User Data Protection Act

To prohibit digital platforms from using information about a user unless the user consents to such use, to ensure personal information is considered a property right, and for other purposes. 1. Short title This Act may be cited as the User Data Protection Act 2. Prohibition on requirement to accept cookies (a) In general (1) Tracking and user property rights It shall be unlawful for the operator of a digital platform or any third-party platform to do any of the following: (A) Without the consent of the user— (i) use cookies for the digital platform; (ii) collect and store any information about the user, including any habit or preference of the user; and (iii) deliver content to the user that corresponds with any of the personal information of the user. (B) Restrict a user from using a digital platform if the user declines to consent to any of the activities described in subparagraph (A). (C) Use tracking pixels. (D) Share information about a user with other digital platforms or online businesses. (2) Property rights for user information The operator of a digital platform shall do the following: (A) If a user consents to the digital platform collecting, storing, or using the information about the user, provide a disclosure statement— (i) that includes a description of the information that the digital platform intends to collect, store, or use, what the information will be used for, and what the digital platform determines the economic value of the information to be; (ii) that is consistent across all digital platforms; and (iii) the form of which shall be determined by the Commission. (B) Make the disclosure statement accessible to the individual on the platform. (C) Treat any information collected, stored, or used by the digital platform or information that a user generates on the digital platform as an exclusive property right owned by that user. (D) Determine the economic value of the information described under subparagraph (A) as a property right. (E) Provide an update to users if there is any change in the collection, storage, or use of the information described under subparagraph (A) or the economic value determined under subparagraph (D). (b) Enforcement (1) Enforcement by the Federal Trade Commission (A) Unfair or deceptive acts or practices A violation of subsection (a) shall be treated as a violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) (B) Powers of commission The Commission shall enforce subsection (a) in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act ( 15 U.S.C. 41 et seq. (2) Effect on other laws Nothing in this section shall be construed in any way to limit the authority of the Commission under any other provision of law or to limit the application of any Federal or State law. (3) Enforcement by State attorneys general (A) In general If the chief law enforcement officer of a State, or an official or agency designated by a State, has reason to believe that any person has violated or is violating subsection (a), the attorney general, official, or agency of the State, in addition to any authority it may have to bring an action in State court under its consumer protection law, may bring a civil action in any appropriate United States district court or in any other court of competent jurisdiction, including a State court, to— (i) enjoin further such violation by such person; (ii) enforce compliance with such subsection; (iii) obtain civil penalties; and (iv) obtain damages, restitution, or other compensation on behalf of residents of the State. (B) Notice and intervention by the Federal Trade Commission The attorney general of a State shall provide prior written notice of any action under subparagraph (A) to the Commission and provide the Commission with a copy of the complaint in the action, except in any case in which such prior notice is not feasible, in which case the attorney general shall serve such notice immediately upon instituting such action. The Commission shall have the right— (i) to intervene in the action; (ii) upon so intervening, to be heard on all matters arising therein; and (iii) to file petitions for appeal. (C) Limitation on State action while Federal action is pending If the Commission has instituted a civil action for violation of this section, no State attorney general, or official or agency of a State, may bring an action under this paragraph during the pendency of that action against any defendant named in the complaint of the Commission for any violation of this section alleged in the complaint. (c) Private cause of action (1) Action A user who suffers harm as a result of a violation of subsection (a) may bring an action against the operator of a digital platform in the appropriate district court of the United States to enjoin such violation and for damages. (2) Damages A user who suffers harm as a result of a violation of subsection (a) shall not receive less than 90 percent of total damages. (3) Attorney’s fees The amount of an award of attorney’s fees under this subsection may not exceed an amount equal to 33 percent of the damages awarded to the user. (d) Federal preemption This Act preempts any State law relating to the requirements described under this Act. (e) Definitions In this section: (1) Commission The term Commission (2) Cookies The term cookies (3) Digital platform The term digital platform (4) Third-party platform The term third-party platform (5) Tracking pixel The term tracking pixel

Summary: User Data Protection Act This bill establishes requirements for websites and other digital platforms that collect and store information about their users, including information saved to a web browser to track a user over time (i.e., cookies). Specifically, a website may not (1) use cookies or otherwise collect information about a user without the user's consent, (2) restrict access to the website if a user declines such consent, (3) use pixel-sized images that are hidden or embedded in a web page that collect data about a user (i.e., tracking pixels), or (4) share a user's information with other websites or online businesses. Further, if a user consents to the collection of information, the website must (1) disclose to the user what the information will be used for, and (2) treat any such information as an exclusive property right owned by the user. The bill provides for enforcement of these provisions by the Federal Trade Commission, state attorneys general, and private right of action.