the format, manner, and timing of the notice re-
quired by paragraph (1)(A). In promulgating the 
regulations, the Commission shall consider how to 
ensure the most effective and efficient communica-
tion to the user regarding the treatment of personal 
data. 
(4) DIRECT ACCESS TO DATA BY THIRD PAR-
TIES.—For purposes of this Act, if the developer of 
a mobile application allows a third party to access 
personal data collected by the application, such per-
sonal data shall be considered to be shared with the 
third party, whether or not such personal data are 
first transmitted to the developer. 
(b) WITHDRAWAL OF CONSENT.—The developer of a 
mobile application shall— 
(1) provide a user of the application with a 
means of— 
(A) notifying the developer that the user 
intends to stop using the application; and 
(B) requesting the developer— 
(i) to refrain from any further collec-
tion of personal data through the applica-
tion; and 
(ii) at the option of the user, either— 
VerDate Mar 15 2010 
16:06 May 13, 2013
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1913.IH
H1913
TKELLEY on DSK3SPTVN1PROD with BILLS
(I) to the extent practicable, to 
delete any personal data collected by 
the application that is stored by the 
developer; or 
(II) to refrain from any further 
use or sharing of such data; and 
(2) within a reasonable and appropriate time 
after receiving a request under paragraph (1)(B), 
comply with such request. 
(c) SECURITY OF PERSONAL DATA AND DE-IDENTI-
FIED DATA.—The developer of a mobile application shall 
take reasonable and appropriate measures to prevent un-
authorized access to personal data and de-identified data 
collected by the application. 
(d) EXCEPTION.—Nothing in this Act prohibits the 
developer of a mobile application from disclosing or pre-
serving personal data or de-identified data as required 
by— 
(1) other Federal law (including a court order); 
or 
(2) except as provided in section 6, the law of 
a State or a political subdivision of a State (includ-
ing a court order). 
VerDate Mar 15 2010 
16:06 May 13, 2013
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1913.IH
H1913
TKELLEY on DSK3SPTVN1PROD with BILLS
SEC. 3. APPLICATION AND ENFORCEMENT. 
(a) GENERAL APPLICATION.—The requirements of 
this Act and the regulations promulgated under this Act 
apply, according to their terms, to those persons, partner-
ships, and corporations over which the Commission has 
authority pursuant to section 5(a)(2) of the Federal Trade 
Commission Act (15 U.S.C. 45(a)(2)). 
(b) ENFORCEMENT BY FEDERAL TRADE COMMIS-
SION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of this Act or a regulation pro-
mulgated under this Act shall be treated as a viola-
tion of a regulation under section 18(a)(1)(B) of the 
Federal 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices. 
(2) POWERS
OF
COMMISSION.—The Commis-
sion shall enforce this Act and the regulations pro-
mulgated under this Act in the same manner, by the 
same means, and with the same jurisdiction, powers, 
and duties as though all applicable terms and provi-
sions of the Federal Trade Commission Act (15 
U.S.C. 41 et seq.) were incorporated into and made 
a part of this Act. Any person who violates this Act 
or a regulation promulgated under this Act shall be 
subject to the penalties and entitled to the privileges 
VerDate Mar 15 2010 
16:06 May 13, 2013
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1913.IH
H1913
TKELLEY on DSK3SPTVN1PROD with BILLS
and immunities provided in the Federal Trade Com-
mission Act. 
(c) ACTIONS BY STATES.— 
(1) IN GENERAL.—In any case in which the at-
torney general of a State, or an official or agency of 
a State, has reason to believe that an interest of the 
residents of such State has been or is threatened or 
adversely affected by an act or practice in violation 
of this Act or a regulation promulgated under this 
Act, the State, as parens patriae, may bring a civil 
action on behalf of the residents of the State in an 
appropriate district court of the United States to— 
(A) enjoin such act or practice; 
(B) enforce compliance with this Act or 
such regulation; 
(C) obtain damages, restitution, or other 
compensation on behalf of residents of the 
State; or 
(D) obtain such other legal and equitable 
relief as the court may consider to be appro-
priate. 
(2) NOTICE.—Before filing an action under this 
subsection, the attorney general, official, or agency 
of the State involved shall provide to the Commis-
sion a written notice of such action and a copy of 
VerDate Mar 15 2010 
16:06 May 13, 2013
Jkt 029200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1913.IH
H1913
TKELLEY on DSK3SPTVN1PROD with BILLS
the complaint for such action. If the attorney gen-
eral, official, or agency determines that it is not fea-
sible to provide the notice described in this para-
graph before the filing of the action, the attorney 
general, official, or agency shall provide written no-
tice of the action and a copy of the complaint to the 
Commission immediately upon the filing of the ac-
tion. 
(3) AUTHORITY OF COMMISSION.— 
(A) IN
GENERAL.—On receiving notice 
under paragraph (2) of an action under this 
subsection, the Commission shall have the 
right— 
(i) to intervene in the action; 
(ii) upon so intervening, to be heard 
on all matters arising therein; and 
(iii) to file petitions for appeal. 
(B) LIMITATION ON STATE ACTION WHILE 
FEDERAL ACTION IS PENDING.—If the Commis-
sion or the Attorney General of the United 
States has instituted a civil action for violation 
of this Act or a regulation promulgated under 
this Act (referred to in this subparagraph as 
the ‘‘Federal action’’), no State attorney gen-
eral, official, or agency may bring an action 
VerDate Mar 15 2010 
16:06 May 13, 2013
Jkt 029200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1913.IH
H1913
TKELLEY on DSK3SPTVN1PROD with BILLS
under this subsection during the pendency of 
the Federal action against any defendant 
named in the complaint in the Federal action 
for any violation of this Act or such regulation 
alleged in such complaint. 
(4) RULE OF CONSTRUCTION.—For purposes of 
bringing a civil action under this subsection, nothing 
in this Act shall be construed to prevent an attorney 
general, official, or agency of a State from exercising 
the powers conferred on the attorney general, offi-
cial, or agency by the laws of such State to conduct 
investigations, administer oaths and affirmations, or 
compel the attendance of witnesses or the production 
of documentary and other evidence. 
SEC. 4. REGULATIONS. 
Not later than 1 year after the date of the enactment 
of this Act, the Commission shall promulgate regulations 
in accordance with section 553 of title 5, United States 
Code, to implement and enforce this Act. 
SEC. 5. SAFE HARBOR. 
(a) IN GENERAL.—The developer of a mobile applica-
tion may satisfy the requirements of this Act and the regu-
lations promulgated under this Act by adopting and fol-
lowing a code of conduct for consumer data privacy (inso-
VerDate Mar 15 2010 
16:06 May 13, 2013
Jkt 029200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1913.IH
H1913
TKELLEY on DSK3SPTVN1PROD with BILLS
far as such code relates to data collected by a mobile appli-
cation) that— 
(1) was developed in a multistakeholder process 
convened by the National Telecommunications and 
Information Administration, as described in the doc-
ument issued by the President on February 23, 
2012, entitled ‘‘Consumer Data Privacy in a 
Networked World: A Framework for Protecting Pri-
vacy and Promoting Innovation in the Global Digital 
Economy’’; and 
(2) the Commission has approved as meeting 
the requirements of the regulations promulgated 
under section 4. 
(b) REGULATIONS.—The Commission shall promul-
gate regulations in accordance with section 553 of title 
5, United States Code, to govern the consideration and 
approval of codes of conduct under subsection (a)(2). 
SEC. 6. RELATIONSHIP TO STATE LAW. 
This Act and the regulations promulgated under this 
Act supercede a provision of law of a State or a political 
subdivision of a State only to the extent that such provi-
sion— 
(1) conflicts with this Act or such regulations, 
as determined without regard to section 2(d)(2); 
VerDate Mar 15 2010 
16:06 May 13, 2013
Jkt 029200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1913.IH
H1913
TKELLEY on DSK3SPTVN1PROD with BILLS
(2) specifically relates to the treatment of per-
sonal data or de-identified data; and 
(3) provides a level of transparency, user con-
trol, or security in the treatment of personal data or 
de-identified data that is less than the level provided 
by this Act and such regulations. 
SEC. 7. PRESERVATION OF FTC AUTHORITY. 
Nothing in this Act may be construed in any way to 
limit or affect the authority of the Commission under any 
other provision of law. 
SEC. 8. DEFINITIONS. 
In this Act: 
(1) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(2) DE-IDENTIFIED DATA.—The term ‘‘de-iden-
tified data’’ means data that cannot reasonably be 
used to identify or infer information about, or other-
wise be linked to, a particular individual or mobile 
device, as determined with a reasonable level of jus-
tified confidence based on the available methods and 
technologies, the nature of the data at issue, and the 
purposes for which the data will be used. 
(3) DEVELOPER.—The term ‘‘developer’’ shall 
have the meaning given such term by the Commis-
sion by regulation. 
VerDate Mar 15 2010 
16:06 May 13, 2013
Jkt 029200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1913.IH
H1913
TKELLEY on DSK3SPTVN1PROD with BILLS
(4) MOBILE APPLICATION.—The term ‘‘mobile 
application’’ means a software program that— 
(A) runs on the operating system of a mo-
bile device; and 
(B) collects data from a user. 
(5) MOBILE
DEVICE.—The term ‘‘mobile de-
vice’’ means a smartphone, tablet computer, or simi-
lar portable computing device that transmits data 
over a wireless connection. 
(6) PERSONAL
DATA.—The term ‘‘personal 
data’’ shall have the meaning given such term by the 
Commission by regulation, except that such term 
shall not include de-identified data. 
(7) STATE.—The term ‘‘State’’ means each of 
the several States, the District of Columbia, each 
commonwealth, territory, or possession of the United 
States, and each federally recognized Indian tribe. 
(8) THIRD
PARTY.—The term ‘‘third party’’ 
means, with respect to the developer of an applica-
tion, an entity that holds itself out to the public as 
separate from the developer such that a user of the 
application 
acting 
reasonably 
under 
the 
cir-
cumstances would not expect the entity to be related 
to the developer or to have access to personal data 
the user provides to the developer. Such term in-
VerDate Mar 15 2010 
16:06 May 13, 2013
Jkt 029200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H1913.IH
H1913
TKELLEY on DSK3SPTVN1PROD with BILLS
cludes an affiliate of the developer unless the affili-
ation is reasonably clear to users of the application. 
SEC. 9. EFFECTIVE DATE. 
This Act shall apply with respect to any collection, 
use, storage, or sharing of personal data or de-identified 
data that occurs after the date that is 30 days after the 
promulgation of final regulations under section 4. 
Æ 
VerDate Mar 15 2010 
16:06 May 13, 2013
Jkt 029200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6301
E:\BILLS\H1913.IH
H1913
TKELLEY on DSK3SPTVN1PROD with BILLS