
7 

•S 2145 RS 

1 software causes to be displayed, such that selection 

2 of the link by the user of the computer generates an 

3 on-screen window that informs the user about how 

4 to turn off the advertising feature or uninstall the 

5 computer software. 

6 SEC. 4. UNAUTHORIZED USE OF CERTAIN COMPUTER SOFT7 WARE. 

8 It is unlawful for any person who is not the user of 

9 a protected computer to use an information collection, ad10 vertising, distributed computing, or settings modification 

11 feature of computer software installed on that computer, 

12 if— 

13 (1) the computer software was installed in vio14 lation of section 2; 

15 (2) the use in question falls outside the scope 

16 of what was described to the user of the computer 

17 in the notice provided pursuant to section 3(a); or 

18 (3) in the case of an information collection fea19 ture, the person using the feature fails to establish 

20 and maintain reasonable procedures to protect the 

21 security and integrity of personal information so col22 lected. 

23 SEC. 5. EXCEPTIONS. 

24 (a) PREINSTALLED SOFTWARE.—A person who in25 stalls, or authorizes, permits, or causes the installation of, 
8 

•S 2145 RS 

1 computer software on a protected computer before the 

2 first retail sale of the computer shall be deemed to be in 

3 compliance with this Act if the user of the computer re4 ceives notice that would satisfy section 3(a)(2) and grants 

5 consent that would satisfy section 3(b)(2) prior to— 

6 (1) the initial collection of personal or network 

7 information, in the case of any information collection 

8 feature contained in the computer software; 

9 (2) the initial generation of an advertisement 

10 on the computer, in the case of any advertising fea11 ture contained in the computer software; 

12 (3) the initial transmission of information or 

13 messages, in the case of any distributed computing 

14 feature contained in the computer software; and 

15 (4) the initial modification of user settings, in 

16 the case of any settings modification feature. 

17 (b) OTHER EXCEPTIONS.—Sections 3(a)(2), 3(b)(2), 

18 and 4 do not apply to any feature of computer software 

19 that is reasonably needed to— 

20 (1) provide capability for general purpose online 

21 browsing, electronic mail, or instant messaging, or 

22 for any optional function that is directly related to 

23 such capability and that the user knowingly chooses 

24 to use; 
9 

•S 2145 RS 

1 (2) determine whether or not the user of the 

2 computer is licensed or authorized to use the com3 puter software; and 

4 (3) provide technical support for the use of the 

5 computer software by the user of the computer. 

6 (c) PASSIVE TRANSMISSION, HOSTING, OR LINK.— 

7 For purposes of this Act, a person shall not be deemed 

8 to have installed computer software, or authorized, per9 mitted, or caused the installation of computer software, 

10 on a computer solely because that person provided— 

11 (1) the Internet connection or other trans12 mission capability through which the software was 

13 delivered to the computer for installation; 

14 (2) the storage or hosting, at the direction of 

15 another person and without selecting the content to 

16 be stored or hosted, of the software or of an Internet 

17 website through which the software was made avail18 able for installation; or 

19 (3) a link or reference to an Internet website 

20 the content of which was selected and controlled by 

21 another person, and through which the computer 

22 software was made available for installation. 

23 (d) SOFTWARE RESIDENT IN TEMPORARY MEM24 ORY.—In the case of an installation of computer software 

25 that falls within the meaning of section 7(10)(B) but not 
10 

•S 2145 RS 

1 within the meaning of section 7(10)(A), the requirements 

2 set forth in subsections (a)(1), (b)(1), and (c) of section 

3 3 shall not apply. 

4 (e) FEATURES ACTIVATED BY USER OPTIONS.—In 

5 the case of an information collection, advertising, distrib6 uted computing, or settings modification feature that re7 mains inactive or turned off unless the user of the com8 puter subsequently selects certain optional settings or 

9 functions provided by the computer software, the require10 ments of subsections (a)(2) and (b)(2) of section 3 may 

11 be satisfied by providing the applicable disclosure and ob12 taining the applicable consent at the time the user selects 

13 the option that activates the feature, rather than at the 

14 time of initial installation. 

15 SEC. 6. ADMINISTRATION AND ENFORCEMENT. 

16 (a) IN GENERAL.—Except as provided in subsection 

17 (b), this Act shall be enforced by the Commission as if 

18 the violation of this Act were an unfair or deceptive act 

19 or practice proscribed under section 18(a)(1)(B) of the 

20 Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)). 

21 (b) ENFORCEMENT BY CERTAIN OTHER AGEN22 CIES.—Compliance with this Act shall be enforced 

23 under— 

24 (1) section 8 of the Federal Deposit Insurance 

25 Act (12 U.S.C. 1818), in the case of— 
11 

•S 2145 RS 

1 (A) national banks, and Federal branches 

2 and Federal agencies of foreign banks, by the 

3 Office of the Comptroller of the Currency; 

4 (B) member banks of the Federal Reserve 

5 System (other than national banks), branches 

6 and agencies of foreign banks (other than Fed7 eral branches, Federal agencies, and insured 

8 State branches of foreign banks), commercial 

9 lending companies owned or controlled by for10 eign banks, and organizations operating under 

11 section 25 or 25A of the Federal Reserve Act 

12 (12 U.S.C. 601 and 611), by the Board; and 

13 (C) banks insured by the Federal Deposit 

14 Insurance Corporation (other than members of 

15 the Federal Reserve System) and insured State 

16 branches of foreign banks, by the Board of Di17 rectors of the Federal Deposit Insurance Cor18 poration; 

19 (2) section 8 of the Federal Deposit Insurance 

20 Act (12 U.S.C. 1818), by the Director of the Office 

21 of Thrift Supervision, in the case of a savings asso22 ciation the deposits of which are insured by the Fed23 eral Deposit Insurance Corporation; 

24 (3) the Federal Credit Union Act (12 U.S.C. 

25 1751 et seq.) by the National Credit Union Adminis-
12 

•S 2145 RS 

1 tration Board with respect to any Federal credit 

2 union; 

3 (4) part A of subtitle VII of title 49, United 

4 States Code, by the Secretary of Transportation 

5 with respect to any air carrier or foreign air carrier 

6 subject to that part; 

7 (5) the Packers and Stockyards Act, 1921 (7 

8 U.S.C. 181 et seq.) (except as provided in section 

9 406 of that Act (7 U.S.C. 226, 227)), by the Sec10 retary of Agriculture with respect to any activities 

11 subject to that Act; and 

12 (6) the Farm Credit Act of 1971 (12 U.S.C. 

13 2001 et seq.) by the Farm Credit Administration 

14 with respect to any Federal land bank, Federal land 

15 bank association, Federal intermediate credit bank, 

16 or production credit association. 

17 (c) EXERCISE OF CERTAIN POWERS.—For the pur18 pose of the exercise by any agency referred to in sub19 section (b) of its powers under any Act referred to in that 

20 subsection, a violation of this Act is deemed to be a viola21 tion of a requirement imposed under that Act. In addition 

22 to its powers under any provision of law specifically re23 ferred to in subsection (b), each of the agencies referred 

24 to in that subsection may exercise, for the purpose of en-
13 

•S 2145 RS 

1 forcing compliance with any requirement imposed under 

2 this Act, any other authority conferred on it by law. 

3 (d) ACTIONS BY THE COMMISSION.—The Commis4 sion shall prevent any person from violating this Act in 

5 the same manner, by the same means, and with the same 

6 jurisdiction, powers, and duties as though all applicable 

7 terms and provisions of the Federal Trade Commission 

8 Act (15 U.S.C. 41 et seq.) were incorporated into and 

9 made a part of this Act. Any entity that violates any provi10 sion of that section is subject to the penalties and entitled 

11 to the privileges and immunities provided in the Federal 

12 Trade Commission Act in the same manner, by the same 

13 means, and with the same jurisdiction, power, and duties 

14 as though all applicable terms and provisions of the Fed15 eral Trade Commission Act were incorporated into and 

16 made a part of that section. 

17 (e) PRESERVATION OF COMMISSION AUTHORITY.— 

18 Nothing contained in this section shall be construed to 

19 limit the authority of the Commission under any other 

20 provision of law. 

21 SEC. 7. ACTIONS BY STATES. 

22 (a) IN GENERAL.— 

23 (1) CIVIL ACTIONS.—In any case in which the 

24 attorney general of a State has reason to believe 

25 that an interest of the residents of that State has 
14 

•S 2145 RS 

1 been or is threatened or adversely affected by the 

2 engagement of any person in a practice that this Act 

3 prohibits, the State, as parens patriae, may bring a 

4 civil action on behalf of the residents of the State in 

5 a district court of the United States of appropriate 

6 jurisdiction— 

7 (A) to enjoin that practice; 

8 (B) to enforce compliance with the rule; 

9 (C) to obtain damage, restitution, or other 

10 compensation on behalf of residents of the 

11 State; or 

12 (D) to obtain such other relief as the court 

13 may consider to be appropriate. 

14 (2) NOTICE.— 

15 (A) IN GENERAL.—Before filing an action 

16 under paragraph (1), the attorney general of 

17 the State involved shall provide to the Commis18 sion— 

19 (i) written notice of that action; and 

20 (ii) a copy of the complaint for that 

21 action. 

22 (B) EXEMPTION.— 

23 (i) IN GENERAL.—Subparagraph (A) 

24 shall not apply with respect to the filing of 

25 an action by an attorney general of a State 
15 

•S 2145 RS 

1 under this subsection, if the attorney gen2 eral determines that it is not feasible to 

3 provide the notice described in that sub4 paragraph before the filing of the action. 

5 (ii) NOTIFICATION.—In an action de6 scribed in clause (i), the attorney general 

7 of a State shall provide notice and a copy 

8 of the complaint to the Commission at the 

9 same time as the attorney general files the 

10 action. 

11 (b) INTERVENTION.— 

12 (1) IN GENERAL.—On receiving notice under 

13 subsection (a)(2), the Commission shall have the 

14 right to intervene in the action that is the subject 

15 of the notice. 

16 (2) EFFECT OF INTERVENTION.—If the Com17 mission intervenes in an action under subsection (a), 

18 it shall have the right— 

19 (A) to be heard with respect to any matter 

20 that arises in that action; and 

21 (B) to file a petition for appeal. 

22 (c) CONSTRUCTION.—For purposes of bringing any 

23 civil action under subsection (a), nothing in this subtitle 

24 shall be construed to prevent an attorney general of a 
16 

•S 2145 RS 

1 State from exercising the powers conferred on the attorney 

2 general by the laws of that State to— 

3 (1) conduct investigations; 

4 (2) administer oaths or affirmations; or 

5 (3) compel the attendance of witnesses or the 

6 production of documentary and other evidence. 

7 (d) ACTIONS BY THE COMMISSION.—In any case in 

8 which an action is instituted by or on behalf of the Com9 mission for violation of section 2 of this Act, no State may, 

10 during the pendency of that action, institute an action 

11 under subsection (a) against any defendant named in the 

12 complaint in that action for violation of that section. 

13 (e) VENUE; SERVICE OF PROCESS.— 

14 (1) VENUE.—Any action brought under sub15 section (a) may be brought in the district court of 

16 the United States that meets applicable require17 ments relating to venue under section 1391 of title 

18 28, United States Code. 

19 (2) SERVICE OF PROCESS.—In an action 

20 brought under subsection (a), process may be served 

21 in any district in which the defendant— 

22 (A) is an inhabitant; or 

23 (B) may be found. 

24 SEC. 8. DEFINITIONS. 

25 In this Act: 
17 

•S 2145 RS 

1 (1) ADVERTISEMENT.—The term ‘‘advertise2 ment’’ means a commercial promotion for a product 

3 or service, but does not include promotions for prod4 ucts or services that appear on computer software 

5 help or support pages that are displayed in response 

6 to a request by the user. 

7 (2) ADVERTISING FEATURE.—The term ‘‘adver8 tising feature’’ means a function of computer soft9 ware that, when installed on a computer, delivers ad10 vertisements to the user of that computer. 

11 (3) AFFIRMATIVE CONSENT.—The term ‘‘af12 firmative consent’’ means consent expressed through 

13 action by the user of a computer other than default 

14 action specified by the installation sequence and 

15 independent from any other consent solicited from 

16 the user during the installation process. 

17 (4) CLEAR DESCRIPTION.—The term ‘‘clear de18 scription’’ means a description that is clear, con19 spicuous, concise, and in a font size that is at least 

20 as large as the largest default font displayed to the 

21 user by the software. 

22 (5) COMPUTER SOFTWARE.—The term ‘‘com23 puter software’’— 
18 

•S 2145 RS 

1 (A) means any program designed to cause 

2 a computer to perform a desired function or 

3 functions; and 

4 (B) does not include any cookie. 

5 (6) COOKIE.—The term ‘‘cookie’’ means a text 

6 file— 

7 (A) that is placed on a computer by an 

8 Internet service provider, interactive computer 

9 service, or Internet website; and 

10 (B) the sole function of which is to record 

11 information that can be read or recognized by 

12 an Internet service provider, interactive com13 puter service, or Internet website when the user 

14 of the computer uses or accesses such provider, 

15 service, or website. 

16 (7) DISTRIBUTED COMPUTING FEATURE.—The 

17 term ‘‘distributed computing feature’’ means a func18 tion of computer software that, when installed on a 

19 computer, transmits information or messages, other 

20 than personal or network information about the user 

21 of the computer, to any other computer without the 

22 knowledge or direction of the user and for purposes 

23 unrelated to the tasks or functions the user inten24 tionally performs using the computer. 
19 

•S 2145 RS 

1 (8) FIRST RETAIL SALE.—The term ‘‘first retail 

2 sale’’ means the first sale of a computer, for a pur3 pose other than resale, after the manufacture, pro4 duction, or importation of the computer. For pur5 poses of this paragraph, the lease of a computer 

6 shall be considered a sale of the computer at retail. 

7 (9) INFORMATION COLLECTION FEATURE.—The 

8 term ‘‘information collection feature’’ means a func9 tion of computer software that, when installed on a 

10 computer, collects personal or network information 

11 about the user of the computer and transmits such 

12 information to any other party on an automatic 

13 basis or at the direction of a party other than the 

14 user of the computer. 

15 (10) INSTALL.—The term ‘‘install’’ means— 

16 (A) to write computer software to a com17 puter’s persistent storage medium, such as the 

18 computer’s hard disk, in such a way that the 

19 computer software is retained on the computer 

20 after the computer is turned off and subse21 quently restarted; or 

22 (B) to write computer software to a com23 puter’s temporary memory, such as random ac24 cess memory, in such a way that the software 

25 is retained and continues to operate after the 
20 

•S 2145 RS 

1 user of the computer turns off or exits the 

2 Internet service, interactive computer service, or 

3 Internet website from which the computer soft4 ware was obtained. 

5 (11) NETWORK INFORMATION.—The term 

6 ‘‘network information’’ means— 

7 (A) an Internet protocol address or domain 

8 name of a user’s computer; or 

9 (B) a Uniform Resource Locator or other 

10 information that identifies Internet web sites or 

11 other online resources accessed by a user of a 

12 computer. 

13 (12) PERSONAL INFORMATION.—The term 

14 ‘‘personal information’’ means— 

15 (A) a first and last name, whether given at 

16 birth or adoption, assumed, or legally changed; 

17 (B) a home or other physical address in18 cluding street name, name of a city or town, 

19 and zip code; 

20 (C) an electronic mail address or online 

21 username; 

22 (D) a telephone number; 

23 (E) a social security number; 

24 (F) any personal identification number; 
21 

•S 2145 RS 

1 (G) a credit card number, any access code 

2 associated with the credit card, or both; 

3 (H) a birth date, birth certificate number, 

4 or place of birth; or 

5 (I) any password or access code. 

6 (13) PERSON.—The term ‘‘person’’ has the 

7 meaning given that term in section 3(32) of the 

8 Communications Act of 1934 (47 U.S.C. 153(32)). 

9 (14) PROTECTED COMPUTER.—The term ‘‘pro10 tected computer’’ has the meaning given that term 

11 in section 1030(e)(2)(B) of title 18, United States 

12 Code. 

13 (15) SETTINGS MODIFICATION FEATURE.—The 

14 term ‘‘settings modification feature’’ means a func15 tion of computer software that, when installed on a 

16 computer— 

17 (A) modifies an existing user setting, with18 out direction from the user of the computer, 

19 with respect to another computer software ap20 plication previously installed on that computer; 

21 or 

22 (B) enables a user setting with respect to 

23 another computer software application pre24 viously installed on that computer to be modi-
22 

•S 2145 RS 

1 fied in the future without advance notification 

2 to and consent from the user of the computer. 

3 (16) USER OF A COMPUTER.—The term ‘‘user 

4 of a computer’’ means a computer’s lawful owner or 

5 an individual who operates a computer with the au6 thorization of the computer’s lawful owner. 

7 SEC. 9. EFFECTIVE DATE. 

8 This Act shall take effect 180 days after the date of 

9 enactment of this Act. 

10 SECTION 1. SHORT TITLE. 

11 This Act may be cited as the ‘‘Software Principles 

12 Yielding Better Levels of Consumer Knowledge Act’’ or the 

13 ‘‘SPY BLOCK Act’’. 

14 SEC. 2. PROHIBITED PRACTICES IN RELATION TO SOFT15 WARE INSTALLATION IN GENERAL. 

16 (a) SURREPTITIOUS INSTALLATION.— 

17 (1) IN GENERAL.—It shall be unlawful for a per18 son who is not an authorized user of a protected com19 puter to cause the installation of software on the com20 puter in a manner designed to— 

21 (A) conceal from the user of the computer 

22 the fact that the software is being installed; or 

23 (B) prevent the user of the computer from 

24 having an opportunity to knowingly grant or 

25 withhold consent to the installation. 
23 

•S 2145 RS 

1 (2) EXCEPTION.—This subsection shall not apply 

2 to— 

3 (A) the installation of software that falls 

4 within the scope of a previous grant of author5 ization by an authorized user; 

6 (B) the installation of an upgrade to a soft7 ware program that has already been installed on 

8 the computer with the authorization of an au9 thorized user; or 

10 (C) the installation of software before the 

11 first retail sale of the computer. 

12 (b) MISLEADING INDUCEMENTS TO INSTALL.—It shall 

13 be unlawful for a person who is not an authorized user of 

14 a protected computer to induce an authorized user of the 

15 computer to consent to the installation of software on the 

16 computer by means of a materially false or misleading rep17 resentation concerning— 

18 (1) the identity of an operator of an Internet 

19 website or online service at which the software is 

20 made available for download from the Internet; 

21 (2) the identity of the author or publisher of the 

22 software; 

23 (3) the nature or function of the software; or 

24 (4) the consequences of not installing the soft25 ware. 
24 

•S 2145 RS 

1 (c) PREVENTING REASONABLE EFFORTS TO

2 UNINSTALL.— 

3 (1) IN GENERAL.—It shall be unlawful for a per4 son who is not an authorized user of a protected com5 puter to authorize or cause the installation of software 

6 on the computer if the software is designed to prevent 

7 reasonable efforts by an authorized user of the com8 puter to uninstall or disable the software once it has 

9 been installed. 

10 (2) LIMITATIONS.— 

11 (A) AUTHORITY TO UNINSTALL.—Software 

12 that enables 1 authorized user of a computer, 

13 such as a parent or system administrator, to 

14 choose to prevent another user of the same com15 puter from uninstalling or disabling the software 

16 shall not be considered to prevent reasonable ef17 forts to uninstall or disable the software within 

18 the meaning of this subsection, provided that at 

19 least 1 authorized user retains the ability to 

20 uninstall or disable the software. 

21 (B) CONSTRUCTION.—This subsection shall 

22 not be construed to require individual features or 

23 functions of a software program, updates to a 

24 previously installed software program, or soft25 ware programs that were installed on a bundled 
25 

•S 2145 RS 

1 basis to be capable of being uninstalled or dis2 abled on an individual basis. 

3 SEC. 3. INSTALLING SURREPTITIOUS INFORMATION COL4 LECTION FEATURES ON A USER’S COMPUTER. 

5 (a) IN GENERAL.—It shall be unlawful for a person 

6 who is not an authorized user of a protected computer to 

7 authorize or cause the installation on that computer of soft8 ware that collects information about the user of the com9 puter or about the user’s Internet browsing behavior or 

10 other use of the computer and transmits such information 

11 to any other person on an automatic basis or at the direc12 tion of a person other than an authorized user of the com13 puter, if— 

14 (1) the software’s collection and transmission of 

15 such information is not functionally related to or in 

16 support of a software capability or function that an 

17 authorized user of the computer has chosen or con18 sented to execute or enable; and 

19 (2) either— 

20 (A) there has been no notification to an au21 thorized user of the computer, prior to the soft22 ware beginning to collect and transmit such in23 formation, explaining the type of information 

24 the software will collect and transmit and the 
26 

•S 2145 RS 

1 types of ways the information may be used and 

2 distributed; 

3 (B) notification pursuant to subparagraph 

4 (A) was not provided in a manner reasonably 

5 calculated to provide actual notice to an author6 ized user of the computer; or 

7 (C) notification pursuant to subparagraph 

8 (A) occurred at a time or in a manner that did 

9 not enable an authorized user of the computer to 

10 consider the information contained in the notifi11 cation before choosing whether to permit the col12 lection or transmission of information. 

13 (b) AUTHORIZATION STATUS.—This section shall not 

14 be interpreted to prohibit a person from authorizing or 

15 causing the installation of software that collects and trans16 mits information that is reasonably needed to determine 

17 whether or not the user of a protected computer is licensed 

18 or authorized to use the software. 

19 (c) INTENTIONAL TRANSMISSION OF INFORMATION BY

20 USER.—Information shall not be construed to have been col21 lected and transmitted on an automatic basis or at the di22 rection of a person other than a user of the protected com23 puter, within the meaning of this section, if the collection 

24 or transmission of the information is intentionally initi25 ated by an authorized user for the purpose of allowing the 
27 

•S 2145 RS 

1 direct or indirect access to the information by an intended 

2 recipient. 

3 SEC. 4. ADWARE THAT CONCEALS ITS OPERATION. 

4 It shall be unlawful for a person who is not an author5 ized user of a protected computer to authorize or cause the 

6 installation on that computer of software if— 

7 (1) the software causes advertisements to be dis8 played to the user— 

9 (A) at a time when the user is not accessing 

10 an Internet website or online service operated by 

11 the publisher of the software; and 

12 (B) in a manner or at a time such that a 

13 reasonable user would not understand that the 

14 software is responsible for delivering the adver15 tisements; and 

16 (2) the advertisements referred to in paragraph 

17 (1) do not contain a label or other reasonable means 

18 of identifying to the user of the computer, each time 

19 such an advertisement is displayed, which software is 

20 responsible for the advertisements’ delivery. 

21 SEC. 5. OTHER PRACTICES THAT THWART USER CONTROL 

22 OF COMPUTER. 

23 It shall be unlawful for a person who is not an author24 ized user of a protected computer to knowingly and without 

25 authorization of an authorized user of the computer— 
28 

•S 2145 RS 

1 (1) utilize the computer to send unsolicited infor2 mation or material from the user’s computer to other 

3 computers; 

4 (2) divert an authorized user’s Internet browser 

5 away from the Internet website the user intended to 

6 view to 1 or more other websites, unless such diversion 

7 has been authorized by the website the user intended 

8 to view; 

9 (3) display an advertisement, series of advertise10 ments, or other content on the computer through win11 dows in an Internet browser, in such a manner that 

12 the user of the computer cannot end the display of 

13 such advertisements or content without turning off the 

14 computer or terminating all sessions of the Internet 

15 browser, provided that this paragraph shall not apply 

16 to the display of content related to the functionality 

17 or identity of the Internet browser; 

18 (4) covertly modify settings relating to the use of 

19 the computer or to the computer’s access to or use of 

20 the Internet, including— 

21 (A) altering the default Web page that ini22 tially appears when a user of the computer 

23 launches an Internet browser; 

24 (B) altering the default provider or Web 

25 proxy used to access or search the Internet; 
29 

•S 2145 RS 

1 (C) altering bookmarks used to store favor2 ite Internet website addresses; or 

3 (D) altering settings relating to security 

4 measures that protect the computer and the in5 formation stored on the computer against unau6 thorized access or use; 

7 provided that this paragraph shall not apply to any 

8 modification that restores settings previously changed 

9 without user consent; 

10 (5) use software installed in violation of section 

11 3 to collect information about the user or the user’s 

12 Internet browsing behavior; or 

13 (6) remove, disable, or render inoperative a secu14 rity or privacy protection technology installed on the 

15 computer. 

16 SEC. 6. LIMITATIONS ON LIABILITY. 

17 (a) PASSIVE TRANSMISSION, HOSTING, OR LINKING.— 

18 A person shall not be deemed to have violated any provision 

19 of this Act solely because the person provided— 

20 (1) the Internet connection, telephone connection, 

21 or other transmission or routing function through 

22 which software was delivered to a protected computer 

23 for installation; 
30 

•S 2145 RS 

1 (2) the storage or hosting of software or of an 

2 Internet website through which software was made 

3 available for installation to a protected computer; or 

4 (3) an information location tool, such as a direc5 tory, index, reference, pointer, or hypertext link, 

6 through which a user of a protected computer located 

7 software available for installation. 

8 (b) NETWORK SECURITY.—A provider of a network or 

9 online service that an authorized user of a protected com10 puter uses or subscribes to shall not be deemed to have vio11 lated section 3 or 5 for any monitoring of, interaction with, 

12 or installation of software for the purposes of— 

13 (1) protecting the security of the network, service, 

14 or computer; 

15 (2) facilitating diagnostics, technical support, 

16 maintenance, network management, or repair; or 

17 (3) preventing or detecting unauthorized, fraudu18 lent, or otherwise unlawful uses of the network or 

19 service. 

20 SEC. 7. ADMINISTRATION AND ENFORCEMENT. 

21 (a) IN GENERAL.—Except as provided in subsection 

22 (b), this Act shall be enforced by the Commission as if the 

23 violation of this Act were an unfair or deceptive act or 

24 practice proscribed under section 18(a)(1)(B) of the Federal 

25 Trade Commission Act (15 U.S.C. 57a(a)(1)(B)). 
31 

•S 2145 RS 

1 (b) ENFORCEMENT BY CERTAIN OTHER AGENCIES.— 

2 Compliance with this Act shall be enforced under— 

3 (1) section 8 of the Federal Deposit Insurance 

4 Act (12 U.S.C. 1818), in the case of— 

5 (A) national banks, and Federal branches 

6 and Federal agencies of foreign banks, by the Of7 fice of the Comptroller of the Currency; 

8 (B) member banks of the Federal Reserve 

9 System (other than national banks), branches 

10 and agencies of foreign banks (other than Fed11 eral branches, Federal agencies, and insured 

12 State branches of foreign banks), commercial 

13 lending companies owned or controlled by for14 eign banks, and organizations operating under 

15 section 25 or 25A of the Federal Reserve Act (12 

16 U.S.C. 601 and 611), by the Board; and 

17 (C) banks insured by the Federal Deposit 

18 Insurance Corporation (other than members of 

19 the Federal Reserve System) and insured State 

20 branches of foreign banks, by the Board of Direc21 tors of the Federal Deposit Insurance Corpora22 tion; 

23 (2) section 8 of the Federal Deposit Insurance 

24 Act (12 U.S.C. 1818), by the Director of the Office of 

25 Thrift Supervision, in the case of a savings associa-
32 

•S 2145 RS 

1 tion the deposits of which are insured by the Federal 

2 Deposit Insurance Corporation; 

3 (3) the Federal Credit Union Act (12 U.S.C. 

4 1751 et seq.) by the National Credit Union Adminis5 tration Board with respect to any Federal credit 

6 union; 

7 (4) part A of subtitle VII of title 49, United 

8 States Code, by the Secretary of Transportation with 

9 respect to any air carrier or foreign air carrier sub10 ject to that part; 

11 (5) the Packers and Stockyards Act, 1921 (7 

12 U.S.C. 181 et seq.) (except as provided in section 406 

13 of that Act (7 U.S.C. 226, 227)), by the Secretary of 

14 Agriculture with respect to any activities subject to 

15 that Act; and 

16 (6) the Farm Credit Act of 1971 (12 U.S.C. 2001 

17 et seq.) by the Farm Credit Administration with re18 spect to any Federal land bank, Federal land bank 

19 association, Federal intermediate credit bank, or pro20 duction credit association. 

21 (c) EXERCISE OF CERTAIN POWERS.—For the purpose 

22 of the exercise by any agency referred to in subsection (b) 

23 of its powers under any Act referred to in that subsection, 

24 a violation of this Act is deemed to be a violation of a re25 quirement imposed under that Act. In addition to its pow-
33 

•S 2145 RS 

1 ers under any provision of law specifically referred to in 

2 subsection (b), each of the agencies referred to in that sub3 section may exercise, for the purpose of enforcing compli4 ance with any requirement imposed under this Act, any 

5 other authority conferred on it by law. 

6 (d) ACTIONS BY THE COMMISSION.—The Commission 

7 shall prevent any person from violating this Act in the same 

8 manner, by the same means, and with the same jurisdic9 tion, powers, and duties as though all applicable terms and 

10 provisions of the Federal Trade Commission Act (15 U.S.C. 

11 41 et seq.) were incorporated into and made a part of this 

12 Act. Any entity that violates any provision of that section 

13 is subject to the penalties and entitled to the privileges and 

14 immunities provided in the Federal Trade Commission Act 

15 in the same manner, by the same means, and with the same 

16 jurisdiction, power, and duties as though all applicable 

17 terms and provisions of the Federal Trade Commission Act 

18 were incorporated into and made a part of that section. 

19 SEC. 8. ACTIONS BY STATES. 

20 (a) IN GENERAL.— 

21 (1) CIVIL ACTIONS.—In any case in which the 

22 attorney general of a State has reason to believe that 

23 an interest of the residents of that State has been or 

24 is threatened or adversely affected by the engagement 

25 of any person in a practice that this Act prohibits, 
34 

•S 2145 RS 

1 the State, as parens patriae, may bring a civil action 

2 on behalf of the residents of the State in a district 

3 court of the United States of appropriate jurisdic4 tion— 

5 (A) to enjoin that practice; 

6 (B) to enforce compliance with the rule; 

7 (C) to obtain damage, restitution, or other 

8 compensation on behalf of residents of the State; 

9 or 

10 (D) to obtain such other relief as the court 

11 may consider to be appropriate. 

12 (2) NOTICE.— 

13 (A) IN GENERAL.—Before filing an action 

14 under paragraph (1), the attorney general of the 

15 State involved shall provide to the Commis16 sion— 

17 (i) written notice of that action; and 

18 (ii) a copy of the complaint for that 

19 action. 

20 (B) EXEMPTION.— 

21 (i) IN GENERAL.—Subparagraph (A) 

22 shall not apply with respect to the filing of 

23 an action by an attorney general of a State 

24 under this subsection, if the attorney gen25 eral determines that it is not feasible to pro-
35 

•S 2145 RS 

1 vide the notice described in that subpara2 graph before the filing of the action. 

3 (ii) NOTIFICATION.—In an action de4 scribed in clause (i), the attorney general of 

5 a State shall provide notice and a copy of 

6 the complaint to the Commission at the 

7 same time as the attorney general files the 

8 action. 

9 (b) INTERVENTION.— 

10 (1) IN GENERAL.—On receiving notice under 

11 subsection (a)(2), the Commission shall have the right 

12 to intervene in the action that is the subject of the no13 tice. 

14 (2) EFFECT OF INTERVENTION.—If the Commis15 sion intervenes in an action under subsection (a), it 

16 shall have the right— 

17 (A) to be heard with respect to any matter 

18 that arises in that action; and 

19 (B) to file a petition for appeal. 

20 (c) CONSTRUCTION.—For purposes of bringing any 

21 civil action under subsection (a), nothing in this subtitle 

22 shall be construed to prevent an attorney general of a State 

23 from exercising the powers conferred on the attorney general 

24 by the laws of that State to— 

25 (1) conduct investigations; 
36 

•S 2145 RS 

1 (2) administer oaths or affirmations; or 

2 (3) compel the attendance of witnesses or the 

3 production of documentary and other evidence. 

4 (d) ACTIONS BY THE COMMISSION.—In any case in 

5 which an action is instituted by or on behalf of the Commis6 sion for violation of section 2, no State may, during the 

7 pendency of that action, institute an action under sub8 section (a) against any defendant named in the complaint 

9 in that action for violation of that section. 

10 (e) VENUE; SERVICE OF PROCESS.— 

11 (1) VENUE.—Any action brought under sub12 section (a) may be brought in the district court of the 

13 United States that meets applicable requirements re14 lating to venue under section 1391 of title 28, United 

15 States Code. 

16 (2) SERVICE OF PROCESS.—In an action brought 

17 under subsection (a), process may be served in any 

18 district in which the defendant— 

19 (A) is an inhabitant; or 

20 (B) may be found. 

21 SEC. 9. EFFECT ON OTHER LAWS. 

22 (a) FEDERAL LAW.—Nothing in this Act shall be con23 strued to limit or affect in any way the Commission’s au24 thority to bring enforcement actions or take any other meas-
37 

•S 2145 RS 

1 ures under the Federal Trade Commission Act or any other 

2 provision of law. 

3 (b) STATE LAW.— 

4 (1) STATE LAW CONCERNING INFORMATION COL5 LECTION SOFTWARE OR ADWARE.—This Act super6 sedes any statute, regulation, or rule of a State or po7 litical subdivision of a State that expressly limits or 

8 restricts the installation or use of software on a pro9 tected computer to— 

10 (A) collect information about the user of the 

11 computer or the user’s Internet browsing behav12 ior or other use of the computer; or 

13 (B) cause advertisements to be delivered to 

14 the user of the computer, 

15 except to the extent that any such statute, regulation, 

16 or rule prohibits deception in connection with the in17 stallation or use of such software. 

18 (2) STATE LAW NOT SPECIFIC TO SOFTWARE.— 

19 This Act shall not be construed to preempt the appli20 cability of State trespass, contract, tort, or anti-fraud 

21 law. 
38 

•S 2145 RS 

1 SEC. 10. PENALTIES FOR CERTAIN UNAUTHORIZED ACTIVI2 TIES RELATING TO COMPUTERS. 

3 (a) IN GENERAL.—Chapter 47 of title 18, United 

4 States Code, is amended by inserting after section 1030 the 

5 following: 

6 ‘‘§ 1030A. Illicit indirect use of protected computers 

7 ‘‘(a) Whoever intentionally accesses a protected com8 puter without authorization, or exceeds authorized access to 

9 a protected computer, by causing a computer program or 

10 code to be copied onto the protected computer, and inten11 tionally uses that program or code in furtherance of another 

12 Federal criminal offense shall be fined under this title or 

13 imprisoned 5 years, or both. 

14 ‘‘(b) Whoever intentionally accesses a protected com15 puter without authorization, or exceeds authorized access to 

16 a protected computer, by causing a computer program or 

17 code to be copied onto the protected computer, and by means 

18 of that program or code intentionally impairs the security 

19 protection of the protected computer shall be fined under 

20 this title or imprisoned not more than 2 years, or both. 

21 ‘‘(c) A person shall not violate this section who solely 

22 provides— 

23 ‘‘(1) an Internet connection, telephone connec24 tion, or other transmission or routing function 

25 through which software is delivered to a protected 

26 computer for installation; 
39 

•S 2145 RS 

1 ‘‘(2) the storage or hosting of software, or of an 

2 Internet website, through which software is made 

3 available for installation to a protected computer; or 

4 ‘‘(3) an information location tool, such as a di5 rectory, index, reference, pointer, or hypertext link, 

6 through which a user of a protected computer locates 

7 software available for installation. 

8 ‘‘(d) A provider of a network or online service that an 

9 authorized user of a protected computer uses or subscribes 

10 to shall not violate this section by any monitoring of, inter11 action with, or installation of software for the purpose of— 

12 ‘‘(1) protecting the security of the network, serv13 ice, or computer; 

14 ‘‘(2) facilitating diagnostics, technical support, 

15 maintenance, network management, or repair; or 

16 ‘‘(3) preventing or detecting unauthorized, fraud17 ulent, or otherwise unlawful uses of the network or 

18 service. 

19 ‘‘(e) No person may bring a civil action under the law 

20 of any State if such action is premised in whole or in part 

21 upon the defendant’s violating this section. For the purposes 

22 of this subsection, the term ‘State’ includes the District of 

23 Columbia, Puerto Rico, and any other territory or posses24 sion of the United States.’’. 
40 

•S 2145 RS 

1 (b) CONFORMING AMENDMENT.—The table of sections 

2 at the beginning of chapter 47 of title 18, United States 

3 Code, is amended by inserting after the item relating to 

4 section 1030 the following new item: 

‘‘1030A. Illicit indirect use of protected computers’’ 

5 SEC. 11. DEFINITIONS. 

6 In this Act: 

7 (1) AUTHORIZED USER.—The term ‘‘authorized 

8 user’’, when used with respect to a computer, means 

9 the owner or lessee of a computer, or someone using 

10 or accessing a computer with the actual or apparent 

11 authorization of the owner or lessee. 

12 (2) CAUSE THE INSTALLATION.—The term 

13 ‘‘cause the installation’’ when used with respect to 

14 particular software, means to knowingly provide the 

15 technical means by which the software is installed, or 

16 to knowingly pay or provide other consideration to, 

17 or induce, another person to do so. 

18 (3) COMMISSION.—The term ‘‘Commission’’ 

19 means the Federal Trade Commission. 

20 (4) COOKIE.—The term ‘‘cookie’’ means a text 

21 file— 

22 (A) that is placed on a computer by an 

23 Internet service provider, interactive computer 

24 service, or Internet website; and 
41 

•S 2145 RS 

1 (B) the sole function of which is to record 

2 information that can be read or recognized when 

3 the user of the computer subsequently accesses 

4 particular websites or online locations or serv5 ices. 

6 (5) FIRST RETAIL SALE.—The term ‘‘first retail 

7 sale’’ means the first sale of a computer, for a purpose 

8 other than resale, after the manufacture, production, 

9 or importation of the computer. For purposes of this 

10 paragraph, the lease of a computer shall be considered 

11 a sale of the computer at retail. 

12 (6) INSTALL.—The term ‘‘install’’ means— 

13 (A) to write computer software to a com14 puter’s persistent storage medium, such as the 

15 computer’s hard disk, in such a way that the 

16 computer software is retained on the computer 

17 after the computer is turned off and subsequently 

18 restarted; or 

19 (B) to write computer software to a com20 puter’s temporary memory, such as random ac21 cess memory, in such a way that the software is 

22 retained and continues to operate after the user 

23 of the computer turns off or exits the Internet 

24 service, interactive computer service, or Internet 
42 

•S 2145 RS 

1 website from which the computer software was 

2 obtained. 

3 (7) PERSON.—The term ‘‘person’’ has the mean4 ing given that term in section 3(32) of the Commu5 nications Act of 1934 (47 U.S.C. 153(32)). 

6 (8) PROTECTED COMPUTER.—The term ‘‘pro7 tected computer’’ has the meaning given that term in 

8 section 1030(e)(2)(B) of title 18, United States Code. 

9 (9) SOFTWARE.—The term ‘‘software’’ means 

10 any program designed to cause a computer to perform 

11 a desired function or functions. Such term does not 

12 include any cookie. 

13 (10) UPGRADE.—The term ‘‘upgrade’’, when 

14 used with respect to a previously installed software 

15 program, means additional software that is issued by 

16 the publisher or any successor to the publisher of the 

17 software program to improve, correct, repair, en18 hance, supplement, or otherwise modify the software 

19 program. 

20 SEC. 12. EFFECTIVE DATE. 

21 This Act shall take effect 180 days after the date of 

22 enactment of this Act. 

Calendar No. 811 

108TH CONGRESS 

2D SESSION S. 2145 

A BILL 

To regulate the unauthorized installation of computer software, to require clear disclosure to 

computer users of certain computer software features that may pose a threat to user privacy, and for other purposes. 

NOVEMBER 19, 2004 

Reported with an amendment