I 
118TH CONGRESS 
2D SESSION 
H. R. 8818 
To provide Americans with foundational data privacy rights, create strong 
oversight mechanisms, and establish meaningful enforcement, and for 
other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 25, 2024 
Mrs. RODGERS of Washington (for herself, Mr. PALLONE, Mr. BILIRAKIS, and 
Ms. SCHAKOWSKY) introduced the following bill; which was referred to 
the Committee on Energy and Commerce 
A BILL 
To provide Americans with foundational data privacy rights, 
create strong oversight mechanisms, and establish mean-
ingful enforcement, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘American Privacy Rights Act of 2024’’. 
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
TITLE I—AMERICAN PRIVACY RIGHTS 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6211
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
Sec. 101. Definitions. 
Sec. 102. Data minimization. 
Sec. 103. Privacy by design. 
Sec. 104. Transparency. 
Sec. 105. Individual control over covered data. 
Sec. 106. Opt-out rights and universal mechanisms. 
Sec. 107. Interference with consumer rights. 
Sec. 108. Prohibition on denial of service and waiver of rights. 
Sec. 109. Data security and protection of covered data. 
Sec. 110. Executive responsibility. 
Sec. 111. Service providers and third parties. 
Sec. 112. Data brokers. 
Sec. 113. Commission-approved compliance guidelines. 
Sec. 114. Privacy-enhancing technology pilot program. 
Sec. 115. Enforcement by Federal Trade Commission. 
Sec. 116. Enforcement by States. 
Sec. 117. Enforcement by persons. 
Sec. 118. Relation to other laws. 
Sec. 119. Children’s Online Privacy Protection Act of 1998. 
Sec. 120. Data protections for covered minors. 
Sec. 121. Termination of FTC rulemaking on commercial surveillance and data 
security. 
Sec. 122. Severability. 
Sec. 123. Innovation rulemakings. 
Sec. 124. Effective date. 
TITLE II—CHILDREN’S ONLINE PRIVACY PROTECTION ACT 2.0 
Sec. 201. Short title. 
Sec. 202. Online collection, use, disclosure, and deletion of personal information 
of children. 
Sec. 203. Study and reports on mobile and online application oversight and en-
forcement. 
Sec. 204. Severability. 
TITLE I—AMERICAN PRIVACY 
RIGHTS 
SEC. 101. DEFINITIONS. 
In this title: 
(1) AFFIRMATIVE EXPRESS CONSENT.— 
(A) IN GENERAL.—The term ‘‘affirmative 
express consent’’ means an affirmative act by 
an individual that— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(i) clearly communicates the author-
ization of the individual for an act or prac-
tice; and 
(ii) is provided in response to a spe-
cific request from a covered entity, or a 
service provider on behalf of a covered en-
tity, that meets the requirements of sub-
paragraph (B). 
(B) REQUEST
REQUIREMENTS.—The re-
quirements of this subparagraph with respect to 
a request are the following: 
(i) The request is provided to the indi-
vidual in a clear and conspicuous stand-
alone disclosure. 
(ii) The request includes a description 
of each act or practice for which the con-
sent of the individual is sought and— 
(I) clearly distinguishes between 
an act or practice that is necessary, 
proportionate, and limited to fulfill a 
request of the individual and an act or 
practice that is for another purpose; 
(II) clearly states the specific 
categories of covered data that the 
covered entity shall collect, process, 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
retain, or transfer under each such 
act or practice; and 
(III) is written in easy-to-under-
stand language and includes a promi-
nent heading that would enable a rea-
sonable individual to identify and un-
derstand each such act or practice. 
(iii) The request clearly explains the 
applicable rights of the individual related 
to consent. 
(iv) The request is made in a manner 
reasonably accessible to and usable by indi-
viduals living with disabilities. 
(v) The request is made available to 
the individual in the language in which the 
covered entity provides a product or service 
for which authorization is sought. 
(vi) The option to refuse consent is at 
least as prominent as the option to provide 
consent, and the option to refuse consent 
takes no more than 1 additional step as 
compared to the number of steps necessary 
to provide consent. 
(vii) With respect to affirmative ex-
press consent sought for the collection, 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
processing, retention, or transfer of bio-
metric information or genetic information, 
the request includes the length of time the 
covered entity or service provider intends 
to retain the biometric information or ge-
netic information or, if it is not possible to 
identify the length of time, the criteria 
used to determine the length of time the 
covered entity or service provider intends 
to retain the biometric information or ge-
netic information. 
(C) EXPRESS
CONSENT
REQUIRED.—Af-
firmative express consent to an act or practice 
may not be inferred from the inaction of an in-
dividual or the continued use by an individual 
of a service or product provided by an entity. 
(D) WITHDRAWAL
OF
AFFIRMATIVE
EX-
PRESS CONSENT.— 
(i) IN
GENERAL.—A covered entity 
shall provide an individual with a means to 
withdraw affirmative express consent pre-
viously provided by the individual. 
(ii) REQUIREMENTS.—The means to 
withdraw affirmative express consent de-
scribed in clause (i) shall be— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(I) clear and conspicuous; and 
(II) as easy for a reasonable indi-
vidual to use as the mechanism by 
which the individual provided affirma-
tive express consent. 
(E) CHILDREN AND TEENS.—If a covered 
entity has knowledge that— 
(i) an individual is a child, only a par-
ent of the child may provide affirmative ex-
press consent on behalf of the child; or 
(ii) an individual is a teen, a parent or 
the teen may provide affirmative express 
consent on behalf of the teen. 
(2) BIOMETRIC INFORMATION.— 
(A) IN
GENERAL.—The term ‘‘biometric 
information’’ means any covered data that al-
lows or confirms the unique identification or 
verification of an individual and is generated 
from the measurement or processing of unique 
biological, physical, or physiological characteris-
tics, including— 
(i) fingerprints; 
(ii) voice prints; 
(iii) iris or retina imagery scans; 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(iv) facial or hand mapping, geometry, 
or templates; and 
(v) gait. 
(B) EXCLUSION.—The term ‘‘biometric in-
formation’’ does not include— 
(i) a digital or physical photograph; 
(ii) an audio or video recording; or 
(iii) data derived from a digital or 
physical photograph or an audio or video 
recording that cannot be used to identify 
or authenticate a specific individual. 
(3) CHILD.—The term ‘‘child’’ means an indi-
vidual under the age of 13. 
(4) CLEAR
AND
CONSPICUOUS.—The term 
‘‘clear and conspicuous’’ means, with respect to a 
disclosure, that the disclosure is difficult to miss and 
easily understandable by ordinary consumers. 
(5) COARSE GEOLOCATION INFORMATION.—The 
term ‘‘coarse geolocation information’’ means infor-
mation that reveals the present physical location of 
an individual or device identified by a unique per-
sistent identifier at the ZIP Code attribution level 
(except, if a geographic area attributed to a ZIP 
Code is equal to or less than the area of a circle 
with a radius of 1,850 feet or less, at a level greater 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
than a geographic area equal to the area of a circle 
with a radius of 1,850 feet). 
(6) COLLECT.—The term ‘‘collect’’ means, with 
respect to covered data, to buy, rent, gather, obtain, 
receive, access, or otherwise acquire the covered data 
by any means. 
(7) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(8) COMMON BRANDING.—The term ‘‘common 
branding’’ means a name, service mark, or trade-
mark that is shared by 2 or more entities. 
(9) CONNECTED
DEVICE.—The term ‘‘con-
nected device’’ means a device that is capable of con-
necting to the internet. 
(10) CONTEXTUAL
ADVERTISING.—The term 
‘‘contextual advertising’’ means displaying or pre-
senting an advertisement that— 
(A) does not vary based on the identity of 
the individual recipient; and 
(B) is based solely on— 
(i) the content of a webpage or online 
service; 
(ii) a specific request of the individual 
for information or feedback; or 
(iii) coarse geolocation information. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(11) CONTROL.—The term ‘‘control’’ means, 
with respect to an entity— 
(A) ownership of, or the power to vote, 
more than 50 percent of the outstanding shares 
of any class of voting security of the entity; 
(B) control over the election of a majority 
of the directors of the entity (or of individuals 
exercising similar functions); or 
(C) the power to exercise a controlling in-
fluence over the management of the entity. 
(12) COVERED DATA.— 
(A) IN
GENERAL.—The term ‘‘covered 
data’’ means information that identifies or is 
linked or reasonably linkable, alone or in com-
bination with other information, to an indi-
vidual or a device that identifies or is linked or 
reasonably linkable to 1 or more individuals. 
(B) EXCLUSIONS.—The term ‘‘covered 
data’’ does not include— 
(i) de-identified data; 
(ii) employee information; 
(iii) publicly available information; 
(iv) inferences made exclusively from 
multiple independent sources of publicly 
available information, if such inferences— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(I) do not reveal information 
about an individual that meets the 
definition of the term ‘‘sensitive cov-
ered data’’ with respect to the indi-
vidual; and 
(II) are not combined with cov-
ered data; 
(v) information in the collection of a 
library, archive, or museum, if— 
(I) the collection is— 
(aa) open to the public or 
routinely made available to re-
searchers who are not affiliated 
with the library, archive, or mu-
seum; and 
(bb) composed of lawfully 
acquired materials with respect 
to which all licensing conditions 
are met; and 
(II) the library, archive, or mu-
seum has— 
(aa) a public service mission; 
and 
(bb) trained staff or volun-
teers to provide professional serv-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
ices normally associated with li-
braries, archives, or museums; or 
(vi) on-device data. 
(13) COVERED ENTITY.— 
(A) IN GENERAL.—The term ‘‘covered en-
tity’’ means any entity that, alone or jointly 
with others, determines the purposes and means 
of collecting, processing, retaining, or transfer-
ring covered data and— 
(i) is subject to the Federal Trade 
Commission Act (15 U.S.C. 41 et seq.); 
(ii) is a common carrier subject to 
title II of the Communications Act of 1934 
(47 U.S.C. 201 et seq.); or 
(iii) is an organization not organized 
to carry on business for its own profit or 
that of its members. 
(B) INCLUSION.—The term ‘‘covered enti-
ty’’ includes any entity that controls, is con-
trolled by, or is under common control with an-
other covered entity. 
(C) EXCLUSIONS.—The term ‘‘covered en-
tity’’ does not include— 
(i) a Federal, State, Tribal, or local 
government entity, such as a body, author-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
ity, board, bureau, commission, district, 
agency, or other political subdivision of the 
Federal Government or a State, Tribal, or 
local government; 
(ii) an entity that is collecting, proc-
essing, retaining, or transferring covered 
data on behalf of a Federal, State, Tribal, 
or local government entity, to the extent 
that such entity is acting as a service pro-
vider to the government entity; 
(iii) a small business; 
(iv) an individual acting at their own 
direction and in a non-commercial context; 
(v) the National Center for Missing 
and Exploited Children; or 
(vi) except with respect to require-
ments under section 109, a nonprofit orga-
nization whose primary mission is to pre-
vent, investigate, or deter fraud, to train 
anti-fraud professionals, or to educate the 
public about fraud, including insurance 
fraud, securities fraud, and financial fraud, 
to the extent the organization collects, 
processes, retains, or transfers covered 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
data in furtherance of such primary mis-
sion. 
(D) NONAPPLICATION
TO
SERVICE
PRO-
VIDERS.—An entity may not be considered to 
be a ‘‘covered entity’’ for the purposes of this 
title, insofar as the entity is acting as a service 
provider. 
(14) COVERED
HIGH-IMPACT
SOCIAL
MEDIA 
COMPANY.— 
(A) IN
GENERAL.—The term ‘‘covered 
high-impact social media company’’ means a 
covered entity that provides any internet-acces-
sible platform that— 
(i) generates $3,000,000,000 or more 
in global annual revenue, including the rev-
enue generated by any affiliate of such cov-
ered entity; 
(ii) has 300,000,000 or more global 
monthly active users for not fewer than 3 
of the preceding 12 months; and 
(iii) constitutes an online product or 
service that is primarily used by users to 
access or share user-generated content. 
(B) TREATMENT
OF
CERTAIN
SERVICES 
AND APPLICATIONS.—A service or application 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
may not be considered to constitute an online 
product or service described in subparagraph 
(A)(iii) solely on the basis of providing any of 
the following: 
(i) Email. 
(ii) Career or professional develop-
ment networking opportunities. 
(iii) Reviews of products, services, 
events, or destinations. 
(iv) A platform for use in a public or 
private school under the direction of the 
school. 
(v) File collaboration. 
(vi) Cloud storage. 
(vii) Closed video or audio commu-
nications services. 
(viii) A wireless messaging service, in-
cluding such a service provided through 
short messaging service or multimedia 
messaging service protocols, that is not a 
component of, or linked to, a platform of 
a covered high-impact social media com-
pany, if the predominant or exclusive func-
tion is direct messaging consisting of the 
transmission of text, photos, or videos that 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
are sent by electronic means, and if mes-
sages are transmitted from the sender to a 
recipient and are not posted within a plat-
form of a covered high-impact social media 
company or publicly. 
(15) COVERED
MINOR.—The term ‘‘covered 
minor’’ means an individual under the age of 17. 
(16) DARK PATTERNS.—The term ‘‘dark pat-
terns’’ means a user interface designed or manipu-
lated with the substantial effect of subverting or im-
pairing user autonomy, decision-making, or choice. 
(17) DATA BROKER.— 
(A) 
IN
GENERAL.—The 
term 
‘‘data 
broker’’ means a covered entity whose principal 
source of revenue is derived from processing or 
transferring covered data that the covered enti-
ty did not collect directly from the individuals 
linked or linkable to the covered data. 
(B) PRINCIPAL
SOURCE
OF
REVENUE.— 
For purposes of this paragraph, the term ‘‘prin-
cipal source of revenue’’ means, for the prior 
12-month period— 
(i) revenue that constitutes greater 
than 50 percent of all revenue of the cov-
ered entity during such period; or 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(ii) revenue obtained from processing 
and transferring the covered data of more 
than 5,000,000 individuals that the cov-
ered entity did not collect directly from the 
individuals linked or linkable to the cov-
ered data. 
(C) NON-APPLICATION
TO
SERVICE
PRO-
VIDERS.—The term ‘‘data broker’’ does not in-
clude an entity to the extent that such entity is 
acting as a service provider. 
(18) DE-IDENTIFIED DATA.— 
(A) IN GENERAL.—The term ‘‘de-identified 
data’’ means information that cannot reason-
ably be used to infer or derive the identity of 
an individual, and does not identify and is not 
linked or reasonably linkable to an individual or 
a device that identifies or is linked or reason-
ably linkable to an individual, regardless of 
whether the information is aggregated, if the 
relevant covered entity or service provider— 
(i) takes reasonable physical, adminis-
trative, and technical measures to ensure 
that the information cannot, at any point, 
be used to re-identify any individual or de-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
vice that identifies or is linked or reason-
ably linkable to an individual; 
(ii) publicly commits in a clear and 
conspicuous manner to— 
(I) process, retain, or transfer 
the information solely in a de-identi-
fied form without any reasonable 
means for re-identification; and 
(II) not attempt to re-identify the 
information with any individual or de-
vice that identifies or is linked or rea-
sonably linkable to an individual, ex-
cept as necessary, limited, and propor-
tionate to test the effectiveness of the 
measures described in clause (i); and 
(iii) contractually obligates any entity 
that receives the information from the cov-
ered entity or service provider to— 
(I) comply with clauses (i) and 
(ii) with respect to the information; 
and 
(II) require that such contractual 
obligations be included contractually 
in all subsequent instances in which 
the information may be received. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(B) HEALTH
INFORMATION.—The term 
‘‘de-identified data’’ includes health information 
(as defined in section 1171 of the Social Secu-
rity Act (42 U.S.C. 1320d)) that has been de- 
identified in accordance with section 164.514(b) 
of title 45, Code of Federal Regulations, except 
that if such information is subsequently pro-
vided to an entity that is not an entity subject 
to parts 160 and 164 of such title 45, such en-
tity shall comply with clauses (ii) and (iii) of 
subparagraph (A) for the information to be con-
sidered de-identified under this title. 
(19) DERIVED DATA.—The term ‘‘derived data’’ 
means covered data that is created by the derivation 
of information, data, assumptions, correlations, in-
ferences, predictions, or conclusions from facts, evi-
dence, or another source of information. 
(20) DEVICE.—The term ‘‘device’’ means any 
electronic equipment capable of collecting, proc-
essing, retaining, or transferring covered data that is 
used by 1 or more individuals, including a connected 
device or a portable connected device. 
(21) DIRECT MAIL TARGETED ADVERTISING.— 
The term ‘‘direct mail targeted advertising’’ means 
advertising or marketing using third-party data 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
through a direct communication with an individual 
via direct mail. 
(22) DISABILITY.—The term ‘‘disability’’ has 
the meaning given such term in section 3 of the 
Americans with Disabilities Act of 1990 (42 U.S.C. 
12102). 
(23) EMAIL
TARGETED
ADVERTISING.—The 
term ‘‘email targeted advertising’’ means advertising 
or marketing using third-party data through a direct 
communication with an individual via email. 
(24) EMPLOYEE.—The term ‘‘employee’’ means 
an individual who is an employee, director, officer, 
staff member, paid intern, individual working as an 
independent contractor (who is not a service pro-
vider), volunteer, or unpaid intern of an employer, 
regardless of whether such individual is paid, un-
paid, or engaged on a temporary basis. 
(25) EMPLOYEE
INFORMATION.—The term 
‘‘employee information’’ means information, includ-
ing biometric information or genetic information— 
(A) about an individual related to the 
course of employment or application for employ-
ment of the individual (including on a contract 
or temporary basis), if such information is col-
lected, retained, processed, or transferred by 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
the employer or the service provider of the em-
ployer solely for purposes necessary for the em-
ployment or application of the individual; 
(B) that is emergency contact information 
for an individual who is an employee or job ap-
plicant of an employer, if such information is 
collected, retained, processed, or transferred by 
the employer or the service provider of the em-
ployer solely for the purpose of having an emer-
gency contact for such individual on file; or 
(C) about an individual who is an employee 
or former employee of an employer, or a rel-
ative, dependent, or beneficiary of the employee 
or former employee, and collected, retained, 
processed, or transferred for the purpose of ad-
ministering benefits, including enrollment and 
disenrollment for benefits, to which the em-
ployee, former employee, relative, dependent, or 
beneficiary is entitled on the basis of the em-
ployment of the employee or former employee 
with the employer, if such information is col-
lected, retained, processed, or transferred by 
the employer or the service provider of the em-
ployer solely for the purpose of administering 
such benefits. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(26) ENTITY.—The term ‘‘entity’’ means an in-
dividual, a trust, a partnership, an association, an 
organization, a company, and a corporation. 
(27) EXECUTIVE AGENCY.—The term ‘‘Execu-
tive agency’’ has the meaning given such term in 
section 105 of title 5, United States Code. 
(28) 
FEDERATED
NONPROFIT
ORGANIZA-
TION.—The term ‘‘federated nonprofit organization’’ 
means a network or system of 2 or more entities, de-
scribed in section 501(c)(3) of the Internal Revenue 
Code of 1986 and exempt from taxation under sec-
tion 501(a) of such Code, that share common brand-
ing. 
(29) FIRST PARTY.—The term ‘‘first party’’— 
(A) means a consumer-facing covered enti-
ty with which a consumer intends and expects 
to interact; and 
(B) includes any entities with which the 
covered entity shares common branding. 
(30) FIRST-PARTY ADVERTISING.— 
(A) IN GENERAL.—The term ‘‘first-party 
advertising’’ means advertising or marketing by 
a first party using the first-party data of the 
first party and not other forms of covered data 
and carried out— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(i) through direct communications 
with an individual, such as direct mail, 
email (subject to the CAN-SPAM Act of 
2003 (15 U.S.C. 7701 et seq.) and the 
regulations promulgated under such Act), 
or text message communications (subject 
to section 227 of the Communications Act 
of 1934 (47 U.S.C. 227) and the regula-
tions promulgated under such section); or 
(ii) entirely— 
(I) in a physical location oper-
ated by the first party; 
(II) in the case of a first party 
that is not a covered high-impact so-
cial media company, on a website, on-
line service, online application, or mo-
bile application operated by the first 
party, through display or presentation 
of an online advertisement that pro-
motes a product or service (whether 
offered by the first party or not of-
fered by the first party) to an indi-
vidual or device identified by a unique 
persistent identifier, or group of indi-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
viduals or devices identified by unique 
persistent identifiers; or 
(III) in the case of a first party 
that is a covered high-impact social 
media company, on a website, online 
service, online application, or mobile 
application operated by the first 
party, through display or presentation 
of an online advertisement that pro-
motes a product or service offered by 
the first party to an individual or de-
vice identified by a unique persistent 
identifier, or group of individuals or 
devices identified by unique persistent 
identifiers. 
(B) EXCLUSION.—The term ‘‘first-party 
advertising’’ does not include contextual adver-
tising. 
(31) FIRST-PARTY
DATA.—The term ‘‘first- 
party data’’ means covered data collected directly 
from an individual by a first party, including based 
on a visit by the individual to or use by the indi-
vidual of a physical location, website, online service, 
online application, or mobile application operated by 
the first party. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(32) GENETIC INFORMATION.—The term ‘‘ge-
netic information’’ means any covered data, regard-
less of format, that concerns the genetic characteris-
tics of an identified or identifiable individual, includ-
ing— 
(A) raw sequence data that results from 
the sequencing of the complete, or a portion of, 
extracted deoxyribonucleic acid (DNA) of an in-
dividual; or 
(B) genotypic and phenotypic information 
that results from analyzing raw sequence data 
described in subparagraph (A). 
(33) 
HEALTH
INFORMATION.—The 
term 
‘‘health information’’ means information that de-
scribes or reveals the past, present, or future phys-
ical health, mental health, disability, diagnosis, or 
health condition, status, or treatment of an indi-
vidual, including the precise geolocation information 
of such treatment. 
(34) 
INDIVIDUAL.—The 
term 
‘‘individual’’ 
means a natural person residing in the United 
States. 
(35) KNOWLEDGE.— 
(A) IN GENERAL.—The term ‘‘knowledge’’ 
means, with respect to whether an individual is 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
a child, teen, or covered minor, actual knowl-
edge or knowledge fairly implied on the basis of 
objective circumstances. 
(B) RULE OF CONSTRUCTION.—For pur-
poses of enforcing this title or a regulation pro-
mulgated under this title, a determination as to 
whether a covered entity has knowledge fairly 
implied on the basis of objective circumstances 
that an individual is a child, teen, or covered 
minor shall rely on competent and reliable evi-
dence, taking into account the totality of the 
circumstances, including whether a reasonable 
and prudent person under the circumstances 
would have known that the individual is a child, 
teen, or covered minor. Nothing in this title, in-
cluding a determination described in the pre-
ceding sentence, may be construed to require a 
covered entity to— 
(i) affirmatively collect any covered 
data with respect to the age of a child, 
teen, or covered minor that the covered en-
tity is not already collecting in the normal 
course of business; or 
(ii) implement an age gating or age 
verification functionality. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(C) COMMISSION GUIDANCE.— 
(i) IN GENERAL.—Not later than 180 
days after the date of the enactment of 
this Act, the Commission shall issue guid-
ance to provide information, including best 
practices and examples, for covered entities 
to use in understanding whether a covered 
entity has knowledge fairly implied on the 
basis of objective circumstances that an in-
dividual is a child, teen, or covered minor. 
(ii) LIMITATION.—No guidance issued 
by the Commission under clause (i) confers 
any rights on any person, State, or local-
ity, or operates to bind the Commission or 
any person, State, or locality to the ap-
proach recommended in such guidance. 
Any enforcement action brought pursuant 
to this title by the Commission, or by the 
attorney general of a State, the chief con-
sumer protection officer of a State, or an 
officer or office of a State authorized to 
enforce privacy or data security laws appli-
cable to covered entities or service pro-
viders, shall allege a specific violation of a 
provision of this title, and the Commission 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
or the attorney general, chief consumer 
protection officer, or other authorized offi-
cer or office of the State, as applicable, 
may not base an enforcement action on, or 
as applicable execute a consent order based 
on, practices that are alleged to be incon-
sistent with any such guidance, unless the 
practices allegedly violate this title. 
(36) LARGE DATA HOLDER.— 
(A) IN GENERAL.—The term ‘‘large data 
holder’’ means a covered entity or service pro-
vider that, in the most recent calendar year, 
had an annual gross revenue of not less than 
$250,000,000 and, subject to subparagraph 
(B), collected, processed, retained, or trans-
ferred— 
(i) the covered data of— 
(I) more than 5,000,000 individ-
uals; 
(II) more than 15,000,000 port-
able connected devices that identify or 
are linked or reasonably linkable to 1 
or more individuals; or 
(III) more than 35,000,000 con-
nected devices that identify or are 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
linked or reasonable linkable to 1 or 
more individuals; or 
(ii) the sensitive covered data of— 
(I) more than 200,000 individ-
uals; 
(II) more than 300,000 portable 
connected devices that identify or are 
linked or reasonable linkable to 1 or 
more individuals; or 
(III) more than 700,000 con-
nected devices that identify or are 
linked or reasonably linkable to 1 or 
more individuals. 
(B) EXCLUSIONS.—For the purposes of 
subparagraph (A), a covered entity or service 
provider may not be considered a large data 
holder solely on the basis of collecting, proc-
essing, retaining, or transferring to a service 
provider— 
(i) personal mailing or email address-
es; 
(ii) personal telephone numbers; 
(iii) log-in information of an indi-
vidual or device to allow the individual or 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
device to log in to an account administered 
by the covered entity; or 
(iv) in the case of a covered entity 
that is a seller of goods or services (other 
than an entity that facilitates payment, 
such as a bank, credit card processor, mo-
bile payment system, or payment plat-
form), credit, debit, or mobile payment in-
formation necessary and used to initiate, 
render, bill for, finalize, complete, or other-
wise facilitate payments for such goods or 
services. 
(C) DEFINITION OF ANNUAL GROSS REV-
ENUE.—For the purposes of subparagraph (A), 
the term ‘‘annual gross revenue’’, with respect 
to a covered entity or service provider— 
(i) means the gross receipts the cov-
ered entity or service provider received, in 
whatever form from all sources, without 
subtracting any costs or expenses; and 
(ii) 
includes 
contributions, 
gifts, 
grants, dues or other assessments, income 
from investments, and proceeds from the 
sale of real or personal property. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(37) MARKET RESEARCH.—The term ‘‘market 
research’’ means the collection, processing, retention, 
or transfer of covered data, with affirmative express 
consent, that is necessary, proportionate, and limited 
to measure and analyze the market or market trends 
of products, services, advertising, or ideas, if the 
covered data is not— 
(A) integrated into any product or service; 
(B) otherwise used to contact any indi-
vidual or device of an individual; or 
(C) used for targeted advertising or to oth-
erwise market to any individual or device of an 
individual. 
(38) MATERIAL CHANGE.—The term ‘‘material 
change’’ means, with respect to treatment of covered 
data, a change by an entity that would likely affect 
the decision of an individual to engage with and pro-
vide covered data to the entity, including providing 
affirmative express consent for, or opting out of, the 
collection, processing, retention, or transfer of cov-
ered data pertaining to such individual. 
(39) MOBILE APPLICATION.—The term ‘‘mobile 
application’’— 
(A) means a software program that runs 
on the operating system of— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(i) a cellular telephone; 
(ii) a tablet computer; or 
(iii) a similar portable computing de-
vice that transmits data over a wireless 
connection; and 
(B) includes a service or application of-
fered via a connected device. 
(40) ON-DEVICE DATA.— 
(A) IN
GENERAL.—The term ‘‘on-device 
data’’ means data collected, retained, and proc-
essed solely on the device of an individual. 
(B) 
LIMITATION.—Data 
collected, 
re-
tained, and processed solely on the device of an 
individual may be considered ‘‘on-device data’’ 
only if— 
(i) such data is not transferred by a 
covered entity or service provider; 
(ii) the relevant covered entity clearly 
and conspicuously provides the device 
owner with controls that allow the owner 
to access, correct, delete, and export such 
data consistent with the rights provided 
with respect to covered data pursuant to 
section 105; 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(iii) the relevant covered entity pro-
vides easy-to-understand instructions on 
how the device owner can access such con-
trols; and 
(iv) the relevant covered entity estab-
lishes, implements, and maintains reason-
able data security practices, consistent 
with section 109, to protect— 
(I) the confidentiality, integrity, 
and availability of the on-device data; 
and 
(II) on device data against unau-
thorized access. 
(41) ONLINE
ACTIVITY
PROFILE.—The term 
‘‘online activity profile’’ means covered data that 
identifies the online activities of an individual (or a 
device linked or reasonably linkable to an individual) 
over time and across third-party websites, online 
services, online applications, or mobile applications 
that do not share common branding and that is col-
lected, processed, retained, or transferred for the 
purpose of evaluating, analyzing, or predicting the 
behaviors or characteristics of an individual. 
(42) ONLINE APPLICATION.—The term ‘‘online 
application’’— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(A) means an internet-connected software 
program; and 
(B) includes a service or application of-
fered via a connected device. 
(43) PARENT.—The term ‘‘parent’’ means a 
legal guardian. 
(44) PORTABLE
CONNECTED
DEVICE.—The 
term ‘‘portable connected device’’ means a portable 
device that is capable of connecting to the internet 
over a wireless connection, including a smartphone, 
tablet computer, laptop computer, smartwatch, or 
similar portable device. 
(45) PRECISE GEOLOCATION INFORMATION.— 
(A) IN
GENERAL.—The term ‘‘precise 
geolocation information’’ means information 
that reveals the past or present physical loca-
tion of an individual or device with sufficient 
precision to identify the location of such indi-
vidual or device within a geographic area that 
is equal to or less than the area of a circle with 
a radius of 1,850 feet or less. 
(B) 
EXCLUSIONS.—The 
term 
‘‘precise 
geolocation information’’ does not include infor-
mation derived solely from— 
(i) a digital or physical photograph; 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(ii) an audio or visual recording; or 
(iii) metadata associated with a digital 
or physical photograph or an audio or vis-
ual recording that cannot be linked to an 
individual. 
(46) PROCESS.—The term ‘‘process’’ means, 
with respect to covered data, any operation or set of 
operations performed on the covered data, including 
analyzing, organizing, structuring, using, modifying, 
or otherwise handling the covered data. 
(47) PUBLICLY AVAILABLE INFORMATION.— 
(A) IN
GENERAL.—The term ‘‘publicly 
available information’’ means any information 
that a covered entity has a reasonable basis to 
believe has been lawfully made available to the 
general public by— 
(i) Federal, State, or local government 
records, if the covered entity collects, proc-
esses, retains, and transfers such informa-
tion in accordance with any restrictions or 
terms of use placed on the information by 
the relevant government entity; 
(ii) widely distributed media; 
(iii) a website or online service made 
available to all members of the public, for 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
free or for a fee, including where all mem-
bers of the public can log in to the website 
or online service; or 
(iv) a disclosure to the general public 
that is required to be made by Federal, 
State, or local law. 
(B) CLARIFICATIONS; LIMITATIONS.— 
(i) AVAILABLE TO ALL MEMBERS OF 
THE PUBLIC.—For purposes of this para-
graph, information from a website or on-
line service is not available to all members 
of the public if the individual to whom the 
information pertains has restricted the in-
formation to a specific audience or main-
tained a default setting that restricts the 
information to a specific audience. 
(ii) BUSINESS
CONTACT
INFORMA-
TION.—The term ‘‘publicly available infor-
mation’’ includes business contact informa-
tion of an individual acting in a business 
or professional context that is made avail-
able on a website or online service made 
available to all members of the public, in-
cluding the name, position or title, busi-
ness telephone number, business email ad-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
dress, or business address of the indi-
vidual. 
(iii) OTHER LIMITATIONS.—The term 
‘‘publicly available information’’ does not 
include— 
(I) any obscene visual depiction 
(as such term is used in section 1460 
of title 18, United States Code); 
(II) derived data from publicly 
available information that reveals in-
formation about an individual that 
meets the definition of the term ‘‘sen-
sitive covered data’’; 
(III) biometric information; 
(IV) genetic information, unless 
made publicly available by the indi-
vidual to whom the information per-
tains by a means described in clause 
(ii) or (iii) of subparagraph (A); 
(V) covered data that is created 
through the combination of covered 
data with publicly available informa-
tion; 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(VI) intimate images, authentic 
or computer-generated, known to be 
nonconsensual; or 
(VII) sensitive covered data made 
available by a data broker. 
(48) RETAIN.—The term ‘‘retain’’ means, with 
respect to covered data, to store, maintain, save, or 
otherwise keep such data, regardless of format. 
(49) SENSITIVE COVERED DATA.— 
(A) IN
GENERAL.—The term ‘‘sensitive 
covered data’’ means the following forms of cov-
ered data: 
(i) A government-issued identifier, in-
cluding a Social Security number, passport 
number, or driver’s license number, that is 
not required by law to be displayed in pub-
lic. 
(ii) Any information that describes or 
reveals the past, present, or future physical 
health, mental health, disability, diagnosis, 
or health condition, status, or treatment of 
an individual. 
(iii) Genetic information. 
(iv) A financial account number, debit 
card number, credit card number, or any 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
required security or access code, password, 
or credentials allowing access to any such 
account or card, except that the last four 
digits of an account number, debit card 
number, or credit card number may not be 
considered sensitive covered data. 
(v) Biometric information. 
(vi) Precise geolocation information. 
(vii) The private communications of 
an individual (such as voicemails, or other 
voice or video communications, emails, 
texts, direct messages, or mail) or informa-
tion identifying the parties to such commu-
nications, information contained in tele-
phone bills, and any information that per-
tains to the transmission of private voice 
or video communications, including num-
bers called, numbers from which calls were 
placed, the time calls were made, call dura-
tion, and location information of the par-
ties to the call, unless the relevant covered 
entity or service provider is an intended re-
cipient of the communication. 
(viii) Unencrypted or unredacted ac-
count or device log-in credentials. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(ix) Information revealing the sexual 
behavior of an individual in a manner in-
consistent with the reasonable expectation 
of the individual regarding disclosure of 
such information. 
(x) Calendar information, address 
book information, phone, text, or electronic 
logs, photographs, audio recordings, or vid-
eos intended for private use. 
(xi) A photograph, film, video record-
ing, or other similar medium that shows 
the naked or undergarment-clad private 
area of an individual. 
(xii) Information revealing the extent 
or content of the access, viewing, or other 
use by an individual of any video program-
ming (as defined in section 713(h)(2) of 
the Communications Act of 1934 (47 
U.S.C. 613(h)(2))), including program-
ming provided by a provider of broadcast 
television service, cable service, satellite 
service, or streaming media service, but 
only with regard to the transfer of such in-
formation to a third party (excluding any 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
such information used solely for transfers 
for independent video measurement). 
(xiii) Information collected by a cov-
ered entity that is not a provider of a serv-
ice described in clause (xii) that reveals the 
video content requested or selected by an 
individual (excluding any such information 
used solely for transfers for independent 
video measurement). 
(xiv) Information revealing the race, 
ethnicity, national origin, religion, or sex of 
an individual in a manner inconsistent 
with the reasonable expectation of the indi-
vidual regarding disclosure of such infor-
mation. 
(xv) An online activity profile. 
(xvi) Information about a covered 
minor. 
(xvii) Information that reveals the sta-
tus of an individual as a member of the 
Armed Forces. 
(xviii) Neural data. 
(xix) Any other covered data collected, 
processed, retained, or transferred for the 
purpose of identifying a type of informa-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
tion described in any of clauses (i) through 
(xviii). 
(B) THIRD PARTY.—For the purposes of 
subparagraph (A)(xii), the term ‘‘third party’’ 
does not include an entity that— 
(i) is related by common ownership or 
corporate control to the provider of broad-
cast television service or streaming media 
service; and 
(ii) provides video programming as de-
scribed in such subparagraph. 
(50) SERVICE PROVIDER.— 
(A) IN GENERAL.—The term ‘‘service pro-
vider’’ means an entity that collects, processes, 
retains, or transfers covered data for the pur-
pose of performing 1 or more services or func-
tions on behalf of, and at the direction of— 
(i) a covered entity or another service 
provider; or 
(ii) a Federal, State, Tribal, or local 
government entity. 
(B) RULE OF CONSTRUCTION.— 
(i) IN GENERAL.—An entity is a cov-
ered entity and not a service provider with 
respect to a specific collecting, processing, 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
retaining, or transferring of covered data, 
if the entity, alone or jointly with others, 
determines the purposes and means of the 
specific collecting, processing, retaining, or 
transferring of data. 
(ii) INSTRUCTIONS.—An entity that is 
not limited in its collecting, processing, re-
taining, or transferring of covered data 
pursuant to the instructions of a covered 
entity, another service provider, or a Fed-
eral, State, Tribal, or local government en-
tity, or that fails to adhere to such instruc-
tions, is a covered entity and not a service 
provider with respect to a specific col-
lecting, processing, retaining, or transfer-
ring of such data. If a service provider be-
gins, alone or jointly with others, deter-
mining the purposes and means of col-
lecting, processing, retaining, or transfer-
ring covered data, the entity is a covered 
entity with respect to such data. 
(iii) CONTEXT
REQUIRED.—Whether 
an entity is a covered entity or a service 
provider depends on the facts surrounding 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
how, and the context in which, data is col-
lected, processed, retained, or transferred. 
(51) SMALL BUSINESS.— 
(A) IN GENERAL.—The term ‘‘small busi-
ness’’ means an entity (including any affiliate 
of the entity)— 
(i) that has average annual gross rev-
enues for the period of the 3 preceding cal-
endar years (or for the period during 
which the entity has been in existence, if 
such period is less than 3 calendar years) 
not exceeding $40,000,000, indexed to the 
Producer Price Index reported by the Bu-
reau of Labor Statistics; 
(ii) that, on average for the period de-
scribed in clause (i), did not annually col-
lect, process, retain, or transfer the cov-
ered data of more than 200,000 individuals 
for any purpose other than initiating, ren-
dering, billing for, finalizing, completing, 
or otherwise collecting payment for a re-
quested service or product; and 
(iii) that did not, during the period 
described in clause (i), transfer covered 
data to a third party in exchange for rev-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
enue or anything of value, except for pur-
poses of initiating, rendering, billing for, fi-
nalizing, completing, or otherwise collecting 
payment for a requested service or product 
or facilitating web analytics that are not 
used to create an online activity profile. 
(B) NONPROFIT REVENUE.—For purposes 
of subparagraph (A)(i), the term ‘‘revenue’’, as 
such term relates to any entity that is not orga-
nized to carry on business for its own profit or 
that of its members, means the gross receipts 
the entity received, in whatever form from all 
sources, without subtracting any costs or ex-
penses, and includes contributions, gifts, grants 
(except for grants from the Federal Govern-
ment), dues or other assessments, income from 
investments, or proceeds from the sale of real 
or personal property. 
(52) STATE.—The term ‘‘State’’ means each of 
the 50 States, the District of Columbia, the Com-
monwealth of Puerto Rico, the Virgin Islands of the 
United States, Guam, American Samoa, and the 
Commonwealth of the Northern Mariana Islands. 
(53) SUBSTANTIAL PRIVACY HARM.—The term 
‘‘substantial privacy harm’’ means— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(A) any alleged financial harm of not less 
than $10,000; or 
(B) any alleged physical or mental harm to 
an individual that involves— 
(i) 
treatment 
by 
a 
licensed, 
credentialed, or otherwise bona fide health 
care provider, hospital, community health 
center, clinic, hospice, or residential or out-
patient facility for medical, mental health, 
or addiction care; or 
(ii) physical injury, highly offensive 
intrusion into the privacy expectations of a 
reasonable 
individual 
under 
the 
cir-
cumstances, or discrimination on the basis 
of race, color, religion, national origin, sex, 
or disability. 
(54) TARGETED ADVERTISING.—The term ‘‘tar-
geted advertising’’— 
(A) means displaying or presenting an on-
line advertisement to an individual or to a de-
vice identified by a unique persistent identifier 
(or to a group of individuals or devices identi-
fied by unique persistent identifiers), if the ad-
vertisement is selected based, in whole or in 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
part, on known or predicted preferences or in-
terests associated with the individual or device; 
(B) includes— 
(i) an online advertisement by a cov-
ered high-impact social media company for 
a product or service that is not a product 
or service offered by the covered high-im-
pact social media company; and 
(ii) an online advertisement for a 
product or service based on the previous 
interaction of an individual or a device 
identified by a unique persistent identifier 
with such product or service on a website 
or online service that does not share com-
mon branding or affiliation with the 
website or online service displaying or pre-
senting the advertisement; and 
(C) excludes contextual advertising and 
first-party advertising. 
(55) TEEN.—The term ‘‘teen’’ means an indi-
vidual 13 years of age or older, but under the age 
of 17. 
(56) THIRD PARTY.—The term ‘‘third party’’— 
(A) means any entity that— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(i) receives covered data from another 
entity that is not the individual to whom 
the data pertains; and 
(ii) is not a service provider with re-
spect to such data; and 
(B) does not include an entity that collects 
covered data from another entity if the 2 enti-
ties are— 
(i) related by common ownership or 
corporate control; or 
(ii) nonprofit entities that are part of 
the same federated nonprofit organization. 
(57) THIRD-PARTY
DATA.—The term ‘‘third- 
party data’’ means covered data that has been trans-
ferred to a third party. 
(58) TRANSFER.—The term ‘‘transfer’’ means, 
with respect to covered data, to disclose, release, 
share, disseminate, make available, sell, rent, or li-
cense the covered data (orally, in writing, electroni-
cally, or by any other means) for consideration of 
any kind or for a commercial purpose. 
(59) UNIQUE PERSISTENT IDENTIFIER.— 
(A) IN GENERAL.—The term ‘‘unique per-
sistent identifier’’ means a technologically cre-
ated identifier to the extent that such identifier 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
is reasonably linkable to an individual or a de-
vice that identifies or is linked or reasonably 
linkable to 1 or more individuals, including de-
vice identifiers, Internet Protocol addresses, 
cookies, beacons, pixel tags, mobile ad identi-
fiers or similar technology customer numbers, 
unique pseudonyms, user aliases, telephone 
numbers, or other forms of persistent or prob-
abilistic identifiers that are linked or reasonably 
linkable to 1 or more individuals or devices. 
(B) EXCLUSION.—The term ‘‘unique per-
sistent identifier’’ does not include an identifier 
assigned by a covered entity for the sole pur-
pose of giving effect to the exercise of affirma-
tive express consent or opt out by an individual 
with respect to the collecting, processing, re-
taining, and transfer of covered data or other-
wise limiting the collecting, processing, retain-
ing, or transfer of covered data. 
(60) WIDELY DISTRIBUTED MEDIA.— 
(A) IN GENERAL.—The term ‘‘widely dis-
tributed media’’ means information that is 
available to the general public, including infor-
mation from a telephone book or online direc-
tory, a television, internet, or radio program, 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
the news media, or an internet site that is avail-
able to the general public on an unrestricted 
basis. 
(B) EXCLUSION.—The term ‘‘widely dis-
tributed media’’ does not include an obscene 
visual depiction (as such term is used in section 
1460 of title 18, United States Code). 
SEC. 102. DATA MINIMIZATION. 
(a) IN GENERAL.—A covered entity may not collect, 
process, retain, or transfer covered data of an individual 
or direct a service provider to collect, process, retain, or 
transfer covered data of an individual beyond what is nec-
essary, proportionate, and limited— 
(1) to provide or maintain— 
(A) a specific product or service requested 
by the individual to whom the data pertains, in-
cluding any associated routine administrative, 
operational, or account-servicing activity, such 
as billing, shipping, delivery, storage, or ac-
counting; or 
(B) a communication, that is not an adver-
tisement, by the covered entity to the individual 
reasonably anticipated within the context of the 
relationship; or 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(2) for a purpose expressly permitted under 
subsection (d). 
(b) ADDITIONAL PROTECTIONS FOR SENSITIVE COV-
ERED DATA.—Subject to subsection (a), a covered entity 
may not transfer sensitive covered data to a third party 
or direct a service provider to transfer sensitive covered 
data to a third party without the affirmative express con-
sent of the individual to whom such data pertains, unless 
for a purpose permitted by paragraph (2), (3), (4), (5), 
(6), (8), (9), (11), (12), or (13) of subsection (d). 
(c) ADDITIONAL PROTECTIONS FOR BIOMETRIC IN-
FORMATION AND GENETIC INFORMATION.— 
(1) COLLECTION.—Subject to subsection (a), a 
covered entity may not collect biometric information 
or genetic information or direct a service provider to 
collect biometric information or genetic information 
without the affirmative express consent of the indi-
vidual to whom such information pertains. 
(2) PROCESSING.—Subject to subsection (a), a 
covered entity may not process biometric information 
or genetic information or direct a service provider to 
process biometric information or genetic information 
without the affirmative express consent of the indi-
vidual to whom such information pertains, unless for 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
a purpose permitted by paragraph (2), (3), or (4) of 
subsection (d). 
(3) RETENTION.—Subject to subsection (a), a 
covered entity may not retain biometric information 
or direct a service provider to retain biometric infor-
mation beyond the point at which the purpose for 
which an individual provided affirmative express 
consent under paragraph (1) has been satisfied or 
beyond the date that is 3 years after the date of the 
last interaction of the individual with the covered en-
tity or service provider, whichever occurs first, un-
less for a purpose permitted under paragraph (2), 
(3), or (4) of subsection (d). 
(4) TRANSFER.— 
(A) AFFIRMATIVE EXPRESS CONSENT RE-
QUIRED.—Subject to subsection (a), a covered 
entity may not transfer biometric information 
or genetic information to a third party or direct 
a service provider to transfer biometric informa-
tion or genetic information to a third party 
without the affirmative express consent of the 
individual to whom such information pertains, 
unless for a purpose permitted by paragraph 
(2), (3), or (4) of subsection (d). 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(B) NO
TRANSFER
FOR
PAYMENT
OR 
OTHER VALUABLE CONSIDERATION.—A covered 
entity may not transfer biometric information 
or genetic information to a third party, or di-
rect a service provider to transfer biometric in-
formation or genetic information to a third 
party, for payment or other valuable consider-
ation (regardless of the purpose of the transfer, 
including a purpose described in subparagraph 
(A)). 
(d) PERMITTED PURPOSES.—Subject to the require-
ments in subsections (b) and (c), a covered entity may 
collect, process, retain, or transfer or direct a service pro-
vider to collect, process, retain, or transfer covered data 
for the following purposes, if the covered entity or service 
provider can demonstrate that the collection, processing, 
retention, or transfer is necessary, proportionate, and lim-
ited to such purpose: 
(1) To protect data security as described in sec-
tion 109, protect against spam, or protect and main-
tain networks and systems, including through 
diagnostics, debugging, and repairs. 
(2) To comply with a legal obligation imposed 
by a Federal, State, Tribal, or local law that is not 
preempted by this title. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(3) To investigate, establish, prepare for, exer-
cise, or defend cognizable legal claims of the covered 
entity or service provider. 
(4) To transfer covered data to a Federal, 
State, Tribal, or local law enforcement agency pur-
suant to a lawful warrant, administrative subpoena, 
or other form of lawful process. 
(5) To effectuate a product recall pursuant to 
Federal or State law, or to fulfill a warranty. 
(6) To conduct market research. 
(7) With respect to covered data previously col-
lected in accordance with this title, to process the 
covered data such that the covered data becomes de- 
identified data, including in order to— 
(A) develop or enhance a product or serv-
ice of the covered entity or service provider; 
(B) conduct research or analytics to im-
prove a product or service of the covered entity 
or service provider; 
(C) conduct research to investigate, estab-
lish, or improve the effectiveness or safety of 
medical products, including drugs, biologics, 
and medical devices; 
(D) enable the effective delivery and ad-
ministration of health care products and treat-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
ments to patients, in compliance with Federal 
regulations; or 
(E) monitor the safety and efficacy of 
health care products and services administered 
to patients, in compliance with Federal regula-
tions. 
(8) To transfer assets to a third party in the 
context of a merger, acquisition, bankruptcy, or 
similar transaction, with respect to which the third 
party assumes control, in whole or in part, of the as-
sets of the covered entity, but only if the covered en-
tity, in a reasonable time prior to such transfer, pro-
vides each affected individual with— 
(A) a notice describing such transfer, in-
cluding the name of the entity or entities receiv-
ing the covered data of the individual and the 
privacy policies of such entity or entities as de-
scribed in section 104; and 
(B) a reasonable opportunity to— 
(i) withdraw any previously provided 
consent in accordance with the require-
ments of affirmative express consent under 
this title related to the covered data of the 
individual; and 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(ii) request the deletion of the covered 
data of the individual, as described in sec-
tion 105. 
(9) With respect to a covered entity or service 
provider that is a telecommunications carrier or a 
provider of a mobile service, interconnected VoIP 
service, or non-interconnected VoIP service (as such 
terms are defined in section 3 of the Communica-
tions Act of 1934 (47 U.S.C. 153)), to provide call 
location information in a manner described in sub-
paragraph (A) or (C) of section 222(d)(4) of such 
Act (47 U.S.C. 222(d)(4)). 
(10) To prevent, detect, protect against, inves-
tigate, or respond to fraud, excluding the transfer of 
covered data for payment or other valuable consider-
ation to a government entity. 
(11) To prevent, detect, protect against, inves-
tigate, or respond to an ongoing or imminent secu-
rity incident relating to network security or physical 
security, including an intrusion or trespass, medical 
alert or request for a medical response, fire alarm or 
request for a fire response, or access control. 
(12) To prevent, detect, protect against, inves-
tigate, or respond to an imminent or ongoing public 
safety incident (such as a mass casualty event, nat-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
ural disaster, or national security incident), exclud-
ing the transfer of covered data for payment or 
other valuable consideration to a government entity. 
(13) Except with respect to health information, 
to prevent, detect, protect against, investigate, or re-
spond to criminal activity or harassment, excluding 
the transfer of covered data for payment or other 
valuable consideration to a government entity. 
(14) Except with respect to sensitive covered 
data, and only with respect to covered data pre-
viously collected in accordance with this title, to 
process or transfer such data to provide first-party 
advertising or contextual advertising or to measure 
and report on marketing performance or media per-
formance by the covered entity, including processing 
or transferring covered data for measurement and 
reporting of frequency, attribution, and performance, 
including by independent entities, except that this 
paragraph does not permit the processing or trans-
fer of covered data for first-party advertising to a 
covered minor as prohibited by section 120. 
(15) Except with respect to sensitive covered 
data, and only with respect to covered data pre-
viously collected in accordance with this title, to 
process or transfer such data to provide targeted ad-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
vertising, direct mail targeted advertising, or email 
targeted advertising (subject to the CAN-SPAM Act 
of 2003 (15 U.S.C. 7701 et seq.) and the regula-
tions promulgated under such Act) or to measure 
and report on marketing performance or media per-
formance, including processing or transferring cov-
ered data for measurement and reporting of fre-
quency, attribution, and performance, including by 
independent entities, except that this paragraph does 
not permit the processing or transfer of covered data 
for targeted advertising to an individual who has 
opted out of targeted advertising pursuant to section 
106 or to a covered minor as prohibited by section 
120. 
(16) To conduct a public or peer-reviewed sci-
entific, historical, or statistical research project 
that— 
(A) is in the public interest; 
(B) adheres to all relevant laws and regu-
lations governing such research, including regu-
lations for the protection of human subjects, if 
applicable; 
(C) limits transfers to third parties of sen-
sitive covered data to only those transfers nec-
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
essary, proportionate, and limited to carry out 
the research; and 
(D) prohibits the transfer of covered data 
to a data broker. 
(17) To conduct medical research in compliance 
with part 46 of title 45, Code of Federal Regula-
tions, or parts 50 and 56 of title 21, Code of Fed-
eral Regulations. 
(e) GUIDANCE.—Not later than 180 days after the 
date of the enactment of this Act, the Commission shall 
issue guidance regarding what is necessary, proportionate, 
and limited to comply with this section. 
(f) JOURNALISM.—Nothing in this title may be con-
strued to limit or diminish journalism, including gath-
ering, preparing, collecting, photographing, recording, 
writing, editing, reporting, or investigating news or infor-
mation that concerns local, national, or international 
events or other matters of public interest for dissemination 
to the public. 
SEC. 103. PRIVACY BY DESIGN. 
(a) IN GENERAL.—Each covered entity and service 
provider shall establish, implement, and maintain reason-
able policies, practices, and procedures that reflect the role 
of the covered entity or service provider in the collection, 
processing, retention, and transferring of covered data. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(b) REQUIREMENTS.—The policies, practices, and 
procedures required by subsection (a) shall— 
(1) identify, assess, and mitigate privacy risks 
related to covered minors (including, if applicable, in 
a manner that considers the developmental needs of 
different age ranges of covered minors), individuals 
living with disabilities, and individuals over the age 
of 65; 
(2) mitigate privacy risks related to the prod-
ucts and services of the covered entity or service pro-
vider, including in the design, development, and im-
plementation of such products and services, taking 
into account the role of the covered entity or service 
provider and the information available to the covered 
entity or service provider; and 
(3) implement reasonable internal training and 
safeguards to promote compliance with this title and 
to mitigate privacy risks, taking into account the 
role of the covered entity or service provider and the 
information available to the covered entity or service 
provider. 
(c) FACTORS TO CONSIDER.—The policies, practices, 
and procedures established by a covered entity or service 
provider under subsection (a) shall align with, as applica-
ble— 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS
(1) the nature, scope, and complexity of the ac-
tivities engaged in by the covered entity or service 
provider, including whether the covered entity or 
service provider is a large data holder, nonprofit or-
ganization, or data broker, taking into account the 
role of the covered entity or service provider and the 
information available to the covered entity or service 
provider; 
(2) the sensitivity of the covered data collected, 
processed, retained, or transferred by the covered 
entity or service provider; 
(3) the volume of covered data collected, proc-
essed, retained, or transferred by the covered entity 
or service provider; 
(4) the number of individuals and devices to 
which the covered data collected, processed, retained, 
or transferred by the covered entity or service pro-
vider relates; 
(5) 
state-of-the-art 
administrative, 
techno-
logical, and organizational measures that, by default, 
serve the purpose of protecting the privacy and secu-
rity of covered data as required by this title; and 
(6) the cost of implementing such policies, prac-
tices, and procedures in relation to the risks and na-
ture of the covered data involved. 
VerDate Sep 11 2014 
02:30 Jun 26, 2024
Jkt 049200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6201
E:\BILLS\H8818.IH
H8818
ssavage on LAPJG3WLY3PROD with BILLS