I 

108TH CONGRESS 

1ST SESSION H. R. 69

To require the Federal Trade Commission to prescribe regulations to protect 

the privacy of personal information collected from and about individuals 

who are not covered by the Children’s Online Privacy Protection Act 

of 1998 on the Internet, to provide greater individual control over the 

collection and use of that information, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JANUARY 7, 2003

Mr. FRELINGHUYSEN introduced the following bill; which was referred to the 

Committee on Energy and Commerce 

A BILL

To require the Federal Trade Commission to prescribe regulations to protect the privacy of personal information 

collected from and about individuals who are not covered 

by the Children’s Online Privacy Protection Act of 1998 

on the Internet, to provide greater individual control 

over the collection and use of that information, and 

for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Online Privacy Protec5 tion Act of 2003’’. 
2

•HR 69 IH 

1 SEC. 2. REGULATION OF UNFAIR AND DECEPTIVE ACTS 

2 AND PRACTICES IN CONNECTION WITH THE 

3 COLLECTION, USE AND DISCLOSURE OF PER4 SONAL INFORMATION. 

5 (a) ACTS PROHIBITED.—

6 (1) IN GENERAL.—It is unlawful for an oper7 ator of a Web site or online service to collect, use 

8 or disclose personal information in a manner that 

9 violates the regulations prescribed under subsection 

10 (b). 

11 (2) DISCLOSURE.—Notwithstanding paragraph 

12 (1), neither an operator of a Web site or online serv13 ice nor the operator’s agent shall be held to be liable 

14 under this Act for any disclosure made in good faith 

15 and following reasonable procedures in responding to 

16 a request under subsection (b)(1)(B) by an indi17 vidual for disclosure of personal information per18 taining to such individual. 

19 (b) REGULATIONS.—

20 (1) IN GENERAL.—Not later than 1 year after 

21 the date of the enactment of this Act, the Commis22 sion shall promulgate under section 553 of title 5, 

23 United States Code, regulations that—

24 (A) require the operator of any Web site or 

25 online service—
3

•HR 69 IH 

1 (i) to provide notice on its Web site, 

2 in a clear and conspicuous manner, of the 

3 identity of the operator, what personal in4 formation is collected by the operator, how 

5 the operator uses such information, and 

6 what information may be shared with other 

7 companies; and 

8 (ii) to provide a meaningful and sim9 ple online process for individuals to con10 sent to or limit the disclosure of personal 

11 information for purposes unrelated to 

12 those for which such information was ob13 tained or described in the notice under 

14 clause (i); 

15 (B) require the operator to provide, upon 

16 request of an individual under this subpara17 graph who has provided personal information to 

18 that Web site or online service, upon proper 

19 identification—

20 (i) a description of the specific types 

21 of personal information collected by that 

22 operator that was sold or transferred to an 

23 external company; and 

24 (ii) notwithstanding any other provi25 sion of law, a means that is reasonable 
4

•HR 69 IH 

1 under the circumstances for the individual 

2 to obtain the personal information de3 scribed in paragraph (i) from such indi4 vidual; and 

5 (C) require the operator of such Web site 

6 or online service to establish and maintain rea7 sonable procedures to protect the confiden8 tiality, security, and integrity of personal infor9 mation it collects or maintains. 

10 (2) WHEN PURPOSE LIMITATION NOT RE11 QUIRED.—The regulations shall provide that the 

12 purpose limitation required under paragraph 

13 (1)(A)(ii) is not required for—

14 (A) transactional information where identi15 fiable information is not removed; 

16 (B) personal information where it is used 

17 to render or conduct a legitimate business activ18 ity related to the business of the operator (for 

19 example, the use of an e-mail address to re20 spond to an e-mail communication); or 

21 (C) the collection, use, or dissemination of 

22 such information by the operator of such a web 

23 site or online service necessary to the extent 

24 permitted under other provisions of law. 
5

•HR 69 IH 

1 (3) WHEN ACCESS NOT REQUIRED.—The regu2 lations shall provide that access as required under 

3 paragraph (1)(B)(ii) is not required—

4 (A) to transactional information where 

5 identifiable information is not removed; 

6 (B) to information that is commercially 

7 confidential to the operator and is obtained 

8 from sources outside of the individual’s contact 

9 with the operator’s web site; 

10 (C) to information that is solely for inter11 nal company processes and is neither sold, 

12 transferred, nor used for activities external to 

13 the web site’s operator; 

14 (D) to information that is discarded upon 

15 the conclusion of the process that generates it; 

16 or 

17 (E) to information that has no impact 

18 upon an individual. 

19 (4) TERMINATION OF SERVICE.—The regula20 tions shall permit the operator of a Web site or an 

21 online service to terminate service provided to an in22 dividual who has refused, under the regulations pre23 scribed under paragraph (1)(B)(ii), to permit the op24 erator’s further use or maintenance in retrievable 

25 form, or future collection, of personal information. 
6

•HR 69 IH 

1 (c) ENFORCEMENT.—Subject to sections 3 and 5, a 

2 violation of a regulation prescribed under subsection (a) 

3 shall be treated as a violation of a rule defining an unfair 

4 or deceptive act or practice prescribed under section 

5 18(a)(1)(B) of the Federal Trade Commission Act (15 

6 U.S.C. 57a(a)(1)(B)). 

7 (d) NO REQUIREMENT TO COLLECT OR MAINTAIN

8 DATA.—Nothing in this Act shall be interpreted to require 

9 an operator to collect or maintain any data that would 

10 not otherwise be collected or maintained. 

11 SEC. 3. SAFE HARBORS. 

12 (a) GUIDELINES.—An operator may satisfy the re13 quirements of regulations issued under section 2(b) by fol14 lowing a set of self-regulatory guidelines, issued by rep15 resentatives of the marketing or online industries, or by 

16 other persons, approved under subsection (b). 

17 (b) INCENTIVES.—

18 (1) SELF-REGULATORY INCENTIVES.—In pre19 scribing regulations under section 2, the Commission 

20 shall provide incentives for self-regulation by opera21 tors to implement the protections afforded under the 

22 regulatory requirements described in subsection (b) 

23 of that section. 

24 (2) DEEMED COMPLIANCE.—Such incentives 

25 shall include provisions for ensuring that a person 
7

•HR 69 IH 

1 will be deemed to be in compliance with the require2 ments of the regulations under section 2 if that per3 son complies with guidelines that, after notice and 

4 comment, are approved by the Commission upon 

5 making a determination that the guidelines meet the 

6 requirements of the regulations issued under section 

7 2. 

8 (3) EXPEDITED RESPONSE TO REQUESTS.—The 

9 Commission shall act upon requests for safe harbor 

10 treatment within 180 days of the filing of the re11 quest, and shall set forth in writing its conclusions 

12 with regard to such requests. 

13 (c) APPEALS.—Final action by the Commission on a 

14 request for approval of guidelines, or the failure to act 

15 within 180 days on a request for approval of guidelines, 

16 submitted under subsection (b) may be appealed to a dis17 trict court of the United States of appropriate jurisdiction 

18 as provided for in section 706 of title 5, United States 

19 Code. 

20 SEC. 4. ACTIONS BY STATES. 

21 (a) IN GENERAL.—

22 (1) CIVIL ACTIONS.—In any case in which the 

23 attorney general of a State has reason to believe 

24 that an interest of the residents of that State has 

25 been or is threatened or adversely affected by the 
8

•HR 69 IH 

1 engagement of any person in a practice that violates 

2 any regulation of the Commission prescribed under 

3 section 2(b) of this Act, the State may bring a civil 

4 action on behalf of the residents of the State in a 

5 district court of the United States of appropriate ju6 risdiction to—

7 (A) enjoin that practice; 

8 (B) enforce compliance with the regulation; 

9 (C) obtain damage, restitution, or other 

10 compensation on behalf of residents of the 

11 State; or 

12 (D) obtain such other relief as the court 

13 may consider to be appropriate. 

14 (2) NOTICE.—

15 (A) IN GENERAL.—Before filing an action 

16 under paragraph (1), the attorney general of 

17 the State involved shall provide to the Commis18 sion—

19 (i) written notice of that action; and 

20 (ii) a copy of the complaint for that 

21 action. 

22 (B) EXEMPTION.—

23 (i) IN GENERAL.—Subparagraph (A) 

24 shall not apply with respect to the filing of 

25 an action by an attorney general of a State 
9

•HR 69 IH 

1 under this subsection, if the attorney gen2 eral determines that it is not feasible to 

3 provide the notice described in that sub4 paragraph before the filing of the action. 

5 (ii) NOTIFICATION.—In an action de6 scribed in clause (i), the attorney general 

7 of a State shall provide notice and a copy 

8 of the complaint to the Commission at the 

9 same time as the attorney general files the 

10 action. 

11 (b) INTERVENTION.—

12 (1) IN GENERAL.—On receiving notice under 

13 subsection (a)(2), the Commission shall have the 

14 right to intervene in the action that is the subject 

15 of the notice. 

16 (2) EFFECT OF INTERVENTION.—If the Com17 mission intervenes in an action under subsection (a), 

18 it shall have the right—

19 (A) to be heard with respect to any matter 

20 that arises in that action; and 

21 (B) to file a petition for appeal. 

22 (3) AMICUS CURIAE.—Upon application to the 

23 court, a person whose self-regulatory guidelines have 

24 been approved by the Commission and are relied 

25 upon as a defense by any defendant to a proceeding 
10

•HR 69 IH 

1 under this section may file amicus curiae in that 

2 proceeding. 

3 (c) CONSTRUCTION.—For purposes of bringing any 

4 civil action under subsection (a), nothing in this Act shall 

5 be construed to prevent an attorney general of a State 

6 from exercising the powers conferred on the attorney gen7 eral by the laws of that State to—

8 (1) conduct investigations; 

9 (2) administer oaths or affirmations; or 

10 (3) compel the attendance of witnesses or the 

11 production of documentary and other evidence. 

12 (d) VENUE; SERVICE OF PROCESS.—

13 (1) VENUE.—Any action brought under sub14 section (a) may be brought in the district court of 

15 the United States that meets applicable require16 ments relating to venue under section 1391 of title 

17 28, United States Code. 

18 (2) SERVICE OF PROCESS.—In an action 

19 brought under subsection (a), process may be served 

20 in any district in which the defendant—

21 (A) is an inhabitant; or 

22 (B) may be found. 
11

•HR 69 IH 

1 SEC. 5. ADMINISTRATION AND APPLICABILITY OF ACT. 

2 (a) IN GENERAL.—Except as otherwise provided, this 

3 Act shall be enforced by the Commission under the Fed4 eral Trade Commission Act (15 U.S.C. 41 et seq.). 

5 (b) PROVISIONS.—Compliance with the requirements 

6 imposed under this Act shall be enforced under—

7 (1) section 8 of the Federal Deposit Insurance 

8 Act (12 U.S.C. 1818), in the case of—

9 (A) national banks, and Federal branches 

10 and Federal agencies of foreign banks, by the 

11 Office of the Comptroller of the Currency; 

12 (B) member banks of the Federal Reserve 

13 System (other than national banks), branches 

14 and agencies of foreign banks (other than Fed15 eral branches, Federal agencies, and insured 

16 State branches of foreign banks), commercial 

17 lending companies owned or controlled by for18 eign banks, and organizations operating under 

19 section 25 or 25(a) of the Federal Reserve Act 

20 (12 U.S.C. 601 et seq. and 611 et seq.), by the 

21 Board; and 

22 (C) banks insured by the Federal Deposit 

23 Insurance Corporation (other than members of 

24 the Federal Reserve System) and insured State 

25 branches of foreign banks, by the Board of Di-
12

•HR 69 IH 

1 rectors of the Federal Deposit Insurance Cor2 poration; 

3 (2) section 8 of the Federal Deposit Insurance 

4 Act (12 U.S.C. 1818), by the Director of the Office 

5 of Thrift Supervision, in the case of a savings asso6 ciation the deposits of which are insured by the Fed7 eral Deposit Insurance Corporation; 

8 (3) the Federal Credit Union Act (12 U.S.C. 

9 1751 et seq.) by the National Credit Union Adminis10 tration Board with respect to any Federal credit 

11 union; 

12 (4) part A of subtitle VII of title 49, United 

13 States Code, by the Secretary of Transportation 

14 with respect to any air carrier or foreign air carrier 

15 subject to that part; 

16 (5) the Packers and Stockyards Act, 1921 (7 

17 U.S.C. 181 et seq.) (except as provided in section 

18 406 of that Act (7 U.S.C. 226, 227)), by the Sec19 retary of Agriculture with respect to any activities 

20 subject to that Act; and 

21 (6) the Farm Credit Act of 1971 (12 U.S.C. 

22 2001 et seq.) by the Farm Credit Administration 

23 with respect to any Federal land bank, Federal land 

24 bank association, Federal intermediate credit bank, 

25 or production credit association. 
13

•HR 69 IH 

1 (c) EXERCISE OF CERTAIN POWERS.—For the pur2 pose of the exercise by any agency referred to in sub3 section (b) of its powers under any other Act referred to 

4 in that subsection, a violation of any requirement imposed 

5 under this Act shall be deemed to be a violation of a re6 quirement imposed under that other Act. In addition to 

7 its powers under any provision of law specifically referred 

8 to in subsection (b), each of the agencies referred to in 

9 that subsection may exercise, for the purpose of enforcing 

10 compliance with any requirement imposed under this Act, 

11 any other authority conferred on such agency by law. 

12 (d) ACTIONS BY THE COMMISSION.—The Commis13 sion shall prevent any person from violating a rule of the 

14 Commission under section 2 in the same manner, by the 

15 same means, and with the same jurisdiction, powers, and 

16 duties as though all applicable terms and provisions of the 

17 Federal Trade Commission Act (15 U.S.C. 41 et seq.) 

18 were incorporated into and made a part of this title. Any 

19 entity that violates such rule shall be subject to the pen20 alties and entitled to the privileges and immunities pro21 vided in the Federal Trade Commission Act in the same 

22 manner, by the same means, and with the same jurisdic23 tion, power, and duties as though all applicable terms and 

24 provisions of the Federal Trade Commission Act were in25 corporated into and made a part of this title. 
14

•HR 69 IH 

1 (e) EFFECT ON OTHER LAWS.—Nothing contained in 

2 this Act shall be construed to limit the authority of the 

3 Commission under any other provisions of law. 

4 (f) PREEMPTION.—Except as otherwise provided in 

5 this Act, this Act supersedes State law to the extent that 

6 it establishes a rule of law applicable to an online privacy 

7 action that is inconsistent with State law. Nothing in this 

8 Act supersedes State law with respect to prosecution of 

9 fraud. 

10 SEC. 6. REVIEW. 

11 Not later than 5 years after the effective date of the 

12 regulations initially issued under section 2, the Commis13 sion shall—

14 (1) review the implementation of this Act, in15 cluding the effect of the implementation of this title 

16 on practices relating to the collection and disclosure 

17 of information; and 

18 (2) prepare and submit to Congress a report on 

19 the results of the review under paragraph (1). 

20 SEC. 7. EFFECTIVE DATE. 

21 Sections 3(a), 5, and 6 of this Act shall take effect 

22 on the later of—

23 (1) the date that is 18 months after the date 

24 of enactment of this Act; or 
15

•HR 69 IH 

1 (2) the date on which the Commission rules on 

2 the first application filed for safe harbor treatment 

3 under section 3 if the Commission does not rule on 

4 the first such application within one year after the 

5 date of enactment of this Act, but in no case later 

6 than the date that is 30 months after the date of 

7 enactment of this Act. 

8 SEC. 8. DEFINITIONS. 

9 In this Act: 

10 (1) INDIVIDUAL.—The term ‘‘individual’’ means 

11 a natural person of age 13 and above. 

12 (2) OPERATOR.—The term ‘‘operator’’—

13 (A) means any person who operates a Web 

14 site located on the Internet or an online service 

15 and who collects or maintains personal informa16 tion from or about the users of or visitors to 

17 such Web site or online service, or on whose be18 half such information is collected or main19 tained, where such Web site or online service is 

20 operated for commercial purposes, including 

21 any person offering products or services for sale 

22 through that Web site or online service, involv23 ing commerce—

24 (i) among the several States or with 1 

25 or more foreign nations; 
16

•HR 69 IH 

1 (ii) in any territory of the United 

2 States or in the District of Columbia, or 

3 between any such territory and—

4 (I) another such territory; or 

5 (II) any State or foreign nation; 

6 or 

7 (iii) between the District of Columbia 

8 and any State, territory, or foreign nation; 

9 but 

10 (B) does not include any nonprofit entity 

11 that would otherwise be exempt from coverage 

12 under section 5 of the Federal Trade Commis13 sion Act (15 U.S.C. 45). 

14 (3) COMMISSION.—The term ‘‘Commission’’ 

15 means the Federal Trade Commission. 

16 (4) DISCLOSURE.—The term ‘‘disclosure’’ 

17 means, with respect to personal information the re18 lease of personal information collected in identifiable 

19 form by an operator for any purpose, except where 

20 such information is provided to a person other than 

21 the operator who provides support for the internal 

22 operations of the Web site and does not disclose or 

23 use that information for any other purpose. 
17

•HR 69 IH 

1 (5) FEDERAL AGENCY.—The term ‘‘Federal 

2 agency’’ means an agency, as that term is defined 

3 in section 551(1) of title 5, United States Code. 

4 (6) INTERNET.—The term ‘‘Internet’’ means 

5 collectively the myriad of computer and tele6 communications facilities, including equipment and 

7 operating software, which comprise the inter8 connected world-wide network of networks that em9 ploy the Transmission Control Protocol/Internet 

10 Protocol, or any predecessor or successor protocols 

11 to such protocol, to communicate information of all 

12 kinds by wire or radio. 

13 (7) TRANSACTIONAL INFORMATION.—The term 

14 ‘‘transactional information’’ means information gen15 erated in connection with the process of requesting, 

16 accessing, or otherwise using the Internet. 

17 (8) PERSONAL INFORMATION.—The term ‘‘per18 sonal information’’ means information collected on19 line from an individual that identifies that indi20 vidual, including—

21 (A) first and last name; 

22 (B) home and other physical address; 

23 (C) e-mail address; 

24 (D) social security number; 

25 (E) telephone number; 
18

•HR 69 IH 

1 (F) any other identifier that the Commis2 sion determines identifies an individual; or 

3 (G) information that is maintained with, or 

4 can be searched or retrieved by means of, data 

5 described in subparagraphs (A) through (F).

Æ