sons located in the United States when the data is col-
lected, to meet the following requirements: 
(1) AFFIRMATIVE, EXPRESS, AND OPT-IN CON-
SENT.—Provide users with notice through a privacy 
and data use policy of a specific request to use their 
sensitive personal information and require that users 
provide affirmative, express, and opt-in consent to 
any functionality that involves the collection, stor-
age, processing, sale, sharing, or other use of sen-
sitive personal information, including sharing sen-
sitive personal information with third parties. 
(2) PRIVACY AND DATA USE POLICY.—Provide 
users with an up-to-date, transparent privacy, secu-
rity, and data use policy that meets general require-
ments, including that such policy, presented to users 
in the context where it applies— 
(A) is concise and intelligible; 
(B) is clear and prominent in appearance; 
(C) uses clear and plain language; 
(D) uses visualizations where appropriate 
to make complex information understandable by 
the ordinary user; and 
(E) is provided free of charge. 
(3) ADDITIONAL REQUIREMENTS FOR PRIVACY 
AND DATA USE POLICY.—The privacy, security, and 
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS
data use policy required under paragraph (2) shall 
include the following: 
(A) Identity and contact information of the 
entity collecting the sensitive personal informa-
tion. 
(B) The purpose or use for collecting, stor-
ing, processing, selling, sharing, or otherwise 
using the sensitive personal information. 
(C) Third parties with whom the sensitive 
personal information will be shared and for 
what purposes. 
(D) The storage period for how long the 
sensitive personal information will be retained 
by the controller and any third party, as appli-
cable. 
(E) How consent to collecting, storing, 
processing, selling, sharing, or otherwise using 
the sensitive personal information, including 
sharing with third parties, may be withdrawn. 
(F) How a user can view or obtain the sen-
sitive personal information that they have pro-
vided to a controller and whether it can be ex-
ported to other web-based platforms. 
(G) What kind of sensitive personal infor-
mation is collected and shared. 
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS
(H) Whether the sensitive personal infor-
mation will be used to create profiles about 
users and whether they will be integrated across 
platforms. 
(I) How sensitive personal information is 
protected from unauthorized access or acquisi-
tion. 
(4) OPT-OUT
CONSENT.—For any collection, 
storage, processing, selling, sharing, or other use of 
non-sensitive personal information, including sharing 
with third parties, controllers shall provide users 
with the ability to opt out at any time. 
(5) PRIVACY AUDITS.— 
(A) IN GENERAL.—Except as provided in 
subparagraphs (C) and (D), annually, each con-
troller collecting, storing, processing, selling, 
sharing, or otherwise using sensitive personal 
information shall— 
(i) obtain a privacy audit from a 
qualified, objective, independent third- 
party; and 
(ii) shall make public whether or not 
the privacy audit found the controller com-
pliant. 
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS
(B) AUDIT
REQUIREMENTS.—Each such 
audit shall— 
(i) set forth the privacy, security, and 
data use controls that the controller has 
implemented and maintained during the 
reporting period; 
(ii) describe whether such controls are 
appropriate to the size and complexity of 
the controller, the nature and scope of the 
activities of the controller, and the nature 
of the sensitive personal information or be-
havioral data collected by the controller; 
(iii) certify whether the privacy and 
security controls operate with sufficient ef-
fectiveness to provide reasonable assurance 
to protect the privacy and security of sen-
sitive personal information or behavioral 
data, including with respect to data shared 
with third parties, and that the controls 
have so operated throughout the reporting 
period; 
(iv) be prepared and completed within 
60 days after the end of the reporting pe-
riod to which the audit applies; and 
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS
(v) be provided to the Federal Trade 
Commission or to the attorney general of 
a State, or other authorized State officer, 
within 10 days of notification by the Com-
mission or the attorney general of a State, 
or other authorized State officer where 
such person has presented to the controller 
allegations that a violation of this Act or 
any regulation issued under this Act has 
been committed by the controller. 
(C) SMALL
BUSINESS
AUDIT
EXEMP-
TION.—The audit requirements described in 
this paragraph shall not apply to controllers 
who collect, store, process, sell, share, or other-
wise use sensitive personal information relating 
to 5,000 or fewer individuals. 
(D) NON-SENSITIVE PERSONAL INFORMA-
TION EXEMPTION.—The audit requirements set 
forth above shall not apply to controllers who 
do not collect, store, process, sell, share, or oth-
erwise use sensitive personal information. 
(b) EXEMPTIONS.— 
(1) NECESSARY
OPERATIONS
AND
SECURITY 
PURPOSES.—Subsection (a) shall not apply to the 
processing, collecting, storing, sharing, selling of 
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS
sensitive personal information for the following pur-
poses: 
(A) Preventing or detecting fraud, identity 
theft, or criminal activity. 
(B) The use of such information to identify 
errors that impair functionality or otherwise en-
hancing or maintaining the availability of the 
services or information systems of the controller 
for authorized access and use. 
(C) Protecting the vital interests of the 
consumer or another natural person. 
(D) Responding in good faith to valid legal 
process or providing information as otherwise 
required or authorized by law. 
(E) Monitoring or enforcing agreements 
between the controller and an individual, includ-
ing but not limited to, terms of service, terms 
of use, user agreements, or agreements concern-
ing monitoring criminal activity. 
(F) Protecting the property, services, or 
information systems of the controller against 
unauthorized access or use. 
(G) Advancing a substantial public inter-
est, including archival purposes, scientific or 
historical research, and public health, if such 
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS
processing does not create a significant risk of 
harm to consumers. 
(2) REASONABLE EXPECTATION OF USERS.— 
The regulations promulgated pursuant to subsection 
(a) with respect to the requirement to provide opt- 
in consent shall not apply to the processing, storage, 
and collection of sensitive personal information or 
behavioral data in which such processing does not 
deviate from purposes consistent with a controller’s 
relationship with users as understood by the reason-
able user. 
SEC. 4. APPLICATION AND ENFORCEMENT BY THE FED-
ERAL TRADE COMMISSION. 
(a) COMMON CARRIERS.—Notwithstanding the limi-
tations in the Federal Trade Commission Act (15 U.S.C. 
41 et seq.) on Commission authority with respect to com-
mon carriers, this Act applies, according to its terms, to 
common carriers subject to the Communications Act of 
1934 (47 U.S.C. 151 et seq.) and all Acts amendatory 
thereof and supplementary thereto. 
(b) ENFORCEMENT.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of this Act or a regulation pro-
mulgated under this Act shall be treated as a viola-
tion of a rule under section 18(a)(1)(B) of the Fed-
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS
eral 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices. 
(2) POWERS OF COMMISSION.—Except as pro-
vided in subsection (a), the Federal Trade Commis-
sion shall enforce this Act and the regulations pro-
mulgated under this Act in the same manner, by the 
same means, and with the same jurisdiction, powers, 
and duties as though all applicable terms and provi-
sions of the Federal Trade Commission Act (15 
U.S.C. 41 et seq.) were incorporated into and made 
a part of this Act. Any person who violates this Act 
or a regulation promulgated under this Act shall be 
subject to the penalties and entitled to the privileges 
and immunities provided in the Federal Trade Com-
mission Act. 
(c) CONSTRUCTION.—Nothing in this Act shall be 
construed to limit the authority of the Federal Trade 
Commission under any other provision of law. 
SEC. 5. RIGHT OF ACTION. 
(a) RIGHT OF ACTION.—Except as provided in sub-
section (e), the attorney general of a State, or other au-
thorized State officer, alleging a violation of this Act or 
any regulation issued under this Act that affects or may 
affect such State or its residents may bring an action on 
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS
behalf of the residents of the State in any United States 
district court for the district in which the defendant is 
found, resides, or transacts business, or wherever venue 
is proper under section 1391 of title 28, to obtain appro-
priate injunctive relief. 
(b) NOTICE TO COMMISSION REQUIRED.—A State 
shall provide prior written notice to the Federal Trade 
Commission of any civil action under subsection (a) to-
gether with a copy of its complaint, except that if it is 
not feasible for the State to provide such prior notice, the 
State shall provide such notice immediately upon insti-
tuting such action. 
(c) INTERVENTION BY THE COMMISSION.—The Com-
mission may intervene in such civil action and upon inter-
vening— 
(1) be heard on all matters arising in such civil 
action; and 
(2) file petitions for appeal of a decision in such 
civil action. 
(d) CONSTRUCTION.—Nothing in this section shall be 
construed— 
(1) to prevent the attorney general of a State, 
or other authorized State officer, from exercising the 
powers conferred on the attorney general, or other 
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS
authorized State officer, by the laws of such State; 
or 
(2) to prohibit the attorney general of a State, 
or other authorized State officer, from proceeding in 
State or Federal court on the basis of an alleged vio-
lation of any civil or criminal statute of that State. 
(e) LIMITATION.— 
(1) NO SEPARATE ACTION.—An action may not 
be brought under subsection (a) if the same alleged 
violation is the subject of a pending action by the 
Commission or the United States. 
(2) EXCLUSIVE
PERIOD
TO
ACT
BY
COMMIS-
SION.—An action— 
(A) may not be brought under subsection 
(a) until the expiration of the 60-day period 
that begins on the date on which a violation is 
discovered by the Commission or the date on 
which the Commission is notified of the viola-
tion; and 
(B) may only be brought under subsection 
(a) if the Commission does not bring an action 
related to the violation during such period. 
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS
SEC. 6. PRIVACY AND DATA SECURITY EMPLOYEES AND 
FUNDING FOR THE COMMISSION. 
(a) EMPLOYMENT AUTHORITY.—The Commission 
shall hire 50 new full-time employees to focus on privacy 
and data security, 15 of which shall have technology exper-
tise. 
(b) ADDITIONAL FUNDING FOR PRIVACY AND DATA 
SECURITY.—There is authorized to be appropriated to the 
Commission $35,000,000 for issues related to privacy and 
data security. 
SEC. 7. DEFINITIONS. 
In this Act: 
(1) CALL DETAIL RECORD.—The term ‘‘call de-
tail record’’— 
(A) means session-identifying information 
(including an originating or terminating tele-
phone number, an International Mobile Sub-
scriber Identity number, or an International 
Mobile Station Equipment Identity number), a 
telephone calling card number, or the time or 
duration of a call; 
(B) does not include— 
(i) the contents (as defined in section 
2510(8) of title 18, United States Code) of 
any communication; 
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS
(ii) the name, address, or financial in-
formation of a subscriber or customer; 
(iii) cell site location or global posi-
tioning system information; or 
(iv) business customers. 
(2) CLEAR AND PROMINENT.—The term ‘‘clear 
and prominent’’ means in any communication me-
dium, the required disclosure is— 
(A) of a type, size, and location sufficiently 
noticeable for an ordinary consumer to read 
and comprehend the communication; 
(B) provided in a manner such that an or-
dinary consumer is able to read and com-
prehend the communication; 
(C) is presented in an understandable lan-
guage and syntax; 
(D) includes nothing contrary to, incon-
sistent with, or that mitigates any statement 
contained within the disclosure or within any 
document linked to or referenced therein; and 
(E) includes an option that is compliant 
with applicable obligations of the controller 
under title III of the Americans with Disabil-
ities Act of 1990 (42 U.S.C. 12181 et seq.). 
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS
(3) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(4) 
CONTROLLER.—The 
term 
‘‘controller’’ 
means a person that, on its own or jointly with other 
entities, determines the purposes and means of proc-
essing sensitive personal information. 
(5) PROCESSOR.—The term ‘‘processor’’ means 
a person that processes data on behalf of the con-
troller. 
(6) SENSITIVE PERSONAL INFORMATION.— 
(A) The term ‘‘sensitive personal informa-
tion’’ means information relating to an identi-
fied or identifiable individual, including the fol-
lowing: 
(i) Financial account information. 
(ii) Health information. 
(iii) Genetic data. 
(iv) Information pertaining to children 
under 13 years of age. 
(v) Social Security numbers. 
(vi) Unique government-issued identi-
fiers 
(vii) Authentication credentials, such 
as a username and password. 
(viii) Precise geolocation information. 
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS
(ix) Content of a wire communication, 
oral communication, or electronic commu-
nication with respect to any entity that is 
not the intended recipient of the commu-
nication. 
(x) Call detail records. 
(xi) Web browsing history, application 
usage history, and the functional equiva-
lent of either. 
(xii) Biometric information. 
(xiii) Sexual orientation. 
(xiv) Religious beliefs. 
(B) The term ‘‘sensitive personal informa-
tion’’ does not include— 
(i) de-identified information (or the 
process of transforming personal data so 
that it is not directly relatable to an identi-
fied or identifiable consumer); 
(ii) information related to employ-
ment; or 
(iii) publicly available information. 
(7) STATE.—The term ‘‘State’’ means each 
State of the United States, the District of Columbia, 
and each commonwealth, territory, or possession of 
the United States. 
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS
(8) THIRD
PARTY.—The term ‘‘third party’’ 
means an individual or entity that uses or receives 
sensitive personal information or behavioral data ob-
tained by or on behalf of a controller, other than— 
(A) a service provider of a controller to 
whom the controller discloses the consumer’s 
sensitive personal information for an oper-
ational purpose pursuant to an agreement that 
prohibits the service provider receiving the sen-
sitive personal information from using or dis-
closing the sensitive personal information for 
the benefit of the provider; and 
(B) any entity that uses sensitive personal 
information only as reasonably necessary— 
(i) to comply with applicable law, reg-
ulation, or legal process; 
(ii) to enforce the terms of use of a 
controller; or 
(iii) to detect, prevent, or mitigate 
fraud or security vulnerabilities. 
SEC. 8. RULE OF CONSTRUCTION. 
Nothing in this Act may be construed to preclude the 
acquisition by the Federal Government of— 
(1) the contents of a wire or electronic commu-
nication pursuant to other lawful authorities, includ-
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS
ing the authorities under chapter 119 of title 18, 
United States Code (commonly known as the ‘‘Wire-
tap Act’’), the Foreign Intelligence Surveillance Act 
of 1978 (50 U.S.C. 1801 et seq.), or any other pro-
vision of Federal law not specifically amended by 
this Act; or 
(2) records or other information relating to a 
subscriber or customer of any electronic communica-
tion service or remote computing service (not includ-
ing the content of such communications) pursuant to 
the Foreign Intelligence Surveillance Act of 1978 
(50 U.S.C. 1801 et seq.), chapter 119 of title 18, 
United States Code (commonly known as the ‘‘Wire-
tap Act’’), or any other provision of Federal law not 
specifically amended by this Act. 
SEC. 9. NATIONAL STANDARD. 
(a) PREEMPTION.—For a controller that is subject 
to this Act, or any regulation promulgated pursuant to 
this Act, the provisions of this Act, or any such regulation, 
shall preempt any civil provision of the law of any State 
or political subdivision of a State to the degree the law 
is focused on the reduction of privacy risk through the 
regulation of the collection of sensitive personal informa-
tion and the collection, storage, processing, sale, sharing 
with third parties, or other use of such information. 
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS
(b) CONSUMER PROTECTION LAWS.—Except as pro-
vided in subsection (a), this section may not be construed 
to limit the enforcement, or the bringing of a claim pursu-
ant to any State consumer protection law by an attorney 
general of a State, other than the extent to which any 
such law regulates the collection of sensitive personal in-
formation and the collection, storage, processing, sale, 
sharing with third parties, or other use of such informa-
tion. 
(c) PROTECTION OF CERTAIN STATE LAW.—Nothing 
in this Act may be construed to preempt the applicability 
of any of the following: 
(1) State constitutional, trespass, contract, data 
breach notification, or tort law, other than to the de-
gree such law is substantially intended to govern the 
collection of sensitive personal information and the 
collection, storage, processing, sale, sharing with 
third parties, or other use of such information. 
(2) Any other State law to the extent that the 
law relates to acts of fraud, wiretapping, or the pro-
tection of social security numbers. 
(3) Any State law to the extent the law pro-
vides additional provisions to specifically regulate the 
covered entities as defined for purposes of the regu-
lations promulgated pursuant to section 264(c) of 
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS
the Health Insurance Portability and Accountability 
Act of 1996 (Public Law 104–191), section 444 of 
the General Education Provisions Act (commonly 
known as the Family Educational Rights and Pri-
vacy Act of 1974) (20 U.S.C. 1232g), the Fair 
Credit Reporting Act (15 U.S.C. 1681 et seq.), or 
the Gramm-Leach-Bliley Act (15 U.S.C. 6701 et 
seq.). 
(4) Any private contract based on a State law 
that requires a party to provide additional or greater 
privacy for sensitive personal information or data se-
curity protections to an individual than this Act, or 
any regulation promulgated pursuant to this Act. 
SEC. 10. EFFECTIVE DATE. 
This Act shall take effect 180 days after the date of 
the enactment of this Act. 
Æ 
VerDate Sep 11 2014 
20:16 Apr 15, 2019
Jkt 089200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6301
E:\BILLS\H2013.IH
H2013
jbell on DSK3GLQ082PROD with BILLS