functions with respect to a protected computer are as fol-
lows:
(1) DISABLING
FUNCTION.—With respect to
any information collection program, a function of
the program that allows a user of the program to re-
move the program or disable operation of the pro-
gram with respect to such protected computer by a
function that—
(A) is easily identifiable to a user of the
computer; and
(B) can be performed without undue effort
or knowledge by the user of the protected com-
puter.
(2) IDENTITY FUNCTION.—
(A) IN GENERAL.—With respect only to an
information collection program that uses infor-
mation collected in the manner described in
subparagraph (A)(ii)(II) or (B)(ii) of subsection
(b)(1) and subject to subparagraph (B) of this
paragraph, a function of the program that pro-
vides that each display of an advertisement di-
rected or displayed using such information,
when the owner or authorized user is accessing
a Web page or online location other than of the
provider of the computer software, is accom-
panied by the name of the information collec-
tion program, a logogram or trademark used
for the exclusive purpose of identifying the pro-
gram, or a statement or other information suffi-
cient to clearly identify the program.
(B) EXEMPTION FOR EMBEDDED ADVER-
TISEMENTS.—The Commission shall, by regula-
tion, exempt from the applicability of subpara-
graph (A) the embedded display of any adver-
tisement on a Web page that contempora-
neously displays other information.
(3) RULEMAKING.—The Commission may issue
regulations to carry out this subsection.
(e) LIMITATION
ON LIABILITY.—A telecommuni-
cations carrier, a provider of information service or inter-
active computer service, a cable operator, or a provider
of transmission capability shall not be liable under this
section to the extent that the carrier, operator, or
provider—
(1) transmits, routes, hosts, stores, or provides
connections for an information collection program
through a system or network controlled or operated
by or for the carrier, operator, or provider; or
(2) provides an information location tool, such
as a directory, index, reference, pointer, or hypertext
link, through which the owner or user of a protected
computer locates an information collection program.
SEC. 4. ENFORCEMENT.
(a) UNFAIR OR DECEPTIVE ACT OR PRACTICE.—
This Act shall be enforced by the Commission under the
Federal Trade Commission Act (15 U.S.C. 41 et seq.).
A violation of any provision of this Act or of a regulation
issued under this Act shall be treated as an unfair or de-
ceptive act or practice violating a rule promulgated under
section 18 of the Federal Trade Commission Act (15
U.S.C. 57a).
(b) PENALTY FOR PATTERN OR PRACTICE VIOLA-
TIONS.—
(1) IN GENERAL.—Notwithstanding subsection
(a) and the Federal Trade Commission Act, in the
case of a person who engages in a pattern or prac-
tice that violates section 2 or 3, the Commission
may, in its discretion, seek a civil penalty for such
pattern or practice of violations in an amount, as de-
termined by the Commission, of not more than—
(A) $3,000,000 for each violation of sec-
tion 2; and
(B) $1,000,000 for each violation of sec-
tion 3.
(2) TREATMENT OF SINGLE ACTION OR CON-
DUCT.—In applying paragraph (1)—
(A) any single action or conduct that vio-
lates section 2 or 3 with respect to multiple
protected computers shall be treated as a single
violation; and
(B) any single action or conduct that vio-
lates more than one paragraph of section 2(a)
shall be considered multiple violations, based on
the number of such paragraphs violated.
(c) REQUIRED SCIENTER.—Civil penalties sought
under this section for any action may not be granted by
the Commission or any court unless the Commission or
court, respectively, establishes that the action was com-
mitted with actual knowledge or knowledge fairly implied
on the basis of objective circumstances that such act is
unfair or deceptive or violates this Act.
(d) FACTORS IN AMOUNT OF PENALTY.—In deter-
mining the amount of any penalty pursuant to subsection
(a) or (b), the court shall take into account the degree
of culpability, any history of prior such conduct, ability
to pay, effect on ability to continue to do business, and
such other matters as justice may require.
(e) EXCLUSIVENESS OF REMEDIES.—The remedies
in this section (including remedies available to the Com-
mission under the Federal Trade Commission Act) are the
exclusive remedies for violations of this Act.
(f) EFFECTIVE DATE.—To the extent only that this
section applies to violations of section 2(a), this section
shall take effect upon the expiration of the 6-month period
that begins on the date of the enactment of this Act.
SEC. 5. LIMITATIONS.
(a) LAW ENFORCEMENT AUTHORITY.—Sections 2
and 3 shall not apply to—
(1) any act taken by a law enforcement agent
in the performance of official duties; or
(2) the transmission or execution of an infor-
mation collection program in compliance with a law
enforcement, investigatory, national security, or reg-
ulatory agency or department of the United States
or any State in response to a request or demand
made under authority granted to that agency or de-
partment, including a warrant issued under the Fed-
eral Rules of Criminal Procedure, an equivalent
State warrant, a court order, or other lawful proc-
ess.
(b) EXCEPTION RELATING TO SECURITY.—Nothing
in this Act shall apply to—
(1) any monitoring of, or interaction with, a
subscriber’s Internet or other network connection or
service, or a protected computer, by a telecommuni-
cations carrier, cable operator, computer hardware
or software provider, or provider of information serv-
ice or interactive computer service, to the extent that
such monitoring or interaction is for network or
computer security purposes, diagnostics, technical
support, or repair, or for the detection or prevention
of fraudulent activities; or
(2) a discrete interaction with a protected com-
puter by a provider of computer software solely to
determine whether the user of the computer is au-
thorized to use such software, that occurs upon—
(A) initialization of the software; or
(B) an affirmative request by the owner or
authorized user for an update of, addition to, or
technical service for, the software.
(c) GOOD SAMARITAN PROTECTION.—No provider of
computer software or of interactive computer service may
be held liable under this Act on account of any action vol-
untarily taken, or service provided, in good faith to remove
or disable a program used to violate section 2 or 3 that
is installed on a computer of a customer of such provider,
if such provider notifies the customer and obtains the con-
sent of the customer before undertaking such action or
providing such service.
(d) LIMITATION ON LIABILITY.—A manufacturer or
retailer of computer equipment shall not be liable under
this Act to the extent that the manufacturer or retailer
is providing third party branded computer software that
is installed on the equipment the manufacturer or retailer
is manufacturing or selling.
SEC. 6. EFFECT ON OTHER LAWS.
(a) PREEMPTION OF STATE LAW.—
(1) PREEMPTION
OF
SPYWARE
LAWS.—This
Act supersedes any provision of a statute, regula-
tion, or rule of a State or political subdivision of a
State that expressly regulates—
(A) unfair or deceptive conduct with re-
spect to computers similar to that described in
section 2(a);
(B) the transmission or execution of a
computer program similar to that described in
section 3; or
(C) the use of computer software that dis-
plays advertising content based on the Web
pages accessed using a computer.
(2) ADDITIONAL PREEMPTION.—
(A) IN GENERAL.—No person other than
the Attorney General of a State may bring a
civil action under the law of any State if such
action is premised in whole or in part upon the
defendant violating any provision of this Act.
(B) PROTECTION OF CONSUMER PROTEC-
TION LAWS.—This paragraph shall not be con-
strued to limit the enforcement of any State
consumer protection law by an Attorney Gen-
eral of a State.
(3) PROTECTION OF CERTAIN STATE LAWS.—
This Act shall not be construed to preempt the ap-
plicability of—
(A) State trespass, contract, or tort law; or
(B) other State laws to the extent that
those laws relate to acts of fraud.
(b) PRESERVATION OF FTC AUTHORITY.—Nothing
in this Act may be construed in any way to limit or affect
the Commission’s authority under any other provision of
law, including the authority to issue advisory opinions
(under part 1 of volume 16 of the Code of Federal Regula-
tions), policy statements, or guidance regarding this Act.
SEC. 7. ANNUAL FTC REPORT.
For the 12-month period that begins upon the effec-
tive date under section 12(a) and for each 12-month pe-
riod thereafter, the Commission shall submit a report to
the Congress that—
(1) specifies the number and types of actions
taken during such period to enforce section 2(a) and
section 3, the disposition of each such action, any
penalties levied in connection with such actions, and
any penalties collected in connection with such ac-
tions; and
(2) describes the administrative structure and
personnel and other resources committed by the
Commission for enforcement of this Act during such
period.
Each report under this subsection for a 12-month period
shall be submitted not later than 90 days after the expira-
tion of such period.
SEC. 8. FTC REPORT ON COOKIES.
(a) IN GENERAL.—Not later than the expiration of
the 6-month period that begins on the date of the enact-
ment of this Act, the Commission shall submit a report
to the Congress regarding the use of cookies, including
tracking cookies, in the delivery or display of advertising
to the owners and users of computers. The report shall
examine and describe the methods by which cookies and
the Web sites that place them on computers function sepa-
rately and together, and shall compare the use of cookies
with the use of information collection programs (as such
term is defined in section 3) to determine the extent to
which such uses are similar or different. The report may
include such recommendations as the Commission con-
siders necessary and appropriate, including treatment of
cookies under this Act or other laws.
(b) DEFINITION.—For purposes of this section, the
term ‘‘tracking cookie’’ means a cookie or similar text or
data file used alone or in conjunction with one or more
Web sites to transmit or convey, to a party other than
the intended recipient, personally identifiable information
of a computer owner or user, information regarding Web
pages accessed by the owner or user, or information re-
garding advertisements previously delivered to a computer,
for the purpose of—
(1) delivering or displaying advertising to the
owner or user; or
(2) assisting the intended recipient to deliver or
display advertising to the owner, user, or others.
(c) EFFECTIVE DATE.—This section shall take effect
on the date of the enactment of this Act.
SEC. 9. FTC REPORT ON INFORMATION COLLECTION PRO-
GRAMS 
INSTALLED 
BEFORE 
EFFECTIVE
DATE.
Not later than the expiration of the 6-month period
that begins on the date of the enactment of this Act, the
Commission shall submit a report to the Congress on the
extent to which there are installed on protected computers
information collection programs that, but for installation
prior to the effective date under section 12(a), would be
subject to the requirements of section 3. The report shall
include recommendations regarding the means of afford-
ing computer users affected by such information collection
programs the protections of section 3, including rec-
ommendations regarding requiring a one-time notice and
consent by the owner or authorized user of a computer
to the continued collection of information by such a pro-
gram so installed on the computer.
SEC. 10. REGULATIONS.
(a) IN GENERAL.—The Commission shall issue the
regulations required by this Act not later than the expira-
tion of the 6-month period beginning on the date of the
enactment of this Act. In exercising its authority to issue
any regulation under this Act, the Commission shall deter-
mine that the regulation is consistent with the public in-
terest and the purposes of this Act. Any regulations issued
pursuant to this Act shall be issued in accordance with
section 553 of title 5, United States Code.
(b) EFFECTIVE DATE.—This section shall take effect
on the date of the enactment of this Act.
SEC. 11. DEFINITIONS.
For purposes of this Act:
(1) CABLE OPERATOR.—The term ‘‘cable oper-
ator’’ has the meaning given such term in section
602 of the Communications Act of 1934 (47 U.S.C.
522).
(2) COLLECT.—The term ‘‘collect’’, when used
with respect to information and for purposes only of
section 3(b)(1)(A), does not include obtaining of the
information by a party who is intended by the owner
or authorized user of a protected computer to receive
the information or by a third party authorized by
such intended recipient to receive the information,
pursuant to the owner or authorized user—
(A) transferring the information to such
intended recipient using the protected com-
puter; or
(B) storing the information on the pro-
tected computer in a manner so that it is acces-
sible by such intended recipient.
(3) COMPUTER; PROTECTED COMPUTER.—The
terms ‘‘computer’’ and ‘‘protected computer’’ have
the meanings given such terms in section 1030(e) of
title 18, United States Code.
(4) COMPUTER SOFTWARE.—
(A) IN GENERAL.—Except as provided in
subparagraph (B), the term ‘‘computer soft-
ware’’ means a set of statements or instructions
that can be installed and executed on a com-
puter for the purpose of bringing about a cer-
tain result.
(B) EXCEPTION.—Such term does not in-
clude computer software that is placed on the
computer system of a user by an Internet serv-
ice provider, interactive computer service, or
Internet Web site solely to enable the user sub-
sequently to use such provider or service or to
access such Web site.
(C) RULE OF CONSTRUCTION REGARDING
COOKIES.—This paragraph may not be con-
strued to include, as computer software—
(i) a cookie; or
(ii) any other type of text or data file
that solely may be read or transferred by
a computer.
(5) COMMISSION.—The term ‘‘Commission’’
means the Federal Trade Commission.
(6) DAMAGE.—The term ‘‘damage’’ has the
meaning given such term in section 1030(e) of title
18, United States Code.
(7) DECEPTIVE
ACTS
OR
PRACTICES.—The
term ‘‘deceptive acts or practices’’ has the meaning
applicable to such term for purposes of section 5 of
the Federal Trade Commission Act (15 U.S.C. 45).
(8) DISABLE.—The term ‘‘disable’’ means, with
respect to an information collection program, to per-
manently prevent such program from executing any
of the functions described in section 3(b)(1) that
such program is otherwise capable of executing (in-
cluding by removing, deleting, or disabling the pro-
gram), unless the owner or operator of a protected
computer takes a subsequent affirmative action to
enable the execution of such functions.
(9) INFORMATION COLLECTION FUNCTIONS.—
The term ‘‘information collection functions’’ means,
with respect to an information collection program,
the functions of the program described in subsection
(b)(1) of section 3.
(10) INFORMATION SERVICE.—The term ‘‘infor-
mation service’’ has the meaning given such term in
section 3 of the Communications Act of 1934 (47
U.S.C. 153).
(11) INTERACTIVE
COMPUTER
SERVICE.—The
term ‘‘interactive computer service’’ has the meaning
given such term in section 230(f) of the Communica-
tions Act of 1934 (47 U.S.C. 230(f)).
(12) INTERNET.—The term ‘‘Internet’’ means
collectively the myriad of computer and tele-
communications facilities, including equipment and
operating software, which comprise the inter-
connected world-wide network of networks that em-
ploy the Transmission Control Protocol/Internet
Protocol, or any predecessor or successor protocols
to such protocol, to communicate information of all
kinds by wire or radio.
(13) PERSONALLY
IDENTIFIABLE
INFORMA-
TION.—
(A) IN GENERAL.—The term ‘‘personally
identifiable information’’ means the following
information, to the extent only that such infor-
mation allows a living individual to be identified
from that information:
(i) First and last name of an indi-
vidual.
(ii) A home or other physical address
of an individual, including street name,
name of a city or town, and zip code.
(iii) An electronic mail address.
(iv) A telephone number.
(v) A social security number, tax iden-
tification number, passport number, driv-
er’s license number, or any other govern-
ment-issued identification number.
(vi) A credit card number.
(vii) Any access code, password, or ac-
count number, other than an access code
or password transmitted by an owner or
authorized user of a protected computer to
the intended recipient to register for, or
log onto, a Web page or other Internet
service or a network connection or service
of a subscriber that is protected by an ac-
cess code or password.
(viii) Date of birth, birth certificate
number, or place of birth of an individual,
except in the case of a date of birth trans-
mitted or collected for the purpose of com-
pliance with the law.
(B) RULEMAKING.—The Commission may,
by regulation, add to the types of information
described in subparagraph (A) that shall be
considered personally identifiable information
for purposes of this Act, except that such addi-
tional types of information shall be considered
personally identifiable information only to the
extent that such information allows living indi-
viduals, particular computers, particular users
of computers, or particular email addresses or
other locations of computers to be identified
from that information.
(14) SUITE OF FUNCTIONALLY RELATED SOFT-
WARE.—The term suite of ‘‘functionally related soft-
ware’’ means a group of computer software pro-
grams distributed to an end user by a single pro-
vider, which programs are necessary to enable fea-
tures or functionalities of an integrated service of-
fered by the provider.
(15) 
TELECOMMUNICATIONS
CARRIER.—The
term ‘‘telecommunications carrier’’ has the meaning
given such term in section 3 of the Communications
Act of 1934 (47 U.S.C. 153).
(16) TRANSMIT.—The term ‘‘transmit’’ means,
with respect to an information collection program,
transmission by any means.
(17) WEB PAGE.—The term ‘‘Web page’’ means
a location, with respect to the World Wide Web, that
has a single Uniform Resource Locator or another
single location with respect to the Internet, as the
Federal Trade Commission may prescribe.
(18) WEB SITE.—The term ‘‘web site’’ means a
collection of Web pages that are presented and made
available by means of the World Wide Web as a sin-
gle Web site (or a single Web page so presented and
made available), which Web pages have any of the
following characteristics:
(A) A common domain name.
(B) Common ownership, management, or
registration.
SEC. 12. APPLICABILITY AND SUNSET.
(a) EFFECTIVE DATE.—Except as specifically pro-
vided otherwise in this Act, this Act shall take effect upon
the expiration of the 12-month period that begins on the
date of the enactment of this Act.
(b) APPLICABILITY.—Section 3 shall not apply to an
information collection program installed on a protected
computer before the effective date under subsection (a) of
this section.
(c) SUNSET.—This Act shall not apply after Decem-
ber 31, 2011.
Passed the House of Representatives May 23, 2005.
Attest:
Clerk.