cations carrier, cable operator, computer hardware or 
software provider, or provider of information service 
or interactive computer service, to the extent that such 
monitoring or interaction is for network or computer 
security purposes, diagnostics, technical support, or 
repair, or for the detection or prevention of fraudulent 
activities; or 
(2) a discrete interaction with a protected com-
puter by a provider of computer software solely to de-
termine whether the user of the computer is author-
ized to use such software, that occurs upon—
(A) initialization of the software; or 
(B) an affirmative request by the owner or 
authorized user for an update of, addition to, or 
technical service for, the software. 
(c) GOOD SAMARITAN PROTECTION.—No provider of 
computer software or of interactive computer service may 
be held liable under this Act on account of any action volun-
tarily taken, or service provided, in good faith to remove 
or disable a program used to violate section 2 or 3 that 
is installed on a computer of a customer of such provider, 
if such provider notifies the customer and obtains the con-
sent of the customer before undertaking such action or pro-
viding such service.
(d) LIMITATION ON LIABILITY.—A manufacturer or re-
tailer of computer equipment shall not be liable under this 
Act to the extent that the manufacturer or retailer is pro-
viding third party branded computer software that is in-
stalled on the equipment the manufacturer or retailer is 
manufacturing or selling. 
SEC. 6. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE LAW.—
(1) PREEMPTION OF SPYWARE LAWS.—This Act 
supersedes any provision of a statute, regulation, or 
rule of a State or political subdivision of a State that 
expressly regulates—
(A) deceptive conduct with respect to com-
puters similar to that described in section 2(a); 
(B) the transmission or execution of a com-
puter program similar to that described in sec-
tion 3; or 
(C) the use of computer software that dis-
plays advertising content based on the Web pages 
accessed using a computer. 
(2) ADDITIONAL PREEMPTION.—
(A) IN GENERAL.—No person other than the 
Attorney General of a State may bring a civil 
action under the law of any State if such action
is premised in whole or in part upon the defend-
ant violating any provision of this Act. 
(B) PROTECTION
OF
CONSUMER
PROTEC-
TION LAWS.—This paragraph shall not be con-
strued to limit the enforcement of any State con-
sumer protection law by an Attorney General of 
a State. 
(3) PROTECTION
OF
CERTAIN
STATE
LAWS.—
This Act shall not be construed to preempt the appli-
cability of—
(A) State trespass, contract, or tort law; or 
(B) other State laws to the extent that those 
laws relate to acts of fraud. 
(b) PRESERVATION OF FTC AUTHORITY.—Nothing in 
this Act may be construed in any way to limit or affect 
the Commission’s authority under any other provision of 
law, including the authority to issue advisory opinions 
(under part 1 of volume 16 of the Code of Federal Regula-
tions), policy statements, or guidance regarding this Act. 
SEC. 7. ANNUAL FTC REPORT. 
For the 12-month period that begins upon the effective 
date under section 11(a) and for each 12-month period 
thereafter, the Commission shall submit a report to the Con-
gress that—
(1) specifies the number and types of actions 
taken during such period to enforce sections 2(a) and 
section 3, the disposition of each such action, any 
penalties levied in connection with such actions, and 
any penalties collected in connection with such ac-
tions; and 
(2) describes the administrative structure and 
personnel and other resources committed by the Com-
mission for enforcement of this Act during such pe-
riod. 
Each report under this subsection for a 12-month period 
shall be submitted not later than 90 days after the expira-
tion of such period. 
SEC. 8. FTC REPORT ON COOKIES. 
(a) IN GENERAL.—Not later than the expiration of the 
6-month period that begins on the date of the enactment 
of this Act, the Commission shall submit a report to the 
Congress regarding the use of cookies, including tracking 
cookies, in the delivery or display of advertising to the own-
ers and users of computers. The report shall examine and 
describe the methods by which cookies and the Web sites that 
place them on computers function separately and together, 
and shall compare the use of cookies with the use of infor-
mation collection programs (as such term is defined in sec-
tion 3) to determine the extent to which such uses are simi-
lar or different. The report may include such recommenda-
tions as the Commission considers necessary and appro-
priate, including treatment of cookies under this Act or 
other laws. 
(b) DEFINITION.—For purposes of this section, the 
term ‘‘tracking cookie’’ means a cookie or similar text or 
data file used alone or in conjunction with one or more 
Web sites to transmit or convey personally identifiable in-
formation of a computer owner or user, or information re-
garding Web pages accessed by the owner or user, to a party 
other than the intended recipient, for the purpose of—
(1) delivering or displaying advertising to the 
owner or user; or 
(2) assisting the intended recipient to deliver or 
display advertising to the owner, user, or others. 
(c) EFFECTIVE DATE.—This section shall take effect 
on the date of the enactment of this Act. 
SEC. 9. REGULATIONS. 
(a) IN GENERAL.—The Commission shall issue the reg-
ulations required by this Act not later than the expiration 
of the 6-month period beginning on the date of the enact-
ment of this Act. In exercising its authority to issue any 
regulation under this Act, the Commission shall determine 
that the regulation is consistent with the public interest and 
the purposes of this Act. Any regulations issued pursuant
to this Act shall be issued in accordance with section 553 
of title 5, United States Code. 
(b) EFFECTIVE DATE.—This section shall take effect 
on the date of the enactment of this Act. 
SEC. 10. DEFINITIONS. 
For purposes of this Act: 
(1) CABLE OPERATOR.—The term ‘‘cable oper-
ator’’ has the meaning given such term in section 602 
of the Communications Act of 1934 (47 U.S.C. 522). 
(2) COLLECT.—The term ‘‘collect’’, when used 
with respect to information and for purposes only of 
section 3(b)(1)(A), does not include obtaining of the 
information by a party who is intended by the owner 
or authorized user of a protected computer to receive 
the information pursuant to the owner or authorized 
user—
(A) transferring the information to such in-
tended recipient using the protected computer; or 
(B) storing the information on the protected 
computer in a manner so that it is accessible by 
such intended recipient. 
(3) COMPUTER; PROTECTED
COMPUTER.—The 
terms ‘‘computer’’ and ‘‘protected computer’’ have the 
meanings given such terms in section 1030(e) of title 
18, United States Code.
(4) COMPUTER SOFTWARE.—
(A) IN GENERAL.—Except as provided in 
subparagraph (B), the term ‘‘computer software’’ 
means a set of statements or instructions that 
can be installed and executed on a computer for 
the purpose of bringing about a certain result. 
(B) EXCEPTION.—Such term does not in-
clude computer software that is placed on the 
computer system of a user by an Internet service 
provider, interactive computer service, or Inter-
net Web site solely to enable the user subse-
quently to use such provider or service or to ac-
cess such Web site. 
(C) RULE
OF
CONSTRUCTION
REGARDING 
COOKIES.—This paragraph may not be con-
strued to include, as computer software—
(i) a cookie; or 
(ii) any other type of text or data file 
that solely may be read or transferred by a 
computer. 
(5) 
COMMISSION.—The 
term 
‘‘Commission’’ 
means the Federal Trade Commission. 
(6) DAMAGE.—The term ‘‘damage’’ has the 
meaning given such term in section 1030(e) of title 
18, United States Code.
(7) DECEPTIVE ACTS OR PRACTICES.—The term 
‘‘deceptive acts or practices’’ has the meaning appli-
cable to such term for purposes of section 5 of the 
Federal Trade Commission Act (15 U.S.C. 45). 
(8) DISABLE.—The term ‘‘disable’’ means, with 
respect to an information collection program, to per-
manently prevent such program from executing any 
of the functions described in section 3(b)(1) that such 
program is otherwise capable of executing (including 
by removing, deleting, or disabling the program), un-
less the owner or operator of a protected computer 
takes a subsequent affirmative action to enable the 
execution of such functions. 
(9) INFORMATION COLLECTION FUNCTIONS.—The 
term ‘‘information collection functions’’ means, with 
respect to an information collection program, the 
functions of the program described in subsection 
(b)(1) of section 3. 
(10) INFORMATION SERVICE.—The term ‘‘infor-
mation service’’ has the meaning given such term in 
section 3 of the Communications Act of 1934 (47 
U.S.C. 153). 
(11) INTERACTIVE
COMPUTER
SERVICE.—The 
term ‘‘interactive computer service’’ has the meaning
given such term in section 230(f) of the Communica-
tions Act of 1934 (47 U.S.C. 230(f)). 
(12) INTERNET.—The term ‘‘Internet’’ means 
collectively the myriad of computer and telecommuni-
cations facilities, including equipment and operating 
software, which comprise the interconnected world-
wide network of networks that employ the Trans-
mission Control Protocol/Internet Protocol, or any 
predecessor or successor protocols to such protocol, to 
communicate information of all kinds by wire or 
radio. 
(13) 
PERSONALLY
IDENTIFIABLE
INFORMA-
TION.—
(A) IN
GENERAL.—The term ‘‘personally 
identifiable information’’ means the following in-
formation, to the extent only that such informa-
tion allows a living individual to be identified 
from that information: 
(i) First and last name of an indi-
vidual. 
(ii) A home or other physical address 
of an individual, including street name, 
name of a city or town, and zip code. 
(iii) An electronic mail address. 
(iv) A telephone number.
(v) A social security number, tax iden-
tification number, passport number, driver’s 
license number, or any other government-
issued identification number. 
(vi) A credit card number. 
(vii) Any access code, password, or ac-
count number, other than an access code or 
password transmitted by an owner or au-
thorized user of a protected computer to the 
intended recipient to register for, or log 
onto, a Web page or other Internet service 
or a network connection or service of a sub-
scriber that is protected by an access code or 
password. 
(viii) Date of birth, birth certificate 
number, or place of birth of an individual, 
except in the case of a date of birth trans-
mitted or collected for the purpose of com-
pliance with the law. 
(B) RULEMAKING.—The Commission may, 
by regulation, add to the types of information 
described in subparagraph (A) that shall be con-
sidered personally identifiable information for 
purposes of this Act, except that such additional 
types of information shall be considered person-
ally identifiable information only to the extent 
that such information allows living individuals, 
particular computers, particular users of com-
puters, or particular email addresses or other lo-
cations of computers to be identified from that 
information. 
(14) SUITE OF FUNCTIONALLY RELATED SOFT-
WARE.—The term suite of ‘‘functionally related soft-
ware’’ means a group of computer software programs 
distributed to an end user by a single provider, which 
programs are necessary to enable features or 
functionalities of an integrated service offered by the 
provider. 
(15) TELECOMMUNICATIONS CARRIER.—The term 
‘‘telecommunications carrier’’ has the meaning given 
such term in section 3 of the Communications Act of 
1934 (47 U.S.C. 153). 
(16) TRANSMIT.—The term ‘‘transmit’’ means, 
with respect to an information collection program, 
transmission by any means. 
(17) WEB PAGE.—The term ‘‘Web page’’ means 
a location, with respect to the World Wide Web, that 
has a single Uniform Resource Locator or another 
single location with respect to the Internet, as the 
Federal Trade Commission may prescribe.
(18) WEB SITE.—The term ‘‘web site’’ means a 
collection of Web pages that are presented and made 
available by means of the World Wide Web as a single 
Web site (or a single Web page so presented and made 
available), which Web pages have such characteristics 
in relation to each other as the Commission may pre-
scribe, which may include—
(A) a common domain name; 
(B) a common theme or topic; 
(C) common ownership, management, or 
registration; and 
(D) relationship to a common intended be-
ginning file or home page or other means of ac-
cessing or linking the pages together. 
SEC. 11. APPLICABILITY AND SUNSET. 
(a) EFFECTIVE DATE.—Except as specifically pro-
vided otherwise in this Act, this Act shall take effect upon 
the expiration of the 12-month period that begins on the 
date of the enactment of this Act. 
(b) APPLICABILITY.—Section 3 shall not apply to an 
information collection program installed on a protected 
computer before the effective date under subsection (a) of 
this section. 
(c) SUNSET.—This Act shall not apply after December 
31, 2010.
Union Calendar No. 15
109TH CONGRESS 
1ST SESSION 
H. R. 29
[Report No. 109–32] 
A BILL 
To protect users of the Internet from unknowing 
transmission of their personally identifiable infor-
mation through spyware programs, and for other 
purposes. 
APRIL 12, 2005
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed