SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Securely Protect Your-
self Against Cyber Trespass Act’’ or the ‘‘Spy Act’’. 
SEC. 2. PROHIBITION OF UNFAIR OR DECEPTIVE ACTS OR 
PRACTICES RELATING TO SPYWARE. 
(a) PROHIBITION.—It is unlawful for any person, 
who is not the owner or authorized user of a protected 
computer, to engage in unfair or deceptive acts or prac-
tices that involve any of the following conduct with respect 
to the protected computer: 
(1) Taking control of the computer by— 
(A) utilizing such computer to send unso-
licited information or material from the com-
puter to others; 
(B) diverting the Internet browser of the 
computer, or similar program of the computer 
used to access and navigate the Internet— 
(i) without authorization of the owner 
or authorized user of the computer; and 
(ii) away from the site the user in-
tended to view, to one or more other Web 
pages, such that the user is prevented from 
viewing the content at the intended Web 
page, unless such diverting is otherwise au-
thorized;
(C) accessing, hijacking, or otherwise using 
the modem, or Internet connection or service, 
for the computer and thereby causing damage 
to the computer or causing the owner or au-
thorized user or a third party defrauded by 
such conduct to incur charges or other costs for 
a service that is not authorized by such owner 
or authorized user; 
(D) using the computer as part of an ac-
tivity performed by a group of computers that 
causes damage to another computer; or 
(E) delivering advertisements or a series of 
advertisements that a user of the computer can-
not close or terminate without undue effort or 
knowledge by the user or without turning off 
the computer or closing all sessions of the 
Internet browser for the computer. 
(2) Modifying settings related to use of the 
computer or to the computer’s access to or use of 
the Internet by altering— 
(A) the Web page that appears when the 
owner or authorized user launches an Internet 
browser or similar program used to access and 
navigate the Internet;
(B) the default provider used to access or 
search the Internet, or other existing Internet 
connections settings; 
(C) a list of bookmarks used by the com-
puter to access Web pages; or 
(D) security or other settings of the com-
puter that protect information about the owner 
or authorized user for the purposes of causing 
damage or harm to the computer or owner or 
user. 
(3) Collecting personally identifiable informa-
tion through the use of a keystroke logging function. 
(4) Inducing the owner or authorized user of 
the computer to disclose personally identifiable infor-
mation by means of a Web page that— 
(A) is substantially similar to a Web page 
established or provided by another person; and 
(B) misleads the owner or authorized user 
that such Web page is provided by such other 
person. 
(5) Inducing the owner or authorized user to 
install a component of computer software onto the 
computer, or preventing reasonable efforts to block 
the installation or execution of, or to disable, a com-
ponent of computer software by—
(A) presenting the owner or authorized 
user with an option to decline installation of 
such a component such that, when the option is 
selected by the owner or authorized user or 
when the owner or authorized user reasonably 
attempts to decline the installation, the installa-
tion nevertheless proceeds; or 
(B) causing such a component that the 
owner or authorized user has properly removed 
or disabled to automatically reinstall or reac-
tivate on the computer. 
(6) Misrepresenting that installing a separate 
component of computer software or providing log-in 
and password information is necessary for security 
or privacy reasons, or that installing a separate com-
ponent of computer software is necessary to open, 
view, or play a particular type of content. 
(7) Inducing the owner or authorized user to 
install or execute computer software by misrepre-
senting the identity or authority of the person or en-
tity providing the computer software to the owner or 
user. 
(8) Inducing the owner or authorized user to 
provide personally identifiable, password, or account 
information to another person—
(A) by misrepresenting the identity of the 
person seeking the information; or 
(B) without the authority of the intended 
recipient of the information. 
(9) Removing, disabling, or rendering inoper-
ative a security, anti-spyware, or anti-virus tech-
nology installed on the computer. 
(10) Installing or executing on the computer 
one or more additional components of computer soft-
ware with the intent of causing a person to use such 
components in a way that violates any other provi-
sion of this section. 
(b) GUIDANCE.—The Commission shall issue guid-
ance regarding compliance with and violations of this sec-
tion. This subsection shall take effect upon the date of 
the enactment of this Act. 
(c) EFFECTIVE DATE.—Except as provided in sub-
section (b), this section shall take effect upon the expira-
tion of the 6-month period that begins on the date of the 
enactment of this Act. 
SEC. 3. PROHIBITION OF COLLECTION OF CERTAIN INFOR-
MATION WITHOUT NOTICE AND CONSENT. 
(a) OPT-IN REQUIREMENT.—Except as provided in 
subsection (e), it is unlawful for any person—
(1) to transmit to a protected computer, which 
is not owned by such person and for which such per-
son is not an authorized user, any information col-
lection program, unless— 
(A) such information collection program 
provides notice in accordance with subsection 
(c) before downloading or installing any of the 
information collection program; and 
(B) such information collection program 
includes the functions required under sub-
section (d); or 
(2) to execute any information collection pro-
gram installed on such a protected computer un-
less— 
(A) before execution of any of the informa-
tion collection functions of the program, the 
owner or an authorized user of the protected 
computer has consented to such execution pur-
suant to notice in accordance with subsection 
(c); and 
(B) such information collection program 
includes the functions required under sub-
section (d). 
(b) INFORMATION COLLECTION PROGRAM.—
(1) IN GENERAL.—For purposes of this section, 
the term ‘‘information collection program’’ means 
computer software that performs either of the fol-
lowing functions: 
(A) COLLECTION OF PERSONALLY IDENTI-
FIABLE
INFORMATION.—The computer soft-
ware— 
(i) collects personally identifiable in-
formation; and 
(ii)(I) sends such information to a 
person other than the owner or authorized 
user of the computer, or 
(II) uses such information to deliver 
advertising to, or display advertising on, 
the computer. 
(B) COLLECTION
OF
INFORMATION
RE-
GARDING INTERNET ACTIVITY TO DELIVER AD-
VERTISING.—The computer software— 
(i) collects information regarding the 
user’s Internet activity using the computer; 
and 
(ii) uses such information to deliver 
advertising to, or display advertising on, 
the computer.
(2) EXCEPTION
FOR
SOFTWARE
COLLECTING 
INFORMATION
REGARDING
INTERNET
ACTIVITY 
WITHIN A PARTICULAR WEB SITE.—Computer soft-
ware that otherwise would be considered an informa-
tion collection program by reason of paragraph 
(1)(B) shall not be considered such a program if— 
(A) the only information collected by the 
software regarding the user’s internet activity, 
and used to deliver advertising to, or display 
advertising on, the protected computer, is— 
(i) information regarding Web pages 
within a particular Web site; or 
(ii) in the case of any Internet-based 
search function, user-supplied search terms 
necessary to complete the search and re-
turn results to the user; 
(B) such information collected is not sent 
to a person other than— 
(i) the provider of the Web site 
accessed or Internet-based search function; 
or 
(ii) a party authorized to facilitate the 
display or functionality of Web pages with-
in the Web site accessed; and
(C) the only advertising delivered to or dis-
played on the computer using such information 
is advertising on Web pages within that par-
ticular Web site. 
(c) NOTICE AND CONSENT.— 
(1) IN GENERAL.—Notice in accordance with 
this subsection with respect to an information collec-
tion program is clear and conspicuous notice in plain 
language, set forth as the Commission shall provide, 
that meets all of the following requirements: 
(A) The notice clearly distinguishes a 
statement required under subparagraph (B) 
from any other information visually presented 
contemporaneously on the computer. 
(B) The notice contains one of the fol-
lowing statements, as applicable, or a substan-
tially similar statement: 
(i) With respect to an information col-
lection program described in subsection 
(b)(1)(A): ‘‘This program will collect and 
transmit information about you. Do you 
accept?’’. 
(ii) With respect to an information 
collection program described in subsection 
(b)(1)(B): ‘‘This program will collect infor-
mation about Web pages you access and 
will use that information to display adver-
tising on your computer. Do you accept?’’. 
(iii) With respect to an information 
collection program that performs the ac-
tions described in both subparagraphs (A) 
and (B) of subsection (b)(1): ‘‘This pro-
gram will collect and transmit information 
about you and will collect information 
about Web pages you access and use that 
information to display advertising on your 
computer. Do you accept?’’. 
(C) The notice provides for the user— 
(i) to grant or deny consent referred 
to in subsection (a) by selecting an option 
to grant or deny such consent; and 
(ii) to abandon or cancel the trans-
mission or execution referred to in sub-
section (a) without granting or denying 
such consent. 
(D) The notice provides an option for the 
user to select to display on the computer, before 
granting or denying consent using the option 
required under subparagraph (C), a clear de-
scription of—
(i) the types of information to be col-
lected and sent (if any) by the information 
collection program; 
(ii) the purpose for which such infor-
mation is to be collected and sent; and 
(iii) in the case of an information col-
lection program that first executes any of 
the information collection functions of the 
program together with the first execution 
of other computer software, the identity of 
any such software that is an information 
collection program. 
(E) The notice provides for concurrent dis-
play of the information required under subpara-
graphs (B) and (C) and the option required 
under subparagraph (D) until the user— 
(i) grants or denies consent using the 
option required under subparagraph (C)(i); 
(ii) abandons or cancels the trans-
mission or execution pursuant to subpara-
graph (C)(ii); or 
(iii) selects the option required under 
subparagraph (D). 
(2) SINGLE
NOTICE.—The Commission shall 
provide that, in the case in which multiple informa-
tion collection programs are provided to the pro-
tected computer together, or as part of a suite of 
functionally related software, the notice require-
ments of paragraphs (1)(A) and (2)(A) of subsection 
(a) may be met by providing, before execution of any 
of the information collection functions of the pro-
grams, clear and conspicuous notice in plain lan-
guage in accordance with paragraph (1) of this sub-
section by means of a single notice that applies to 
all such information collection programs, except that 
such notice shall provide the option under subpara-
graph (D) of paragraph (1) of this subsection with 
respect to each such information collection program. 
(3) CHANGE IN INFORMATION COLLECTION.—If 
an owner or authorized user has granted consent to 
execution of an information collection program pur-
suant to a notice in accordance with this subsection: 
(A) IN
GENERAL.—No subsequent such 
notice is required, except as provided in sub-
paragraph (B). 
(B) SUBSEQUENT
NOTICE.—The person 
who transmitted the program shall provide an-
other notice in accordance with this subsection 
and obtain consent before such program may be 
used to collect or send information of a type or
for a purpose that is materially different from, 
and outside the scope of, the type or purpose 
set forth in the initial or any previous notice. 
(4) REGULATIONS.—The Commission shall 
issue regulations to carry out this subsection. 
(d) REQUIRED FUNCTIONS.—The functions required 
under this subsection to be included in an information col-
lection program that executes any information collection 
functions with respect to a protected computer are as fol-
lows: 
(1) DISABLING
FUNCTION.—With respect to 
any information collection program, a function of 
the program that allows a user of the program to re-
move the program or disable operation of the pro-
gram with respect to such protected computer by a 
function that— 
(A) is easily identifiable to a user of the 
computer; and 
(B) can be performed without undue effort 
or knowledge by the user of the protected com-
puter. 
(2) IDENTITY FUNCTION.— 
(A) IN GENERAL.—With respect only to an 
information collection program that uses infor-
mation collected in the manner described in
subparagraph (A)(ii)(II) or (B)(ii) of subsection 
(b)(1) and subject to subparagraph (B) of this 
paragraph, a function of the program that pro-
vides that each display of an advertisement di-
rected or displayed using such information, 
when the owner or authorized user is accessing 
a Web page or online location other than of the 
provider of the computer software, is accom-
panied by the name of the information collec-
tion program, a logogram or trademark used 
for the exclusive purpose of identifying the pro-
gram, or a statement or other information suffi-
cient to clearly identify the program. 
(B) EXEMPTION FOR EMBEDDED ADVER-
TISEMENTS.—The Commission shall, by regula-
tion, exempt from the applicability of subpara-
graph (A) the embedded display of any adver-
tisement on a Web page that contempora-
neously displays other information. 
(3) RULEMAKING.—The Commission may issue 
regulations to carry out this subsection. 
(e) LIMITATION
ON LIABILITY.—A telecommuni-
cations carrier, a provider of information service or inter-
active computer service, a cable operator, or a provider 
of transmission capability shall not be liable under this
section to the extent that the carrier, operator, or pro-
vider— 
(1) transmits, routes, hosts, stores, or provides 
connections for an information collection program 
through a system or network controlled or operated 
by or for the carrier, operator, or provider; or 
(2) provides an information location tool, such 
as a directory, index, reference, pointer, or hypertext 
link, through which the owner or user of a protected 
computer locates an information collection program. 
(f) STUDY AND ADDITIONAL EXEMPTION.— 
(1) STUDY
AND
REPORT.—The Commission 
shall conduct a study to determine the applicability 
of the information collection prohibitions of this sec-
tion to information that is input directly by users in 
a field provided on a website. The study shall exam-
ine— 
(A) the nature of such fields for user 
input; 
(B) the use of a user’s information once 
input and whether such information is sent to 
a person other than the provider of the Web 
site;