(d) INVESTIGATORY POWERS.—Nothing in this sec-
tion may be construed to prevent the attorney general of 
a State from exercising the powers conferred on such at-
torney general by the laws of such State to conduct inves-
tigations or to administer oaths or affirmations or to com-
pel the attendance of witnesses or the production of docu-
mentary and other evidence. 
(e) VENUE; SERVICE OF PROCESS.— 
(1) VENUE.—Any action brought under sub-
section (a) may be brought in— 
(A) the district court of the United States 
that meets applicable requirements relating to 
venue under section 1391 of title 28, United 
States Code; or 
(B) another court of competent jurisdic-
tion. 
(2) SERVICE
OF
PROCESS.—In an action 
brought under subsection (a), process may be served 
in any district in which the defendant— 
(A) is an inhabitant; or 
(B) may be found. 
(f) ACTIONS BY OTHER STATE OFFICIALS.— 
(1) IN GENERAL.—In addition to civil actions 
brought by attorneys general under subsection (a), 
any other officer of a State who is authorized by the 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00063
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
State to do so may bring a civil action under sub-
section (a), subject to the same requirements and 
limitations that apply under this section to civil ac-
tions brought by attorneys general. 
(2) SAVINGS PROVISION.—Nothing in this sec-
tion may be construed to prohibit an authorized offi-
cial of a State from initiating or continuing any pro-
ceeding in a court of the State for a violation of any 
civil or criminal law of the State. 
SEC. 155. CIVIL PENALTIES. 
(a) IN GENERAL.—In an action brought under sec-
tion 154, in addition to any other penalty otherwise appli-
cable to a violation of this title or any regulation promul-
gated under this title, the following civil penalties shall 
apply: 
(1) SUBTITLE A VIOLATIONS.—A covered entity 
that recklessly or repeatedly violates subtitle A is lia-
ble for a civil penalty equal to the amount calculated 
by multiplying the number of days that the entity is 
not in compliance with such subtitle by an amount 
not to exceed $33,000. 
(2) SUBTITLE B VIOLATIONS.—A covered entity 
that recklessly or repeatedly violates subtitle B is 
liable for a civil penalty equal to the amount cal-
culated by multiplying the number of days that such 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00064
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
an entity is not in compliance with such subtitle, or 
the number of individuals for whom the entity failed 
to obtain consent as required by such subtitle, 
whichever is greater, by an amount not to exceed 
$33,000. 
(3) SUBTITLE D VIOLATIONS.—A covered entity 
that recklessly or repeatedly violates section 142 is 
liable for a civil penalty equal to the amount cal-
culated by multiplying the number of violations of 
such section by an amount not to exceed $33,000. 
Each failure to send notification as required under 
such section to a resident of the State shall be treat-
ed as a separate violation. 
(b) ADJUSTMENT
FOR INFLATION.—Beginning on 
the date that the Consumer Price Index for All Urban 
Consumers is first published by the Bureau of Labor Sta-
tistics that is after 1 year after the date of the enactment 
of this Act, and each year thereafter, each of the amounts 
specified in subsection (a) shall be increased by the per-
centage increase in the Consumer Price Index published 
on that date from the Consumer Price Index published 
the previous year. 
(c) MAXIMUM TOTAL LIABILITY.—Notwithstanding 
the number of actions which may be brought against a 
covered entity under section 154, the maximum civil pen-
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
alty for which any covered entity may be liable under this 
section in such actions shall not exceed— 
(1) $6,000,000 for any related series of viola-
tions of any rule promulgated under subtitle A; 
(2) $6,000,000 for any related series of viola-
tions of subtitle B; and 
(3) $6,000,000 for any related series of viola-
tions of section 142. 
SEC. 156. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE LAWS.—The provisions 
of this title shall supersede any provisions of the law of 
any State relating to those entities covered by the regula-
tions issued pursuant to this title, to the extent that such 
provisions relate to the collection, use, or disclosure of— 
(1) covered information addressed in this title; 
or 
(2) personally identifiable information or per-
sonal identification information addressed in provi-
sions of the law of a State. 
(b) UNAUTHORIZED CIVIL ACTIONS; CERTAIN STATE 
LAWS.— 
(1) 
UNAUTHORIZED
ACTIONS.—No 
person 
other than a person specified in section 154 may 
bring a civil action under the laws of any State if 
such action is premised in whole or in part upon the 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00066
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
defendant violating this title or a regulation promul-
gated under this title. 
(2) PROTECTION OF CERTAIN STATE LAWS.— 
This title shall not be construed to preempt the ap-
plicability of— 
(A) State laws that address the collection, 
use, or disclosure of health information or fi-
nancial information; or 
(B) other State laws to the extent that 
those laws relate to acts of fraud. 
(c) RULE
OF CONSTRUCTION RELATING
TO RE-
QUIRED DISCLOSURES
TO GOVERNMENT ENTITIES.— 
This title shall not be construed to expand or limit the 
duty or authority of a covered entity or third party to dis-
close personally identifiable information to a government 
entity under any provision of law. 
SEC. 157. NO PRIVATE RIGHT OF ACTION. 
This title may not be construed to provide any private 
right of action. 
Subtitle F—Co-Regulatory Safe 
Harbor Programs 
SEC. 161. ESTABLISHMENT OF SAFE HARBOR PROGRAMS. 
(a) IN GENERAL.—Not later than 1 year after the 
date of the enactment of this Act, the Commission shall 
initiate a rulemaking proceeding to establish requirements 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
for the establishment and administration of safe harbor 
programs under which a nongovernmental organization 
will administer a program that— 
(1) establishes a mechanism for participants to 
implement the requirements of this title with regards 
to— 
(A) certain types of unauthorized uses of 
covered information as described in paragraph 
(2); or 
(B) any unauthorized use of covered infor-
mation; and 
(2) offers consumers a clear, conspicuous, per-
sistent, and effective means of opting out of the 
transfer of covered information by a covered entity 
participating in the safe harbor program to a third 
party for— 
(A) behavioral advertising purposes; 
(B) location-based advertising purposes; 
(C) other specific types of unauthorized 
use; or 
(D) any unauthorized use. 
(b) SELECTION OF NONGOVERNMENTAL ORGANIZA-
TIONS TO ADMINISTER PROGRAM.— 
(1) SUBMITTAL OF APPLICATIONS.—An appli-
cant seeking to administer a program under the re-
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
quirements established pursuant to subsection (a) 
shall submit to the Commission an application there-
for at such time, in such manner, and containing 
such information as the Commission may require. 
(2) NOTICE AND RECEIPT OF APPLICATIONS.— 
Upon completion of the rulemaking proceedings re-
quired by subsection (a), the Commission shall— 
(A) publish a notice in the Federal Reg-
ister that it will receive applications for ap-
proval of safe harbor programs under this sub-
title; and 
(B) begin receiving applications under 
paragraph (1). 
(3) SELECTION.—Not later than 270 days after 
the date on which the Commission receives a com-
pleted application under this subsection, the Com-
mission shall grant or deny the application on the 
basis of the Commission’s evaluation of the appli-
cant’s capacity to provide protection of individuals’ 
covered information with regard to specific types of 
unauthorized uses of covered information as de-
scribed in subsection (a)(2) that is substantially 
equivalent to or superior to the protection otherwise 
provided under this title. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(4) WRITTEN FINDINGS.—Any decision reached 
by the Commission under this subsection shall be ac-
companied by written findings setting forth the basis 
for and reasons supporting such decision. 
(c) SCOPE
OF SAFE HARBOR PROTECTION.—The 
scope of protection offered by safe harbor programs ap-
proved by the Commission that establish mechanisms for 
participants to implement the requirements of the title 
only for certain uses of covered information as described 
in subsection (a)(2) shall be limited to participating enti-
ties’ use of those particular types of covered information. 
(d) SUPERVISION
BY FEDERAL TRADE COMMIS-
SION.— 
(1) IN GENERAL.—The Commission shall exer-
cise oversight and supervisory authority of a safe 
harbor 
program 
approved 
under 
this 
section 
through— 
(A) ongoing review of the practices of the 
nongovernmental 
organization 
administering 
the program; 
(B) the imposition of civil penalties on the 
nongovernmental organization if it is not com-
pliant with the requirements established under 
subsection (a); and 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00070
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(C) withdrawal of authorization to admin-
ister the safe harbor program under this sub-
title. 
(2) ANNUAL REPORTS BY NONGOVERNMENTAL 
ORGANIZATIONS.—Each year, each nongovernmental 
organization administering a safe harbor program 
under this section shall submit to the Commission a 
report on its activities under this subtitle during the 
preceding year. 
SEC. 162. PARTICIPATION IN SAFE HARBOR PROGRAM. 
(a) EXEMPTION.—Any covered entity that partici-
pates in, and demonstrates compliance with, a safe harbor 
program administered under section 161 shall be exempt 
from any provision of subtitle B or subtitle C if the Com-
mission finds that the requirements of the safe harbor pro-
gram are substantially the same as or more protective of 
privacy of individuals than the requirements of the provi-
sion from which the exemption is granted. 
(b) LIMITATION.—Nothing in this subtitle shall be 
construed to exempt any covered entity participating in 
a safe harbor program from compliance with any other 
requirement of the regulations promulgated under this 
title for which the safe harbor does not provide an excep-
tion. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
Subtitle G—Application With Other 
Federal Laws 
SEC. 171. APPLICATION WITH OTHER FEDERAL LAWS. 
(a) QUALIFIED EXEMPTION FOR PERSONS SUBJECT 
TO OTHER FEDERAL PRIVACY LAWS.—If a person is sub-
ject to a provision of this title and a provision of a Federal 
privacy law described in subsection (d), such provision of 
this title shall not apply to such person to the extent that 
such provision of Federal privacy law applies to such per-
son. 
(b) PROTECTION
OF OTHER FEDERAL PRIVACY 
LAWS.—Nothing in this title may be construed to modify, 
limit, or supersede the operation of the Federal privacy 
laws described in subsection (d) or the provision of infor-
mation permitted or required, expressly or by implication, 
by such laws, with respect to Federal rights and practices. 
(c) COMMUNICATIONS INFRASTRUCTURE AND PRI-
VACY.—If a person is subject to a provision of section 222 
or 631 of the Communications Act of 1934 (47 U.S.C. 
222 and 551) and a provision of this title, such provision 
of such section 222 or 631 shall not apply to such person 
to the extent that such provision of this title applies to 
such person. 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(d) OTHER FEDERAL PRIVACY LAWS DESCRIBED.— 
The Federal privacy laws described in this subsection are 
as follows: 
(1) Section 552a of title 5, United States Code 
(commonly known as the Privacy Act of 1974). 
(2) The Right to Financial Privacy Act of 1978 
(12 U.S.C. 3401 et seq.). 
(3) The Fair Credit Reporting Act (15 U.S.C. 
1681 et seq.). 
(4) The Fair Debt Collection Practices Act (15 
U.S.C. 1692 et seq.). 
(5) The Children’s Online Privacy Protection 
Act of 1998 (15 U.S.C. 6501 et seq.). 
(6) Title V of the Gramm-Leach-Bliley Act of 
1999 (15 U.S.C. 6801 et seq.). 
(7) Chapters 119, 123, and 206 of title 18, 
United States Code. 
(8) Section 2710 of title 18, United States 
Code. 
(9) Section 444 of the General Education Pro-
visions Act (20 U.S.C. 1232g) (commonly referred 
to as the ‘‘Family Educational Rights and Privacy 
Act of 1974’’). 
(10) Section 445 of the General Education Pro-
visions Act (20 U.S.C. 1232h). 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
(11) The Privacy Protection Act of 1980 (42 
U.S.C. 2000aa et seq.). 
(12) The regulations promulgated under section 
264(c) of the Health Insurance Portability and Ac-
countability Act of 1996 (42 U.S.C. 1320d–2 note), 
as such regulations relate to a person described in 
section 1172(a) of the Social Security Act (42 
U.S.C. 1320d–1(a)) or to transactions referred to in 
section 1173(a)(1) of such Act (42 U.S.C. 1320d– 
2(a)(1)). 
(13) The Communications Assistance for Law 
Enforcement Act (47 U.S.C. 1001 et seq.). 
(14) Section 227 of the Communications Act of 
1934 (47 U.S.C. 227). 
Subtitle H—Development of Com-
mercial Data Privacy Policy in 
the Department of Commerce 
SEC. 181. DIRECTION TO DEVELOP COMMERCIAL DATA PRI-
VACY POLICY. 
The Secretary of Commerce shall contribute to the 
development of commercial data privacy policy by— 
(1) convening private sector stakeholders, in-
cluding members of industry, civil society groups, 
academia, in open forums, to develop codes of con-
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00074
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
duct in support of applications for safe harbor pro-
grams under subtitle F; 
(2) expanding interoperability between the 
United States commercial data privacy framework 
and other national and regional privacy frameworks; 
(3) conducting research related to improving 
privacy protection under this title; and 
(4) conducting research related to improving 
data sharing practices, including the use of 
anonymised data, and growing the information econ-
omy. 
TITLE II—ONLINE PRIVACY OF 
CHILDREN 
SEC. 201. SHORT TITLE. 
This title may be cited as the ‘‘Do Not Track Kids 
Act of 2015’’. 
SEC. 202. FINDINGS. 
Congress finds the following: 
(1) Since the enactment of the Children’s On-
line Privacy Protection Act of 1998, the World Wide 
Web has changed dramatically, with the creation of 
tens of millions of websites, the proliferation of en-
tirely new media platforms, and the emergence of a 
diverse ecosystem of services, devices, and applica-
tions that enable users to connect wirelessly within 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00075
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
an online environment without being tethered to a 
desktop computer. 
(2) The explosive growth of the Internet eco-
system has unleashed a wide array of opportunities 
to learn, communicate, participate in civic life, ac-
cess entertainment, and engage in commerce. 
(3) In addition to these significant benefits, the 
Internet also presents challenges, particularly with 
respect to the efforts of entities to track the online 
activities of children and minors and to collect, use, 
and disclose personal information about them, in-
cluding their geolocation, for commercial purposes. 
(4) Children and teens are visiting numerous 
companies’ websites, and marketers are using multi-
media games, online quizzes, and mobile phone and 
tablet applications to create ties to children and 
teens. 
(5) According to a study by the Wall Street 
Journal in 2010, websites directed to children and 
teens were more likely to use cookies and other 
tracking tools than sites directed to a general audi-
ence. 
(6) This study examined 50 popular websites 
for children and teens in the United States and 
found that these 50 sites placed 4,123 cookies, bea-
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00076
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
cons, and other tracking tools on the test computer 
used for the study. 
(7) This is 30-percent greater than the number 
of such tracking tools that were placed on the test 
computer in a similar study of the 50 overall most 
popular websites in the United States, which are 
generally directed to adults. 
(8) Children and teens lack the cognitive ability 
to distinguish advertising from program content and 
to understand that the purpose of advertising is to 
persuade them, making them unable to activate the 
defenses on which adults rely. 
(9) Children and teens are less able than adults 
to understand the potential long-term consequences 
of having their information available to third parties, 
including advertisers, and other individuals. 
(10) According to Common Sense Media and 
the Center for Digital Democracy, 90 percent of 
teens have used some form of social media, 75 per-
cent have a social networking site, and 51 percent 
check their social networking site at least once a 
day. 
(11) Ninety-one percent of parents and 91 per-
cent of adults believe it is not okay for advertisers 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00077
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
to collect information about a child’s location from 
that child’s mobile phone. 
(12) Ninety-four percent of parents and 91 per-
cent of adults agree that advertisers should receive 
the parent’s permission before putting tracking soft-
ware on a child’s computer. 
(13) Ninety-six percent of parents and 94 per-
cent of adults expressed disapproval when asked if 
it is ‘‘okay for a website to ask children for personal 
information about their friends’’. 
(14) Eighty-eight percent of parents would sup-
port a law that requires search engines and social 
networking sites to get users’ permission before 
using their personal information. 
(15) A Commonsense Media/Zogby poll found 
that 94 percent of parents and 94 percent of adults 
believe individuals should have the ability to request 
the deletion, after a specific period of time, of all of 
their personal information held by an online search 
engine, social networking site, or marketing com-
pany. 
(16) According to a Pew/Berkman Center poll, 
69 percent of parents of teens who engage in online 
activity are concerned about how that activity might 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS
affect their children’s future academic or employ-
ment opportunities. 
(17) Eighty-one percent of parents of teens who 
engage in online activity say they are concerned 
about how much information advertisers can learn 
about their children’s online activity. 
SEC. 203. DEFINITIONS. 
(a) IN GENERAL.—In this title: 
(1) MINOR.—The term ‘‘minor’’ means an indi-
vidual over the age of 12 and under the age of 16. 
(2) TARGETED
MARKETING.—The term ‘‘tar-
geted marketing’’ means advertising or other efforts 
to market a product or service that are directed to 
a specific individual or device— 
(A) based on the personal information of 
the individual or a unique identifier of the de-
vice; and 
(B) as a result of use by the individual, or 
access by the device, of a website, online serv-
ice, online application, or mobile application. 
(b) TERMS DEFINED BY COMMISSION.—In this title, 
the terms ‘‘directed to minors’’ and ‘‘geolocation informa-
tion’’ shall have the meanings given such terms by the 
Commission by regulation. Not later than 1 year after the 
date of the enactment of this Act, the Commission shall 
VerDate Sep 11 2014 
02:23 Mar 03, 2015
Jkt 049200
PO 00000
Frm 00079
Fmt 6652
Sfmt 6201
E:\BILLS\H1053.IH
H1053
emcdonald on DSK67QTVN1PROD with BILLS