information from an individual in a manner that vio-
lates the rules prescribed under subsection (b).
(2) DISCLOSURE
TO
PARENT
PROTECTED.—
Notwithstanding paragraph (1), neither an operator
of such a website or online service nor the operator’s
agent shall be held to be liable under any Federal
or State law for any disclosure made in good faith
and following reasonable procedures in responding to
a request for disclosure of personal information
under section 1302(b)(1)(B)(iii) of the Children’s
Online Privacy Protection Act of 1998 to the parent
of a child.
(b) PRIVACY PROTECTIONS.—
(1) IN GENERAL.—Not later than 18 months
after the date of the enactment of this Act, the
Commission shall promulgate under section 553 of
title 5, United States Code, rules that—
(A) require the operator of any website or
online service that collects personal information
to provide clear and conspicuous notice on the
website of the specific types of personal infor-
mation collected by the operator, how the oper-
ator uses such information, and the operator’s
disclosure practices for such information;
(B)(i) require the operator of such a
website or online service to provide, whenever
such operator collects personal information, a
clear and explicit online method by which an in-
dividual grants or denies consent to the collec-
tion and uses disclosed pursuant to the rules
prescribed under subparagraph (A); and
(ii) permit the operator of such a website
or online service to establish, in accordance with
self-regulatory guidelines approved under sec-
tion 5, a method or methods by which an indi-
vidual can preset protocols for granting or de-
nying such consent in accordance with the indi-
vidual’s choices concerning such collection and
use;
(C) prohibit the operator of such a website
or online service to collect and use personal in-
formation unless—
(i) such collection or use has been dis-
closed in accordance with the rules pre-
scribed under subparagraph (A); and
(ii) such collection or use has been
consented to by the individual by a method
that complies with the rules prescribed
under clause (i) or (ii) of subparagraph
(B);
(D) require the operator of such a website
or online service to provide individuals, upon
request—
(i) access to personal information per-
taining to them collected by such operator
for correction; and
(ii) notice of whether any personal in-
formation pertaining to such individual has
been reused, disclosed, or sold and to
whom; and
(E) require the operator of such a website
or online service to establish and maintain rea-
sonable procedures to protect the confiden-
tiality, security, and integrity of personal infor-
mation collected.
(2) EXCEPTION.—The rules prescribed under
paragraph (1) shall not prohibit the collection, use,
or dissemination of such information by the operator
of such a website or online service necessary—
(A) to protect the security or integrity of
its website;
(B) to take precautions against liability;
(C) to respond to judicial process; or
(D) to the extent permitted under other
provisions of law, to provide information to law
enforcement agencies.
(3) TERMINATION
OF
SERVICE.—The rules
shall permit the operator of a website or an online
service to terminate service provided to an individual
who has refused to consent to the collection and use
of information pursuant to the rules prescribed
under paragraph (1)(B).
(c) ENFORCEMENT.—Subject to sections 4 through
7, a violation of a rule prescribed under subsection (a)
shall be treated as a violation of a rule defining an unfair
or deceptive act or practice prescribed under section
18(a)(1)(B) of the Federal Trade Commission Act (15
U.S.C. 57a(a)(1)(B)).
(d) INCONSISTENT STATE LAW.—No State or local
government may impose any liability for commercial ac-
tivities or actions by operators in interstate or foreign
commerce in connection with an activity or action de-
scribed in this Act that is inconsistent with the treatment
of those activities or actions under this section.
SEC. 4. SAFE HARBORS.
(a) GUIDELINES.—An operator may satisfy the re-
quirements of rules issued under section 3(b) by following
a set of self-regulatory guidelines, issued by representa-
tives of the marketing or online industries, or by other
persons, approved under subsection (b).
(b) INCENTIVES.—
(1) SELF-REGULATORY
INCENTIVES.—In pre-
scribing rules under section 3, the Commission shall
provide incentives for self-regulation by operators to
implement the protections afforded individuals under
the regulatory requirements described in subsection
(b) of that section.
(2) DEEMED
COMPLIANCE.—Such incentives
shall include provisions for ensuring that a person
will be deemed to be in compliance with the require-
ments of the rules under section 3 if that person
complies with guidelines that, after notice and com-
ment, are approved by the Commission upon making
a determination that the guidelines meet the require-
ments of the rules issued under section 3.
(3) EXPEDITED RESPONSE TO REQUESTS.—The
Commission shall act upon requests for safe harbor
treatment within 180 days of the filing of the re-
quest, and shall set forth in writing its conclusions
with regard to such requests.
(c) APPEALS.—Final action by the Commission on a
request for approval of guidelines, or the failure to act
within 180 days on a request for approval of guidelines,
submitted under subsection (b) may be appealed to a dis-
trict court of the United States of appropriate jurisdiction
as provided for in section 706 of title 5, United States
Code.
SEC. 5. ACTIONS BY STATES.
(a) IN GENERAL.—
(1) CIVIL ACTIONS.—In any case in which the
attorney general of a State has reason to believe
that an interest of the residents of that State has
been or is threatened or adversely affected by the
engagement of any person in a practice that violates
any rule of the Commission prescribed under section
3(b), the State, as parens patriae, may bring a civil
action on behalf of the residents of the State in a
district court of the United States of appropriate ju-
risdiction to—
(A) enjoin that practice;
(B) enforce compliance with the rule;
(C) obtain damage, restitution, or other
compensation on behalf of residents of the
State; or
(D) obtain such other relief as the court
may consider to be appropriate.
(2) NOTICE.—
(A) IN GENERAL.—Before filing an action
under paragraph (1), the attorney general of
the State involved shall provide to the
Commission—
(i) written notice of that action; and
(ii) a copy of the complaint for that
action.
(B) EXEMPTION.—
(i) IN GENERAL.—Subparagraph (A)
shall not apply with respect to the filing of
an action by an attorney general of a State
under this subsection, if the attorney gen-
eral determines that it is not feasible to
provide the notice described in that sub-
paragraph before the filing of the action.
(ii) NOTIFICATION.—In an action de-
scribed in clause (i), the attorney general
of a State shall provide notice and a copy
of the complaint to the Commission at the
same time as the attorney general files the
action.
(b) INTERVENTION.—
(1) IN GENERAL.—On receiving notice under
subsection (a)(2), the Commission shall have the
right to intervene in the action that is the subject
of the notice.
(2) EFFECT OF INTERVENTION.—If the Com-
mission intervenes in an action under subsection (a),
it shall have the right—
(A) to be heard with respect to any matter
that arises in that action; and
(B) to file a petition for appeal.
(3) AMICUS CURIAE.—Upon application to the
court, a person whose self-regulatory guidelines have
been approved by the Commission and are relied
upon as a defense by any defendant to a proceeding
under this section may file amicus curiae in that
proceeding.
(c) CONSTRUCTION.—For purposes of bringing any
civil action under subsection (a), nothing in this Act shall
be construed to prevent an attorney general of a State
from exercising the powers conferred on the attorney gen-
eral by the laws of that State to—
(1) conduct investigations;
(2) administer oaths or affirmations; or
(3) compel the attendance of witnesses or the
production of documentary and other evidence.
(d) ACTIONS BY THE COMMISSION.—In any case
in which an action is instituted by or on behalf of the
Commission for violation of any rule prescribed under
section 3, no State may, during the pendency of that ac-
tion, institute an action under subsection (a) against any
defendant named in the complaint in that action for vio-
lation of that rule.
(e) VENUE; SERVICE OF PROCESS.—
(1) VENUE.—Any action brought under sub-
section (a) may be brought in the district court of
the United States that meets applicable require-
ments relating to venue under section 1391 of title
28, United States Code.
(2) SERVICE
OF
PROCESS.—In an action
brought under subsection (a), process may be served
in any district in which the defendant—
(A) is an inhabitant; or
(B) may be found.
SEC. 6. ADMINISTRATION AND APPLICABILITY OF ACT.
(a) IN GENERAL.—Except as otherwise provided,
this Act shall be enforced by the Commission under the
Federal Trade Commission Act (15 U.S.C. 41 et seq.).
(b) PROVISIONS.—Compliance with the require-
ments imposed under this Act shall be enforced under—
(1) section 8 of the Federal Deposit Insurance
Act (12 U.S.C. 1818), in the case of—
(A) national banks, and Federal branches
and Federal agencies of foreign banks, by the
Office of the Comptroller of the Currency;
(B) member banks of the Federal Reserve
System (other than national banks), branches
and agencies of foreign banks (other than Fed-
eral branches, Federal agencies, and insured
State branches of foreign banks), commercial
lending companies owned or controlled by for-
eign banks, and organizations operating under
section 25 or 25(a) of the Federal Reserve Act
(12 U.S.C. 601 et seq. and 611 et seq.), by the
Board; and
(C) banks insured by the Federal Deposit
Insurance Corporation (other than members of
the Federal Reserve System) and insured State
branches of foreign banks, by the Board of Di-
rectors of the Federal Deposit Insurance Cor-
poration;
(2) section 8 of the Federal Deposit Insurance
Act (12 U.S.C. 1818), by the Director of the Office
of Thrift Supervision, in the case of a savings asso-
ciation the deposits of which are insured by the Fed-
eral Deposit Insurance Corporation;
(3) the Federal Credit Union Act (12 U.S.C.
1751 et seq.) by the National Credit Union Adminis-
tration Board with respect to any Federal credit
union;
(4) part A of subtitle VII of title 49, United
States Code, by the Secretary of Transportation
with respect to any air carrier or foreign air carrier
subject to that part;
(5) the Packers and Stockyards Act, 1921 (7
U.S.C. 181 et seq.) (except as provided in section
406 of that Act (7 U.S.C. 226, 227)), by the Sec-
retary of Agriculture with respect to any activities
subject to that Act; and
(6) the Farm Credit Act of 1971 (12 U.S.C.
2001 et seq.) by the Farm Credit Administration
with respect to any Federal land bank, Federal land
bank association, Federal intermediate credit bank,
or production credit association.
(c) EXERCISE OF CERTAIN POWERS.—For the pur-
pose of the exercise by any agency referred to in sub-
section (a) of its powers under any Act referred to in that
subsection, a violation of any requirement imposed under
this Act shall be deemed to be a violation of a requirement
imposed under that Act. In addition to its powers under
any provision of law specifically referred to in subsection
(a), each of the agencies referred to in that subsection may
exercise, for the purpose of enforcing compliance with any
requirement imposed under this Act, any other authority
conferred on it by law.
(d) ACTIONS BY THE COMMISSION.—The Commis-
sion shall prevent any person from violating a rule of the
Commission under section 3 in the same manner, by the
same means, and with the same jurisdiction, powers, and
duties as though all applicable terms and provisions of the
Federal Trade Commission Act (15 U.S.C. 41 et seq.)
were incorporated into and made a part of this Act. Any
entity that violates such rule shall be subject to the pen-
alties and entitled to the privileges and immunities pro-
vided in the Federal Trade Commission Act in the same
manner, by the same means, and with the same jurisdic-
tion, power, and duties as though all applicable terms and
provisions of the Federal Trade Commission Act were in-
corporated into and made a part of this Act.
(e) EFFECT ON OTHER LAWS.—
(1) PRESERVATION
OF
COMMISSION
AUTHOR-
ITY.—Nothing contained in the Act shall be con-
strued to limit the authority of the Commission
under any other provisions of law.
(2) RELATION
TO
COMMUNICATIONS
ACT.—
Nothing in this Act or the rules prescribed there-
under shall require an operator of a website or on-
line service to take any action that is inconsistent
with the requirements of section 222 or 631 of the
Communications Act of 1934 (47 U.S.C. 222, 551).
SEC. 7. PRIVATE RIGHT OF ACTION.
(a) PRIVATE RIGHT OF ACTION.—A person or entity
may, if otherwise permitted by the laws or rules of court
of a State, bring in an appropriate court of that State—
(1) an action based on a violation of any rule
prescribed under section 3 to enjoin such violation;
(2) an action to recover for actual monetary
loss from such a violation, or to receive $1,000 in
damages for each such violation, whichever is great-
er; or
(3) both such actions.
(b) WILLFUL AND KNOWING VIOLATIONS.—If the
court finds that the defendant willfully or knowingly vio-
lated any rule prescribed under section 3, the court may,
in its discretion, increase the amount of the award avail-
able under subsection (a)(2) to $10,000.
SEC. 8. REVIEW.
Not later than 5 years after the effective date of the
rules initially issued under section 3, the Commission
shall—
(1) review the implementation of this Act, in-
cluding the effect of the implementation of this Act
on practices relating to the collection and disclosure
of information relating to children, children’s ability
to obtain access to information of their choice online,
and on the availability of websites directed to chil-
dren; and
(2) prepare and submit to Congress a report on
the results of the review under paragraph (1).
SEC. 9. DEFINITIONS.
In this Act:
(1) OPERATOR.—The term ‘‘operator’’—
(A) means any person who operates a
website located on the Internet or an online
service and who collects or maintains personal
information from or about the users of or visi-
tors to such website or online service, or on
whose behalf such information is collected or
maintained, where such website or online serv-
ice is operated for commercial purposes, includ-
ing any person offering products or services for
sale through that website or online service, in-
volving commerce—
(i) among the several States or with 1
or more foreign nations;
(ii) in any territory of the United
States or in the District of Columbia, or
between any such territory and—
(I) another such territory; or
(II) any State or foreign nation;
or
(iii) between the District of Columbia
and any State, territory, or foreign nation;
but
(B) does not include any nonprofit entity
that would otherwise be exempt from coverage
under section 5 of the Federal Trade Commis-
sion Act (15 U.S.C. 45).
(2) COMMISSION.—The term ‘‘Commission’’
means the Federal Trade Commission.
(3) 
DISCLOSURE.—The 
term 
‘‘disclosure’’
means, with respect to personal information—
(A) the release of personal information col-
lected from an individual in identifiable form by
an operator for any purpose, except where such
information is provided to a person other than
the operator who provides support for the inter-
nal operations of the website and does not dis-
close or use that information for any other pur-
pose; and
(B) making personal information collected
from an individual by a website or online serv-
ice publicly available in identifiable form, by
any means including by a public posting,
through the Internet, or through—
(i) a home page of a website;
(ii) a pen pal service;
(iii) an electronic mail service;
(iv) a message board; or
(v) a chat room.
(4) FEDERAL
AGENCY.—The term ‘‘Federal
agency’’ means an agency, as that term is defined
in section 551(1) of title 5, United States Code.
(5) INTERNET.—The term ‘‘Internet’’ means
collectively the myriad of computer and tele-
communications facilities, including equipment and
operating software, which comprise the inter-
connected world-wide network of networks that em-
ploy the Transmission Control Protocol/Internet
Protocol, or any predecessor or successor protocols
to such protocol, to communicate information of all
kinds by wire or radio.
(6) PERSONAL INFORMATION.—The term ‘‘per-
sonal information’’ means individually identifiable
information about an individual collected online,
including—
(A) a first and last name;
(B) a home or other physical address in-
cluding street name and name of a city or town;
(C) an e-mail address;
(D) a telephone number;
(E) a Social Security number;
(F) any other identifier that the Commis-
sion determines permits the physical or online
contacting of a specific individual; or
(G) unique identifying information that the
website collects online and combines with an
identifier described in this paragraph.
(7) PERSON.—The term ‘‘person’’ means any
individual, partnership, corporation, trust, estate, co-
operative, association, or other entity.
(8) WEBSITE; ONLINE SERVICE.—The Commis-
sion shall by rule define the terms ‘‘website’’ and
‘‘online service’’ in a manner consistent with the
purposes of this Act, and shall revise or amend such
rule to take into account changes in technology,
practice, or procedure with respect to the collection
of personal information over the Internet.