I 
109TH CONGRESS 
1ST SESSION 
H. R. 84 
To require the Federal Trade Commission to prescribe regulations to protect 
the privacy of personal information collected from and about individuals 
who are not covered by the Children’s Online Privacy Protection Act 
of 1998 on the Internet, to provide greater individual control over the 
collection and use of that information, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JANUARY 4, 2005 
Mr. FRELINGHUYSEN introduced the following bill; which was referred to the 
Committee on Energy and Commerce 
A BILL 
To require the Federal Trade Commission to prescribe regu-
lations to protect the privacy of personal information 
collected from and about individuals who are not covered 
by the Children’s Online Privacy Protection Act of 1998 
on the Internet, to provide greater individual control 
over the collection and use of that information, and 
for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Online Privacy Protec-
tion Act of 2005’’.
SEC. 2. REGULATION OF UNFAIR AND DECEPTIVE ACTS 
AND PRACTICES IN CONNECTION WITH THE 
COLLECTION, USE AND DISCLOSURE OF PER-
SONAL INFORMATION. 
(a) ACTS PROHIBITED.— 
(1) IN GENERAL.—It is unlawful for an oper-
ator of a Web site or online service to collect, use 
or disclose personal information in a manner that 
violates the regulations prescribed under subsection 
(b). 
(2) DISCLOSURE.—Notwithstanding paragraph 
(1), neither an operator of a Web site or online serv-
ice nor the operator’s agent shall be held to be liable 
under this Act for any disclosure made in good faith 
and following reasonable procedures in responding to 
a request under subsection (b)(1)(B) by an indi-
vidual for disclosure of personal information per-
taining to such individual. 
(b) REGULATIONS.— 
(1) IN GENERAL.—Not later than 1 year after 
the date of the enactment of this Act, the Commis-
sion shall promulgate under section 553 of title 5, 
United States Code, regulations that— 
(A) require the operator of any Web site or 
online service—
(i) to provide notice on its Web site, 
in a clear and conspicuous manner, of the 
identity of the operator, what personal in-
formation is collected by the operator, how 
the operator uses such information, and 
what information may be shared with other 
companies; and 
(ii) to provide a meaningful and sim-
ple online process for individuals to con-
sent to or limit the disclosure of personal 
information for purposes unrelated to 
those for which such information was ob-
tained or described in the notice under 
clause (i); 
(B) require the operator to provide, upon 
request of an individual under this subpara-
graph who has provided personal information to 
that Web site or online service, upon proper 
identification— 
(i) a description of the specific types 
of personal information collected by that 
operator that was sold or transferred to an 
external company; and 
(ii) notwithstanding any other provi-
sion of law, a means that is reasonable
under the circumstances for the individual 
to obtain the personal information de-
scribed in paragraph (i) from such indi-
vidual; and 
(C) require the operator of such Web site 
or online service to establish and maintain rea-
sonable procedures to protect the confiden-
tiality, security, and integrity of personal infor-
mation it collects or maintains. 
(2) WHEN
PURPOSE
LIMITATION
NOT
RE-
QUIRED.—The regulations shall provide that the 
purpose 
limitation 
required 
under 
paragraph 
(1)(A)(ii) is not required for—
(A) transactional information where identi-
fiable information is not removed; 
(B) personal information where it is used 
to render or conduct a legitimate business activ-
ity related to the business of the operator (for 
example, the use of an e-mail address to re-
spond to an e-mail communication); or 
(C) the collection, use, or dissemination of 
such information by the operator of such a Web 
site or online service necessary to the extent 
permitted under other provisions of law.
(3) WHEN ACCESS NOT REQUIRED.—The regu-
lations shall provide that access as required under 
paragraph (1)(B)(ii) is not required—
(A) to transactional information where 
identifiable information is not removed; 
(B) to information that is commercially 
confidential to the operator and is obtained 
from sources outside of the individual’s contact 
with the operator’s Web site; 
(C) to information that is solely for inter-
nal company processes and is neither sold, 
transferred, nor used for activities external to 
the Web site’s operator; 
(D) to information that is discarded upon 
the conclusion of the process that generates it; 
or 
(E) to information that has no impact 
upon an individual. 
(4) TERMINATION
OF
SERVICE.—The regula-
tions shall permit the operator of a Web site or an 
online service to terminate service provided to an in-
dividual who has refused, under the regulations pre-
scribed under paragraph (1)(B)(ii), to permit the op-
erator’s further use or maintenance in retrievable 
form, or future collection, of personal information.