I 
114TH CONGRESS 
2D SESSION 
H. R. 4517 
To provide for greater transparency in and user control over the treatment 
of data collected by mobile applications and to enhance the security 
of such data. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 10, 2016 
Mr. JOHNSON of Georgia (for himself, Mr. BARTON, Mr. CHABOT, Ms. JACK-
SON LEE, Mr. CICILLINE, and Mr. COHEN) introduced the following bill; 
which was referred to the Committee on Energy and Commerce 
A BILL 
To provide for greater transparency in and user control 
over the treatment of data collected by mobile applica-
tions and to enhance the security of such data. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Application Privacy, 
Protection, and Security Act of 2016’’ or the ‘‘APPS Act 
of 2016’’. 
SEC. 2. TRANSPARENCY, USER CONTROL, AND SECURITY. 
(a) CONSENT TO TERMS AND CONDITIONS.— 
VerDate Sep 11 2014 
04:00 Feb 11, 2016
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4517.IH
H4517
SSpencer on DSK4SPTVN1PROD with BILLS
(1) IN GENERAL.—Before a mobile application 
collects personal data about a user of the applica-
tion, the developer of the application shall— 
(A) provide the user with notice of the 
terms and conditions governing the collection, 
use, storage, and sharing of the personal data; 
and 
(B) obtain the consent of the user to such 
terms and conditions. 
(2) REQUIRED CONTENT.—The notice required 
by paragraph (1)(A) shall include the following: 
(A) The categories of personal data that 
will be collected. 
(B) The categories of purposes for which 
the personal data will be used. 
(C) The categories of third parties with 
which the personal data will be shared. 
(D) A data retention policy that governs 
the length for which the personal data will be 
stored and the terms and conditions applicable 
to storage, including a description of the rights 
of the user under subsection (b) and the proc-
ess by which the user may exercise such rights. 
(3) ADDITIONAL SPECIFICATIONS AND FLEXI-
BILITY.—The Commission shall by regulation specify 
VerDate Sep 11 2014 
04:00 Feb 11, 2016
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4517.IH
H4517
SSpencer on DSK4SPTVN1PROD with BILLS
the format, manner, and timing of the notice re-
quired by paragraph (1)(A). In promulgating the 
regulations, the Commission shall consider how to 
ensure the most effective and efficient communica-
tion to the user regarding the treatment of personal 
data. 
(4) DIRECT ACCESS TO DATA BY THIRD PAR-
TIES.—For purposes of this Act, if the developer of 
a mobile application allows a third party to access 
personal data collected by the application, such per-
sonal data shall be considered to be shared with the 
third party, whether or not such personal data are 
first transmitted to the developer. 
(b) WITHDRAWAL OF CONSENT.—The developer of a 
mobile application shall— 
(1) provide a user of the application with a 
means of— 
(A) notifying the developer that the user 
intends to stop using the application; and 
(B) requesting the developer— 
(i) to refrain from any further collec-
tion of personal data through the applica-
tion; and 
(ii) at the option of the user, either— 
VerDate Sep 11 2014 
04:00 Feb 11, 2016
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4517.IH
H4517
SSpencer on DSK4SPTVN1PROD with BILLS
(I) to the extent practicable, to 
delete any personal data collected by 
the application that is stored by the 
developer; or 
(II) to refrain from any further 
use or sharing of such data; and 
(2) within a reasonable and appropriate time 
after receiving a request under paragraph (1)(B), 
comply with such request. 
(c) SECURITY OF PERSONAL DATA AND DE-IDENTI-
FIED DATA.—The developer of a mobile application shall 
take reasonable and appropriate measures to prevent un-
authorized access to personal data and de-identified data 
collected by the application. 
(d) EXCEPTION.—Nothing in this Act prohibits the 
developer of a mobile application from disclosing or pre-
serving personal data or de-identified data as required 
by— 
(1) other Federal law (including a court order); 
or 
(2) except as provided in section 6, the law of 
a State or a political subdivision of a State (includ-
ing a court order). 
VerDate Sep 11 2014 
04:00 Feb 11, 2016
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4517.IH
H4517
SSpencer on DSK4SPTVN1PROD with BILLS
SEC. 3. APPLICATION AND ENFORCEMENT. 
(a) GENERAL APPLICATION.—The requirements of 
this Act and the regulations promulgated under this Act 
apply, according to their terms, to those persons, partner-
ships, and corporations over which the Commission has 
authority pursuant to section 5(a)(2) of the Federal Trade 
Commission Act (15 U.S.C. 45(a)(2)). 
(b) ENFORCEMENT BY FEDERAL TRADE COMMIS-
SION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of this Act or a regulation pro-
mulgated under this Act shall be treated as a viola-
tion of a regulation under section 18(a)(1)(B) of the 
Federal 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices. 
(2) POWERS
OF
COMMISSION.—The Commis-
sion shall enforce this Act and the regulations pro-
mulgated under this Act in the same manner, by the 
same means, and with the same jurisdiction, powers, 
and duties as though all applicable terms and provi-
sions of the Federal Trade Commission Act (15 
U.S.C. 41 et seq.) were incorporated into and made 
a part of this Act. Any person who violates this Act 
or a regulation promulgated under this Act shall be 
subject to the penalties and entitled to the privileges 
VerDate Sep 11 2014 
04:00 Feb 11, 2016
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4517.IH
H4517
SSpencer on DSK4SPTVN1PROD with BILLS
the complaint for such action. If the attorney gen-
eral, official, or agency determines that it is not fea-
sible to provide the notice described in this para-
graph before the filing of the action, the attorney 
general, official, or agency shall provide written no-
tice of the action and a copy of the complaint to the 
Commission immediately upon the filing of the ac-
tion. 
(3) AUTHORITY OF COMMISSION.— 
(A) IN
GENERAL.—On receiving notice 
under paragraph (2) of an action under this 
subsection, the Commission shall have the 
right— 
(i) to intervene in the action; 
(ii) upon so intervening, to be heard 
on all matters arising therein; and 
(iii) to file petitions for appeal. 
(B) LIMITATION ON STATE ACTION WHILE 
FEDERAL ACTION IS PENDING.—If the Commis-
sion or the Attorney General of the United 
States has instituted a civil action for violation 
of this Act or a regulation promulgated under 
this Act (referred to in this subparagraph as 
the ‘‘Federal action’’), no State attorney gen-
eral, official, or agency may bring an action 
VerDate Sep 11 2014 
04:00 Feb 11, 2016
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4517.IH
H4517
SSpencer on DSK4SPTVN1PROD with BILLS
under this subsection during the pendency of 
the Federal action against any defendant 
named in the complaint in the Federal action 
for any violation of this Act or such regulation 
alleged in such complaint. 
(4) RULE OF CONSTRUCTION.—For purposes of 
bringing a civil action under this subsection, nothing 
in this Act shall be construed to prevent an attorney 
general, official, or agency of a State from exercising 
the powers conferred on the attorney general, offi-
cial, or agency by the laws of such State to conduct 
investigations, administer oaths and affirmations, or 
compel the attendance of witnesses or the production 
of documentary and other evidence. 
SEC. 4. REGULATIONS. 
Not later than 1 year after the date of the enactment 
of this Act, the Commission shall promulgate regulations 
in accordance with section 553 of title 5, United States 
Code, to implement and enforce this Act. 
SEC. 5. SAFE HARBOR. 
(a) IN GENERAL.—The developer of a mobile applica-
tion may satisfy the requirements of this Act and the regu-
lations promulgated under this Act by adopting and fol-
lowing a code of conduct for consumer data privacy (inso-
far as such code relates to data collected by a mobile appli-
VerDate Sep 11 2014 
04:00 Feb 11, 2016
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4517.IH
H4517
SSpencer on DSK4SPTVN1PROD with BILLS
cation) that the Commission has approved as meeting the 
requirements of the regulations promulgated under section 
4. 
(b) REGULATIONS.—The Commission shall promul-
gate regulations in accordance with section 553 of title 
5, United States Code, to govern the consideration and 
approval of codes of conduct under subsection (a). 
SEC. 6. RELATIONSHIP TO STATE LAW. 
This Act and the regulations promulgated under this 
Act supercede a provision of law of a State or a political 
subdivision of a State only to the extent that such provi-
sion— 
(1) conflicts with this Act or such regulations, 
as determined without regard to section 2(d)(2); 
(2) specifically relates to the treatment of per-
sonal data or de-identified data; and 
(3) provides a level of transparency, user con-
trol, or security in the treatment of personal data or 
de-identified data that is less than the level provided 
by this Act and such regulations. 
SEC. 7. PRESERVATION OF FTC AUTHORITY. 
Nothing in this Act may be construed in any way to 
limit or affect the authority of the Commission under any 
other provision of law. 
VerDate Sep 11 2014 
04:00 Feb 11, 2016
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4517.IH
H4517
SSpencer on DSK4SPTVN1PROD with BILLS
SEC. 8. DEFINITIONS. 
In this Act: 
(1) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(2) DE-IDENTIFIED DATA.—The term ‘‘de-iden-
tified data’’ means data that cannot reasonably be 
used to identify or infer information about, or other-
wise be linked to, a particular individual or mobile 
device, as determined with a reasonable level of jus-
tified confidence based on the available methods and 
technologies, the nature of the data at issue, and the 
purposes for which the data will be used. 
(3) DEVELOPER.—The term ‘‘developer’’ shall 
have the meaning given such term by the Commis-
sion by regulation. 
(4) MOBILE APPLICATION.—The term ‘‘mobile 
application’’ means a software program that— 
(A) runs on the operating system of a mo-
bile device; and 
(B) collects data from a user. 
(5) MOBILE
DEVICE.—The term ‘‘mobile de-
vice’’ means a smartphone, tablet computer, or simi-
lar portable computing device that transmits data 
over a wireless connection. 
(6) PERSONAL
DATA.—The term ‘‘personal 
data’’ shall have the meaning given such term by the 
VerDate Sep 11 2014 
04:00 Feb 11, 2016
Jkt 059200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4517.IH
H4517
SSpencer on DSK4SPTVN1PROD with BILLS
Commission by regulation, except that such term 
shall not include de-identified data. 
(7) STATE.—The term ‘‘State’’ means each of 
the several States, the District of Columbia, each 
commonwealth, territory, or possession of the United 
States, and each federally recognized Indian tribe. 
(8) THIRD
PARTY.—The term ‘‘third party’’ 
means, with respect to the developer of an applica-
tion, an entity that holds itself out to the public as 
separate from the developer such that a user of the 
application 
acting 
reasonably 
under 
the 
cir-
cumstances would not expect the entity to be related 
to the developer or to have access to personal data 
the user provides to the developer. Such term in-
cludes an affiliate of the developer unless the affili-
ation is reasonably clear to users of the application. 
SEC. 9. EFFECTIVE DATE. 
This Act shall apply with respect to any collection, 
use, storage, or sharing of personal data or de-identified 
data that occurs after the date that is 30 days after the 
promulgation of final regulations under section 4. 
Æ 
VerDate Sep 11 2014 
04:00 Feb 11, 2016
Jkt 059200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6301
E:\BILLS\H4517.IH
H4517
SSpencer on DSK4SPTVN1PROD with BILLS