poses of this Act, the Commission may prescribe 
such an exemption or modification by regulation. 
SEC. 4. ENFORCEMENT. 
(a) UNFAIR OR DECEPTIVE ACT OR PRACTICE.— 
This Act shall be enforced by the Commission under the 
Federal Trade Commission Act (15 U.S.C. 41 et seq.). 
A violation of any provision of this Act or of a regulation 
issued under this Act shall be treated as an unfair or de-
ceptive act or practice violating a rule promulgated under 
section 18 of the Federal Trade Commission Act (15 
U.S.C. 57a). 
(b) PENALTY FOR PATTERN OR PRACTICE VIOLA-
TIONS.— 
(1) IN GENERAL.—Notwithstanding subsection 
(a) and the Federal Trade Commission Act, in the 
case of a person who engages in a pattern or prac-
tice that violates section 2 or 3, the Commission 
may, in its discretion, seek a civil penalty for such 
pattern or practice of violations in an amount, as de-
termined by the Commission, of not more than— 
(A) $3,000,000 for each violation of sec-
tion 2; and 
(B) $1,000,000 for each violation of sec-
tion 3.
(2) TREATMENT OF SINGLE ACTION OR CON-
DUCT.—In applying paragraph (1)— 
(A) any single action or conduct that vio-
lates section 2 or 3 with respect to multiple 
protected computers shall be treated as a single 
violation; and 
(B) any single action or conduct that vio-
lates more than one paragraph of section 2(a) 
shall be considered multiple violations, based on 
the number of such paragraphs violated. 
(c) REQUIRED SCIENTER.—Civil penalties sought 
under this section for any action may not be granted by 
the Commission or any court unless the Commission or 
court, respectively, establishes that the action was com-
mitted with actual knowledge or knowledge fairly implied 
on the basis of objective circumstances that such act is 
unfair or deceptive or violates this Act. 
(d) FACTORS IN AMOUNT OF PENALTY.—In deter-
mining the amount of any penalty pursuant to subsection 
(a) or (b), the court shall take into account the degree 
of culpability, any history of prior such conduct, ability 
to pay, effect on ability to continue to do business, and 
such other matters as justice may require. 
(e) EXCLUSIVENESS OF REMEDIES.—The remedies 
in this section (and other remedies available to the Com-
mission in an enforcement action against unfair and de-
ceptive acts and practices) are the exclusive remedies for 
violations of this Act. 
(f) EFFECTIVE DATE.—To the extent only that this 
section applies to violations of section 2(a), this section 
shall take effect upon the expiration of the 6-month period 
that begins on the date of the enactment of this Act. 
SEC. 5. LIMITATIONS. 
(a) LAW ENFORCEMENT AUTHORITY.—Sections 2 
and 3 shall not apply to— 
(1) any act taken by a law enforcement agent 
in the performance of official duties; or 
(2) the transmission or execution of an infor-
mation collection program in compliance with a law 
enforcement, investigatory, national security, or reg-
ulatory agency or department of the United States 
or any State in response to a request or demand 
made under authority granted to that agency or de-
partment, including a warrant issued under the Fed-
eral Rules of Criminal Procedure, an equivalent 
State warrant, a court order, or other lawful proc-
ess. 
(b) EXCEPTION RELATING TO SECURITY.—Nothing 
in this Act shall apply to—
(1) any monitoring of, or interaction with, a 
protected computer— 
(A) in connection with the provision of a 
network access service or other service or prod-
uct with respect to which the user of the pro-
tected computer is an actual or prospective cus-
tomer, subscriber, registered user, or account 
holder; 
(B) by the provider of that service or prod-
uct or with such provider’s authorization; and 
(C) that involves or enables the collection 
of information about the user’s activities only 
with respect to the user’s relationship with or 
use of such service or product, 
to the extent that such monitoring or interaction is 
for the purpose of network security, computer secu-
rity, diagnostics, technical support or repair, net-
work management, authorized updates of software, 
or for the detection or prevention of fraudulent ac-
tivities; or 
(2) a discrete interaction with a protected com-
puter by a provider of computer software solely to 
determine whether the user of the computer is au-
thorized to use such software, that occurs upon— 
(A) initialization of the software; or
(B) an affirmative request by the owner or 
authorized user for an update of, addition to, or 
technical service for, the software. 
(c) GOOD SAMARITAN PROTECTION.— 
(1) IN
GENERAL.—No provider of computer 
software or of interactive computer service may be 
held liable under this Act on account of any action 
voluntarily taken, or service provided, in good faith 
to remove or disable a program used to violate sec-
tion 2 or 3 that is installed on a computer of a cus-
tomer of such provider, if such provider notifies the 
customer and obtains the consent of the customer 
before undertaking such action or providing such 
service. 
(2) CONSTRUCTION.—Nothing in this sub-
section shall be construed to limit the liability of a 
provider of computer software or of an interactive 
computer service for any anti-competitive act other-
wise prohibited by law. 
(d) LIMITATION ON LIABILITY.—A manufacturer or 
retailer of computer equipment shall not be liable under 
this Act to the extent that the manufacturer or retailer 
is providing third party branded computer software that 
is installed on the equipment the manufacturer or retailer 
is manufacturing or selling.
(e) SERVICES PROVIDED BY CABLE OPERATORS AND 
SATELLITE CARRIERS.—It shall not be a violation of sec-
tion 3 for a satellite carrier (as such term is defined in 
section 338(k) of the Communications Act of 1934 (47 
U.S.C. 338(k)) or cable operator (as such term is defined 
in section 631(a)(2) of such Act (47 U.S.C. 551(a)(2))) 
to— 
(1) utilize a navigation device (as such term is 
defined in the rules of the Federal Communications 
Commission); 
(2) interact with such a navigation device; or 
(3) transmit software to or execute software in-
stalled on such a navigation device to provide service 
or collect or disclose subscriber information, 
if the provision of such service, the utilization of or the 
interaction with such device, or the collection of or disclo-
sure of such information, is subject to section 338(i) or 
section 631 of the Communications Act of 1934. 
SEC. 6. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE LAW.— 
(1) PREEMPTION
OF
SPYWARE
LAWS.—This 
Act supersedes any provision of a statute, regula-
tion, or rule of a State or political subdivision of a 
State that expressly regulates—
(A) unfair or deceptive conduct with re-
spect to computers similar to that described in 
section 2(a); 
(B) the transmission or execution of a 
computer program similar to that described in 
section 3; or 
(C) the use of computer software that dis-
plays advertising content based on the Web 
pages accessed using a computer. 
(2) ADDITIONAL PREEMPTION.— 
(A) IN GENERAL.—No person other than 
the Attorney General of a State may bring a 
civil action under the law of any State if such 
action is premised in whole or in part upon the 
defendant violating any provision of this Act. 
(B) PROTECTION OF CONSUMER PROTEC-
TION LAWS.—This paragraph shall not be con-
strued to limit the enforcement of any State 
consumer protection law by an Attorney Gen-
eral of a State. 
(3) PROTECTION OF CERTAIN STATE LAWS.— 
This Act shall not be construed to preempt the ap-
plicability of— 
(A) State trespass, contract, or tort law; or
(B) other State laws to the extent that 
those laws relate to acts of fraud. 
(4) EFFECTIVE
DATE.—The preemption pro-
vided for under this subsection shall take effect, with 
respect to specific provisions of this Act, on the ef-
fective date for such provisions. 
(b) PRESERVATION OF FTC AUTHORITY.—Nothing 
in this Act may be construed in any way to limit or affect 
the Commission’s authority under any other provision of 
law, including the authority to issue advisory opinions 
(under part 1 of volume 16 of the Code of Federal Regula-
tions), policy statements, or guidance regarding this Act. 
SEC. 7. FTC REPORT ON COOKIES. 
(a) IN GENERAL.—Not later than the expiration of 
the 6-month period that begins on the date on which final 
regulations are issued under section 9, the Commission 
shall submit a report to the Congress regarding the use 
of cookies in the delivery or display of advertising to the 
owners and users of computers. The report shall examine 
the extent to which cookies are or may be used to transmit 
to a third party personally identifiable information of a 
computer owner or user, information regarding Web pages 
accessed by the owner or user, or information regarding 
advertisements previously delivered to a computer, for the 
purpose of—
(1) delivering or displaying advertising to the 
owner or user; or 
(2) assisting the intended recipient to deliver or 
display advertising to the owner, user, or others. 
The report shall examine and describe the methods by 
which cookies and the Web sites that place them on com-
puters function separately and together, and shall com-
pare the use of cookies with the use of information collec-
tion programs (as such term is defined in section 3) to 
determine the extent to which such uses are similar or dif-
ferent. The report may include such recommendations as 
the Commission considers necessary and appropriate, in-
cluding treatment of cookies under this Act or other laws. 
(b) EFFECTIVE DATE.—This section shall take effect 
on the date of the enactment of this Act. 
(c) PAPERWORK REDUCTION REQUIREMENTS.—The 
requirements of subchapter I of chapter 35 of title 44, 
United States Code, shall not apply to the report required 
under this section. 
SEC. 8. FTC REPORT ON INFORMATION COLLECTION PRO-
GRAMS 
INSTALLED 
BEFORE 
EFFECTIVE 
DATE. 
Not later than the expiration of the 6-month period 
that begins on the date on which final regulations are 
issued under section 9, the Commission shall submit a re-
port to the Congress on the extent to which there are in-
stalled on protected computers information collection pro-
grams that, but for installation prior to the effective date 
under section 11(a), would be subject to the requirements 
of section 3. The report shall include recommendations re-
garding the means of affording computer users affected 
by such information collection programs the protections 
of section 3, including recommendations regarding requir-
ing a one-time notice and consent by the owner or author-
ized user of a computer to the continued collection of in-
formation by such a program so installed on the computer. 
The requirements of subchapter I of chapter 35 of title 
44, United States Code, shall not apply to the report re-
quired under this section. 
SEC. 9. REGULATIONS. 
(a) IN GENERAL.—The Commission shall issue the 
regulations required by this Act not later than the expira-
tion of the 9-month period beginning on the date of the 
enactment of this Act. In exercising its authority to issue 
any regulation under this Act, the Commission shall deter-
mine that the regulation is consistent with the public in-
terest and the purposes of this Act. Any regulations issued 
pursuant to this Act shall be issued in accordance with 
section 553 of title 5, United States Code.
(b) EFFECTIVE DATE.—This section shall take effect 
on the date of the enactment of this Act. 
SEC. 10. DEFINITIONS. 
For purposes of this Act: 
(1) CABLE OPERATOR.—The term ‘‘cable oper-
ator’’ has the meaning given such term in section 
602 of the Communications Act of 1934 (47 U.S.C. 
522). 
(2) COLLECT.—The term ‘‘collect’’, when used 
with respect to information and for purposes only of 
section 3(b)(1)(A), does not include obtaining of the 
information by a party who is intended by the owner 
or authorized user of a protected computer to receive 
the information or by a third party authorized by 
such intended recipient to receive the information, 
pursuant to the owner or authorized user— 
(A) transferring the information to such 
intended recipient using the protected com-
puter; or 
(B) storing the information on the pro-
tected computer in a manner so that it is acces-
sible by such intended recipient. 
(3) COMPUTER; PROTECTED COMPUTER.—The 
terms ‘‘computer’’ and ‘‘protected computer’’ have
the meanings given such terms in section 1030(e) of 
title 18, United States Code. 
(4) COMPUTER SOFTWARE.— 
(A) IN GENERAL.—Except as provided in 
subparagraph (B), the term ‘‘computer soft-
ware’’ means a set of statements or instructions 
that can be installed and executed on a com-
puter for the purpose of bringing about a cer-
tain result. 
(B) EXCEPTIONS.—Such term does not in-
clude— 
(i) computer software that is placed 
on the computer system of a user by an 
Internet service provider, interactive com-
puter service, or Internet Web site solely to 
enable the user subsequently to use such 
provider or service or to access such Web 
site; 
(ii) a cookie; or 
(iii) any other type of text or data file 
that solely may be read or transferred by 
a computer. 
(5) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission.
section 3 of the Communications Act of 1934 (47 
U.S.C. 153). 
(11) INTERACTIVE
COMPUTER
SERVICE.—The 
term ‘‘interactive computer service’’ has the meaning 
given such term in section 230(f) of the Communica-
tions Act of 1934 (47 U.S.C. 230(f)). 
(12) INTERNET.—The term ‘‘Internet’’ means 
collectively the myriad of computer and tele-
communications facilities, including equipment and 
operating software, which comprise the inter-
connected world-wide network of networks that em-
ploy the Transmission Control Protocol/Internet 
Protocol, or any predecessor or successor protocols 
to such protocol, to communicate information of all 
kinds by wire or radio. 
(13) PERSONALLY
IDENTIFIABLE
INFORMA-
TION.— 
(A) IN GENERAL.—The term ‘‘personally 
identifiable information’’ means the following 
information, to the extent only that such infor-
mation allows a living individual to be identified 
from that information: 
(i) First and last name of an indi-
vidual.
(ii) A home or other physical address 
of an individual, including street name, 
name of a city or town, and zip code. 
(iii) An electronic mail address. 
(iv) A telephone number. 
(v) A social security number, tax iden-
tification number, passport number, driv-
er’s license number, or any other govern-
ment-issued identification number. 
(vi) A credit card number. 
(vii) Any access code, password, or ac-
count number, other than an access code 
or password transmitted by an owner or 
authorized user of a protected computer to 
the intended recipient to register for, or 
log onto, a Web page or other Internet 
service or a network connection or service 
of a subscriber that is protected by an ac-
cess code or password. 
(viii) Date of birth, birth certificate 
number, or place of birth of an individual, 
except in the case of a date of birth trans-
mitted or collected for the purpose of com-
pliance with the law.
(B) RULEMAKING.—The Commission may, 
by regulation, add to the types of information 
described in subparagraph (A) that shall be 
considered personally identifiable information 
for purposes of this Act, except that such addi-
tional types of information shall be considered 
personally identifiable information only to the 
extent that such information allows living indi-
viduals, particular computers, particular users 
of computers, or particular email addresses or 
other locations of computers to be identified 
from that information. 
(14) SUITE OF FUNCTIONALLY RELATED SOFT-
WARE.—The term suite of ‘‘functionally related soft-
ware’’ means a group of computer software pro-
grams distributed to an end user by a single pro-
vider, 
which 
programs 
enable 
features 
or 
functionalities of an integrated service offered by the 
provider. 
(15) 
TELECOMMUNICATIONS
CARRIER.—The 
term ‘‘telecommunications carrier’’ has the meaning 
given such term in section 3 of the Communications 
Act of 1934 (47 U.S.C. 153).
(16) TRANSMIT.—The term ‘‘transmit’’ means, 
with respect to an information collection program, 
transmission by any means. 
(17) WEB PAGE.—The term ‘‘Web page’’ means 
a location, with respect to the World Wide Web, that 
has a single Uniform Resource Locator or another 
single location with respect to the Internet, as the 
Federal Trade Commission may prescribe. 
(18) WEB SITE.—The term ‘‘web site’’ means a 
collection of Web pages that are presented and made 
available by means of the World Wide Web as a sin-
gle Web site (or a single Web page so presented and 
made available), which Web pages have any of the 
following characteristics: 
(A) A common domain name. 
(B) Common ownership, management, or 
registration. 
SEC. 11. APPLICABILITY AND SUNSET. 
(a) EFFECTIVE DATE.—Except as specifically pro-
vided otherwise in this Act, this Act shall take effect upon 
the expiration of the 12-month period that begins on the 
date of the enactment of this Act. 
(b) APPLICABILITY.—Section 3 shall not apply to an 
information collection program installed on a protected
computer before the effective date under subsection (a) of 
this section. 
(c) SUNSET.—This Act shall not apply after Decem-
ber 31, 2013. 
Passed the House of Representatives June 6, 2007. 
Attest: 
Clerk.
110TH CONGRESS 
1ST SESSION 
H. R. 964 
AN ACT 
To protect users of the Internet from unknowing 
transmission of their personally identifiable infor-
mation through spyware programs, and for other 
purposes.