(c) ENFORCEMENT.—Subject to sections 3 and 5, a 
violation of a regulation prescribed under subsection (a) 
shall be treated as a violation of a rule defining an unfair 
or deceptive act or practice prescribed under section 
18(a)(1)(B) of the Federal Trade Commission Act (15 
U.S.C. 57a(a)(1)(B)). 
(d) NO REQUIREMENT TO COLLECT OR MAINTAIN 
DATA.—Nothing in this Act shall be interpreted to require 
an operator to collect or maintain any data that would 
not otherwise be collected or maintained. 
SEC. 3. SAFE HARBORS. 
(a) GUIDELINES.—An operator may satisfy the re-
quirements of regulations issued under section 2(b) by fol-
lowing a set of self-regulatory guidelines, issued by rep-
resentatives of the marketing or online industries, or by 
other persons, approved under subsection (b). 
(b) INCENTIVES.—
(1) SELF-REGULATORY
INCENTIVES.—In pre-
scribing regulations under section 2, the Commission 
shall provide incentives for self-regulation by opera-
tors to implement the protections afforded under the 
regulatory requirements described in subsection (b) 
of that section. 
(2) DEEMED
COMPLIANCE.—Such incentives 
shall include provisions for ensuring that a person
will be deemed to be in compliance with the require-
ments of the regulations under section 2 if that per-
son complies with guidelines that, after notice and 
comment, are approved by the Commission upon 
making a determination that the guidelines meet the 
requirements of the regulations issued under section 
2. 
(3) EXPEDITED RESPONSE TO REQUESTS.—The 
Commission shall act upon requests for safe harbor 
treatment within 180 days of the filing of the re-
quest, and shall set forth in writing its conclusions 
with regard to such requests. 
(c) APPEALS.—Final action by the Commission on a 
request for approval of guidelines, or the failure to act 
within 180 days on a request for approval of guidelines, 
submitted under subsection (b) may be appealed to a dis-
trict court of the United States of appropriate jurisdiction 
as provided for in section 706 of title 5, United States 
Code. 
SEC. 4. ACTIONS BY STATES. 
(a) IN GENERAL.—
(1) CIVIL ACTIONS.—In any case in which the 
attorney general of a State has reason to believe 
that an interest of the residents of that State has 
been or is threatened or adversely affected by the
engagement of any person in a practice that violates 
any regulation of the Commission prescribed under 
section 2(b) of this Act, the State may bring a civil 
action on behalf of the residents of the State in a 
district court of the United States of appropriate ju-
risdiction to—
(A) enjoin that practice; 
(B) enforce compliance with the regulation; 
(C) obtain damage, restitution, or other 
compensation on behalf of residents of the 
State; or 
(D) obtain such other relief as the court 
may consider to be appropriate. 
(2) NOTICE.—
(A) IN GENERAL.—Before filing an action 
under paragraph (1), the attorney general of 
the State involved shall provide to the Commis-
sion—
(i) written notice of that action; and 
(ii) a copy of the complaint for that 
action. 
(B) EXEMPTION.—
(i) IN GENERAL.—Subparagraph (A) 
shall not apply with respect to the filing of 
an action by an attorney general of a State
under this subsection, if the attorney gen-
eral determines that it is not feasible to 
provide the notice described in that sub-
paragraph before the filing of the action. 
(ii) NOTIFICATION.—In an action de-
scribed in clause (i), the attorney general 
of a State shall provide notice and a copy 
of the complaint to the Commission at the 
same time as the attorney general files the 
action. 
(b) INTERVENTION.—
(1) IN GENERAL.—On receiving notice under 
subsection (a)(2), the Commission shall have the 
right to intervene in the action that is the subject 
of the notice. 
(2) EFFECT OF INTERVENTION.—If the Com-
mission intervenes in an action under subsection (a), 
it shall have the right—
(A) to be heard with respect to any matter 
that arises in that action; and 
(B) to file a petition for appeal. 
(3) AMICUS CURIAE.—Upon application to the 
court, a person whose self-regulatory guidelines have 
been approved by the Commission and are relied 
upon as a defense by any defendant to a proceeding
under this section may file amicus curiae in that 
proceeding. 
(c) CONSTRUCTION.—For purposes of bringing any 
civil action under subsection (a), nothing in this Act shall 
be construed to prevent an attorney general of a State 
from exercising the powers conferred on the attorney gen-
eral by the laws of that State to—
(1) conduct investigations; 
(2) administer oaths or affirmations; or 
(3) compel the attendance of witnesses or the 
production of documentary and other evidence. 
(d) VENUE; SERVICE OF PROCESS.—
(1) VENUE.—Any action brought under sub-
section (a) may be brought in the district court of 
the United States that meets applicable require-
ments relating to venue under section 1391 of title 
28, United States Code. 
(2) SERVICE
OF
PROCESS.—In an action 
brought under subsection (a), process may be served 
in any district in which the defendant—
(A) is an inhabitant; or 
(B) may be found.
SEC. 5. ADMINISTRATION AND APPLICABILITY OF ACT. 
(a) IN GENERAL.—Except as otherwise provided, this 
Act shall be enforced by the Commission under the Fed-
eral Trade Commission Act (15 U.S.C. 41 et seq.). 
(b) PROVISIONS.—Compliance with the requirements 
imposed under this Act shall be enforced under—
(1) section 8 of the Federal Deposit Insurance 
Act (12 U.S.C. 1818), in the case of—
(A) national banks, and Federal branches 
and Federal agencies of foreign banks, by the 
Office of the Comptroller of the Currency; 
(B) member banks of the Federal Reserve 
System (other than national banks), branches 
and agencies of foreign banks (other than Fed-
eral branches, Federal agencies, and insured 
State branches of foreign banks), commercial 
lending companies owned or controlled by for-
eign banks, and organizations operating under 
section 25 or 25(a) of the Federal Reserve Act 
(12 U.S.C. 601 et seq. and 611 et seq.), by the 
Board; and 
(C) banks insured by the Federal Deposit 
Insurance Corporation (other than members of 
the Federal Reserve System) and insured State 
branches of foreign banks, by the Board of Di-
rectors of the Federal Deposit Insurance Cor-
poration; 
(2) section 8 of the Federal Deposit Insurance 
Act (12 U.S.C. 1818), by the Director of the Office 
of Thrift Supervision, in the case of a savings asso-
ciation the deposits of which are insured by the Fed-
eral Deposit Insurance Corporation; 
(3) the Federal Credit Union Act (12 U.S.C. 
1751 et seq.) by the National Credit Union Adminis-
tration Board with respect to any Federal credit 
union; 
(4) part A of subtitle VII of title 49, United 
States Code, by the Secretary of Transportation 
with respect to any air carrier or foreign air carrier 
subject to that part; 
(5) the Packers and Stockyards Act, 1921 (7 
U.S.C. 181 et seq.) (except as provided in section 
406 of that Act (7 U.S.C. 226, 227)), by the Sec-
retary of Agriculture with respect to any activities 
subject to that Act; and 
(6) the Farm Credit Act of 1971 (12 U.S.C. 
2001 et seq.) by the Farm Credit Administration 
with respect to any Federal land bank, Federal land 
bank association, Federal intermediate credit bank, 
or production credit association.
(e) EFFECT ON OTHER LAWS.—Nothing contained in 
this Act shall be construed to limit the authority of the 
Commission under any other provisions of law. 
(f) PREEMPTION.—Except as otherwise provided in 
this Act, this Act supersedes State law to the extent that 
it establishes a rule of law applicable to an online privacy 
action that is inconsistent with State law. Nothing in this 
Act supersedes State law with respect to prosecution of 
fraud. 
SEC. 6. REVIEW. 
Not later than 5 years after the effective date of the 
regulations initially issued under section 2, the Commis-
sion shall—
(1) review the implementation of this Act, in-
cluding the effect of the implementation of this title 
on practices relating to the collection and disclosure 
of information; and 
(2) prepare and submit to Congress a report on 
the results of the review under paragraph (1). 
SEC. 7. EFFECTIVE DATE. 
Sections 3(a), 5, and 6 of this Act shall take effect 
on the later of—
(1) the date that is 18 months after the date 
of enactment of this Act; or
(2) the date on which the Commission rules on 
the first application filed for safe harbor treatment 
under section 3 if the Commission does not rule on 
the first such application within one year after the 
date of enactment of this Act, but in no case later 
than the date that is 30 months after the date of 
enactment of this Act. 
SEC. 8. DEFINITIONS. 
In this Act: 
(1) INDIVIDUAL.—The term ‘‘individual’’ means 
a natural person of age 13 and above. 
(2) OPERATOR.—The term ‘‘operator’’—
(A) means any person who operates a Web 
site located on the Internet or an online service 
and who collects or maintains personal informa-
tion from or about the users of or visitors to 
such Web site or online service, or on whose be-
half such information is collected or main-
tained, where such Web site or online service is 
operated for commercial purposes, including 
any person offering products or services for sale 
through that Web site or online service, involv-
ing commerce—
(i) among the several States or with 1 
or more foreign nations;
(ii) in any territory of the United 
States or in the District of Columbia, or 
between any such territory and—
(I) another such territory; or 
(II) any State or foreign nation; 
or 
(iii) between the District of Columbia 
and any State, territory, or foreign nation; 
but 
(B) does not include any nonprofit entity 
that would otherwise be exempt from coverage 
under section 5 of the Federal Trade Commis-
sion Act (15 U.S.C. 45). 
(3) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(4) 
DISCLOSURE.—The 
term 
‘‘disclosure’’ 
means, with respect to personal information the re-
lease of personal information collected in identifiable 
form by an operator for any purpose, except where 
such information is provided to a person other than 
the operator who provides support for the internal 
operations of the Web site and does not disclose or 
use that information for any other purpose.
(5) FEDERAL
AGENCY.—The term ‘‘Federal 
agency’’ means an agency, as that term is defined 
in section 551(1) of title 5, United States Code. 
(6) INTERNET.—The term ‘‘Internet’’ means 
collectively the myriad of computer and tele-
communications facilities, including equipment and 
operating software, which comprise the inter-
connected world-wide network of networks that em-
ploy the Transmission Control Protocol/Internet 
Protocol, or any predecessor or successor protocols 
to such protocol, to communicate information of all 
kinds by wire or radio. 
(7) TRANSACTIONAL INFORMATION.—The term 
‘‘transactional information’’ means information gen-
erated in connection with the process of requesting, 
accessing, or otherwise using the Internet. 
(8) PERSONAL INFORMATION.—The term ‘‘per-
sonal information’’ means information collected on-
line from an individual that identifies that indi-
vidual, including—
(A) first and last name; 
(B) home and other physical address; 
(C) e-mail address; 
(D) social security number; 
(E) telephone number;
(F) any other identifier that the Commis-
sion determines identifies an individual; or 
(G) information that is maintained with, or 
can be searched or retrieved by means of, data 
described in subparagraphs (A) through (F).
Æ