tices of interactive computer services (in this section 
referred to as the ‘‘privacy framework’’). 
(2) 
FRAMEWORK
CRITERIA.—The 
privacy 
framework shall include an assessment of the fol-
lowing criteria, with respect to an interactive com-
puter service: 
(A) Whether the service collects, stores, 
uses, and shares only covered information nec-
essary to perform a relevant user-facing pur-
pose. 
(B) The level of transparency of the serv-
ice regarding the privacy practices of the serv-
ice, including the extent to which the service 
communicates to users the following: 
(i) What covered information may be 
collected. 
(ii) How such information may be 
stored. 
(iii) How such information may be 
used. 
(iv) With whom such information may 
be shared. 
(C) Whether the service offers users any 
options to designate preferences for covered in-
formation collected, stored, used, or shared in 
VerDate Sep 11 2014 
00:51 Mar 26, 2020
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
pamtmann on DSKBC07HB2PROD with BILLS
excess of the minimum information necessary to 
perform a relevant user-facing purpose, and 
whether such preferences are respected. 
(D) The risk that covered information col-
lected by the service may be used to identify 
users, while taking into consideration whether 
the identification is necessary to perform a rel-
evant user-facing purpose of the service and 
whether a reasonable user would be aware of 
such purpose. 
(E) The security of sensitive covered infor-
mation collected by the service. 
(F) Any other criteria the Commission de-
termines necessary to protect the privacy of 
users with respect to covered information. 
(b) PRIVACY SCORES.— 
(1) DEVELOPMENT.—The Commission shall use 
the privacy framework to develop a system for 
issuing a score for an interactive computer service 
that reflects the extent to which the service protects 
the privacy of the covered information of users, tak-
ing into consideration the purpose of the service and 
options offered to users with respect to covered in-
formation (in this section referred to as a ‘‘privacy 
score’’). 
VerDate Sep 11 2014 
00:51 Mar 26, 2020
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
pamtmann on DSKBC07HB2PROD with BILLS
(2) ISSUANCE OF SCORE.—The Commission— 
(A) shall issue a privacy score for the 100 
interactive computer services that have the 
most unique United States users each year (as 
determined by the Commission); and 
(B) may issue a privacy score for inter-
active computer services not described in sub-
paragraph (A) with a high number of unique 
United States users (as determined by the 
Commission). 
(3) EVALUATION OF SCORE.—Each year, the 
Commission shall evaluate interactive computer serv-
ices to determine— 
(A) whether the interactive computer serv-
ices required to be issued a privacy score under 
paragraph (2)(A) have changed; 
(B) whether the interactive computer serv-
ices eligible to be issued a privacy score under 
paragraph (2)(B) have changed; and 
(C) whether to modify a privacy score pre-
viously issued for an interactive computer serv-
ice based on changes in— 
(i) the extent to which the service pro-
tects the privacy of the covered informa-
tion of users; 
VerDate Sep 11 2014 
00:51 Mar 26, 2020
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
pamtmann on DSKBC07HB2PROD with BILLS
(ii) the purposes of the service; or 
(iii) the options offered to users with 
respect to covered information collected by 
the service. 
(4) PUBLICATION OF SCORE.— 
(A) IN GENERAL.—Not later than 1 year 
after the date of the enactment of this Act, the 
Commission shall publish on a public website of 
the Commission the privacy scores issued pur-
suant to paragraph (2), the corresponding dates 
of issuance, and a link to the online privacy pol-
icy of the interactive computer service. 
(B) UPDATES.—Beginning on the date 
that is 1 year after the date on which the Com-
mission initially publishes the privacy scores 
under subparagraph (A), and annually there-
after, the Commission shall publish updates of 
such scores based on the evaluation conducted 
under paragraph (3) for the relevant year. 
(C) DECLINE IN UNIQUE UNITED STATES 
USERS.—Notwithstanding the Commission de-
termining that an interactive computer service 
for which a privacy score has been issued pur-
suant to paragraph (2) no longer has a high 
number of unique United States users, the 
VerDate Sep 11 2014 
00:51 Mar 26, 2020
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
pamtmann on DSKBC07HB2PROD with BILLS
Commission may continue to publish the most 
recently issued score and the corresponding 
date of issuance. 
(5) DISPUTE PROCESS.—Not later than 1 year 
after the date of the enactment of this Act, the 
Commission shall establish a process for resolving 
disputes related to the issuance of privacy scores 
that have been raised— 
(A) by an interactive computer service for 
which a privacy score has been issued; or 
(B) by a third party. 
(6) REPORT.—Not later than 2 years after the 
date of the publication of the initial privacy scores 
under paragraph (4)(A), and annually thereafter, 
the Commission shall submit to Congress a report 
that describes the following: 
(A) The number of interactive computer 
services evaluated with respect to the issuance 
of privacy scores during the most recently com-
pleted year and in total. 
(B) Trends related to privacy scores, in-
cluding the number of privacy scores that the 
Commission issued or modified during the most 
recently completed year and in total. 
VerDate Sep 11 2014 
00:51 Mar 26, 2020
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
pamtmann on DSKBC07HB2PROD with BILLS
(C) Any common characteristics of inter-
active computer services with low privacy 
scores, such as privacy policy terms, industry, 
location where the service is based, type of serv-
ice offered, or ownership or control of the serv-
ice. 
(D) If applicable, an identification of 
trends in the practices of interactive computer 
services with respect to the privacy of the cov-
ered information of users of such services, in-
cluding any potential emerging threats posed by 
such practices. 
(E) If determined necessary by the Com-
mission, recommendations for congressional ac-
tion to promote the privacy of users of inter-
active computer services. 
(c) PUBLIC AWARENESS AND RECOGNITION.—The 
Commission may— 
(1) conduct public awareness campaigns to edu-
cate users about the privacy scores issued under 
subsection (b); and 
(2) establish a recognition program for inter-
active computer services with outstanding privacy 
scores issued under such subsection. 
(d) DEFINITIONS.—In this section: 
VerDate Sep 11 2014 
00:51 Mar 26, 2020
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
pamtmann on DSKBC07HB2PROD with BILLS
(1) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(2) COVERED INFORMATION.—The term ‘‘cov-
ered information’’ means information that is linked 
or that the Commission determines is reasonably 
linkable to a unique user of an interactive computer 
service, including— 
(A) first and last name of the user; 
(B) home or other physical address of the 
user, including the name of a street, city, or 
town; 
(C) email address of the user; 
(D) telephone number of the user; and 
(E) Social Security number of the user. 
(3) INTERACTIVE
COMPUTER
SERVICE.—The 
term ‘‘interactive computer service’’ has the meaning 
given the term in section 230(f) of the Communica-
tions Act of 1934 (47 U.S.C. 230(f)). 
(4) SENSITIVE
COVERED
INFORMATION.—The 
term ‘‘sensitive covered information’’ means any of 
the following covered information: 
(A) Financial information of the user. 
(B) Biometric identifiers of the user. 
(C) Citizenship or immigration status of 
the user. 
VerDate Sep 11 2014 
00:51 Mar 26, 2020
Jkt 099200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H6227.IH
H6227
pamtmann on DSKBC07HB2PROD with BILLS