(d) COMMISSION GUIDANCE.—Not later than 1 year 
after the date of the enactment of this Act, the Commis-
sion shall issue guidance with respect to what constitutes 
reasonable policies, practices, and procedures as required 
by subsection (a). In issuing such guidance, the Commis-
sion shall consider unique circumstances applicable to non-
profit organizations, service providers, and data brokers. 
SEC. 104. TRANSPARENCY. 
(a) IN GENERAL.—Each covered entity and service 
provider shall make publicly available a clear and con-
spicuous, not misleading, and easy-to-read privacy policy 
that provides a detailed and accurate representation of the 
data collection, processing, retention, and transfer activi-
ties of the covered entity or service provider. 
(b) CONTENT OF PRIVACY POLICY.—The privacy pol-
icy required under subsection (a) shall include, at a min-
imum, the following: 
(1) The identity and the contact information 
of— 
(A) the covered entity or service provider 
to which the privacy policy applies, including a 
point of contact and a monitored email address 
or other monitored online contact mechanism, 
as applicable, specific to data privacy and data 
security inquiries; and 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(B) any affiliate within the same corporate 
structure as the covered entity or service pro-
vider, to which the covered entity or service pro-
vider may transfer data, that— 
(i) is not under common branding 
with the covered entity or service provider; 
or 
(ii) has different contact information 
than the covered entity or service provider. 
(2) With respect to the collection, processing, 
and retention of covered data— 
(A) the categories of covered data the cov-
ered entity or service provider collects, proc-
esses, or retains; and 
(B) the processing purposes for each such 
category of covered data. 
(3) Whether the covered entity or service pro-
vider transfers covered data and, if so— 
(A) each category of service provider or 
third party to which the covered entity or serv-
ice provider transfers covered data; 
(B) the name of each data broker to which 
the covered entity or service provider transfers 
covered data; and 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00062
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(C) the purposes for which such data is 
transferred. 
(4) The length of time the covered entity or 
service provider intends to retain each category of 
covered data or, if it is not possible to identify the 
length of time, the criteria used to determine the 
length of time the covered entity or service provider 
intends to retain each category of covered data. 
(5) A prominent description of how an indi-
vidual may exercise the rights, as applicable, of the 
individual under this title. 
(6) A description of how the covered entity 
treats data collected from covered minors differently 
than data collected from other individuals, if the 
covered entity has knowledge that the covered entity 
has collected data from covered minors. 
(7) A general description of the data security 
practices of the covered entity or service provider. 
(8) The effective date of the privacy policy. 
(9) Whether any covered data collected by the 
covered entity or service provider is transferred to, 
processed in, retained in, or otherwise accessible to 
a foreign adversary (as determined by the Secretary 
of Commerce and specified in section 7.4 of title 15, 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00063
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
Code of Federal Regulations (or any successor regu-
lation)). 
(c) LANGUAGES.—A privacy policy required under 
subsection (a) shall be made available to the public— 
(1) in the 10 most-used languages in which a 
covered entity or service provider provides products 
or services or carries out activities related to such 
products or services; or 
(2) if the covered entity or service provider pro-
vides products or services in fewer than 10 lan-
guages, in the languages in which the covered entity 
or service provider provides products or services or 
carries out activities related to such products or 
services. 
(d) ACCESSIBILITY.—A covered entity or service pro-
vider shall provide the disclosures required under this sec-
tion in a manner that is reasonably accessible to and usa-
ble by individuals living with disabilities. 
(e) MATERIAL CHANGES.— 
(1) NOTICE AND OPT OUT.—A covered entity 
that makes a material change to the privacy policy 
or practices of the covered entity shall— 
(A) provide to each affected individual, in 
a clear and conspicuous manner— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00064
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(i) advance notice of such material 
change; and 
(ii) a means to opt out of the collec-
tion, processing, retention, or transfer of 
any covered data of such individual pursu-
ant to such material change; and 
(B) with respect to the covered data of any 
individual who opts out using the means de-
scribed in subparagraph (A)(ii), discontinue the 
collection, processing, retention, or transfer of 
such covered data, unless such collection, proc-
essing, retention, or transfer is necessary, pro-
portionate, and limited to provide or maintain 
a product or service specifically requested by 
the individual. 
(2) DIRECT NOTIFICATION.—A covered entity 
shall take all reasonable electronic measures to pro-
vide direct notification, if possible, to each affected 
individual regarding material changes to the privacy 
policy of the covered entity, and such notification 
shall be provided in each language in which the pri-
vacy policy is made available, taking into account 
available technology and the nature of the relation-
ship between the covered entity and the individual. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(3) CLARIFICATION.—Except as provided in 
paragraph (1)(B), nothing in this subsection may be 
construed to affect the requirements for covered en-
tities under sections 102, 105, and 106. 
(f) TRANSPARENCY
REQUIREMENTS
FOR
LARGE 
DATA HOLDERS.— 
(1) RETENTION OF PRIVACY POLICIES; LOG OF 
MATERIAL CHANGES.— 
(A) IN GENERAL.—Beginning on the date 
that is 180 days after the date of the enact-
ment of this Act, each large data holder shall— 
(i) retain and publish on the website 
of the large data holder a copy of each 
version of the privacy policy of the large 
data holder required under subsection (a) 
for not less than 10 years; and 
(ii) make publicly available on the 
website of the large data holder, in a clear 
and conspicuous manner, a log that de-
scribes the date and nature of each mate-
rial change to the privacy policy of the 
large data holder during the preceding 10- 
year period in a manner that is sufficient 
for a reasonable individual to understand 
the effect of each material change. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00066
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(B) EXCLUSION.—This paragraph does not 
apply to material changes to previous versions 
of the privacy policy of a large data holder that 
precede the date that is 180 days after the date 
of the enactment of this Act. 
(2) SHORT FORM NOTICE TO CONSUMERS.— 
(A) IN GENERAL.—In addition to the pri-
vacy policy required under subsection (a), a 
large data holder shall provide a short-form no-
tice of the covered data practices of the large 
data holder in a manner that— 
(i) is concise; 
(ii) is clear and conspicuous; 
(iii) is readily accessible to an indi-
vidual, based on the manner in which the 
individual interacts with the large data 
holder and the products or services of the 
large data holder and what is reasonably 
anticipated within the context of the rela-
tionship between the individual and the 
large data holder; 
(iv) includes an overview of individual 
rights and disclosures to reasonably draw 
attention to data practices that may be un-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
expected or that involve sensitive covered 
data; and 
(v) is not more than 500 words in 
length in the English language or, if in a 
language other than English, not more 
than 550 words in length. 
(B) GUIDANCE.—Not later than 180 days 
after the date of the enactment of this Act, the 
Commission shall issue guidance establishing 
the minimum disclosures necessary for the 
short-form notice described in this paragraph 
and shall include templates or models for such 
notice. 
SEC. 105. INDIVIDUAL CONTROL OVER COVERED DATA. 
(a) ACCESS TO, AND CORRECTION, DELETION, AND 
PORTABILITY
OF, COVERED DATA.—After receiving a 
verified request from an individual, including a parent act-
ing on behalf of a child of the parent, a covered entity 
shall provide the individual with the right to— 
(1) access— 
(A) in a format that can be naturally read 
by a human, the covered data of the individual 
or child (as applicable) (or an accurate rep-
resentation of the covered data of the individual 
or child (as applicable), if the covered data is 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
no longer in the possession of the covered entity 
or a service provider acting on behalf of the 
covered entity) that is collected, processed, or 
retained by the covered entity or any service 
provider of the covered entity; 
(B) the name of any third party or service 
provider to whom the covered entity has trans-
ferred the covered data, as well as the cat-
egories of sources from which the covered data 
was collected; and 
(C) a description of the purpose for which 
the covered entity transferred any covered data 
of the individual or child (as applicable) to a 
third party or service provider; 
(2) correct any inaccuracy or incomplete infor-
mation with respect to the covered data of the indi-
vidual or child (as applicable) that is collected, proc-
essed, or retained by the covered entity and, for cov-
ered data that has been transferred, request the cov-
ered entity to notify any third party or service pro-
vider to which the covered entity transferred such 
covered data of the corrected information, including 
so that service providers may provide the assistance 
required by section 111(a)(1)(C); 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(3) delete covered data of the individual or child 
(as applicable) that is retained by the covered entity 
and, for covered data that has been transferred, re-
quest that the covered entity notify any third party 
or service provider to which the covered entity trans-
ferred such covered data of the deletion request, in-
cluding so that service providers may provide the as-
sistance required by section 111(a)(1)(C); 
(4) to the extent technically feasible, have ex-
ported covered data of the individual or child (as ap-
plicable) that is collected, processed, or retained by 
the covered entity, without licensing restrictions that 
unreasonably limit such transfers, in— 
(A) a format that can be naturally read by 
a human; and 
(B) a format that is portable, structured, 
interoperable, and machine-readable; and 
(5) delete any content or information submitted 
to the covered entity by the individual when a cov-
ered minor and, for any such content or information 
that has been transferred, request that the covered 
entity notify any third party or service provider to 
which the covered entity transferred such content or 
information of the deletion request, including so that 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00070
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
service providers may provide the assistance required 
by section 111(a)(1)(C). 
(b) FREQUENCY AND COST.—A covered entity— 
(1) shall provide an individual with the oppor-
tunity to exercise each of the rights described in 
subsection (a); and 
(2) with respect to— 
(A) the first 3 instances that an individual 
exercises any right described in subsection (a) 
during any 12-month period, shall allow the in-
dividual to exercise such right free of charge; 
and 
(B) any instance beyond the first 3 in-
stances described in subparagraph (A), may 
charge a reasonable fee for each additional re-
quest to exercise any such right during such 
12-month period. 
(c) TIMING.— 
(1) IN GENERAL.—Subject to subsections (b), 
(d), and (e), each request under subsection (a) shall 
be completed— 
(A) by any covered entity that is a large 
data holder or data broker, not later than 30 
calendar days after receiving such request from 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
an individual, unless it is impossible or demon-
strably impracticable to verify the individual; or 
(B) by a covered entity that is not a large 
data holder or data broker, not later than 45 
calendar days after receiving such request from 
an individual, unless it is impossible or demon-
strably impracticable to verify the individual. 
(2) EXTENSION.—A response period required 
under paragraph (1) may be extended once, by not 
more than the applicable time period described in 
such paragraph, when reasonably necessary, consid-
ering the complexity and number of requests from 
the individual, if the covered entity informs the indi-
vidual of any such extension, and the reason for the 
extension, within the initial response period. 
(d) VERIFICATION.— 
(1) IN GENERAL.—A covered entity shall rea-
sonably verify that an individual making a request 
to exercise a right described in subsection (a) is— 
(A) the individual whose covered data is 
the subject of the request; 
(B) the parent of the child whose covered 
data (or, with respect to a request under sub-
section (a)(5), whose content or other informa-
tion) is the subject of the request; or 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(C) another individual who is a natural 
person who is authorized to make such a re-
quest on behalf of the individual whose covered 
data is the subject of the request. 
(2) ADDITIONAL INFORMATION.—If a covered 
entity cannot make the verification described in 
paragraph (1), the covered entity may request that 
the individual making the request provide any addi-
tional information necessary for the sole purpose of 
making such verification, except that— 
(A) the request of the covered entity may 
not be burdensome on the individual; and 
(B) the covered entity may not process, re-
tain, or transfer such additional information for 
any other purpose. 
(e) EXCEPTIONS.— 
(1) REQUIRED EXCEPTIONS.—A covered entity 
may not permit an individual to exercise a right de-
scribed in subsection (a), in whole or in part, if the 
covered entity— 
(A) 
cannot 
reasonably 
make 
the 
verification described in subsection (d)(1); 
(B) determines that exercise of the right 
would require access to, or the correction or de-
letion of, the sensitive covered data of an indi-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
vidual other than the individual whose covered 
data is the subject of the request; 
(C) determines that exercise of the right 
would require correction or deletion of covered 
data subject to a warrant, lawfully executed 
subpoena, or litigation hold notice or equivalent 
preservation notice in connection with such war-
rant or subpoena or issued in a matter in which 
the covered entity is a named party; 
(D) determines that exercise of the right 
would violate a Federal, State, Tribal, or local 
law that is not preempted by this title; 
(E) determines that exercise of the right 
would violate the professional ethical obligations 
of the covered entity; 
(F) reasonably believes that the request is 
made to further fraud; 
(G) except with respect to health informa-
tion, reasonably believes that the request is 
made in furtherance of criminal activity; or 
(H) reasonably believes that complying 
with the request would threaten data security 
or network security. 
(2) PERMISSIVE EXCEPTIONS.—A covered enti-
ty may decline, in whole or in part, to comply with 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00074
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
a request to exercise a right described in subsection 
(a), with adequate explanation to the individual 
making the request, if compliance with the request 
would— 
(A) be demonstrably impracticable due to 
technological limitations or prohibitive cost, and 
if the covered entity provides a detailed descrip-
tion to the individual regarding the inability to 
comply with the request due to technological 
limitations or prohibitive cost; 
(B) delete covered data necessary to per-
form a contract between the covered entity and 
the individual; 
(C) with respect to a right described in 
paragraph (1) or (4) of subsection (a), require 
the covered entity to release trade secrets or 
other privileged, proprietary, or confidential 
business information; 
(D) prevent a covered entity from being 
able to maintain a confidential record of opt-out 
requests pursuant to this title that is main-
tained solely for the purpose of preventing cov-
ered data of an individual from being collected, 
processed, retained, or transferred after the in-
dividual submits an opt-out request; 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00075
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(E) with respect to a deletion request, re-
quire a private elementary or secondary school 
(as determined under State law) or a private in-
stitution of higher education (as defined in title 
I of the Higher Education Act of 1965 (20 
U.S.C. 1001 et seq.)) to delete covered data, if 
the deletion would unreasonably interfere with 
the provision of education services by, or the or-
dinary operation of, the school or institution; 
(F) delete covered data that relates to a 
public figure regarding a matter of legitimate 
public interest and for which the requesting in-
dividual has no reasonable expectation of pri-
vacy; or 
(G) delete covered data that the covered 
entity reasonably believes may be evidence of an 
abuse of the products or services of the covered 
entity, including a violation of terms of service. 
(3) RULE
OF
CONSTRUCTION.—This section 
may not be construed to require a covered entity or 
service provider acting on behalf of a covered entity 
to— 
(A) retain covered data collected for a 1- 
time transaction, if such covered data is not 
processed or transferred by the covered entity 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00076
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
for any purpose other than completing such 
transaction; 
(B) re-identify, or attempt to re-identify, 
de-identified data; or 
(C) collect or retain any data in order to 
be capable of associating a request with the cov-
ered data that is the subject of the request. 
(4) PARTIAL COMPLIANCE.—In the event a cov-
ered entity declines a request under paragraph (2), 
the covered entity shall comply with the remainder 
of the request if partial compliance is possible and 
not unduly burdensome. 
(5) NUMBER OF REQUESTS.—For purposes of 
paragraph (2)(A), the receipt of a large number of 
verified requests, on its own, may not be considered 
to render compliance with a request demonstrably 
impracticable. 
(6) ADDITIONAL EXCEPTIONS.— 
(A) IN GENERAL.—The Commission may 
promulgate regulations, in accordance with sec-
tion 553 of title 5, United States Code, to es-
tablish additional permissive exceptions to sub-
section (a) necessary to protect the rights of in-
dividuals, to alleviate undue burdens on covered 
entities, to prevent unjust or unreasonable out-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00077
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
comes from the exercise of access, correction, 
deletion, or portability rights, or to otherwise 
fulfill the purposes of this section. 
(B) 
CONSIDERATIONS.—In 
establishing 
any exceptions under subparagraph (A), the 
Commission shall consider any relevant changes 
in technology, means for protecting privacy and 
other rights, and beneficial uses of covered data 
by covered entities. 
(C) CLARIFICATION.—A covered entity 
may decline to comply with a request of an in-
dividual to exercise a right under this section 
pursuant to an exception the Commission estab-
lishes under this paragraph. 
(f) LARGE DATA HOLDER METRICS REPORTING.— 
With respect to each calendar year for which an entity 
is a large data holder, such entity shall comply with the 
following requirements: 
(1) REQUIRED
METRICS.—Compile the fol-
lowing information for such calendar year: 
(A) The number of verified access requests 
under subsection (a)(1). 
(B) The number of verified deletion re-
quests under subsection (a)(3). 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(C) The number of verified deletion re-
quests under subsection (a)(5). 
(D) The number of verified requests to opt 
out of covered data transfers under section 
106(a)(1). 
(E) The number of verified requests to opt 
out of targeted advertising under section 
106(a)(2). 
(F) For each category of request described 
in subparagraphs (A) through (E), the number 
of such requests that the large data holder com-
plied with in whole or in part. 
(G) For each category of request described 
in subparagraphs (A) through (E), the average 
number of days within which the large data 
holder substantively responded to the requests. 
(2) PUBLIC DISCLOSURE.—Not later than July 
1 of each calendar year, disclose the information 
compiled under paragraph (1) for the previous cal-
endar year— 
(A) in the privacy policy of the large data 
holder; or 
(B) on a publicly available website of the 
large data holder that is accessible from a 
hyperlink included in the privacy policy. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00079
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(g) GUIDANCE.—Not later than 1 year after the date 
of the enactment of this Act, the Commission shall issue 
guidance to clarify or explain the provisions of this section 
and establish practices by which a covered entity may 
verify a request to exercise a right described in subsection 
(a). 
(h) ACCESSIBILITY.— 
(1) LANGUAGE.—A covered entity shall facili-
tate the ability of individuals to make requests to ex-
ercise rights described in subsection (a) in any lan-
guage in which the covered entity provides a product 
or service. 
(2) INDIVIDUALS LIVING WITH DISABILITIES.— 
The mechanisms by which a covered entity enables 
individuals to make a request to exercise a right de-
scribed in subsection (a) shall be readily accessible 
and usable by individuals living with disabilities. 
SEC. 106. OPT-OUT RIGHTS AND UNIVERSAL MECHANISMS. 
(a) IN GENERAL.—A covered entity shall provide to 
an individual the following opt-out rights with respect to 
the covered data of the individual: 
(1) RIGHT
TO
OPT
OUT
OF
COVERED
DATA 
TRANSFERS TO THIRD PARTIES.—A covered entity— 
(A) shall provide an individual with a clear 
and conspicuous means to opt out of the trans-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00080
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
fer of the covered data of the individual to a 
third party; 
(B) upon establishment of an opt out 
mechanism that meets the requirements and 
technical specifications promulgated under sub-
section (b), shall allow an individual to make an 
opt-out designation pursuant to subparagraph 
(A) through the opt out mechanism; 
(C) shall abide by an opt-out designation 
made pursuant to subparagraph (A) and com-
municate such designation to all relevant serv-
ice providers and third parties; and 
(D) except as provided in subsection (b) or 
(c)(4) of section 102, paragraph (3) or (4) of 
section 112(c), or section 120(b), need not 
allow an individual to opt out of a transfer of 
covered data made pursuant to a permissible 
purpose described in paragraph (1), (2), (3), 
(4), (5), (6), (7), (8), (9), (10), (11), (12), 
(13), or (14) of section 102(d). 
(2) RIGHT TO OPT OUT OF TARGETED ADVER-
TISING.—A covered entity that engages in targeted 
advertising shall— 
(A) provide an individual with a clear and 
conspicuous means to opt out of the processing 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00081
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
and transfer of covered data of the individual in 
furtherance of targeted advertising; 
(B) upon establishment of an opt out 
mechanism that meets the requirements and 
technical specifications promulgated under sub-
section (b), allow an individual to make an opt- 
out designation with respect to targeted adver-
tising through the opt-out mechanism; and 
(C) abide by any such opt-out designation 
made by an individual and communicate such 
designation to all relevant service providers and 
third parties. 
(b) UNIVERSAL OPT-OUT MECHANISMS.— 
(1) IN GENERAL.—Not later than 2 years after 
the date of the enactment of this Act, the Commis-
sion shall, in consultation with the Secretary of 
Commerce, promulgate regulations, in accordance 
with section 553 of title 5, United States Code, to 
establish requirements and technical specifications 
for 1 or more opt-out mechanisms (including global 
privacy signals, such as browser or device privacy 
settings) for individuals to exercise the opt-out 
rights established under this title through a single 
interface that— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00082
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(A) ensures that the opt-out preference 
signal— 
(i) is clearly described, and easy-to- 
use by a reasonable individual; 
(ii) does not require that an individual 
provide additional information beyond what 
is necessary to indicate such preference; 
(iii) clearly represents the preference 
of an individual; 
(iv) is provided— 
(I) in the 10 most-used lan-
guages in which a covered entity pro-
vides products or services subject to 
the opt-out; or 
(II) if the covered entity provides 
products or services subject to the 
opt-out in fewer than 10 languages, in 
the languages in which the covered 
entity provides such products or serv-
ices; and 
(v) is provided in a manner that is 
reasonably accessible to and usable by indi-
viduals living with disabilities; 
(B) provides a mechanism for an individual 
to selectively opt out of the collection, proc-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00083
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
essing, retention, or transfer of covered data by 
a covered entity, without affecting the pref-
erences of the individual with respect to other 
entities or disabling the opt-out preference sig-
nal globally; 
(C) states that, in the case of a page or 
setting view that the individual accesses to set 
the opt-out preference signal, the individual 
should see up to 2 choices, corresponding to the 
rights established under subsection (a); and 
(D) ensures that the opt-out preference 
signal will be registered and set only by the in-
dividual or by another individual who is a nat-
ural person on behalf of the individual. 
(2) EFFECT OF DESIGNATIONS.—A covered en-
tity shall abide by any designation made by an indi-
vidual through any mechanism that meets the re-
quirements and technical specifications promulgated 
under paragraph (1). 
SEC. 107. INTERFERENCE WITH CONSUMER RIGHTS. 
(a) DARK PATTERNS PROHIBITED.— 
(1) IN GENERAL.—A covered entity may not 
use dark patterns to— 
(A) divert the attention of an individual 
from any notice required under this title; 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00084
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(B) impair the ability of an individual to 
exercise any right under this title; or 
(C) obtain, infer, or facilitate the consent 
of an individual for any action that requires the 
consent of an individual under this title. 
(2) CLARIFICATION.—Any agreement by an in-
dividual that is obtained, inferred, or facilitated 
through dark patterns does not constitute consent 
for any purpose under this title. 
(b) INDIVIDUAL AUTONOMY.—A covered entity may 
not condition, effectively condition, attempt to condition, 
or attempt to effectively condition the exercise of a right 
described in this title through the use of any false, ficti-
tious, fraudulent, or materially misleading statement or 
representation. 
SEC. 108. PROHIBITION ON DENIAL OF SERVICE AND WAIV-
ER OF RIGHTS. 
(a) RETALIATION THROUGH SERVICE OR PRICING 
PROHIBITED.—A covered entity may not retaliate against 
an individual for exercising any of the rights established 
under this title, or any regulations promulgated under this 
title, including by denying goods or services, charging dif-
ferent prices or rates for goods or services, or providing 
a different level of quality of goods or services. 
(b) RULES OF CONSTRUCTION.— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00085
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(1) BONA FIDE LOYALTY PROGRAMS.— 
(A) IN GENERAL.—Nothing in subsection 
(a) may be construed to prohibit a covered enti-
ty from offering— 
(i) to an individual different prices, 
rates, levels, qualities, or selections of 
goods or services, or functionalities with 
respect to a product or service, including 
offering goods or services for no fee, if the 
offering is in connection with the voluntary 
participation of the individual in a bona 
fide loyalty program, and if— 
(I) the individual provided af-
firmative express consent to partici-
pate in such bona fide loyalty pro-
gram; 
(II) the covered entity abides by 
the exercise by the individual of any 
right provided by subsection (b) or (c) 
of section 102, section 105, or section 
106; and 
(III) the sale of covered data is 
not a condition of participation in the 
bona fide loyalty program; or 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00086
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(ii) to an individual different prices, 
rates, levels, qualities, or selections of 
goods or services, or functionalities with 
respect to a product or service, based on 
the decision of the individual to terminate 
membership in a bona fide loyalty program 
or to exercise a right under section 
105(a)(3) to delete covered data that is 
necessary for participation in the bona fide 
loyalty program. 
(B) BONA
FIDE
LOYALTY
PROGRAM
DE-
FINED.—For purposes of this section, the term 
‘‘bona fide loyalty program’’— 
(i) includes rewards, premium fea-
tures, discounts, and club card programs 
offered by a covered entity; and 
(ii) excludes such programs offered by 
a covered high-impact social media com-
pany or data broker. 
(2) MARKET
RESEARCH.—Nothing in sub-
section (a) may be construed to prohibit a covered 
entity from offering a financial incentive or other 
consideration to an individual for participation in 
market research. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00087
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(3) DECLINING
A
PRODUCT
OR
SERVICE.— 
Nothing in subsection (a) may be construed to pro-
hibit a covered entity from declining to provide a 
product or service or a bona fide loyalty program to 
an individual, if any collection, processing, retention, 
or transfer affected by the individual exercising a 
right established under this title is necessary, pro-
portionate, and limited to providing such product or 
service. 
SEC. 109. DATA SECURITY AND PROTECTION OF COVERED 
DATA. 
(a) ESTABLISHMENT
OF DATA SECURITY PRAC-
TICES.— 
(1) IN GENERAL.—Each covered entity or serv-
ice provider shall establish, implement, and maintain 
reasonable data security practices to protect— 
(A) the confidentiality, integrity, and avail-
ability of covered data; and 
(B) covered data against unauthorized ac-
cess. 
(2) CONSIDERATIONS.—The data security prac-
tices required under paragraph (1) shall be appro-
priate to— 
(A) the size and complexity of the covered 
entity or service provider; 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00088
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(B) the nature and scope of the relevant 
collecting, processing, retaining, or transferring 
of covered data, taking into account changing 
business operations with respect to covered 
data; 
(C) the volume, nature, and sensitivity of 
the covered data; and 
(D) the state-of-the-art (and limitations 
thereof) in administrative, technical, and phys-
ical safeguards for protecting covered data. 
(b) SPECIFIC REQUIREMENTS.—The data security 
practices required under subsection (a) shall include, at 
a minimum, the following: 
(1) ASSESS VULNERABILITIES.—Routinely iden-
tifying and assessing any reasonably foreseeable in-
ternal or external risk to, or vulnerability in, each 
system maintained by the covered entity or service 
provider that collects, processes, retains, or transfers 
covered data, including unauthorized access to or 
corruption 
of 
such 
covered 
data, 
human 
vulnerabilities, access rights, and the use of service 
providers. Such activities shall include developing 
and implementing a plan for receiving and consid-
ering unsolicited reports of vulnerability by any enti-
ty and, if such a report is reasonably credible, per-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00089
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
forming a reasonable and timely investigation of 
such report and taking appropriate action to protect 
covered data against the vulnerability. 
(2) PREVENTIVE AND CORRECTIVE ACTION.— 
(A) IN GENERAL.—Taking preventive and 
corrective action to mitigate any reasonably 
foreseeable internal or external risk to, or vul-
nerability of, covered data identified by the cov-
ered entity or service provider, consistent with 
the nature of such risk or vulnerability and the 
role of the covered entity or service provider in 
collecting, processing, retaining, or transferring 
the data, which may include implementing ad-
ministrative, technical, or physical safeguards 
or changes to data security practices or the ar-
chitecture, installation, or implementation of 
network or operating software. 
(B) EVALUATION OF PREVENTATIVE AND 
CORRECTIVE ACTION.—Evaluating and making 
reasonable adjustments to the action described 
in subparagraph (A) in light of any material 
changes in state-of-the-art technology, internal 
or external threats to covered data, and chang-
ing business operations with respect to covered 
data. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00090
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(3) 
INFORMATION
RETENTION
AND
DIS-
POSAL.—Disposing of covered data (either by or at 
the direction of the covered entity) that is required 
to be deleted by law or is no longer necessary for the 
purpose for which the data was collected, processed, 
retained, or transferred, unless a permitted purpose 
under section 102(d) applies, except that retention 
and disposal of biometric information shall be gov-
erned by section 102(c)(3). Such disposal shall in-
clude destroying, permanently erasing, or otherwise 
modifying the covered data to make such data per-
manently unreadable or indecipherable and unre-
coverable to ensure ongoing compliance with this 
section. 
(4) RETENTION SCHEDULE.—Developing, main-
taining, and adhering to a retention schedule for 
covered data consistent with paragraph (3). 
(5) TRAINING.—Training each employee with 
access to covered data on how to safeguard covered 
data, and updating such training as necessary. 
(6) INCIDENT RESPONSE.—Implementing pro-
cedures to detect, respond to, and recover from data 
security incidents, including breaches. 
(c) REGULATIONS.—The Commission may, in con-
sultation with the Secretary of Commerce, promulgate, in 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00091
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
accordance with section 553 of title 5, United States Code, 
technology-neutral, process-based regulations to carry out 
this section. 
SEC. 110. EXECUTIVE RESPONSIBILITY. 
(a) DESIGNATION OF PRIVACY AND DATA SECURITY 
OFFICERS.— 
(1) IN GENERAL.—A covered entity or service 
provider (except for a large data holder) shall des-
ignate 1 or more qualified employees to serve as pri-
vacy and data security officers. 
(2) REQUIREMENTS
FOR
OFFICERS.—An em-
ployee who is designated by a covered entity or serv-
ice provider as a privacy and data security officer 
shall, at a minimum— 
(A) implement a data privacy program and 
a data security program to safeguard the pri-
vacy and security of covered data in compliance 
with the requirements of this title; and 
(B) facilitate the ongoing compliance of 
the covered entity or service provider with this 
title. 
(b) REQUIREMENTS FOR LARGE DATA HOLDERS.— 
(1) DESIGNATION.—A covered entity or service 
provider that is a large data holder shall designate 
1 qualified employee to serve as a privacy officer and 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00092
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
1 qualified employee to serve as a data security offi-
cer. 
(2) ANNUAL CERTIFICATION.— 
(A) IN GENERAL.—Beginning on the date 
that is 1 year after the date of the enactment 
of this Act, the chief executive officer of a large 
data holder (or, if the large data holder does 
not have a chief executive officer, the highest 
ranking officer of the large data holder) and 
each privacy officer and data security officer of 
such large data holder designated under para-
graph (1), shall annually certify to the Commis-
sion, in a manner specified by the Commission, 
that the large data holder implements and 
maintains— 
(i) internal controls reasonably de-
signed, 
implemented, 
maintained, 
and 
monitored to comply with this title; and 
(ii) internal reporting structures (as 
described in paragraph (3)) to ensure that 
such certifying officers are involved in, and 
responsible for, decisions that impact com-
pliance by the large data holder with this 
title. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00093
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(B) REQUIREMENTS.—A certification sub-
mitted under subparagraph (A) shall be based 
on a review of the effectiveness of the internal 
controls and reporting structures of the large 
data holder that is conducted by the certifying 
officers not more than 90 days before the sub-
mission of the certification. 
(3) INTERNAL
REPORTING
STRUCTURE
RE-
QUIREMENTS.—At least 1 of the officers designated 
under paragraph (1) shall, either directly or through 
a supervised designee— 
(A) establish practices to periodically re-
view and update, as necessary, the privacy and 
security policies, practices, and procedures of 
the large data holder; 
(B) conduct biennial and comprehensive 
audits to ensure the policies, practices, and pro-
cedures of the large data holder comply with 
this title and, upon request, make such audits 
available to the Commission; 
(C) develop a program to educate and 
train employees about the requirements of this 
title; 
(D) maintain updated, accurate, clear, and 
understandable records of all significant privacy 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00094
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
and data security practices of the large data 
holder; and 
(E) serve as the point of contact between 
the large data holder and enforcement authori-
ties. 
(4) PRIVACY IMPACT ASSESSMENTS.— 
(A) IN GENERAL.—Not later than 1 year 
after the date of the enactment of this Act or 
1 year after the date on which an entity first 
meets the definition of the term ‘‘large data 
holder’’, whichever is earlier, and biennially 
thereafter, each large data holder shall conduct 
a privacy impact assessment that weighs the 
benefits of the covered data collection, proc-
essing, retention, and transfer practices of the 
entity against the potential adverse con-
sequences of such practices to individual pri-
vacy. 
(B) ASSESSMENT REQUIREMENTS.—A pri-
vacy impact assessment required under sub-
paragraph (A) shall be— 
(i) reasonable and appropriate in 
scope given— 
(I) the nature and volume of the 
covered data collected, processed, re-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00095
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
tained, or transferred by the large 
data holder; and 
(II) the potential risks posed to 
the privacy of individuals by the col-
lection, processing, retention, and 
transfer of covered data by the large 
data holder; 
(ii) documented in written form and 
maintained by the large data holder for as 
long as the relevant privacy policy is re-
quired to be retained under section 
104(f)(1); and 
(iii) approved by the privacy officer of 
the large data holder. 
(C) ADDITIONAL FACTORS TO INCLUDE IN 
ASSESSMENT.—In assessing privacy risks for 
purposes of an assessment conducted under 
subparagraph (A), including significant risks of 
harm to the privacy of an individual or the se-
curity of covered data, the large data holder 
shall include reviews of the means by which 
technologies, including blockchain and distrib-
uted ledger technologies and other emerging 
technologies, including privacy enhancing tech-
nologies, are used to secure covered data. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00096
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
SEC. 111. SERVICE PROVIDERS AND THIRD PARTIES. 
(a) SERVICE PROVIDERS.— 
(1) IN GENERAL.—A service provider that col-
lects, processes, retains, or transfers covered data on 
behalf of or at the direction of a covered entity or 
another service provider— 
(A) shall adhere to the instructions of the 
covered entity or other service provider and col-
lect, process, retain, or transfer covered data 
only to the extent necessary, proportionate, and 
limited to provide a service requested by the 
covered entity or other service provider, as set 
out in the contract described in paragraph (2); 
(B) may not collect, process, retain, or 
transfer covered data if the service provider has 
actual knowledge that the covered entity or 
other service provider violated this title with re-
spect to such data; 
(C) shall assist the covered entity or other 
service provider in fulfilling the obligations of 
the covered entity or other service provider to 
respond to consumer rights requests pursuant 
to this title by— 
(i) providing appropriate technical and 
organizational support, taking into account 
the nature of the processing and the infor-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00097
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
mation reasonably available to the service 
provider; or 
(ii) fulfilling a request by the covered 
entity or other service provider to execute 
a consumer rights request that the covered 
entity or other service provider has deter-
mined should be compiled with, by either— 
(I) complying with the request 
pursuant to the instructions of the 
covered entity or other service pro-
vider; or 
(II) providing written verification 
to the covered entity or other service 
provider that the service provider does 
not hold data related to the request, 
that complying with the request would 
be inconsistent with the legal obliga-
tions of the service provider, or that 
the request falls within an exception 
pursuant to this title; 
(D) shall, upon the reasonable request of 
the covered entity or other service provider, 
make available to the covered entity or other 
service provider all information necessary to 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00098
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
demonstrate the compliance of the service pro-
vider with the requirements of this title; 
(E) shall delete or return, as directed by 
the covered entity or other service provider, all 
covered data as soon as practicable after the 
contractually agreed upon end of the provision 
of services, unless the retention by the service 
provider of covered data is required by law; 
(F) may engage another service provider 
for purposes of processing or retaining covered 
data on behalf of the covered entity or other 
service provider only after exercising reasonable 
care in selecting another service provider as re-
quired by subsection (d), providing the covered 
entity or other service provider with written no-
tice of the engagement, and entering into a 
written contract that requires the other service 
provider to satisfy the requirements of this title 
with respect to covered data; and 
(G) shall— 
(i) allow and cooperate with reason-
able assessments by the covered entity or 
other service provider at least annually; or 
(ii) arrange for a qualified and inde-
pendent assessor to conduct an assessment 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00099
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
100 
of the policies and technical and organiza-
tional measures of the service provider in 
support of the obligations of the service 
provider under this title at least annually, 
using an appropriate and accepted control 
standard or framework and assessment 
procedure for such assessments, and report 
the results of such assessment to the cov-
ered entity or other service provider. 
(2) CONTRACT REQUIREMENTS.—An entity may 
only operate as a service provider pursuant to a con-
tract between a covered entity and a service pro-
vider. Such contract— 
(A) shall govern the data processing proce-
dures of the service provider with respect to any 
collection, processing, retention, or transfer per-
formed on behalf of the covered entity; 
(B) shall clearly set forth— 
(i) instructions for collecting, proc-
essing, retaining, or transferring data; 
(ii) the nature and purpose of the col-
lection, processing, retention, or transfer; 
(iii) the type of data subject to collec-
tion, processing, retention, or transfer; 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00100
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
101 
(iv) the duration of the processing or 
retention; and 
(v) the rights and obligations of both 
parties; 
(C) may not relieve the covered entity or 
service provider of any obligation under this 
title; and 
(D) shall prohibit— 
(i) the collection, processing, reten-
tion, or transfer of covered data in a man-
ner that does not comply with the require-
ments of paragraph (1); and 
(ii) combining covered data that the 
service provider receives from or on behalf 
of a covered entity with covered data that 
the service provider receives from or on be-
half of another entity or collects from the 
interaction of the service provider with an 
individual, unless such combining is nec-
essary for a purpose described in section 
102(d), other than a purpose described in 
paragraph (7), (14), (15), or (16) of such 
section, and is otherwise permitted under 
the contract. 
(b) THIRD PARTIES.— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00101
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
102 
(1) IN GENERAL.—A third party may not proc-
ess, retain, or transfer third-party data for a pur-
pose other than— 
(A) in the case of sensitive covered data— 
(i) except as provided in clause (ii), a 
purpose for which an individual gave af-
firmative express consent pursuant to sub-
section (b) or (c) of section 102; or 
(ii) in the case of sensitive covered 
data with respect to which affirmative ex-
press consent is not required pursuant to 
subsection (b) of section 102, a purpose 
for which the covered entity or service pro-
vider made a disclosure pursuant to section 
104; or 
(B) in the case of covered data that is not 
sensitive covered data, a purpose for which the 
covered entity or service provider made a disclo-
sure pursuant to section 104. 
(2) CONTRACT REQUIREMENTS.—Before trans-
ferring covered data to a third party, a covered enti-
ty or service provider shall enter into a contract with 
the third party that— 
(A) identifies the purposes for which cov-
ered data is being transferred; 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00102
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
103 
(B) specifies that the third party may only 
use the covered data for such purposes; 
(C) with respect to the covered data trans-
ferred, requires the third party to comply with 
all applicable provisions of, and regulations pro-
mulgated under, this title; 
(D) requires the third party to notify the 
covered entity or service provider if the third 
party makes a determination that the third 
party can no longer meet the obligations of the 
third party under this title; and 
(E) grants the covered entity or service 
provider the right, upon notice (including under 
subparagraph (D)), to take reasonable and ap-
propriate steps to stop and remediate unauthor-
ized use of covered data by the third party. 
(c) RULES OF CONSTRUCTION.— 
(1) SUCCESSIVE ACTOR VIOLATIONS.— 
(A) IN GENERAL.—With respect to a viola-
tion of this title by a service provider or third 
party regarding covered data received by the 
service provider or third party from a covered 
entity or another service provider, the covered 
entity or service provider that transferred such 
covered data may not be considered to be in 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00103
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
104 
violation of this title if the covered entity or 
service provider transferred the covered data in 
compliance with the requirements of this title 
and, at the time of transferring such covered 
data, did not have actual knowledge, or reason 
to believe, that the service provider or third 
party to which the covered data was transferred 
intended to violate this title. 
(B) KNOWLEDGE OF VIOLATION.—A cov-
ered entity or service provider that transfers 
covered data to a service provider or third party 
and has actual knowledge, or reason to believe, 
that such service provider or third party is vio-
lating, or is about to violate, the requirements 
of this title shall immediately cease the transfer 
of covered data to such service provider or third 
party. 
(2) PRIOR ACTOR VIOLATIONS.—An entity that 
collects, processes, retains, or transfers covered data 
in compliance with the requirements of this title may 
not be considered to be in violation of this title as 
a result of a violation by an entity from which it re-
ceives, or on whose behalf it collects, processes, re-
tains, or transfers, covered data. 
(d) REASONABLE CARE.— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00104
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
105 
(1) SERVICE PROVIDER SELECTION.—A covered 
entity or service provider shall exercise reasonable 
care in selecting a service provider. 
(2) TRANSFER TO THIRD PARTY.—A covered 
entity or service provider shall exercise reasonable 
care in deciding to transfer covered data to a third 
party. 
(3) GUIDANCE.—Not later than 2 years after 
the date of the enactment of this Act, the Commis-
sion shall publish guidance regarding compliance 
with this subsection. 
(e) RULE OF CONSTRUCTION.—Solely for purposes of 
this section, the requirements under this section for serv-
ice providers to contract with, assist, and follow the in-
structions of covered entities shall also apply to any entity 
that collects, processes, retains, or transfers covered data 
for the purpose of performing services on behalf of, or at 
the direction of, a government entity, as though such gov-
ernment entity were a covered entity. 
SEC. 112. DATA BROKERS. 
(a) NOTICE.—A data broker shall— 
(1) establish and maintain a publicly available 
website; and 
(2) place a clear and conspicuous, and not mis-
leading, notice on such publicly available website, 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00105
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
106 
and any mobile application of the data broker, 
that— 
(A) states that the entity is a data broker; 
(B) states that an individual may exercise 
a right described in section 105 or 106, and in-
cludes a link or other tool to allow an individual 
to exercise such right; 
(C) includes a link to the website described 
in subsection (c)(3); 
(D) is reasonably accessible to and usable 
by individuals living with disabilities; and 
(E) is provided in any language in which 
the data broker provides products or services. 
(b) PROHIBITED PRACTICES.—A data broker may 
not— 
(1) advertise or market access to, or the trans-
fer of, covered data for the purposes of— 
(A) stalking or harassing an individual; or 
(B) engaging in fraud, identity theft, or 
unfair or deceptive acts or practices; or 
(2) misrepresent the business practices of the 
data broker. 
(c) DATA BROKER REGISTRATION.— 
(1) IN GENERAL.—Not later than January 31 
of each calendar year that follows a calendar year 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00106
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
107 
during which an entity acted as a data broker with 
respect to more than 5,000 individuals or devices 
that identify or are linked or reasonably linkable to 
an individual, such entity shall register with the 
Commission in accordance with this subsection. 
(2) REGISTRATION
REQUIREMENTS.—In reg-
istering with the Commission as required under 
paragraph (1), a data broker shall do the following: 
(A) Pay to the Commission a registration 
fee of $100. 
(B) Provide the Commission with the fol-
lowing information: 
(i) The legal name and primary valid 
physical postal address, email address, and 
internet address of the data broker. 
(ii) A description of the categories of 
covered data the data broker collects, proc-
esses, retains, or transfers. 
(iii) The contact information of the 
data broker, including the name of a con-
tact person, a human-monitored telephone 
number, a human-monitored e-mail ad-
dress, a website, and a physical mailing ad-
dress. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00107
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
108 
(iv) A link to a website through which 
an individual may easily exercise the rights 
described in sections 105 and 106. 
(3) DATA BROKER REGISTRY.— 
(A) ESTABLISHMENT.—The Commission 
shall establish and maintain on a publicly avail-
able website a searchable list of data brokers 
that are registered with the Commission under 
this subsection. 
(B) REQUIREMENTS.—The registry estab-
lished under subparagraph (A) shall— 
(i) allow members of the public to 
search for and identify data brokers; 
(ii) include the information required 
under paragraph (2)(B) for each data 
broker; 
(iii) include a mechanism by which an 
individual, including a parent acting on be-
half of a child of the parent, may submit 
to all registered data brokers a ‘‘Do Not 
Collect’’ request that results in registered 
data brokers no longer collecting covered 
data related to such individual or child (as 
applicable) without the affirmative express 
consent of such individual; and 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00108
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
109 
(iv) include a mechanism by which an 
individual, including a parent acting on be-
half of a child of the parent, may submit 
to all registered data brokers a ‘‘Delete My 
Data’’ request that results in registered 
data brokers deleting all covered data re-
lated to such individual or child (as appli-
cable) that the data broker did not collect 
directly from such individual or when act-
ing as a service provider. 
(C) AFFORDABILITY.—A data broker may 
not charge an individual a fee to exercise a 
right under this paragraph. 
(4) DO NOT COLLECT AND DELETE MY DATA 
REQUESTS.— 
(A) COMPLIANCE.—Subject to subpara-
graph (B), each data broker that receives a re-
quest from an individual, including a parent 
acting on behalf of a child of the parent, using 
the mechanism established under paragraph 
(3)(B)(iii) or paragraph (3)(B)(iv) shall comply 
with such request not later than 30 days after 
the date on which the request is received by the 
data broker. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00109
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
110 
(B) EXCEPTION.—A data broker may de-
cline to fulfill a request from an individual, if— 
(i) the data broker has actual knowl-
edge that the individual has been convicted 
of a crime related to the abduction or sex-
ual exploitation of a child; and 
(ii) the data collected by the data 
broker is necessary— 
(I) to carry out a national or 
State-run sex offender registry; or 
(II) for the National Center for 
Missing and Exploited Children. 
SEC. 113. COMMISSION-APPROVED COMPLIANCE GUIDE-
LINES. 
(a) APPLICATION FOR COMPLIANCE GUIDELINE AP-
PROVAL.— 
(1) IN GENERAL.—A covered entity that is not 
a data broker and is not a large data holder, or a 
group of such covered entities, may apply to the 
Commission for approval of 1 or more sets of com-
pliance guidelines governing the collection, proc-
essing, retention, or transfer of covered data by the 
covered entity or covered entities. 
(2) APPLICATION REQUIREMENTS.—An applica-
tion under paragraph (1) shall include— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00110
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
111 
(A) a description of how the proposed 
guidelines will meet or exceed the applicable re-
quirements of this title; 
(B) a description of the entities or activi-
ties the proposed guidelines are designed to 
cover; 
(C) a list of the covered entities, to the ex-
tent known at the time of application, that in-
tend to adhere to the proposed guidelines; 
(D) a description of an independent orga-
nization, not associated with any of the in-
tended adhering covered entities, that will ad-
minister the proposed guidelines; and 
(E) a description of how such intended ad-
hering entities will be assessed for adherence to 
the proposed guidelines by the independent or-
ganization described in subparagraph (D). 
(3) COMMISSION REVIEW.— 
(A) INITIAL APPROVAL.— 
(i) PUBLIC
COMMENT
PERIOD.—Not 
later than 90 days after receipt of an ap-
plication regarding proposed guidelines 
submitted pursuant to paragraph (1), the 
Commission shall publish the application 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00111
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
112 
and provide an opportunity for public com-
ment on such proposed guidelines. 
(ii) APPROVAL CRITERIA.—The Com-
mission shall approve an application re-
garding proposed guidelines submitted pur-
suant to paragraph (1), including the inde-
pendent organization that will administer 
the guidelines, if the applicant dem-
onstrates that the proposed guidelines— 
(I) meet or exceed the applicable 
requirements of this title; 
(II) provide for regular review 
and validation by an independent or-
ganization to ensure that the covered 
entity or covered entities adhering to 
the guidelines continue to meet or ex-
ceed the applicable requirements of 
this title; and 
(III) include a means of enforce-
ment if a covered entity does not meet 
or exceed the requirements in the 
guidelines, which may include referral 
to the Commission for enforcement 
under section 115 or referral to the 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00112
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
113 
appropriate State attorney general for 
enforcement under section 116. 
(iii) TIMELINE.—Not later than 1 
year after the date on which the Commis-
sion receives an application regarding pro-
posed guidelines pursuant to paragraph 
(1), the Commission shall issue a deter-
mination approving or denying the applica-
tion, including the relevant independent or-
ganization, and providing the reasons for 
approving or denying the application. 
(B) APPROVAL OF MODIFICATIONS.— 
(i) IN GENERAL.—If the independent 
organization administering a set of guide-
lines approved under subparagraph (A) 
makes significant changes to the guide-
lines, the independent organization shall 
submit the updated guidelines to the Com-
mission for approval. As soon as feasible, 
the Commission shall publish the updated 
guidelines and provide an opportunity for 
public comment. 
(ii) 
TIMELINE.—The 
Commission 
shall approve or deny any significant 
change to guidelines submitted under 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00113
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
114 
clause (i) not later than 180 days after the 
date on which the Commission receives the 
submission for approval. 
(b) WITHDRAWAL OF APPROVAL.— 
(1) IN GENERAL.—If at any time the Commis-
sion determines that guidelines previously approved 
under this section no longer meet the applicable re-
quirements of this title or that compliance with the 
approved guidelines is insufficiently enforced by the 
independent organization administering the guide-
lines, the Commission shall notify the relevant cov-
ered entity or group of covered entities and the inde-
pendent organization of the determination of the 
Commission to withdraw approval of the guidelines, 
including the basis for the determination. 
(2) OPPORTUNITY TO CURE.— 
(A) IN
GENERAL.—Not later than 180 
days after receipt of a notice under paragraph 
(1), the covered entity or group of covered enti-
ties and the independent organization may cure 
any alleged deficiency with the guidelines or the 
enforcement of the guidelines and submit each 
proposed cure to the Commission. 
(B) EFFECT
ON
WITHDRAWAL
OF
AP-
PROVAL.—If the Commission determines that 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00114
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
115 
cures proposed under subparagraph (A) elimi-
nate alleged deficiencies in the guidelines, the 
Commission may not withdraw the approval of 
such guidelines on the basis of such defi-
ciencies. 
(c) CERTIFICATION.—A covered entity with guide-
lines approved by the Commission under this section 
shall— 
(1) publicly self-certify that the covered entity 
is in compliance with the guidelines; and 
(2) as part of the self-certification under para-
graph (1), indicate the independent organization re-
sponsible for assessing compliance with the guide-
lines. 
(d) REBUTTABLE PRESUMPTION OF COMPLIANCE.— 
A covered entity that is eligible to participate in guidelines 
approved under this section, participates in the guidelines, 
and is in compliance with the guidelines shall be entitled 
to a rebuttable presumption that the covered entity is in 
compliance with the relevant provisions of this title to 
which the guidelines apply. 
(e) ELIGIBILITY OF SERVICE PROVIDERS.—This sec-
tion shall apply to a service provider that is not a large 
data holder, or a group of such service providers, in the 
same manner as this section applies to a covered entity 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00115
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
116 
or group of covered entities. Such a service provider or 
group of service providers may apply for approval of, and 
participate in, the same guidelines as a covered entity or 
group of covered entities. 
SEC. 114. PRIVACY-ENHANCING TECHNOLOGY PILOT PRO-
GRAM. 
(a) PRIVACY-ENHANCING TECHNOLOGY DEFINED.— 
In this section, the term ‘‘privacy-enhancing tech-
nology’’— 
(1) means any software or hardware solution, 
cryptographic algorithm, or other technical process 
of extracting the value of information without sub-
stantially reducing the privacy and security of the 
information; and 
(2) includes technologies with functionality 
similar to homomorphic encryption, differential pri-
vacy, zero-knowledge proofs, synthetic data genera-
tion, federated learning, and secure multi-party com-
putation. 
(b) ESTABLISHMENT.—Not later than 1 year after 
the date of the enactment of this Act, the Commission 
shall establish and carry out a pilot program to encourage 
private sector use of privacy-enhancing technologies for 
the purposes of protecting covered data to comply with 
section 109. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00116
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
117 
(c) PURPOSES.—Under the pilot program established 
under subsection (b), the Commission shall— 
(1) develop and implement a petition process 
for covered entities to request to be a part of the 
pilot program; and 
(2) build an auditing system that leverages pri-
vacy-enhancing technologies to support the enforce-
ment actions of the Commission. 
(d) PETITION PROCESS.—A covered entity wishing to 
be accepted into the pilot program established under sub-
section (b) shall demonstrate to the Commission that the 
privacy-enhancing technologies to be used under the pilot 
program by the covered entity will establish data security 
practices that meet or exceed all or some of the require-
ments in section 109. If the covered entity demonstrates 
the privacy-enhancing technologies meet or exceed the re-
quirements in section 109, the Commission may accept the 
covered entity to be a part of the pilot program. If the 
Commission does not accept a covered entity to be a part 
of the pilot program, the Commission shall provide an ade-
quate response to the covered entity detailing why the cov-
ered entity was not accepted, and the covered entity may 
subsequently revise the petition of the covered entity to 
address any deficiencies indicated by the Commission in 
the response of the Commission to the covered entity. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00117
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS