123 
Act or a regulation promulgated under this Act by a covered 
entity or service provider, the attorney general or State Pri-
vacy Authority may bring a civil action in the name of 
the State, or as parens patriae on behalf of the residents 
of the State. Any such action shall be brought exclusively 
in an appropriate Federal district court of the United 
States to— 
(1) enjoin such act or practice; 
(2) enforce compliance with this Act or such reg-
ulation; 
(3) obtain damages, civil penalties, restitution, 
or other compensation on behalf of the residents of 
such State; or 
(4) obtain reasonable attorneys’ fees and other 
litigation costs reasonably incurred. 
(b) RIGHTS OF THE COMMISSION.— 
(1) IN GENERAL.—Except as provided in para-
graph (2), the attorney general or State Privacy Au-
thority of a State shall notify the Commission in 
writing prior to initiating a civil action under sub-
section (a). Such notification shall include a copy of 
the complaint to be filed to initiate such action. Upon 
receiving such notification, the Commission may in-
tervene in such action as a matter of right pursuant 
to the Federal Rules of Civil Procedure. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00123
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
124 
(2) FEASIBILITY.—If the notification required by 
paragraph (1) is not feasible, the attorney general or 
State Privacy Authority shall notify the Commission 
immediately after initiating the civil action. 
(c) ACTIONS BY THE COMMISSION.—In any case in 
which a civil action is instituted by or on behalf of the Com-
mission for violation of this Act or a regulation promul-
gated under this Act, no attorney general or State Privacy 
Authority of a State may, during the pendency of such ac-
tion, institute a civil action against any defendant named 
in the complaint in the action instituted by or on behalf 
of the Commission for a violation of this Act or a regulation 
promulgated under this Act that is alleged in such com-
plaint, if such complaint alleges such violation affected the 
residents of such State or individuals nationwide. If the 
Commission brings a civil action against a covered entity 
or service provider for a violation of this Act or a regulation 
promulgated under this Act that affects the interests of the 
residents of a State, the attorney general or State Privacy 
Authority of such State may intervene in such action as 
a matter of right pursuant to the Federal Rules of Civil 
Procedure. 
(d) RULE OF CONSTRUCTION.—Nothing in this section 
may be construed to prevent the attorney general or State 
Privacy Authority of a State from exercising the powers 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00124
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
125 
conferred on the attorney general or State Privacy Author-
ity to conduct investigations, to administer oaths or affir-
mations, or to compel the attendance of witnesses or the 
production of documentary or other evidence. 
(e) PRESERVATION OF STATE POWERS.—Except as 
provided in subsection (c), nothing in this section may be 
construed as altering, limiting, or affecting the authority 
of the attorney general or State Privacy Authority of a 
State to— 
(1) bring an action or other regulatory pro-
ceeding arising solely under the law in effect in the 
State that is preempted by this Act or under another 
applicable Federal law; or 
(2) exercise the powers conferred on the attorney 
general or State Privacy Authority by the laws of the 
State, including the ability to conduct investigations, 
administer oaths or affirmations, or compel the at-
tendance of witnesses or the production of documen-
tary or other evidence. 
SEC. 403. ENFORCEMENT BY PERSONS. 
(a) ENFORCEMENT BY PERSONS.— 
(1) IN GENERAL.—Beginning on the date that is 
2 years after the date on which this Act takes effect, 
any person or class of persons for a violation of this 
Act or a regulation promulgated under this Act by a 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00125
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
126 
covered entity or service provider may bring a civil 
action against such entity in any Federal court of 
competent jurisdiction. 
(2) RELIEF.—In a civil action brought under 
paragraph (1) in which a plaintiff prevails, the court 
may award the plaintiff— 
(A) an amount equal to the sum of any 
compensatory damages; 
(B) injunctive relief; 
(C) declaratory relief; and 
(D) reasonable attorney’s fees and litigation 
costs. 
(3) RIGHTS OF THE COMMISSION AND STATE AT-
TORNEYS GENERAL.— 
(A) IN GENERAL.—Prior to a person bring-
ing a civil action under paragraph (1), such per-
son shall notify the Commission and the attorney 
general of the State where such person resides in 
writing that such person intends to bring a civil 
action under such paragraph. Upon receiving 
such notice, the Commission and State attorney 
general shall each or jointly make a determina-
tion and respond to such person not later than 
60 days after receiving such notice, as to whether 
they will intervene in such action pursuant to 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00126
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
127 
the Federal Rules of Civil Procedure. If a state 
attorney general does intervene, they shall only 
be heard with respect to the interests of the resi-
dents of their State 
(B) RETAINED AUTHORITY.—Subparagraph 
(A) may not be construed to limit the authority 
of the Commission or any applicable State attor-
ney general or State Privacy Authority to later 
commence a proceeding or civil action or inter-
vene by motion if the Commission or State attor-
ney general or State Privacy Authority does not 
commence a proceeding or civil action within the 
60-day period. 
(C) BAD FAITH.—Any written communica-
tion from counsel for an aggrieved party to a 
covered entity or service provider requesting a 
monetary payment from that covered entity or 
service provider regarding a specific claim de-
scribed in a letter sent pursuant to subsection 
(d), not including filings in court proceedings, 
arbitrations, mediations, judgment collection 
processes, or other communications related to 
previously initiated litigation or arbitrations, 
shall be considered to have been sent in bad faith 
and shall be unlawful as defined in this Act, if 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00127
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
128 
the written communication was sent prior to the 
date that is 60 days after either a State attorney 
general or the Commission has received the no-
tice required under subparagraph (A). 
(4) FTC STUDY.—Beginning on the date that is 
5 years after the date of enactment of this Act and 
every 5 years thereafter, the Commission’s Bureau of 
Economics and Bureau of Privacy shall assist the 
Commission in conducting a study to determine the 
economic impacts in the United States of demand let-
ters sent pursuant to this section and the scope of the 
rights of a person under this section to bring forth 
civil actions against covered entities and service pro-
viders. Such study shall include the following: 
(A) The impact on insurance rates in the 
United States. 
(B) The impact on the ability of covered en-
tities to offer new products or services. 
(C) The impact on the creation and growth 
of new startup companies, including new tech-
nology companies. 
(D) Any emerging risks, benefits, and long- 
term trends in relevant marketplaces, supply 
chains, and labor availability. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00128
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
129 
(E) The impact on reducing, preventing, or 
remediating harms to individuals, including 
from fraud, identity theft, spam, discrimination, 
defective products, and violations of rights. 
(F) The impact on the volume and severity 
of data security incidents, and the ability to re-
spond to data security incidents. 
(G) Other intangible direct and indirect 
costs and benefits to individuals. 
(5) REPORT TO CONGRESS.—Not later than 5 
years after the first day on which persons and classes 
of persons are able to bring civil actions under this 
subsection, and annually thereafter, the Commission 
shall submit to the Committee on Energy and Com-
merce of the House of Representatives and the Com-
mittee on Commerce, Science, and Transportation of 
the Senate a report that contains the results of the 
study conducted under paragraph (4). 
(b) ARBITRATION AGREEMENTS
AND PRE-DISPUTE 
JOINT ACTION WAIVERS.— 
(1) PRE-DISPUTE ARBITRATION AGREEMENTS.— 
(A) Notwithstanding any other provision of 
law, no pre-dispute arbitration agreement with 
respect to an individual under the age of 18 is 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00129
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
130 
enforceable with regard to a dispute arising 
under this Act. 
(B) Notwithstanding any other provision of 
law, no pre-dispute arbitration agreement is en-
forceable with regard to a dispute arising under 
this Act concerning a claim related to gender or 
partner-based violence or physical harm. 
(2) PRE-DISPUTE JOINT-ACTION WAIVERS.—Not-
withstanding any other provision of law, no pre-dis-
pute joint-action waiver with respect to an individual 
under the age of 18 is enforceable with regard to a 
dispute arising under this Act. 
(3) DEFINITIONS.—For purposes of this sub-
section: 
(A) PRE-DISPUTE
ARBITRATION
AGREE-
MENT.—The term ‘‘pre-dispute arbitration agree-
ment’’ means any agreement to arbitrate a dis-
pute that has not arisen at the time of the mak-
ing of the agreement. 
(B) PRE-DISPUTE JOINT-ACTION WAIVER.— 
The term ‘‘pre-dispute joint-action waiver’’ 
means an agreement, whether or not part of a 
pre-dispute arbitration agreement, that would 
prohibit or waive the right of 1 of the parties to 
the agreement to participate in a joint, class, or 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00130
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
131 
collective action in a judicial, arbitral, adminis-
trative, or other related forum, concerning a dis-
pute that has not yet arisen at the time of the 
making of the agreement. 
(c) RIGHT TO CURE.— 
(1) NOTICE.—Subject to paragraph (3), with re-
spect to a claim under this section for— 
(A) injunctive relief; or 
(B) an action against a covered entity or 
service provider that meets the requirements of 
section 209 of this Act, such claim may be 
brought by a person or class of persons if—prior 
to asserting such claim—the person or class or 
persons provides to the covered entity or service 
provider 45 days’ written notice identifying the 
specific provisions of this Act the person or class 
of persons alleges have been or are being violated. 
(2) EFFECT
OF
CURE.—Subject to paragraph 
(3), in the event a cure is possible, if within the 45 
days the covered entity or service provider dem-
onstrates to the court that it has cured the noticed 
violation or violations and provides the person or 
class of persons an express written statement that the 
violation or violations has been cured and that no 
further violations shall occur, a claim for injunctive 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00131
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
132 
relief shall not be permitted and may be reasonably 
dismissed. 
(3) RULE
OF
CONSTRUCTION.—The notice de-
scribed in paragraph (1) and the reasonable dismissal 
in paragraph (2) shall not apply more than once to 
any alleged underlying violation by the same covered 
entity. 
(d) DEMAND LETTER.—If a person or a identified 
members of a class of persons represented by counsel in re-
gard to an alleged violation or violations of the Act and 
has correspondence sent to a covered entity or service pro-
vider by counsel alleging a violation or violations of the 
provisions of this Act and requests a monetary payment, 
such correspondence shall include the following language: 
‘‘Please visit the website of the Federal Trade Commission 
for a general description of your rights under the American 
Data Privacy and Protection Act’’ followed by a hyperlink 
to the webpage of the Commission required under section 
201. If such correspondence does not include such language 
and hyperlink, a civil action brought under this section by 
such person or identified members of the class of persons 
represented by counsel may be dismissed without prejudice 
and shall not be reinstated until such person or persons has 
complied with this subsection. 
(e) APPLICABILITY.— 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00132
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
133 
(1) IN GENERAL.—This section shall only apply 
to a claim alleging a violation of section 102, 104, 
202, 203, 204, 205(a), 205(b), 206(b)(3)(C), 207(a), 
208(a), or 302, or a regulation promulgated under 
any such section. 
(2) EXCEPTION.—This section shall not apply to 
any claim against a covered entity that has less than 
$25,000,000 per year in revenue, collects, processes, or 
transfers the covered data of fewer than 50,000 indi-
viduals, and derives less than 50 percent of its rev-
enue from transferring covered data. 
SEC. 404. RELATIONSHIP TO FEDERAL AND STATE LAWS. 
(a) FEDERAL LAW PRESERVATION.— 
(1) IN GENERAL.—Nothing in this Act or a regu-
lation promulgated under this Act may be construed 
to limit— 
(A) the authority of the Commission, or any 
other Executive agency, under any other provi-
sion of law; 
(B) any requirement for a common carrier 
subject to section 64.2011 of title 47, Code of 
Federal Regulations (or any successor regula-
tion) regarding information security breaches; or 
(C) any other provision of Federal law, ex-
cept as otherwise provided in this Act. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00133
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
134 
(2) ANTITRUST SAVINGS CLAUSE.— 
(A) FULL APPLICATION OF THE ANTITRUST 
LAW.—Nothing in this Act may be construed to 
modify, impair or supersede the operation of the 
antitrust law or any other provision of law. 
(B) NO
IMMUNITY
FROM
THE
ANTITRUST 
LAW.—Nothing in the regulatory regime adopted 
by this Act shall be construed as operating to 
limit any law deterring anticompetitive conduct 
or diminishing the need for full application of 
the antitrust law. Nothing in this Act explicitly 
or implicitly precludes the application of the 
antitrust law. 
(C) DEFINITION OF ANTITRUST LAW.—For 
purposes of this section, the term antitrust law 
has the same meaning as in subsection (a) of the 
first section of the Clayton Act (15 U.S.C. 12), 
except that such term includes section 5 of the 
Federal Trade Commission Act (15 U.S.C. 45) to 
the extent that such section 5 applies to unfair 
methods of competition. 
(3) APPLICABILITY OF OTHER PRIVACY REQUIRE-
MENTS.—A covered entity that is required to comply 
with title V of the Gramm-Leach-Bliley Act (15 
U.S.C. 6801 et seq.), the Health Information Tech-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00134
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
135 
nology for Economic and Clinical Health Act (42 
U.S.C. 17931 et seq.), part C of title XI of the Social 
Security Act (42 U.S.C. 1320d et seq.), the Fair Cred-
it Reporting Act (15 U.S.C. 1681 et seq.), the Family 
Educational Rights and Privacy Act (20 U.S.C. 
1232g; part 99 of title 34, Code of Federal Regula-
tions) to the extent such covered entity is a school as 
defined in 20 U.S.C. 1232g(a)(3) or 34 C.F.R. 
99.1(a), section 444 of the General Education Provi-
sions Act (commonly known as the ‘‘Family Edu-
cational Rights and Privacy Act of 1974’’) (20 U.S.C. 
1232g) and part 99 of title 34, Code of Federal Regu-
lations (or any successor regulation), the Confiden-
tiality of Alcohol and Drug Abuse Patient Records at 
42 U.S.C. 290dd-2 and its implementing regulations 
at 42 CFR part 2, the Genetic Information Non-dis-
crimination Act (GINA), or the regulations promul-
gated pursuant to section 264(c) of the Health Insur-
ance Portability and Accountability Act of 1996 (42 
U.S.C. 1320d–2 note), and is in compliance with the 
data privacy requirements of such regulations, part, 
title, or Act (as applicable), shall be deemed to be in 
compliance with the related requirements of this Act, 
except for section 208, solely and exclusively with re-
spect to data subject to the requirements of such regu-
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00135
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
136 
lations, part, title, or Act. Not later than 1 year after 
the date of enactment of this Act, the Commission 
shall issue guidance describing the implementation of 
this paragraph. 
(4) APPLICABILITY OF OTHER DATA SECURITY 
REQUIREMENTS.—A covered entity that is required to 
comply with title V of the Gramm-Leach-Bliley Act 
(15 U.S.C. 6801 et seq.), the Health Information 
Technology for Economic and Clinical Health Act (42 
U.S.C. 17931 et seq.), part C of title XI of the Social 
Security Act (42 U.S.C. 1320d et seq.), or the regula-
tions promulgated pursuant to section 264(c) of the 
Health Insurance Portability and Accountability Act 
of 1996 (42 U.S.C. 1320d–2 note), and is in compli-
ance with the information security requirements of 
such regulations, part, title, or Act (as applicable), 
shall be deemed to be in compliance with the require-
ments of section 208, solely and exclusively with re-
spect to data subject to the requirements of such regu-
lations, part, title, or Act. Not later than 1 year after 
the date of enactment of this Act, the Commission 
shall issue guidance describing the implementation of 
this paragraph. 
(b) PREEMPTION OF STATE LAWS.— 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00136
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
137 
(1) IN GENERAL.—No State or political subdivi-
sion of a State may adopt, maintain, enforce, pre-
scribe, or continue in effect any law, regulation, rule, 
standard, requirement, or other provision having the 
force and effect of law of any State, or political sub-
division of a State, covered by the provisions of this 
Act, or a rule, regulation, or requirement promul-
gated under this Act. 
(2) STATE LAW PRESERVATION.—Paragraph (1) 
may not be construed to preempt, displace, or sup-
plant the following State laws, rules, regulations, or 
requirements: 
(A) Consumer protection laws of general ap-
plicability, such as laws regulating deceptive, 
unfair, or unconscionable practices, except that 
the fact of a violation of this Act or a regulation 
promulgated under this Act may not be pleaded 
as an element of any violation of such a law. 
(B) Civil rights laws. 
(C) Provisions of laws, in so far as, that 
govern the privacy rights or other protections of 
employees, employee information, students, or 
student information. 
(D) Laws that address notification require-
ments in the event of a data breach. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00137
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
138 
(E) Contract or tort law. 
(F) Criminal laws. 
(G) Civil laws governing fraud, theft (in-
cluding identity theft), unauthorized access to in-
formation or electronic devices, unauthorized use 
of information, malicious behavior, or similar 
provisions of law. 
(H) Civil laws regarding cyberstalking, 
cyberbullying, nonconsensual pornography, sex-
ual harassment, child abuse material, child por-
nography, child abduction or attempted child ab-
duction, coercion or enticement of a child for sex-
ual activity, or child sex trafficking. 
(I) Public safety or sector specific laws un-
related to privacy or security. 
(J) Provisions of law, insofar as such provi-
sions address public records, criminal justice in-
formation systems, arrest records, mug shots, 
conviction records, or non-conviction records. 
(K) Provisions of law, insofar as such pro-
visions 
address 
banking 
records, 
financial 
records, tax records, Social Security numbers, 
credit cards, consumer and credit reporting and 
investigations, credit repair, credit clinics, or 
check-cashing services. 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00138
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS
139 
(L) Provisions of law, insofar as such provi-
sions address facial recognition or facial recogni-
tion technologies, electronic surveillance, wire-
tapping, or telephone monitoring. 
(M) The Biometric Information Privacy Act 
(740 ICLS 14 et seq.) and the Genetic Informa-
tion Privacy Act (410 ILCS 513 et seq.). 
(N) Provisions of laws, in so far as, such 
provisions to address unsolicited email or text 
messages, telephone solicitation, or caller identi-
fication. 
(O) Provisions of laws, in so far as, such 
provisions address health information, medical 
information, medical records, HIV status, or 
HIV testing. 
(P) Provisions of laws, in so far as, such 
provisions pertain to public health activities, re-
porting, data, or services. 
(Q) Provisions of law, insofar as such pro-
visions address the confidentiality of library 
records. 
(R) Section 1798.150 of the California Civil 
Code (as amended on November 3, 2020 by ini-
tiative Proposition 24, Section 16). 
VerDate Sep 11 2014 
01:59 Dec 31, 2022
Jkt 039200
PO 00000
Frm 00139
Fmt 6652
Sfmt 6203
E:\BILLS\H8152.RH
H8152
kjohnson on DSK79L0C42PROD with BILLS