I 
117TH CONGRESS 
1ST SESSION H. R. 5433 
To protect the privacy of internet users by reinforcing online privacy rights 
and through the establishment of a national Do Not Track system, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 30, 2021 
Mr. POSEY (for himself, Mr. GOHMERT, and Mr. MULLIN) introduced the 
following bill; which was referred to the Committee on Energy and Commerce 
A BILL 
To protect the privacy of internet users by reinforcing online 
privacy rights and through the establishment of a na-
tional Do Not Track system, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Renew Effective Protection of Americans’ Information 
Rights Act’’ or the ‘‘REPAIR Act’’. 
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6211
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
TITLE I—DATA PRIVACY BILL OF RIGHTS 
Sec. 101. Short title. 
Sec. 102. Policy of the United States. 
Sec. 103. Findings. 
Sec. 104. Rights relating to transparency. 
Sec. 105. Right to delete. 
Sec. 106. Right to correct inaccuracies. 
Sec. 107. Right to controls. 
Sec. 108. Right to data minimization. 
Sec. 109. Right to data security. 
Sec. 110. Prohibition of service offers conditioned on waivers of privacy rights. 
Sec. 111. Scope of coverage. 
Sec. 112. Small business exception. 
Sec. 113. Application and enforcement. 
Sec. 114. State privacy protections. 
Sec. 115. Severability. 
Sec. 116. Definitions. 
Sec. 117. Effective date. 
TITLE II—DO NOT TRACK 
Sec. 201. Short title. 
Sec. 202. Establishment of Do Not Track system. 
Sec. 203. Do Not Track: requirements for operators; prohibited acts. 
Sec. 204. Scope of coverage. 
Sec. 205. Application and enforcement. 
Sec. 206. State privacy protections. 
Sec. 207. Severability. 
Sec. 208. Definitions. 
Sec. 209. Effective date. 
TITLE I—DATA PRIVACY BILL OF 
RIGHTS 
SEC. 101. SHORT TITLE. 
This title may be cited as the ‘‘Data Privacy Bill of 
Rights Act’’. 
SEC. 102. POLICY OF THE UNITED STATES. 
It is the policy of the United States that individuals 
have fundamental rights to secure and protect their pri-
vacy in data collected from and about them by firms doing 
business with them as provided for in this title and that 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
it is also a fundamental purpose of the Federal Govern-
ment to defend and enforce such privacy rights. 
SEC. 103. FINDINGS. 
Congress finds the following: 
(1) Individuals are endowed with rights to se-
cure and protect data related to their lives, their 
patterns of movement and commercial exchange and 
any other information that is classified as sensitive 
pursuant to this title. 
(2) Individuals have a right to complete trans-
parency with respect to the exchanges they make in 
terms of a complete accounting of both the nonpecu-
niary and pecuniary costs allocated to and collected 
from them. 
(3) While the internet and other technologies 
have produced enormous benefits to the Nation, they 
have also had unintentional consequences in eroding 
individual data privacy rights. 
(4) The Nation needs to update individual 
rights to include adequate and effective protections 
to secure and sustain individual rights to data pri-
vacy. 
(5) That protection of individual data privacy 
rights should be secured with due consideration of 
the collateral rights of entities to pursue businesses 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
while assuring complete transparency to individuals 
as relates to their data and the role that such data 
plays in the entities’ business models. 
SEC. 104. RIGHTS RELATING TO TRANSPARENCY. 
(a) RIGHT TO ACCESS.—Upon the verified request of 
an individual, a covered entity shall provide to the indi-
vidual— 
(1) in a portable format, without licensing re-
strictions, the covered data of the individual that is 
collected, processed, or transferred by the covered 
entity; and 
(2) in a human-readable format that a reason-
able individual can understand— 
(A) a copy of the covered data of the indi-
vidual that is collected, processed, or trans-
ferred by the covered entity; 
(B) a list of each category of third party 
to which the covered entity has transferred the 
covered data of the individual; and 
(C) the identity of each such third party 
and a description of the covered data that was 
transferred to such third party and the purpose 
of the transfer. 
(b) RIGHT TO IMMEDIATE NOTIFICATION OF COL-
LECTION.— 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(1) IN GENERAL.—On every website or applica-
tion landing page, the second-party operator of a 
covered internet platform shall display, immediately 
when the page is accessed by an individual, an easily 
identifiable indicator that provides a real-time notifi-
cation of whether or not the covered data of the in-
dividual is being actively collected by the covered 
internet platform or any program of a third-party 
operator that appears on the covered internet plat-
form. 
(2) CONTENTS OF NOTIFICATION.—The notifi-
cation required by paragraph (1) shall include (or 
provide a link to or other convenient means of ac-
cessing) the following information: 
(A) The types of data being collected. 
(B) The purposes for which such data is 
processed. 
(C) The categories of such data trans-
ferred to third parties. 
(D) The categories of third parties to 
which such data is transferred. 
(E) The identity of each third party to 
which such data is transferred. 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(F) How long such data will be retained by 
the second-party operator, any third-party oper-
ator, and any third party (as applicable). 
(G) A description of individuals’ privacy 
rights under this title. 
(H) The contact information for the rep-
resentatives for privacy and data security in-
quires of the second-party operator, any third- 
party operator, and any third party (as applica-
ble). 
(3) RESPONSIBILITY OF THIRD-PARTY OPERA-
TORS.—A third-party operator of a program that ap-
pears on a covered internet platform shall, if the 
program collects any covered data of a user of the 
platform, ensure that the second-party operator of 
the platform provides the notification required by 
paragraph (1) and that the notification includes the 
information required by paragraph (2) with respect 
to the program. 
(c) RIGHT TO RECEIVE PRIVACY POLICY.— 
(1) IN GENERAL.—A covered entity shall make 
publicly and persistently available, in a conspicuous 
and readily accessible manner, a privacy policy that 
provides a detailed and accurate representation of 
the activities of the covered entity with respect to 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
the collection, processing, and transfer of covered 
data. 
(2) CONTENTS OF PRIVACY POLICY.—The pri-
vacy policy required by paragraph (1) shall include, 
at a minimum, the following: 
(A) An easy-to-understand explanation of 
the policy of the covered entity with respect to 
the collection, processing, and transfer of cov-
ered data (including clear descriptions that 
avoid technical and legal jargon to the extent 
practicable). 
(B) The identity of and contact informa-
tion for the covered entity, including the con-
tact information for the covered entity’s rep-
resentative for privacy and data security inquir-
ies. 
(C) Each category of covered data the cov-
ered entity collects and the processing purposes 
for which such data is collected. 
(D) Whether the covered entity transfers 
covered data and, if so— 
(i) each category of service provider or 
third party to which the covered entity 
transfers covered data and the purposes 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
for which such data is transferred to each 
such category; and 
(ii) the identity of each third party to 
which the covered entity transfers covered 
data and the purposes for which such data 
is transferred to such third party. 
(E) How long covered data processed by 
the covered entity will be retained by the cov-
ered entity or a third party and a description 
of the covered entity’s data minimization poli-
cies. 
(F) How individuals can exercise the indi-
vidual rights described in this title. 
(G) A description of the covered entity’s 
data security policies. 
(H) The effective date of the privacy pol-
icy. 
(3) LANGUAGES.—A covered entity shall make 
the privacy policy required under paragraph (1) 
available to the public in all of the languages in 
which the covered entity provides a product or serv-
ice or carries out any other activities to which the 
privacy policy relates. 
(d) RIGHT TO CONSENT TO MATERIAL CHANGES.— 
If a material change to the privacy policy of a covered 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
entity required under subsection (c) would weaken privacy 
protections for covered data, the covered entity may not 
apply such change to the covered data of an individual 
that was collected before the change takes effect without 
obtaining the affirmative express consent of the individual 
to the change. 
SEC. 105. RIGHT TO DELETE. 
(a) IN GENERAL.—A covered entity, upon the verified 
request of an individual, shall— 
(1) at the option of the individual— 
(A) delete, or allow the individual to delete, 
any information in the covered data of the indi-
vidual that is processed by the covered entity; 
or 
(B) take action to disable or mask the 
identification of the individual connected to any 
information in the covered data of the indi-
vidual that is processed by the covered entity; 
(2) inform any service provider or third party 
to which the covered entity transferred such data of 
the request of the individual under paragraph (1); 
and 
(3) direct the service provider or third party to 
honor the request. 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(b) SERVICE PROVIDERS AND THIRD PARTIES.—In 
the case of a service provider or third party that is in-
formed under paragraph (2) of subsection (a) and directed 
to honor under paragraph (3) of such subsection the re-
quest of an individual under paragraph (1) of such sub-
section, the service provider or third party shall, in accord-
ance with the request, delete the information or take ac-
tion to disable or mask the identification of the individual. 
SEC. 106. RIGHT TO CORRECT INACCURACIES. 
(a) IN GENERAL.—A covered entity, upon the verified 
request of an individual, shall— 
(1) correct, or allow the individual to correct, 
inaccurate or incomplete information in the covered 
data of the individual that is processed by the cov-
ered entity; 
(2) inform any service provider or third party 
to which the covered entity transferred such data of 
the request of the individual under paragraph (1) 
and of the corrected information; and 
(3) direct the service provider or third party to 
honor the request. 
(b) SERVICE PROVIDERS AND THIRD PARTIES.—In 
the case of a service provider or third party that is in-
formed under paragraph (2) of subsection (a) and directed 
to honor under paragraph (3) of such subsection the re-
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
quest of an individual under paragraph (1) of such sub-
section, the service provider or third party shall, in accord-
ance with the request, correct the information. 
SEC. 107. RIGHT TO CONTROLS. 
(a) SENSE OF CONGRESS.—It is the sense of Con-
gress that— 
(1) the term ‘‘privacy policy’’ is deceptive; 
(2) such policies are in fact data collection poli-
cies; and 
(3) covered data is the private property of the 
individual about whom the data has been collected 
and should be treated as such. 
(b) REQUIREMENT FOR AFFIRMATIVE EXPRESS CON-
SENT FOR COLLECTION, PROCESSING, OR TRANSFER OF 
COVERED DATA.— 
(1) IN GENERAL.—A covered entity may not 
collect, process, or transfer to a third party the cov-
ered data of an individual without obtaining the af-
firmative express consent of the individual to the col-
lection, processing, or transfer through a process es-
tablished under the rule issued by the Commission 
under paragraph (3). 
(2) RIGHT
TO
WITHDRAW
AFFIRMATIVE
EX-
PRESS CONSENT.—A covered entity shall permit an 
individual to withdraw the affirmative express con-
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(I) for the collection, processing, 
or transfer of some or all (at the op-
tion of the individual) of the covered 
data of the individual; and 
(II) for the transfer of the cov-
ered data of the individual to some or 
all (at the option of the individual) 
third parties; 
(iii) allow an individual to view the 
status of affirmative express consent pro-
vided or withdrawn; 
(iv) be privacy protective; and 
(v) be informed by the Commission’s 
experience developing and implementing 
the National Do Not Call Registry. 
SEC. 108. RIGHT TO DATA MINIMIZATION. 
(a) IN GENERAL.—A covered entity may not collect, 
process, or transfer the covered data of an individual be-
yond what is reasonably necessary, proportionate, and lim-
ited to the purposes for which the individual provides af-
firmative express consent to the collection, processing, or 
transfer. 
(b) RULE
OF CONSTRUCTION.—Nothing in sub-
section (a) may be construed to authorize any collection, 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
processing, or transfer of covered data that is prohibited 
by any other provision of this title. 
SEC. 109. RIGHT TO DATA SECURITY. 
(a) IN GENERAL.—A covered entity shall establish, 
implement, and maintain reasonable data security prac-
tices to protect the confidentiality, integrity, and accessi-
bility of covered data. Such data security practices shall 
be appropriate to the volume and nature of the covered 
data at issue. 
(b) SPECIFIC REQUIREMENTS.—Data security prac-
tices required under subsection (a) shall include, at a min-
imum, the following: 
(1) 
ASSESS
VULNERABILITIES.—Identifying 
and assessing any reasonably foreseeable risks to, 
and vulnerabilities in, each system maintained by 
the covered entity that collects, processes, or trans-
fers covered data, including unauthorized access to 
or risks to covered data, human vulnerabilities, ac-
cess rights, and use of service providers. Such activi-
ties shall include a plan to receive and respond to 
unsolicited reports of vulnerabilities by entities and 
individuals. 
(2) PREVENTIVE AND CORRECTION ACTION.— 
Taking preventive and corrective action to mitigate 
any risks or vulnerabilities to covered data identified 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
by the covered entity, which may include imple-
menting administrative, technical, or physical safe-
guards or changes to data security practices or the 
architecture, installation, or implementation of net-
work or operating software. 
(3) 
INFORMATION
RETENTION
AND
DIS-
POSAL.—Deleting covered data that is required to be 
deleted or is no longer necessary for the purpose for 
which the data was collected unless the individual to 
whom the data relates provides affirmative express 
consent to the retention of the data. Such process 
shall include data hygiene practices to ensure ongo-
ing compliance with this paragraph. 
(4) COMPREHENSIVE
DATA
SECURITY
PRO-
GRAM.—Implementation of a comprehensive data se-
curity program, including— 
(A) designation of an employee responsible 
for data security; 
(B) training for all employees with access 
to covered data on how to safeguard covered 
data and protect individual privacy, and updat-
ing that training as necessary; and 
(C) due diligence with regard to the data 
security practices of service providers to which 
the covered entity transfers covered data. 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
SEC. 110. PROHIBITION OF SERVICE OFFERS CONDITIONED 
ON WAIVERS OF PRIVACY RIGHTS. 
A covered entity may not— 
(1) condition, or effectively condition, provision 
of the service on agreement by an individual to 
waive privacy rights guaranteed by law or regula-
tion, including this title; or 
(2) terminate the service or otherwise refuse to 
provide the service as a direct or indirect con-
sequence of the refusal of a user to waive any pri-
vacy rights described in this title. 
SEC. 111. SCOPE OF COVERAGE. 
(a) GENERAL EXCEPTIONS.—Notwithstanding any 
other provision of this title, a covered entity may collect, 
process, or transfer covered data for any of the following 
purposes, if the collection, processing, or transfer is rea-
sonably necessary, proportionate, and limited to such pur-
pose: 
(1) To initiate or complete a transaction or to 
fulfill an order or provide a service specifically re-
quested by an individual, including associated rou-
tine administrative activities such as billing, ship-
ping, financial reporting, and accounting. 
(2) To perform internal system maintenance, 
diagnostics, product or service management, inven-
tory management, or network management. 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(3) To prevent, detect, or respond to a security 
incident or trespassing, provide a secure environ-
ment, or maintain the safety and security of a prod-
uct, service, or individual. 
(4) To protect against malicious, deceptive, 
fraudulent, or illegal activity. 
(5) To comply with a legal obligation or the es-
tablishment, exercise, analysis, or defense of legal 
claims or rights, or as required or specifically au-
thorized by law. 
(6) To comply with a civil, criminal, or regu-
latory inquiry, investigation, subpoena, or summons 
by an Executive agency. 
(7) To cooperate with an Executive agency or 
a law enforcement official acting under the authority 
of an Executive or State agency concerning conduct 
or activity that the Executive agency or law enforce-
ment official reasonably and in good faith believes 
may violate Federal, State, or local law, or pose a 
threat to public safety or national security. 
(8) To address risks to the safety of an indi-
vidual or group of individuals, or to ensure customer 
safety, including by authenticating individuals in 
order to provide access to large venues open to the 
public. 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(9) To effectuate a product recall pursuant to 
Federal or State law. 
(10) To conduct public or peer-reviewed sci-
entific, historical, or statistical research that— 
(A) is in the public interest; 
(B) adheres to all applicable ethics and 
privacy laws; and 
(C) is approved, monitored, and governed 
by an institutional review board or other over-
sight entity that meets standards promulgated 
by the Commission pursuant to section 553 of 
title 5, United States Code. 
(11) To transfer covered data to a service pro-
vider. 
(12) For a purpose identified by the Commis-
sion pursuant to a regulation promulgated under 
subsection (b). 
(b) ADDITIONAL PURPOSES.—The Commission may 
promulgate regulations under section 553 of title 5, 
United States Code, identifying additional purposes for 
which a covered entity may collect, process, or transfer 
covered data and protect individual rights to data privacy 
in accordance with this title. 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
SEC. 112. SMALL BUSINESS EXCEPTION. 
Sections 103, 104, 105, and 106 do not apply in the 
case of a person who can establish that, for the 3 pre-
ceding calendar years (or for the period during which the 
person has been in existence if such period is less than 
3 years)— 
(1) the average annual gross revenues of the 
person did not exceed $50,000,000; 
(2) on average, the person annually processed 
the covered data of less than 1,000,000 individuals; 
(3) the person never employed more than 500 
individuals at any one time; and 
(4) the person derived less than 50 percent of 
the revenues of the person from transferring covered 
data. 
SEC. 113. APPLICATION AND ENFORCEMENT. 
(a) GENERAL APPLICATION.—The requirements of 
this title apply, according to their terms, to— 
(1) those persons, partnerships, and corpora-
tions over which the Commission has authority pur-
suant to section 5(a)(2) of the Federal Trade Com-
mission Act (15 U.S.C. 45(a)(2)); and 
(2) notwithstanding sections 4 and 5(a)(2) of 
such Act (15 U.S.C. 44; 45(a)(2))— 
(A) common carriers described in such sec-
tion 5(a)(2); and 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(B) organizations not organized to carry 
on business for their own profit or that of their 
members. 
(b) ENFORCEMENT BY THE COMMISSION.— 
(1) IN
GENERAL.—Except as otherwise pro-
vided, this title and the regulations prescribed under 
this title shall be enforced by the Commission under 
the Federal Trade Commission Act (15 U.S.C. 41 et 
seq.). 
(2) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of this title or a regulation pre-
scribed under this title shall be treated as a violation 
of a rule defining an unfair or deceptive act or prac-
tice prescribed under section 18(a)(1)(B) of the Fed-
eral 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)). 
(3) ACTIONS BY THE COMMISSION.— 
(A) IN GENERAL.—Except as provided in 
subparagraph (B) and subsection (a), the Com-
mission shall prevent any person from violating 
this title or a regulation prescribed under this 
title in the same manner, by the same means, 
and with the same jurisdiction, powers, and du-
ties as though all applicable terms and provi-
sions of the Federal Trade Commission Act (15 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
U.S.C. 41 et seq.) were incorporated into and 
made a part of this title, and any person who 
violates this title or a regulation prescribed 
under this title shall be subject to the penalties 
and entitled to the privileges and immunities 
provided in the Federal Trade Commission Act. 
(B) PENALTIES.— 
(i) IN
GENERAL.—Notwithstanding 
section 5(m) of the Federal Trade Com-
mission Act (15 U.S.C. 45(m)), a civil pen-
alty recovered for a violation of this title or 
a regulation prescribed under this title 
may be in excess of the amounts provided 
for in that section, if such penalty meets 
the requirements of this subparagraph. 
(ii) PENALTY FOR NEGLIGENT VIOLA-
TION.—In the case of a person who neg-
ligently violates this title or a regulation 
prescribed under this title, such person 
shall be liable for a civil penalty that does 
not exceed $50 for every individual af-
fected by such violation for every day dur-
ing which the person is in violation of this 
title or such regulation as described in this 
clause. 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(iii) PENALTY
FOR
WILLFUL
OR 
RECKLESS VIOLATION.—In the case of a 
person who willfully or recklessly violates 
this title or a regulation prescribed under 
this title, such person shall be liable for a 
civil penalty that— 
(I) is not less than $100,000; 
and 
(II) does not exceed $1,000 for 
every individual affected by such vio-
lation for every day during which the 
person is in violation of this title or 
such regulation as described in this 
clause. 
(c) ENFORCEMENT
BY STATE ATTORNEYS GEN-
ERAL.— 
(1) IN GENERAL.— 
(A) CIVIL ACTIONS.—In any case in which 
the attorney general of a State has reason to 
believe that an interest of the residents of that 
State has been or is threatened or adversely af-
fected by the engagement of any person in an 
act or practice that violates this title or a regu-
lation prescribed under this title, the State, as 
parens patriae, may bring a civil action on be-
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
half of the residents of the State in a district 
court of the United States or a State court of 
appropriate jurisdiction to— 
(i) enjoin that act or practice; 
(ii) enforce compliance with this title 
or such regulation; 
(iii) obtain damages, statutory dam-
ages in the same amount as the penalties 
that the Commission may obtain under 
section 5(m) of the Federal Trade Com-
mission Act (15 U.S.C. 45(m)) and sub-
section (b)(3)(B) of this section, restitu-
tion, or other compensation on behalf of 
residents of the State; or 
(iv) obtain such other relief as the 
court may consider to be appropriate. 
(B) NOTICE.— 
(i) IN GENERAL.—Before filing an ac-
tion under subparagraph (A), the attorney 
general of the State involved shall provide 
to the Commission— 
(I) written notice of that action; 
and 
(II) a copy of the complaint for 
that action. 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(ii) EXEMPTION.— 
(I) IN
GENERAL.—Clause (i) 
does not apply with respect to the fil-
ing of an action by an attorney gen-
eral of a State under this paragraph 
if the attorney general of the State 
determines that it is not feasible to 
provide the notice described in that 
clause before the filing of the action. 
(II) NOTIFICATION.—In an ac-
tion described in subclause (I), the at-
torney general of a State shall provide 
notice and a copy of the complaint to 
the Commission at the same time as 
the attorney general files the action. 
(2) INTERVENTION.— 
(A) IN
GENERAL.—On receiving notice 
under paragraph (1)(B), the Commission shall 
have the right to intervene in the action that is 
the subject of the notice. 
(B) EFFECT
OF
INTERVENTION.—If the 
Commission intervenes in an action under para-
graph (1), it shall have the right— 
(i) to be heard with respect to any 
matter that arises in that action; and 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(ii) to file a petition for appeal. 
(3) CONSTRUCTION.—For purposes of bringing 
any civil action under paragraph (1), nothing in this 
title shall be construed to prevent an attorney gen-
eral of a State from exercising the powers conferred 
on the attorney general by the laws of that State 
to— 
(A) conduct investigations; 
(B) administer oaths or affirmations; or 
(C) compel the attendance of witnesses or 
the production of documentary and other evi-
dence. 
(4) ACTIONS
BY
THE
COMMISSION.—In any 
case in which an action is instituted by or on behalf 
of the Commission for violation of this title or a reg-
ulation prescribed under this title, no State may, 
during the pendency of that action, institute an ac-
tion under paragraph (1) against any defendant 
named in the complaint in the action instituted by 
or on behalf of the Commission for that violation. 
(5) VENUE; SERVICE OF PROCESS.— 
(A) VENUE.—Any action brought under 
paragraph (1) may be brought in— 
(i) a district court of the United 
States that meets applicable requirements 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
relating to venue under section 1391 of 
title 28, United States Code; or 
(ii) a State court of competent juris-
diction. 
(B) SERVICE OF PROCESS.—In an action 
brought under paragraph (1) in a district court 
of the United States, process may be served 
wherever the defendant— 
(i) is an inhabitant; or 
(ii) may be found. 
SEC. 114. STATE PRIVACY PROTECTIONS. 
Nothing in this title shall preempt any State law, reg-
ulation, or other requirement having the force or effect 
of law that is more protective of the privacy of individuals 
than the requirements of this title. 
SEC. 115. SEVERABILITY. 
If any provision of this title or the application of a 
provision of this title to any person or circumstance is held 
to be invalid or unconstitutional, the remainder of this 
title, or the application of such provision to any other per-
son or circumstance, shall not be affected. 
SEC. 116. DEFINITIONS. 
In this title: 
(1) AFFIRMATIVE EXPRESS CONSENT.— 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(A) IN GENERAL.—The term ‘‘affirmative 
express consent’’ means an affirmative act by 
an individual that clearly communicates the in-
dividual’s authorization for an act or practice, 
in response to a specific request that meets the 
requirements of subparagraph (B). 
(B) REQUEST
REQUIREMENTS.—The re-
quirements of this subparagraph with respect to 
a request from a covered entity to an individual 
are the following: 
(i) The request is provided to the indi-
vidual in a standalone disclosure. 
(ii) The request includes a description 
of each act or practice for which the indi-
vidual’s consent is sought and— 
(I) clearly distinguishes between 
an act or practice which is necessary 
to fulfill a request of the individual 
and an act or practice which is for an-
other purpose; and 
(II) is written in easy-to-under-
stand language and includes a promi-
nent heading that would enable a rea-
sonable individual to identify and un-
derstand the act or practice. 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(iii) The request clearly explains the 
individual’s applicable rights related to 
consent. 
(C) EXPRESS
CONSENT
REQUIRED.—A 
covered entity may not infer that an individual 
has provided affirmative express consent to an 
act or practice from the inaction of the indi-
vidual or the individual’s continued use of a 
service or product provided by the covered enti-
ty. 
(D) PRIOR CONSENT REQUIRED.—In the 
case of any requirement of this title for a cov-
ered entity to obtain affirmative express consent 
for an act or practice, the covered entity shall 
obtain such consent before engaging in the act 
or practice. 
(2) COLLECT; COLLECTION.—The terms ‘‘col-
lect’’ and ‘‘collection’’ mean, with respect to the cov-
ered data of an individual, buying, renting, gath-
ering, obtaining, receiving, accessing, or otherwise 
acquiring such data by any means, including by pas-
sively or actively observing the individual’s behavior. 
(3) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(4) CONNECTED
DEVICE.—The term ‘‘con-
nected device’’ means a physical object that— 
(A) is capable of connecting to the inter-
net, either directly or indirectly through a net-
work, to communicate information at the direc-
tion of an individual; and 
(B) has computer processing capabilities 
for collecting, sending, receiving, or analyzing 
data. 
(5) CONTROL.—The term ‘‘control’’ means, 
with respect to an entity— 
(A) ownership of, or the power to vote, 
more than 50 percent of the outstanding shares 
of any class of voting security of the entity; 
(B) control in any manner over the election 
of a majority of the directors of the entity (or 
of individuals exercising similar functions); or 
(C) the power to exercise a controlling in-
fluence over the management of the entity. 
(6) COVERED DATA.— 
(A) IN
GENERAL.—The term ‘‘covered 
data’’ means information that identifies or is 
linked or reasonably linkable to an individual or 
a connected device that is linked or reasonably 
linkable to an individual. 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(B) LINKED OR REASONABLY LINKABLE.— 
For purposes of subparagraph (A), information 
held by a covered entity is linked or reasonably 
linkable to an individual or a connected device 
if, as a practical matter, it can be used on its 
own or in combination with other information 
held by, or readily accessible to, the covered en-
tity to identify such individual or such device. 
(C) EXCLUSIONS.—Such term does not in-
clude— 
(i) aggregated data; 
(ii) de-identified data; 
(iii) data of an individual processed by 
the covered entity in the capacity of the 
covered entity as the employer of the indi-
vidual; or 
(iv) publicly available information. 
(7) COVERED ENTITY.—The term ‘‘covered en-
tity’’ means any person who— 
(A) collects, processes, or transfers covered 
data; and 
(B) determines the purposes and means of 
such collection, processing, or transfer. 
(8) COVERED INTERNET PLATFORM.— 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(A) IN
GENERAL.—The term ‘‘covered 
internet platform’’ means any public-facing 
website, internet application, or mobile applica-
tion, including a social network site, video shar-
ing service, search engine, or content aggrega-
tion service. 
(B) EXCLUSION.—Such term does not in-
clude a platform that is operated for the sole 
purpose of conducting research that is not con-
ducted for profit, either directly or indirectly. 
(9) DELETE.—The term ‘‘delete’’ means to re-
move or destroy information such that it is not 
maintained in human or machine-readable form and 
cannot be retrieved or utilized in such form in the 
normal course of business. 
(10) EXECUTIVE AGENCY.—The term ‘‘Execu-
tive agency’’ has the meaning given such term in 
section 105 of title 5, United States Code. 
(11) 
INDIVIDUAL.—The 
term 
‘‘individual’’ 
means a natural person residing in the United 
States, however identified, including by any unique 
identifier. 
(12) MATERIAL.—The term ‘‘material’’ means, 
with respect to an act, practice, or representation of 
a covered entity (including a representation made by 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
the covered entity in a privacy policy or similar dis-
closure to individuals), that such act, practice, or 
representation is likely to affect an individual’s deci-
sion or conduct regarding a product or service. 
(13) PROCESS.—The term ‘‘process’’ means to 
perform any operation or set of operations on cov-
ered data, including collection, analysis, organiza-
tion, structuring, retaining, using, transferring, or 
otherwise handling covered data. 
(14) PROCESSING PURPOSE.—The term ‘‘proc-
essing purpose’’ means an adequately specific and 
granular reason for which a covered entity processes 
covered data that clearly describes the processing ac-
tivity. 
(15) PROGRAM.—The term ‘‘program’’ means, 
with respect to a covered internet platform, any pro-
gram that appears on the platform, including a pro-
gram that delivers advertisements to users of the 
platform and a program used to log into the plat-
form. 
(16) PUBLICLY
AVAILABLE
INFORMATION.— 
The term ‘‘publicly available information’’ means in-
formation that is available to the general public, in-
cluding— 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(A) any information to which the source 
allows access by anyone upon request; and 
(B) any information that a covered entity 
has a reasonable basis to believe is lawfully 
made available to the general public from Fed-
eral, State, or local government records, widely 
distributed media, or disclosures to the general 
public that are required to be made by Federal, 
State, or local law. 
(17) RESEARCH.—The term ‘‘research’’ means 
the scientific analysis of information, including cov-
ered data, by a covered entity or those with whom 
the covered entity is cooperating or others acting at 
the direction or on behalf of the covered entity, that 
is conducted for the primary purpose of advancing 
scientific knowledge and may be for the commercial 
benefit of the covered entity. 
(18) SECOND-PARTY
OPERATOR.—The term 
‘‘second-party operator’’ means the operator of a 
covered internet platform with which a user intends 
to connect, but does not include the operator of a 
program that appears on the platform (if the oper-
ator of the program is different from the operator 
of the platform). 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(19) SERVICE PROVIDER.—The term ‘‘service 
provider’’ means, with respect to a set of covered 
data, a covered entity that collects, processes, or 
transfers such covered data for the purpose of per-
forming one or more services or functions on behalf 
of, and at the direction of, another covered entity 
that— 
(A) is not related to the covered entity pro-
viding the service or function by common own-
ership or corporate control; and 
(B) does not share common branding with 
the covered entity providing the service or func-
tion. 
(20) STATE.—The term ‘‘State’’ means each 
State of the United States, the District of Columbia, 
each commonwealth, territory, or possession of the 
United States, and each federally recognized Indian 
Tribe. 
(21) THIRD PARTY.—The term ‘‘third party’’ 
means with respect to a set of covered data, a cov-
ered entity— 
(A) that is not a service provider with re-
spect to such covered data; and 
(B) that received such covered data from 
another covered entity— 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(i) that is not related to the covered 
entity by common ownership or corporate 
control; and 
(ii) that does not share common 
branding with the covered entity. 
(22) 
THIRD-PARTY
OPERATOR.—The 
term 
‘‘third-party operator’’ means the operator of a pro-
gram that appears on a covered internet platform (if 
the operator of the program is different from the op-
erator of the platform). 
(23) TRANSFER.—The term ‘‘transfer’’ means, 
with respect to covered data, to disclose, release, 
share, disseminate, make available, or license such 
data, in writing, electronically, or by any other 
means, for consideration of any kind or for a com-
mercial purpose. 
SEC. 117. EFFECTIVE DATE. 
This title shall take effect on the date that is 6 
months after the date of the enactment of this Act. 
TITLE II—DO NOT TRACK 
SEC. 201. SHORT TITLE. 
This title may be cited as the ‘‘Do Not Track Act’’. 
SEC. 202. ESTABLISHMENT OF DO NOT TRACK SYSTEM. 
(a) IN GENERAL.—Not later than 6 months after the 
date of the enactment of this Act, the Commission shall 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
implement and enforce a Do Not Track (DNT) system, 
including the program described in subsection (b), to pro-
tect consumers from unwanted online data harvesting and 
targeted advertising. 
(b) DO NOT TRACK PROGRAM.—As part of the Do 
Not Track system required under this section, the Com-
mission shall designate the DNT signal and make avail-
able on the public website of the Commission a simple pro-
gram that— 
(1) can be downloaded to any common con-
nected device; 
(2) sends the DNT signal to every covered 
internet platform (except for a covered internet plat-
form designated under paragraph (3)) to which the 
device connects each time the device connects to the 
platform; and 
(3) permits the user of the device to designate 
covered internet platforms to which the DNT signal 
should not be sent, but does not exempt any covered 
internet platform from receiving the signal if the 
platform is not so designated. 
(c) OTHER DO NOT TRACK SYSTEMS.—Nothing in 
this title may be construed to prohibit the operator of any 
web browser or similar interface or a connected device de-
signer or manufacturer from offering a program that 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
sends the DNT signal to covered internet platforms, if the 
program permits users to designate covered internet plat-
forms to which the DNT signal should not be sent. 
(d) RULEMAKING
AUTHORITY.—The Commission 
may promulgate regulations, in accordance with section 
553 of title 5, United States Code, to carry out this sec-
tion. 
SEC. 203. DO NOT TRACK: REQUIREMENTS FOR OPERA-
TORS; PROHIBITED ACTS. 
(a) REQUIREMENTS.— 
(1) SEARCH FOR DNT SIGNAL.—When a con-
nected device connects to a covered internet plat-
form— 
(A) the second-party operator of the plat-
form shall ensure that the platform searches for 
the DNT signal; and 
(B) the third-party operator of any pro-
gram that appears on the platform shall ensure 
that the program searches for the DNT signal. 
(2) MANDATORY NOTIFICATION.— 
(A) IN
GENERAL.—Subject to subpara-
graph (B), if a second-party operator of a cov-
ered internet platform collects more data from 
a user of the platform than is necessary to op-
erate the platform, or if a third-party operator 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
of a program that appears on the platform col-
lects more data from a user of the platform 
than is necessary to operate the platform, the 
second-party operator or third-party operator, 
respectively, shall, through a pop-up notifica-
tion, provide any user whose connected device is 
not sending the DNT signal with— 
(i) notice of the policy of the platform 
or program of collecting data beyond what 
is necessary to operate the platform; 
(ii) notice of the protections from data 
collection and targeted advertising avail-
able to users under this title; 
(iii) notice that the user may, through 
the public website of the Commission, 
download the Do Not Track program de-
scribed in section 202(b), including a link 
to such website; and 
(iv) notice that the user may be able 
to activate the DNT signal through the 
user’s device or browser. 
(B) NUMBER
AND
TIMING.—A second- 
party operator or third-party operator, respec-
tively, shall provide the notification required by 
subparagraph (A)— 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(i) the first time a connected device 
connects to the covered internet platform; 
and 
(ii) unless the user of the connected 
device opts out of receiving the notification 
required by subparagraph (A), at least 
every 30th time the connected device con-
nects to the covered internet platform. 
(C) COLLECTION OF DATA FOR TARGETED 
ADVERTISING.—For purposes of this para-
graph, the second-party operator of a covered 
internet platform, or the third-party operator of 
a program that appears on the platform, that 
collects data for the purpose of designing or 
displaying advertisements for targeted adver-
tising shall be considered to be collecting more 
data than is necessary to operate the platform. 
(b) PROHIBITION ON DATA COLLECTION AND TAR-
GETED ADVERTISING.— 
(1) SECOND-PARTY
OPERATORS.—Subject to 
paragraph (3), it shall be unlawful for a second- 
party operator of a covered internet platform that 
receives the DNT signal from the connected device 
of a user to— 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(A) collect any data (other than such data 
as is necessary to operate the platform) from 
the user; 
(B) use any data collected from the user 
for a secondary purpose, including for the pur-
pose of targeted advertising; or 
(C) transfer any data collected from the 
user to a third party, unless the user provides 
affirmative express consent to the transfer of 
data in a manner that demonstrates the user’s 
intent for the second-party operator to be an 
intermediary between the user and the third 
party. 
(2) THIRD-PARTY OPERATORS.— 
(A) IN GENERAL.—It shall be unlawful for 
a third-party operator of a program that re-
ceives the DNT signal from the connected de-
vice of a user of a covered internet platform on 
which the program appears to collect any data 
from the user, other than, subject to subpara-
graph (B), data collected for the purpose of 
analyzing how or whether the user engaged 
with the program. 
(B) LIMITATIONS
ON
COLLECTION
OF 
DATA
FOR
ENGAGEMENT
ANALYTICS.—Data 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
collected for the purpose of analyzing how or 
whether the user engaged with the program, as 
described in subparagraph (A)— 
(i) may only be collected in a de-iden-
tified manner; and 
(ii) may not be used to create or con-
tribute to a profile of the user. 
(3) EXCEPTION
FOR
COMPLEMENTARY
SERV-
ICES.—Notwithstanding paragraph (1), a second- 
party operator of a covered internet platform may 
collect additional data from a user beyond what is 
necessary for the operation of the platform if the ad-
ditional data is necessary for the operation of a dif-
ferent covered internet platform that is— 
(A) both owned and operated by the sec-
ond-party operator; 
(B) designed to complement the covered 
internet platform accessed by the user; and 
(C) branded as a complementary covered 
internet platform to the covered internet plat-
form accessed by the user. 
(c) INTERFERING WITH DNT SIGNAL.—It shall be 
unlawful for any person to— 
(1) block or impede the ability of a covered 
internet platform, or a program that appears on a 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
covered internet platform, to receive the DNT sig-
nal; or 
(2) block or impede the ability of a connected 
device to send the DNT signal. 
(d) DISCRIMINATION
BASED
ON
DNT PREF-
ERENCES.—It shall be unlawful for a second-party oper-
ator of a covered internet platform to— 
(1) deny a user access to, or service from, the 
platform on the basis of receiving the DNT signal 
from the user; or 
(2) provide a user from whom the platform re-
ceives the DNT signal with a different level of access 
or service than the level of access or service provided 
to a user from whom the platform does not receive 
the DNT signal. 
SEC. 204. SCOPE OF COVERAGE. 
(a) GENERAL EXCEPTIONS.—Notwithstanding any 
other provision of this title, a covered entity may collect, 
process, or transfer covered data for any of the following 
purposes, if the collection, processing, or transfer is rea-
sonably necessary, proportionate, and limited to such pur-
pose: 
(1) To initiate or complete a transaction or to 
fulfill an order or provide a service specifically re-
quested by an individual, including associated rou-
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
tine administrative activities such as billing, ship-
ping, financial reporting, and accounting. 
(2) To perform internal system maintenance, 
diagnostics, product or service management, inven-
tory management, or network management. 
(3) To prevent, detect, or respond to a security 
incident or trespassing, provide a secure environ-
ment, or maintain the safety and security of a prod-
uct, service, or individual. 
(4) To protect against malicious, deceptive, 
fraudulent, or illegal activity. 
(5) To comply with a legal obligation or the es-
tablishment, exercise, analysis, or defense of legal 
claims or rights, or as required or specifically au-
thorized by law. 
(6) To comply with a civil, criminal, or regu-
latory inquiry, investigation, subpoena, or summons 
by an Executive agency. 
(7) To cooperate with an Executive agency or 
a law enforcement official acting under the authority 
of an Executive or State agency concerning conduct 
or activity that the Executive agency or law enforce-
ment official reasonably and in good faith believes 
may violate Federal, State, or local law, or pose a 
threat to public safety or national security. 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(8) To address risks to the safety of an indi-
vidual or group of individuals, or to ensure customer 
safety, including by authenticating individuals in 
order to provide access to large venues open to the 
public. 
(9) To effectuate a product recall pursuant to 
Federal or State law. 
(10) To conduct public or peer-reviewed sci-
entific, historical, or statistical research that— 
(A) is in the public interest; 
(B) adheres to all applicable ethics and 
privacy laws; and 
(C) is approved, monitored, and governed 
by an institutional review board or other over-
sight entity that meets standards promulgated 
by the Commission pursuant to section 553 of 
title 5, United States Code. 
(11) To transfer covered data to a service pro-
vider. 
(12) For a purpose identified by the Commis-
sion pursuant to a regulation promulgated under 
subsection (b). 
(b) ADDITIONAL PURPOSES.—The Commission may 
promulgate regulations under section 553 of title 5, 
United States Code, identifying additional purposes for 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
which a covered entity may collect, process, or transfer 
covered data and protect individual rights to data privacy 
in accordance with this title. 
SEC. 205. APPLICATION AND ENFORCEMENT. 
(a) GENERAL APPLICATION.—The requirements of 
this title apply, according to their terms, to— 
(1) those persons, partnerships, and corpora-
tions over which the Commission has authority pur-
suant to section 5(a)(2) of the Federal Trade Com-
mission Act (15 U.S.C. 45(a)(2)); and 
(2) notwithstanding sections 4 and 5(a)(2) of 
such Act (15 U.S.C. 44; 45(a)(2))— 
(A) common carriers described in such sec-
tion 5(a)(2); and 
(B) organizations not organized to carry 
on business for their own profit or that of their 
members. 
(b) ENFORCEMENT BY THE COMMISSION.— 
(1) IN
GENERAL.—Except as otherwise pro-
vided, this title and the regulations prescribed under 
this title shall be enforced by the Commission under 
the Federal Trade Commission Act (15 U.S.C. 41 et 
seq.). 
(2) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of this title or a regulation pre-
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
scribed under this title shall be treated as a violation 
of a rule defining an unfair or deceptive act or prac-
tice prescribed under section 18(a)(1)(B) of the Fed-
eral 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)). 
(3) ACTIONS BY THE COMMISSION.— 
(A) IN GENERAL.—Except as provided in 
subparagraph (B) and subsection (a), the Com-
mission shall prevent any person from violating 
this title or a regulation prescribed under this 
title in the same manner, by the same means, 
and with the same jurisdiction, powers, and du-
ties as though all applicable terms and provi-
sions of the Federal Trade Commission Act (15 
U.S.C. 41 et seq.) were incorporated into and 
made a part of this title, and any person who 
violates this title or a regulation prescribed 
under this title shall be subject to the penalties 
and entitled to the privileges and immunities 
provided in the Federal Trade Commission Act. 
(B) PENALTIES.— 
(i) IN
GENERAL.—Notwithstanding 
section 5(m) of the Federal Trade Com-
mission Act (15 U.S.C. 45(m)), a civil pen-
alty recovered for a violation of this title or 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
a regulation prescribed under this title 
may be in excess of the amounts provided 
for in that section, if such penalty meets 
the requirements of this subparagraph. 
(ii) PENALTY FOR NEGLIGENT VIOLA-
TION.—In the case of a person who neg-
ligently violates this title or a regulation 
prescribed under this title, such person 
shall be liable for a civil penalty that does 
not exceed $50 for every individual af-
fected by such violation for every day dur-
ing which the person is in violation of this 
title or such regulation as described in this 
clause. 
(iii) PENALTY
FOR
WILLFUL
OR 
RECKLESS VIOLATION.—In the case of a 
person who willfully or recklessly violates 
this title or a regulation prescribed under 
this title, such person shall be liable for a 
civil penalty that— 
(I) is not less than $100,000; 
and 
(II) does not exceed $1,000 for 
every individual affected by such vio-
lation for every day during which the 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
person is in violation of this title or 
such regulation as described in this 
clause. 
(c) ENFORCEMENT
BY STATE ATTORNEYS GEN-
ERAL.— 
(1) IN GENERAL.— 
(A) CIVIL ACTIONS.—In any case in which 
the attorney general of a State has reason to 
believe that an interest of the residents of that 
State has been or is threatened or adversely af-
fected by the engagement of any person in an 
act or practice that violates this title or a regu-
lation prescribed under this title, the State, as 
parens patriae, may bring a civil action on be-
half of the residents of the State in a district 
court of the United States or a State court of 
appropriate jurisdiction to— 
(i) enjoin that act or practice; 
(ii) enforce compliance with this title 
or such regulation; 
(iii) obtain damages, statutory dam-
ages in the same amount as the penalties 
that the Commission may obtain under 
section 5(m) of the Federal Trade Com-
mission Act (15 U.S.C. 45(m)) and sub-
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
section (b)(3)(B) of this section, restitu-
tion, or other compensation on behalf of 
residents of the State; or 
(iv) obtain such other relief as the 
court may consider to be appropriate. 
(B) NOTICE.— 
(i) IN GENERAL.—Before filing an ac-
tion under subparagraph (A), the attorney 
general of the State involved shall provide 
to the Commission— 
(I) written notice of that action; 
and 
(II) a copy of the complaint for 
that action. 
(ii) EXEMPTION.— 
(I) IN
GENERAL.—Clause (i) 
does not apply with respect to the fil-
ing of an action by an attorney gen-
eral of a State under this paragraph 
if the attorney general of the State 
determines that it is not feasible to 
provide the notice described in that 
clause before the filing of the action. 
(II) NOTIFICATION.—In an ac-
tion described in subclause (I), the at-
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
torney general of a State shall provide 
notice and a copy of the complaint to 
the Commission at the same time as 
the attorney general files the action. 
(2) INTERVENTION.— 
(A) IN
GENERAL.—On receiving notice 
under paragraph (1)(B), the Commission shall 
have the right to intervene in the action that is 
the subject of the notice. 
(B) EFFECT
OF
INTERVENTION.—If the 
Commission intervenes in an action under para-
graph (1), it shall have the right— 
(i) to be heard with respect to any 
matter that arises in that action; and 
(ii) to file a petition for appeal. 
(3) CONSTRUCTION.—For purposes of bringing 
any civil action under paragraph (1), nothing in this 
title shall be construed to prevent an attorney gen-
eral of a State from exercising the powers conferred 
on the attorney general by the laws of that State 
to— 
(A) conduct investigations; 
(B) administer oaths or affirmations; or 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(C) compel the attendance of witnesses or 
the production of documentary and other evi-
dence. 
(4) ACTIONS
BY
THE
COMMISSION.—In any 
case in which an action is instituted by or on behalf 
of the Commission for violation of this title or a reg-
ulation prescribed under this title, no State may, 
during the pendency of that action, institute an ac-
tion under paragraph (1) against any defendant 
named in the complaint in the action instituted by 
or on behalf of the Commission for that violation. 
(5) VENUE; SERVICE OF PROCESS.— 
(A) VENUE.—Any action brought under 
paragraph (1) may be brought in— 
(i) a district court of the United 
States that meets applicable requirements 
relating to venue under section 1391 of 
title 28, United States Code; or 
(ii) a State court of competent juris-
diction. 
(B) SERVICE OF PROCESS.—In an action 
brought under paragraph (1) in a district court 
of the United States, process may be served 
wherever the defendant— 
(i) is an inhabitant; or 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(ii) may be found. 
SEC. 206. STATE PRIVACY PROTECTIONS. 
Nothing in this title shall preempt any State law, reg-
ulation, or other requirement having the force or effect 
of law that is more protective of the privacy of individuals 
than the requirements of this title. 
SEC. 207. SEVERABILITY. 
If any provision of this title or the application of a 
provision of this title to any person or circumstance is held 
to be invalid or unconstitutional, the remainder of this 
title, or the application of such provision to any other per-
son or circumstance, shall not be affected. 
SEC. 208. DEFINITIONS. 
In this title: 
(1) AFFIRMATIVE EXPRESS CONSENT.— 
(A) IN GENERAL.—The term ‘‘affirmative 
express consent’’ means an affirmative act by 
an individual that clearly communicates the in-
dividual’s authorization for an act or practice, 
in response to a specific request that meets the 
requirements of subparagraph (B). 
(B) REQUEST
REQUIREMENTS.—The re-
quirements of this subparagraph with respect to 
a request from a covered entity to an individual 
are the following: 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(i) The request is provided to the indi-
vidual in a standalone disclosure. 
(ii) The request includes a description 
of each act or practice for which the indi-
vidual’s consent is sought and— 
(I) clearly distinguishes between 
an act or practice which is necessary 
to fulfill a request of the individual 
and an act or practice which is for an-
other purpose; and 
(II) is written in easy-to-under-
stand language and includes a promi-
nent heading that would enable a rea-
sonable individual to identify and un-
derstand the act or practice. 
(iii) The request clearly explains the 
individual’s applicable rights related to 
consent. 
(C) EXPRESS
CONSENT
REQUIRED.—A 
covered entity may not infer that an individual 
has provided affirmative express consent to an 
act or practice from the inaction of the indi-
vidual or the individual’s continued use of a 
service or product provided by the covered enti-
ty. 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(D) PRIOR CONSENT REQUIRED.—In the 
case of any requirement of this title for a cov-
ered entity to obtain affirmative express consent 
for an act or practice, the covered entity shall 
obtain such consent before engaging in the act 
or practice. 
(2) COLLECT; COLLECTION.—The terms ‘‘col-
lect’’ and ‘‘collection’’ mean, with respect to the cov-
ered data of an individual, buying, renting, gath-
ering, obtaining, receiving, accessing, or otherwise 
acquiring such data by any means, including by pas-
sively or actively observing the individual’s behavior. 
(3) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(4) CONNECTED
DEVICE.—The term ‘‘con-
nected device’’ means a physical object that— 
(A) is capable of connecting to the inter-
net, either directly or indirectly through a net-
work, to communicate information at the direc-
tion of an individual; and 
(B) has computer processing capabilities 
for collecting, sending, receiving, or analyzing 
data. 
(5) CONTROL.—The term ‘‘control’’ means, 
with respect to an entity— 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(A) ownership of, or the power to vote, 
more than 50 percent of the outstanding shares 
of any class of voting security of the entity; 
(B) control in any manner over the election 
of a majority of the directors of the entity (or 
of individuals exercising similar functions); or 
(C) the power to exercise a controlling in-
fluence over the management of the entity. 
(6) COVERED DATA.— 
(A) IN
GENERAL.—The term ‘‘covered 
data’’ means information that identifies or is 
linked or reasonably linkable to an individual or 
a connected device that is linked or reasonably 
linkable to an individual. 
(B) LINKED OR REASONABLY LINKABLE.— 
For purposes of subparagraph (A), information 
held by a covered entity is linked or reasonably 
linkable to an individual or a connected device 
if, as a practical matter, it can be used on its 
own or in combination with other information 
held by, or readily accessible to, the covered en-
tity to identify such individual or such device. 
(C) EXCLUSIONS.—Such term does not in-
clude— 
(i) aggregated data; 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(ii) de-identified data; 
(iii) data of an individual processed by 
the covered entity in the capacity of the 
covered entity as the employer of the indi-
vidual; or 
(iv) publicly available information. 
(7) COVERED ENTITY.—The term ‘‘covered en-
tity’’ means any person who— 
(A) collects, processes, or transfers covered 
data; and 
(B) determines the purposes and means of 
such collection, processing, or transfer. 
(8) COVERED INTERNET PLATFORM.— 
(A) IN
GENERAL.—The term ‘‘covered 
internet platform’’ means any public-facing 
website, internet application, or mobile applica-
tion, including a social network site, video shar-
ing service, search engine, or content aggrega-
tion service. 
(B) EXCLUSION.—Such term does not in-
clude a platform that is operated for the sole 
purpose of conducting research that is not con-
ducted for profit, either directly or indirectly. 
(9) DNT SIGNAL.—The term ‘‘DNT signal’’ 
means a signal sent by a connected device, such as 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
the hypertext transfer protocol developed by the 
World Wide Web Consortium Working Group on 
Tracking Preference Expression, that is designated 
by the Commission for purposes of the Do Not 
Track program required under section 202(b). 
(10) EXECUTIVE AGENCY.—The term ‘‘Execu-
tive agency’’ has the meaning given such term in 
section 105 of title 5, United States Code. 
(11) 
INDIVIDUAL.—The 
term 
‘‘individual’’ 
means a natural person residing in the United 
States, however identified, including by any unique 
identifier. 
(12) PROCESS.—The term ‘‘process’’ means to 
perform any operation or set of operations on cov-
ered data, including collection, analysis, organiza-
tion, structuring, retaining, using, transferring, or 
otherwise handling covered data. 
(13) PROGRAM.—The term ‘‘program’’ means, 
with respect to a covered internet platform, any pro-
gram that appears on the platform, including a pro-
gram that delivers advertisements to users of the 
platform and a program used to log into the plat-
form. 
(14) PUBLICLY
AVAILABLE
INFORMATION.— 
The term ‘‘publicly available information’’ means in-
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
formation that is available to the general public, in-
cluding— 
(A) any information to which the source 
allows access by anyone upon request; and 
(B) any information that a covered entity 
has a reasonable basis to believe is lawfully 
made available to the general public from Fed-
eral, State, or local government records, widely 
distributed media, or disclosures to the general 
public that are required to be made by Federal, 
State, or local law. 
(15) RESEARCH.—The term ‘‘research’’ means 
the scientific analysis of information, including cov-
ered data, by a covered entity or those with whom 
the covered entity is cooperating or others acting at 
the direction or on behalf of the covered entity, that 
is conducted for the primary purpose of advancing 
scientific knowledge and may be for the commercial 
benefit of the covered entity. 
(16) SECOND-PARTY
OPERATOR.—The term 
‘‘second-party operator’’ means the operator of a 
covered internet platform with which a user intends 
to connect, but does not include the operator of a 
program that appears on the platform (if the oper-
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
ator of the program is different from the operator 
of the platform). 
(17) SERVICE PROVIDER.—The term ‘‘service 
provider’’ means, with respect to a set of covered 
data, a covered entity that collects, processes, or 
transfers such covered data for the purpose of per-
forming one or more services or functions on behalf 
of, and at the direction of, another covered entity 
that— 
(A) is not related to the covered entity pro-
viding the service or function by common own-
ership or corporate control; and 
(B) does not share common branding with 
the covered entity providing the service or func-
tion. 
(18) STATE.—The term ‘‘State’’ means each 
State of the United States, the District of Columbia, 
each commonwealth, territory, or possession of the 
United States, and each federally recognized Indian 
Tribe. 
(19) TARGETED ADVERTISING.— 
(A) IN GENERAL.—The term ‘‘targeted ad-
vertising’’ means a form of advertising in which 
advertisements are displayed to a user based on 
the user’s traits, information from a profile 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
about the user that is created for the purpose 
of selling advertisements, or the user’s previous 
online or offline behavior. 
(B) LIMITATION.—Such term does not in-
clude contextual advertising, including— 
(i) advertising that is directed to a 
user based on the content of the covered 
internet platform that the user is con-
nected to; or 
(ii) advertising that is directed to a 
user by the second-party operator of a cov-
ered internet platform, or by the third- 
party operator of a program that appears 
on the platform, based on the search terms 
that the user used to arrive at the plat-
form. 
(20) THIRD PARTY.—The term ‘‘third party’’ 
means with respect to a set of covered data, a cov-
ered entity— 
(A) that is not a service provider with re-
spect to such covered data; and 
(B) that received such covered data from 
another covered entity— 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6201
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS
(i) that is not related to the covered 
entity by common ownership or corporate 
control; and 
(ii) that does not share common 
branding with the covered entity. 
(21) 
THIRD-PARTY
OPERATOR.—The 
term 
‘‘third-party operator’’ means the operator of a pro-
gram that appears on a covered internet platform (if 
the operator of the program is different from the op-
erator of the platform). 
(22) TRANSFER.—The term ‘‘transfer’’ means, 
with respect to covered data, to disclose, release, 
share, disseminate, make available, or license such 
data, in writing, electronically, or by any other 
means, for consideration of any kind or for a com-
mercial purpose. 
SEC. 209. EFFECTIVE DATE. 
This title shall take effect on the date that is 6 
months after the date of the enactment of this Act. 
Æ 
VerDate Sep 11 2014 
22:48 Oct 04, 2021
Jkt 029200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6301
E:\BILLS\H5433.IH
H5433
kjohnson on DSK79L0C42PROD with BILLS