IIB 
#(Star Print)
110TH CONGRESS 
1ST SESSION 
H. R. 964 
IN THE SENATE OF THE UNITED STATES 
JUNE 7, 2007 
Received; read twice and referred to the Committee on Commerce, Science, 
and Transportation 
AN ACT 
To protect users of the Internet from unknowing trans-
mission of their personally identifiable information 
through spyware programs, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Securely Protect Your-
self Against Cyber Trespass Act’’ or the ‘‘Spy Act’’. 
SEC. 2. PROHIBITION OF UNFAIR OR DECEPTIVE ACTS OR 
PRACTICES RELATING TO SPYWARE. 
(a) PROHIBITION.—It is unlawful for any person, 
who is not the owner or authorized user of a protected 
computer, to engage in unfair or deceptive acts or prac-
tices that involve any of the following conduct with respect 
to the protected computer: 
(1) Taking control of the computer by— 
(A) utilizing such computer to send unso-
licited information or material from the com-
puter to others; 
(B) diverting the Internet browser of the 
computer, or similar program of the computer 
used to access and navigate the Internet— 
(i) without authorization of the owner 
or authorized user of the computer; and 
(ii) away from the site the user in-
tended to view, to one or more other Web 
pages, such that the user is prevented from 
viewing the content at the intended Web 
page, unless such diverting is otherwise au-
thorized; 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(C) accessing, hijacking, or otherwise using 
the modem, or Internet connection or service, 
for the computer and thereby causing damage 
to the computer or causing the owner or au-
thorized user or a third party defrauded by 
such conduct to incur charges or other costs for 
a service that is not authorized by such owner 
or authorized user; 
(D) using the computer as part of an ac-
tivity performed by a group of computers that 
causes damage to another computer; or 
(E) delivering advertisements or a series of 
advertisements that a user of the computer can-
not close or terminate without undue effort or 
knowledge by the user or without turning off 
the computer or closing all sessions of the 
Internet browser for the computer. 
(2) Modifying settings related to use of the 
computer or to the computer’s access to or use of 
the Internet by altering— 
(A) the Web page that appears when the 
owner or authorized user launches an Internet 
browser or similar program used to access and 
navigate the Internet; 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(B) the default provider used to access or 
search the Internet, or other existing Internet 
connections settings; 
(C) a list of bookmarks used by the com-
puter to access Web pages; or 
(D) security or other settings of the com-
puter that protect information about the owner 
or authorized user for the purposes of causing 
damage or harm to the computer or owner or 
user. 
(3) Collecting personally identifiable informa-
tion through the use of a keystroke logging function. 
(4) Inducing the owner or authorized user of 
the computer to disclose personally identifiable infor-
mation by means of a Web page that— 
(A) is substantially similar to a Web page 
established or provided by another person; and 
(B) misleads the owner or authorized user 
that such Web page is provided by such other 
person. 
(5) Inducing the owner or authorized user to 
install a component of computer software onto the 
computer, or preventing reasonable efforts to block 
the installation or execution of, or to disable, a com-
ponent of computer software by— 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(A) presenting the owner or authorized 
user with an option to decline installation of 
such a component such that, when the option is 
selected by the owner or authorized user or 
when the owner or authorized user reasonably 
attempts to decline the installation, the installa-
tion nevertheless proceeds; or 
(B) causing such a component that the 
owner or authorized user has properly removed 
or disabled to automatically reinstall or reac-
tivate on the computer. 
(6) Misrepresenting that installing a separate 
component of computer software or providing log-in 
and password information is necessary for security 
or privacy reasons, or that installing a separate com-
ponent of computer software is necessary to open, 
view, or play a particular type of content. 
(7) Inducing the owner or authorized user to 
install or execute computer software by misrepre-
senting the identity or authority of the person or en-
tity providing the computer software to the owner or 
user. 
(8) Inducing the owner or authorized user to 
provide personally identifiable, password, or account 
information to another person— 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(A) by misrepresenting the identity of the 
person seeking the information; or 
(B) without the authority of the intended 
recipient of the information. 
(9) Removing, disabling, or rendering inoper-
ative a security, anti-spyware, or anti-virus tech-
nology installed on the computer. 
(10) Installing or executing on the computer 
one or more additional components of computer soft-
ware with the intent of causing a person to use such 
components in a way that violates any other provi-
sion of this section. 
(b) GUIDANCE.—The Commission shall issue guid-
ance regarding compliance with and violations of this sec-
tion. This subsection shall take effect upon the date of 
the enactment of this Act. 
(c) EFFECTIVE DATE.—Except as provided in sub-
section (b), this section shall take effect upon the expira-
tion of the 6-month period that begins on the date of the 
enactment of this Act. 
SEC. 3. PROHIBITION OF COLLECTION OF CERTAIN INFOR-
MATION WITHOUT NOTICE AND CONSENT. 
(a) OPT-IN REQUIREMENT.—Except as provided in 
subsection (e), it is unlawful for any person— 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(1) to transmit to a protected computer, which 
is not owned by such person and for which such per-
son is not an authorized user, any information col-
lection program, unless— 
(A) such information collection program 
provides notice in accordance with subsection 
(c) before downloading or installing any of the 
information collection program; and 
(B) such information collection program 
includes the functions required under sub-
section (d); or 
(2) to execute any information collection pro-
gram installed on such a protected computer un-
less— 
(A) before execution of any of the informa-
tion collection functions of the program, the 
owner or an authorized user of the protected 
computer has consented to such execution pur-
suant to notice in accordance with subsection 
(c); and 
(B) such information collection program 
includes the functions required under sub-
section (d). 
(b) INFORMATION COLLECTION PROGRAM.— 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(1) IN GENERAL.—For purposes of this section, 
the term ‘‘information collection program’’ means 
computer software that performs either of the fol-
lowing functions: 
(A) COLLECTION OF PERSONALLY IDENTI-
FIABLE
INFORMATION.—The computer soft-
ware— 
(i) collects personally identifiable in-
formation; and 
(ii)(I) sends such information to a 
person other than the owner or authorized 
user of the computer, or 
(II) uses such information to deliver 
advertising to, or display advertising on, 
the computer. 
(B) COLLECTION
OF
INFORMATION
RE-
GARDING INTERNET ACTIVITY TO DELIVER AD-
VERTISING.—The computer software— 
(i) collects information regarding the 
user’s Internet activity using the computer; 
and 
(ii) uses such information to deliver 
advertising to, or display advertising on, 
the computer. 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(2) EXCEPTION
FOR
SOFTWARE
COLLECTING 
INFORMATION
REGARDING
INTERNET
ACTIVITY 
WITHIN A PARTICULAR WEB SITE.—Computer soft-
ware that otherwise would be considered an informa-
tion collection program by reason of paragraph 
(1)(B) shall not be considered such a program if— 
(A) the only information collected by the 
software regarding the user’s internet activity, 
and used to deliver advertising to, or display 
advertising on, the protected computer, is— 
(i) information regarding Web pages 
within a particular Web site; or 
(ii) in the case of any Internet-based 
search function, user-supplied search terms 
necessary to complete the search and re-
turn results to the user; 
(B) such information collected is not sent 
to a person other than— 
(i) the provider of the Web site 
accessed or Internet-based search function; 
or 
(ii) a party authorized to facilitate the 
display or functionality of Web pages with-
in the Web site accessed; and 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(C) the only advertising delivered to or dis-
played on the computer using such information 
is advertising on Web pages within that par-
ticular Web site. 
(c) NOTICE AND CONSENT.— 
(1) IN GENERAL.—Notice in accordance with 
this subsection with respect to an information collec-
tion program is clear and conspicuous notice in plain 
language, set forth as the Commission shall provide, 
that meets all of the following requirements: 
(A) The notice clearly distinguishes a 
statement required under subparagraph (B) 
from any other information visually presented 
contemporaneously on the computer. 
(B) The notice contains one of the fol-
lowing statements, as applicable, or a substan-
tially similar statement: 
(i) With respect to an information col-
lection program described in subsection 
(b)(1)(A): ‘‘This program will collect and 
transmit information about you. Do you 
accept?’’. 
(ii) With respect to an information 
collection program described in subsection 
(b)(1)(B): ‘‘This program will collect infor-
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
mation about Web pages you access and 
will use that information to display adver-
tising on your computer. Do you accept?’’. 
(iii) With respect to an information 
collection program that performs the ac-
tions described in both subparagraphs (A) 
and (B) of subsection (b)(1): ‘‘This pro-
gram will collect and transmit information 
about you and will collect information 
about Web pages you access and use that 
information to display advertising on your 
computer. Do you accept?’’. 
(C) The notice provides for the user— 
(i) to grant or deny consent referred 
to in subsection (a) by selecting an option 
to grant or deny such consent; and 
(ii) to abandon or cancel the trans-
mission or execution referred to in sub-
section (a) without granting or denying 
such consent. 
(D) The notice provides an option for the 
user to select to display on the computer, before 
granting or denying consent using the option 
required under subparagraph (C), a clear de-
scription of— 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(i) the types of information to be col-
lected and sent (if any) by the information 
collection program; 
(ii) the purpose for which such infor-
mation is to be collected and sent; and 
(iii) in the case of an information col-
lection program that first executes any of 
the information collection functions of the 
program together with the first execution 
of other computer software, the identity of 
any such software that is an information 
collection program. 
(E) The notice provides for concurrent dis-
play of the information required under subpara-
graphs (B) and (C) and the option required 
under subparagraph (D) until the user— 
(i) grants or denies consent using the 
option required under subparagraph (C)(i); 
(ii) abandons or cancels the trans-
mission or execution pursuant to subpara-
graph (C)(ii); or 
(iii) selects the option required under 
subparagraph (D). 
(2) SINGLE
NOTICE.—The Commission shall 
provide that, in the case in which multiple informa-
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
subparagraph (A)(ii)(II) or (B)(ii) of subsection 
(b)(1) and subject to subparagraph (B) of this 
paragraph, a function of the program that pro-
vides that each display of an advertisement di-
rected or displayed using such information, 
when the owner or authorized user is accessing 
a Web page or online location other than of the 
provider of the computer software, is accom-
panied by the name of the information collec-
tion program, a logogram or trademark used 
for the exclusive purpose of identifying the pro-
gram, or a statement or other information suffi-
cient to clearly identify the program. 
(B) EXEMPTION FOR EMBEDDED ADVER-
TISEMENTS.—The Commission shall, by regula-
tion, exempt from the applicability of subpara-
graph (A) the embedded display of any adver-
tisement on a Web page that contempora-
neously displays other information. 
(3) RULEMAKING.—The Commission may issue 
regulations to carry out this subsection. 
(e) LIMITATION
ON LIABILITY.—A telecommuni-
cations carrier, a provider of information service or inter-
active computer service, a cable operator, or a provider 
of transmission capability shall not be liable under this 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
section to the extent that the carrier, operator, or pro-
vider— 
(1) transmits, routes, hosts, stores, or provides 
connections for an information collection program 
through a system or network controlled or operated 
by or for the carrier, operator, or provider; or 
(2) provides an information location tool, such 
as a directory, index, reference, pointer, or hypertext 
link, through which the owner or user of a protected 
computer locates an information collection program. 
(f) STUDY AND ADDITIONAL EXEMPTION.— 
(1) STUDY
AND
REPORT.—The Commission 
shall conduct a study to determine the applicability 
of the information collection prohibitions of this sec-
tion to information that is input directly by users in 
a field provided on a website. The study shall exam-
ine— 
(A) the nature of such fields for user 
input; 
(B) the use of a user’s information once 
input and whether such information is sent to 
a person other than the provider of the Web 
site; 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(C) whether such information is used to 
deliver advertisements to the user’s computer; 
and 
(D) the extent of any notice provided to 
the user prior to such input. 
(2) REPORT.—The Commission shall transmit a 
report on such study to the Committee on Energy 
and Commerce of the House of Representatives and 
the Committee on Commerce, Science, and Trans-
portation of the Senate not later than the expiration 
of the 6-month period that begins on the date on 
which final regulations are issued under section 9. 
The requirements of subchapter I of chapter 35 of 
title 44, United States Code, shall not apply to the 
report required under this subsection. 
(3) REGULATION.—If the Commission finds 
that users have adequate notice regarding the uses 
of any information input directly by the user in a 
field provided on a website, such that an exemption 
from the requirements of this section, or a modifica-
tion of the notice required by this section is appro-
priate for such information, and that such an ex-
emption or modification is consistent with the public 
interest, the protection of consumers, and the pur-
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
poses of this Act, the Commission may prescribe 
such an exemption or modification by regulation. 
SEC. 4. ENFORCEMENT. 
(a) UNFAIR OR DECEPTIVE ACT OR PRACTICE.— 
This Act shall be enforced by the Commission under the 
Federal Trade Commission Act (15 U.S.C. 41 et seq.). 
A violation of any provision of this Act or of a regulation 
issued under this Act shall be treated as an unfair or de-
ceptive act or practice violating a rule promulgated under 
section 18 of the Federal Trade Commission Act (15 
U.S.C. 57a). 
(b) PENALTY FOR PATTERN OR PRACTICE VIOLA-
TIONS.— 
(1) IN GENERAL.—Notwithstanding subsection 
(a) and the Federal Trade Commission Act, in the 
case of a person who engages in a pattern or prac-
tice that violates section 2 or 3, the Commission 
may, in its discretion, seek a civil penalty for such 
pattern or practice of violations in an amount, as de-
termined by the Commission, of not more than— 
(A) $3,000,000 for each violation of sec-
tion 2; and 
(B) $1,000,000 for each violation of sec-
tion 3. 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(2) TREATMENT OF SINGLE ACTION OR CON-
DUCT.—In applying paragraph (1)— 
(A) any single action or conduct that vio-
lates section 2 or 3 with respect to multiple 
protected computers shall be treated as a single 
violation; and 
(B) any single action or conduct that vio-
lates more than one paragraph of section 2(a) 
shall be considered multiple violations, based on 
the number of such paragraphs violated. 
(c) REQUIRED SCIENTER.—Civil penalties sought 
under this section for any action may not be granted by 
the Commission or any court unless the Commission or 
court, respectively, establishes that the action was com-
mitted with actual knowledge or knowledge fairly implied 
on the basis of objective circumstances that such act is 
unfair or deceptive or violates this Act. 
(d) FACTORS IN AMOUNT OF PENALTY.—In deter-
mining the amount of any penalty pursuant to subsection 
(a) or (b), the court shall take into account the degree 
of culpability, any history of prior such conduct, ability 
to pay, effect on ability to continue to do business, and 
such other matters as justice may require. 
(e) EXCLUSIVENESS OF REMEDIES.—The remedies 
in this section (and other remedies available to the Com-
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
mission in an enforcement action against unfair and de-
ceptive acts and practices) are the exclusive remedies for 
violations of this Act. 
(f) EFFECTIVE DATE.—To the extent only that this 
section applies to violations of section 2(a), this section 
shall take effect upon the expiration of the 6-month period 
that begins on the date of the enactment of this Act. 
SEC. 5. LIMITATIONS. 
(a) LAW ENFORCEMENT AUTHORITY.—Sections 2 
and 3 shall not apply to— 
(1) any act taken by a law enforcement agent 
in the performance of official duties; or 
(2) the transmission or execution of an infor-
mation collection program in compliance with a law 
enforcement, investigatory, national security, or reg-
ulatory agency or department of the United States 
or any State in response to a request or demand 
made under authority granted to that agency or de-
partment, including a warrant issued under the Fed-
eral Rules of Criminal Procedure, an equivalent 
State warrant, a court order, or other lawful proc-
ess. 
(b) EXCEPTION RELATING TO SECURITY.—Nothing 
in this Act shall apply to— 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(1) any monitoring of, or interaction with, a 
protected computer— 
(A) in connection with the provision of a 
network access service or other service or prod-
uct with respect to which the user of the pro-
tected computer is an actual or prospective cus-
tomer, subscriber, registered user, or account 
holder; 
(B) by the provider of that service or prod-
uct or with such provider’s authorization; and 
(C) that involves or enables the collection 
of information about the user’s activities only 
with respect to the user’s relationship with or 
use of such service or product, 
to the extent that such monitoring or interaction is 
for the purpose of network security, computer secu-
rity, diagnostics, technical support or repair, net-
work management, authorized updates of software, 
or for the detection or prevention of fraudulent ac-
tivities; or 
(2) a discrete interaction with a protected com-
puter by a provider of computer software solely to 
determine whether the user of the computer is au-
thorized to use such software, that occurs upon— 
(A) initialization of the software; or 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(B) an affirmative request by the owner or 
authorized user for an update of, addition to, or 
technical service for, the software. 
(c) GOOD SAMARITAN PROTECTION.— 
(1) IN
GENERAL.—No provider of computer 
software or of interactive computer service may be 
held liable under this Act on account of any action 
voluntarily taken, or service provided, in good faith 
to remove or disable a program used to violate sec-
tion 2 or 3 that is installed on a computer of a cus-
tomer of such provider, if such provider notifies the 
customer and obtains the consent of the customer 
before undertaking such action or providing such 
service. 
(2) CONSTRUCTION.—Nothing in this sub-
section shall be construed to limit the liability of a 
provider of computer software or of an interactive 
computer service for any anti-competitive act other-
wise prohibited by law. 
(d) LIMITATION ON LIABILITY.—A manufacturer or 
retailer of computer equipment shall not be liable under 
this Act to the extent that the manufacturer or retailer 
is providing third party branded computer software that 
is installed on the equipment the manufacturer or retailer 
is manufacturing or selling. 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(e) SERVICES PROVIDED BY CABLE OPERATORS AND 
SATELLITE CARRIERS.—It shall not be a violation of sec-
tion 3 for a satellite carrier (as such term is defined in 
section 338(k) of the Communications Act of 1934 (47 
U.S.C. 338(k)) or cable operator (as such term is defined 
in section 631(a)(2) of such Act (47 U.S.C. 551(a)(2))) 
to— 
(1) utilize a navigation device (as such term is 
defined in the rules of the Federal Communications 
Commission); 
(2) interact with such a navigation device; or 
(3) transmit software to or execute software in-
stalled on such a navigation device to provide service 
or collect or disclose subscriber information, 
if the provision of such service, the utilization of or the 
interaction with such device, or the collection of or disclo-
sure of such information, is subject to section 338(i) or 
section 631 of the Communications Act of 1934. 
SEC. 6. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE LAW.— 
(1) PREEMPTION
OF
SPYWARE
LAWS.—This 
Act supersedes any provision of a statute, regula-
tion, or rule of a State or political subdivision of a 
State that expressly regulates— 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(A) unfair or deceptive conduct with re-
spect to computers similar to that described in 
section 2(a); 
(B) the transmission or execution of a 
computer program similar to that described in 
section 3; or 
(C) the use of computer software that dis-
plays advertising content based on the Web 
pages accessed using a computer. 
(2) ADDITIONAL PREEMPTION.— 
(A) IN GENERAL.—No person other than 
the Attorney General of a State may bring a 
civil action under the law of any State if such 
action is premised in whole or in part upon the 
defendant violating any provision of this Act. 
(B) PROTECTION OF CONSUMER PROTEC-
TION LAWS.—This paragraph shall not be con-
strued to limit the enforcement of any State 
consumer protection law by an Attorney Gen-
eral of a State. 
(3) PROTECTION OF CERTAIN STATE LAWS.— 
This Act shall not be construed to preempt the ap-
plicability of— 
(A) State trespass, contract, or tort law; or 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(B) other State laws to the extent that 
those laws relate to acts of fraud. 
(4) EFFECTIVE
DATE.—The preemption pro-
vided for under this subsection shall take effect, with 
respect to specific provisions of this Act, on the ef-
fective date for such provisions. 
(b) PRESERVATION OF FTC AUTHORITY.—Nothing 
in this Act may be construed in any way to limit or affect 
the Commission’s authority under any other provision of 
law, including the authority to issue advisory opinions 
(under part 1 of volume 16 of the Code of Federal Regula-
tions), policy statements, or guidance regarding this Act. 
SEC. 7. FTC REPORT ON COOKIES. 
(a) IN GENERAL.—Not later than the expiration of 
the 6-month period that begins on the date on which final 
regulations are issued under section 9, the Commission 
shall submit a report to the Congress regarding the use 
of cookies in the delivery or display of advertising to the 
owners and users of computers. The report shall examine 
the extent to which cookies are or may be used to transmit 
to a third party personally identifiable information of a 
computer owner or user, information regarding Web pages 
accessed by the owner or user, or information regarding 
advertisements previously delivered to a computer, for the 
purpose of— 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(1) delivering or displaying advertising to the 
owner or user; or 
(2) assisting the intended recipient to deliver or 
display advertising to the owner, user, or others. 
The report shall examine and describe the methods by 
which cookies and the Web sites that place them on com-
puters function separately and together, and shall com-
pare the use of cookies with the use of information collec-
tion programs (as such term is defined in section 3) to 
determine the extent to which such uses are similar or dif-
ferent. The report may include such recommendations as 
the Commission considers necessary and appropriate, in-
cluding treatment of cookies under this Act or other laws. 
(b) EFFECTIVE DATE.—This section shall take effect 
on the date of the enactment of this Act. 
(c) PAPERWORK REDUCTION REQUIREMENTS.—The 
requirements of subchapter I of chapter 35 of title 44, 
United States Code, shall not apply to the report required 
under this section. 
SEC. 8. FTC REPORT ON INFORMATION COLLECTION PRO-
GRAMS 
INSTALLED 
BEFORE 
EFFECTIVE 
DATE. 
Not later than the expiration of the 6-month period 
that begins on the date on which final regulations are 
issued under section 9, the Commission shall submit a re-
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
port to the Congress on the extent to which there are in-
stalled on protected computers information collection pro-
grams that, but for installation prior to the effective date 
under section 11(a), would be subject to the requirements 
of section 3. The report shall include recommendations re-
garding the means of affording computer users affected 
by such information collection programs the protections 
of section 3, including recommendations regarding requir-
ing a one-time notice and consent by the owner or author-
ized user of a computer to the continued collection of in-
formation by such a program so installed on the computer. 
The requirements of subchapter I of chapter 35 of title 
44, United States Code, shall not apply to the report re-
quired under this section. 
SEC. 9. REGULATIONS. 
(a) IN GENERAL.—The Commission shall issue the 
regulations required by this Act not later than the expira-
tion of the 9-month period beginning on the date of the 
enactment of this Act. In exercising its authority to issue 
any regulation under this Act, the Commission shall deter-
mine that the regulation is consistent with the public in-
terest and the purposes of this Act. Any regulations issued 
pursuant to this Act shall be issued in accordance with 
section 553 of title 5, United States Code. 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(b) EFFECTIVE DATE.—This section shall take effect 
on the date of the enactment of this Act. 
SEC. 10. DEFINITIONS. 
For purposes of this Act: 
(1) CABLE OPERATOR.—The term ‘‘cable oper-
ator’’ has the meaning given such term in section 
602 of the Communications Act of 1934 (47 U.S.C. 
522). 
(2) COLLECT.—The term ‘‘collect’’, when used 
with respect to information and for purposes only of 
section 3(b)(1)(A), does not include obtaining of the 
information by a party who is intended by the owner 
or authorized user of a protected computer to receive 
the information or by a third party authorized by 
such intended recipient to receive the information, 
pursuant to the owner or authorized user— 
(A) transferring the information to such 
intended recipient using the protected com-
puter; or 
(B) storing the information on the pro-
tected computer in a manner so that it is acces-
sible by such intended recipient. 
(3) COMPUTER; PROTECTED COMPUTER.—The 
terms ‘‘computer’’ and ‘‘protected computer’’ have 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
the meanings given such terms in section 1030(e) of 
title 18, United States Code. 
(4) COMPUTER SOFTWARE.— 
(A) IN GENERAL.—Except as provided in 
subparagraph (B), the term ‘‘computer soft-
ware’’ means a set of statements or instructions 
that can be installed and executed on a com-
puter for the purpose of bringing about a cer-
tain result. 
(B) EXCEPTIONS.—Such term does not in-
clude— 
(i) computer software that is placed 
on the computer system of a user by an 
Internet service provider, interactive com-
puter service, or Internet Web site solely to 
enable the user subsequently to use such 
provider or service or to access such Web 
site; 
(ii) a cookie; or 
(iii) any other type of text or data file 
that solely may be read or transferred by 
a computer. 
(5) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(6) DAMAGE.—The term ‘‘damage’’ has the 
meaning given such term in section 1030(e) of title 
18, United States Code. 
(7) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—The term ‘‘unfair or deceptive acts or prac-
tices’’ has the meaning applicable to such term for 
purposes of section 5 of the Federal Trade Commis-
sion Act (15 U.S.C. 45). 
(8) DISABLE.—The term ‘‘disable’’ means, with 
respect to an information collection program, to per-
manently prevent such program from executing any 
of the functions described in section 3(b)(1) that 
such program is otherwise capable of executing (in-
cluding by removing, deleting, or disabling the pro-
gram), unless the owner or operator of a protected 
computer takes a subsequent affirmative action to 
enable the execution of such functions. 
(9) INFORMATION COLLECTION FUNCTIONS.— 
The term ‘‘information collection functions’’ means, 
with respect to an information collection program, 
the functions of the program described in subsection 
(b)(1) of section 3. 
(10) INFORMATION SERVICE.—The term ‘‘infor-
mation service’’ has the meaning given such term in 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
section 3 of the Communications Act of 1934 (47 
U.S.C. 153). 
(11) INTERACTIVE
COMPUTER
SERVICE.—The 
term ‘‘interactive computer service’’ has the meaning 
given such term in section 230(f) of the Communica-
tions Act of 1934 (47 U.S.C. 230(f)). 
(12) INTERNET.—The term ‘‘Internet’’ means 
collectively the myriad of computer and tele-
communications facilities, including equipment and 
operating software, which comprise the inter-
connected world-wide network of networks that em-
ploy the Transmission Control Protocol/Internet 
Protocol, or any predecessor or successor protocols 
to such protocol, to communicate information of all 
kinds by wire or radio. 
(13) PERSONALLY
IDENTIFIABLE
INFORMA-
TION.— 
(A) IN GENERAL.—The term ‘‘personally 
identifiable information’’ means the following 
information, to the extent only that such infor-
mation allows a living individual to be identified 
from that information: 
(i) First and last name of an indi-
vidual. 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(ii) A home or other physical address 
of an individual, including street name, 
name of a city or town, and zip code. 
(iii) An electronic mail address. 
(iv) A telephone number. 
(v) A social security number, tax iden-
tification number, passport number, driv-
er’s license number, or any other govern-
ment-issued identification number. 
(vi) A credit card number. 
(vii) Any access code, password, or ac-
count number, other than an access code 
or password transmitted by an owner or 
authorized user of a protected computer to 
the intended recipient to register for, or 
log onto, a Web page or other Internet 
service or a network connection or service 
of a subscriber that is protected by an ac-
cess code or password. 
(viii) Date of birth, birth certificate 
number, or place of birth of an individual, 
except in the case of a date of birth trans-
mitted or collected for the purpose of com-
pliance with the law. 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(B) RULEMAKING.—The Commission may, 
by regulation, add to the types of information 
described in subparagraph (A) that shall be 
considered personally identifiable information 
for purposes of this Act, except that such addi-
tional types of information shall be considered 
personally identifiable information only to the 
extent that such information allows living indi-
viduals, particular computers, particular users 
of computers, or particular email addresses or 
other locations of computers to be identified 
from that information. 
(14) SUITE OF FUNCTIONALLY RELATED SOFT-
WARE.—The term suite of ‘‘functionally related soft-
ware’’ means a group of computer software pro-
grams distributed to an end user by a single pro-
vider, 
which 
programs 
enable 
features 
or 
functionalities of an integrated service offered by the 
provider. 
(15) 
TELECOMMUNICATIONS
CARRIER.—The 
term ‘‘telecommunications carrier’’ has the meaning 
given such term in section 3 of the Communications 
Act of 1934 (47 U.S.C. 153). 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
(16) TRANSMIT.—The term ‘‘transmit’’ means, 
with respect to an information collection program, 
transmission by any means. 
(17) WEB PAGE.—The term ‘‘Web page’’ means 
a location, with respect to the World Wide Web, that 
has a single Uniform Resource Locator or another 
single location with respect to the Internet, as the 
Federal Trade Commission may prescribe. 
(18) WEB SITE.—The term ‘‘web site’’ means a 
collection of Web pages that are presented and made 
available by means of the World Wide Web as a sin-
gle Web site (or a single Web page so presented and 
made available), which Web pages have any of the 
following characteristics: 
(A) A common domain name. 
(B) Common ownership, management, or 
registration. 
SEC. 11. APPLICABILITY AND SUNSET. 
(a) EFFECTIVE DATE.—Except as specifically pro-
vided otherwise in this Act, this Act shall take effect upon 
the expiration of the 12-month period that begins on the 
date of the enactment of this Act. 
(b) APPLICABILITY.—Section 3 shall not apply to an 
information collection program installed on a protected 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS
HR 964 RFS1S 
computer before the effective date under subsection (a) of 
this section. 
(c) SUNSET.—This Act shall not apply after Decem-
ber 31, 2013. 
Passed the House of Representatives June 6, 2007. 
Attest: 
LORRAINE C. MILLER, 
Clerk. 
By DEBORAH M. SPRIGGS, 
Deputy Clerk. 
VerDate Aug 31 2005 
21:13 Jul 18, 2007
Jkt 059200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H964.RFS
H964
jlentini on PROD1PC65 with BILLS