I 
112TH CONGRESS 
2D SESSION 
H. R. 6377 
To require disclosures to consumers regarding the capability of software 
to monitor mobile device usage, to require the express consent of the 
consumer prior to monitoring, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 12, 2012 
Mr. MARKEY (for himself and Ms. DEGETTE) introduced the following bill; 
which was referred to the Committee on Energy and Commerce 
A BILL 
To require disclosures to consumers regarding the capability 
of software to monitor mobile device usage, to require 
the express consent of the consumer prior to monitoring, 
and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Mobile Device Privacy 
Act’’. 
VerDate Mar 15 2010 
23:28 Sep 12, 2012
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H6377.IH
H6377
tjames on DSK6SPTVN1PROD with BILLS
SEC. 2. DISCLOSURES TO CONSUMERS REGARDING MOBILE 
DEVICE MONITORING SOFTWARE. 
(a) IN GENERAL.—Not later than 1 year after the 
date of the enactment of this Act, the Federal Trade Com-
mission shall promulgate regulations under section 553 of 
title 5, United States Code, that require— 
(1) a person who is in the business of selling 
mobile devices directly to consumers (including a 
provider of commercial mobile service or commercial 
mobile data service who sells mobile devices in con-
nection with contracts to provide service) to disclose 
the information described in subsection (b) to the 
consumer at the time of sale of a mobile device on 
which monitoring software is installed; 
(2) a provider of commercial mobile service or 
commercial mobile data service to disclose the infor-
mation described in subsection (b) to the consumer 
at the time of entry into a contract to provide serv-
ice to the consumer on a mobile device— 
(A) on which the provider installs moni-
toring software in connection with such con-
tract; and 
(B) that the consumer does not purchase 
from the provider in connection with such con-
tract; 
VerDate Mar 15 2010 
23:28 Sep 12, 2012
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H6377.IH
H6377
tjames on DSK6SPTVN1PROD with BILLS
(3) a manufacturer of a mobile device or of the 
operating system software for a mobile device who 
installs monitoring software on such device, after 
such device is sold to the consumer, to disclose to 
the consumer at the time of installing such software 
the information described in subsection (b); 
(4) a provider of commercial mobile service or 
commercial mobile data service who installs moni-
toring software on a mobile device, after entry into 
a contract to provide service to the consumer on 
such device, to disclose to the consumer at the time 
of installing such software the information described 
in subsection (b); and 
(5) a person who operates a website or other 
online service from which a consumer downloads 
monitoring software for installation on a mobile de-
vice to disclose the information described in sub-
section (b) to the consumer at the time of the 
download. 
(b) INFORMATION DESCRIBED.—The information de-
scribed in this subsection is the following: 
(1) The fact that the monitoring software is in-
stalled on the mobile device (or, in the case of a dis-
closure described in subsection (a)(5), the fact that 
VerDate Mar 15 2010 
23:28 Sep 12, 2012
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H6377.IH
H6377
tjames on DSK6SPTVN1PROD with BILLS
the software that the consumer downloads is moni-
toring software). 
(2) The types of information that the moni-
toring software is capable of collecting and transmit-
ting. 
(3) The identity of any person to whom any in-
formation collected will be transmitted and of any 
other person with whom such information will be 
shared. 
(4) How such information will be used. 
(5) Procedures by which a consumer who has 
consented to collection and transmission of informa-
tion by the monitoring software may exercise the op-
portunity to prohibit further collection and trans-
mission, as described in section 3(2). 
(6) Such additional information about the mon-
itoring software as the Federal Trade Commission 
considers appropriate. 
(c) MANNER OF DISCLOSURE.—The regulations pro-
mulgated under subsection (a) shall require the following: 
(1) The disclosures shall be made in a clear and 
conspicuous manner, to be determined by the Fed-
eral Trade Commission. 
(2) The disclosures shall be displayed in a clear 
and conspicuous manner on the website of a person 
VerDate Mar 15 2010 
23:28 Sep 12, 2012
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H6377.IH
H6377
tjames on DSK6SPTVN1PROD with BILLS
required to make such disclosures, except that if 
such person does not maintain a website, such per-
son shall file such disclosures with the appropriate 
Commission. 
(d) EXEMPTIONS PERMITTED.—If the Federal Trade 
Commission determines that the use of monitoring soft-
ware for a particular purpose is consistent with the rea-
sonable expectations of consumers, the Federal Trade 
Commission may include in the regulations promulgated 
under subsection (a) an exemption from the disclosures 
required by such regulations with respect to monitoring 
software that is used only for such purpose (or for another 
purpose with respect to which the Federal Trade Commis-
sion has made a determination under this subsection). 
SEC. 3. CONSUMER CONSENT TO MONITORING OF MOBILE 
DEVICE USAGE. 
Not later than 1 year after the date of the enactment 
of this Act, the Federal Trade Commission shall promul-
gate regulations under section 553 of title 5, United 
States Code, that require any person who is subject to the 
disclosure requirements of the regulations promulgated 
under section 2(a) to— 
(1) obtain the express consent of the consumer 
prior to the time when the monitoring software first 
begins collecting and transmitting information; and 
VerDate Mar 15 2010 
23:28 Sep 12, 2012
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H6377.IH
H6377
tjames on DSK6SPTVN1PROD with BILLS
(2) provide a consumer who has consented to 
collection and transmission of information by the 
monitoring software with the opportunity at any 
time to prohibit further collection and transmission 
of information by such software. 
SEC. 4. INFORMATION SECURITY REQUIREMENTS. 
(a) IN GENERAL.—Not later than 1 year after the 
date of the enactment of this Act, the Federal Trade Com-
mission shall promulgate regulations under section 553 of 
title 5, United States Code, that require any person who 
receives, directly or indirectly, information that is trans-
mitted from monitoring software with respect to which dis-
closures are required by the regulations promulgated 
under section 2(a) to establish and implement policies and 
procedures regarding information security practices for 
the treatment and protection of such information, taking 
into consideration— 
(1) the size of, and the nature, scope, and com-
plexity of the activities engaged in by, such person; 
(2) the current state of the art in administra-
tive, technical, and physical safeguards for pro-
tecting such information; and 
(3) the cost of implementing such safeguards. 
(b) REQUIREMENTS.—Such regulations shall require 
the policies and procedures to include the following: 
VerDate Mar 15 2010 
23:28 Sep 12, 2012
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H6377.IH
H6377
tjames on DSK6SPTVN1PROD with BILLS
(1) A security policy with respect to the collec-
tion, use, sale, other dissemination, and maintenance 
of such information. 
(2) The identification of an officer or other in-
dividual as the point of contact with responsibility 
for the management of the security of such informa-
tion. 
(3) A process for identifying and assessing any 
reasonably foreseeable vulnerabilities in any system 
maintained by such person that contains such infor-
mation, which shall include regular monitoring for a 
breach of security of such system. 
(4) A process for taking preventive and correc-
tive action to mitigate against any vulnerabilities 
identified in the process required by paragraph (3), 
which may include implementing any changes to se-
curity practices and the architecture, installation, or 
implementation of network or operating software. 
(5) A process for disposing of such information 
by shredding, permanently erasing, or otherwise 
modifying such information to make such informa-
tion permanently unreadable or undecipherable. 
(6) A standard method or methods for the de-
struction of paper documents and other non-elec-
tronic data containing such information. 
VerDate Mar 15 2010 
23:28 Sep 12, 2012
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H6377.IH
H6377
tjames on DSK6SPTVN1PROD with BILLS
(c) DISCLOSURE OF POLICIES AND PROCEDURES.— 
Such regulations shall require the policies and procedures 
to be displayed in a clear and conspicuous manner on the 
website of a person required to establish and implement 
such policies and procedures, except that if such person 
does not maintain a website, such person shall file such 
policies and procedures with the appropriate Commission. 
(d) TREATMENT OF ENTITIES GOVERNED BY OTHER 
LAW.—A person shall be deemed to be in compliance with 
the regulations promulgated under subsection (a) if such 
person is in compliance with any other Federal law that 
requires such person to maintain policies and procedures 
with respect to information security that, taken as a whole 
and as the Federal Trade Commission shall determine in 
the rulemaking required by such subsection, provide pro-
tections substantially similar to, or greater than, those 
provided by the policies and procedures required by the 
regulations promulgated under such subsection. 
SEC. 5. FILING OF CERTAIN AGREEMENTS REGARDING IN-
FORMATION RECEIPT. 
(a) IN GENERAL.—Not later than 1 year after the 
date of the enactment of this Act, the Federal Trade Com-
mission shall promulgate regulations under section 553 of 
title 5, United States Code, that require a copy of an 
VerDate Mar 15 2010 
23:28 Sep 12, 2012
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H6377.IH
H6377
tjames on DSK6SPTVN1PROD with BILLS
agreement described in subsection (b) to be filed with the 
appropriate Commission. 
(b) AGREEMENT DESCRIBED.—An agreement de-
scribed in this subsection— 
(1) is an agreement under which a person re-
ceives, directly or indirectly, information that is 
transmitted from monitoring software with respect 
to which disclosures are required by the regulations 
promulgated under section 2(a); and 
(2) does not include an agreement between such 
a person and the consumer on whose mobile device 
such monitoring software is installed. 
SEC. 6. ENFORCEMENT. 
(a) BY FEDERAL TRADE COMMISSION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of a regulation promulgated 
under section 2, 3, 4, or 5 shall be treated as a vio-
lation of a regulation under section 18(a)(1)(B) of 
the Federal Trade Commission Act (15 U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices. 
(2) POWERS
OF
FEDERAL
TRADE
COMMIS-
SION.—The Federal Trade Commission shall enforce 
the regulations promulgated under sections 2, 3, 4, 
and 5 in the same manner, by the same means, and 
VerDate Mar 15 2010 
23:28 Sep 12, 2012
Jkt 019200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H6377.IH
H6377
tjames on DSK6SPTVN1PROD with BILLS
with the same jurisdiction, powers, and duties as 
though all applicable terms and provisions of the 
Federal Trade Commission Act (15 U.S.C. 41 et 
seq.) were incorporated into and made a part of this 
Act, and any person who violates such regulations 
shall be subject to the penalties and entitled to the 
privileges and immunities provided in the Federal 
Trade Commission Act. 
(b) BY FEDERAL COMMUNICATIONS COMMISSION.— 
(1) TREATMENT AS VIOLATION OF COMMUNICA-
TIONS ACT OF 1934.—A violation of a regulation pro-
mulgated under section 2, 3, 4, or 5 by a provider 
of commercial mobile service or commercial mobile 
data service or a manufacturer of a mobile device 
shall be treated as a violation of the Communica-
tions Act of 1934 (47 U.S.C. 151 et seq.). 
(2) POWERS
OF
FEDERAL
COMMUNICATIONS 
COMMISSION.—The Federal Communications Com-
mission shall enforce the regulations promulgated 
under sections 2, 3, 4, and 5 with respect to pro-
viders of commercial mobile service or commercial 
mobile data service and manufacturers of mobile de-
vices in the same manner, by the same means, and 
with the same jurisdiction, powers, and duties as 
though all applicable terms and provisions of the 
VerDate Mar 15 2010 
23:28 Sep 12, 2012
Jkt 019200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H6377.IH
H6377
tjames on DSK6SPTVN1PROD with BILLS
Communications Act of 1934 were incorporated into 
and made a part of this Act, and any such provider 
or manufacturer who violates such regulations shall 
be subject to the penalties and entitled to the privi-
leges and immunities provided in the Communica-
tions Act of 1934. 
(c) DIVISION OF RESPONSIBILITIES BETWEEN FTC 
AND FCC.— 
(1) REGULATIONS.—In promulgating the regu-
lations required by sections 2, 3, 4, and 5, the Fed-
eral Trade Commission shall consult with the Fed-
eral Communications Commission. 
(2) ENFORCEMENT.—In enforcing such regula-
tions, the Federal Trade Commission and the Fed-
eral Communications Commission shall consult with 
each other. 
(3) FCC REGULATIONS ON FILINGS.—The Fed-
eral Communications Commission, in consultation 
with the Federal Trade Commission, may promul-
gate regulations with respect to the form and man-
ner of any filing that is required to be made with 
the Federal Communications Commission by a regu-
lation required by section 2, 4, or 5. 
(d) ACTIONS BY STATES.— 
VerDate Mar 15 2010 
23:28 Sep 12, 2012
Jkt 019200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H6377.IH
H6377
tjames on DSK6SPTVN1PROD with BILLS
(1) CIVIL ACTIONS.—In any case in which the 
attorney general of a State, or an official or agency 
of a State, has reason to believe that an interest of 
the residents of that State has been or is threatened 
or adversely affected by an act or practice that vio-
lates any regulation promulgated under section 2, 3, 
4, or 5, the State, as parens patriae, may bring a 
civil action on behalf of the residents of the State in 
an appropriate State court or an appropriate district 
court of the United States to— 
(A) enjoin that act or practice; 
(B) enforce compliance with the regulation; 
(C) obtain damages, restitution, or other 
compensation on behalf of residents of the 
State; or 
(D) obtain such other legal and equitable 
relief as the court may consider to be appro-
priate. 
(2) NOTICE.—Before filing an action under this 
subsection, the attorney general, official, or agency 
of the State involved shall provide to the appropriate 
Commission a written notice of that action and a 
copy of the complaint for that action. If the attorney 
general, official, or agency determines that it is not 
feasible to provide the notice described in this para-
VerDate Mar 15 2010 
23:28 Sep 12, 2012
Jkt 019200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H6377.IH
H6377
tjames on DSK6SPTVN1PROD with BILLS
graph before the filing of the action, the attorney 
general, official, or agency shall provide written no-
tice of the action and a copy of the complaint to the 
appropriate Commission immediately upon the filing 
of the action. 
(3) AUTHORITY
OF
APPROPRIATE
COMMIS-
SION.— 
(A) IN
GENERAL.—On receiving notice 
under paragraph (2) of an action under this 
subsection, the appropriate Commission shall 
have the right— 
(i) to intervene in the action; 
(ii) upon so intervening, to be heard 
on all matters arising therein; and 
(iii) to file petitions for appeal. 
(B) LIMITATION ON STATE ACTION WHILE 
FEDERAL ACTION IS PENDING.—If the Federal 
Trade Commission, the Federal Communica-
tions Commission, or the Attorney General of 
the United States has instituted a civil action 
for violation of a regulation promulgated under 
section 2, 3, 4, or 5 (referred to in this sub-
paragraph as the ‘‘Federal action’’), no State 
attorney general, official, or agency may bring 
an action under this subsection during the 
VerDate Mar 15 2010 
23:28 Sep 12, 2012
Jkt 019200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H6377.IH
H6377
tjames on DSK6SPTVN1PROD with BILLS
pendency of the Federal action against any de-
fendant named in the complaint in the Federal 
action for any violation as alleged in that com-
plaint. 
(4) RULE OF CONSTRUCTION.—For purposes of 
bringing a civil action under this subsection, nothing 
in this Act shall be construed to prevent an attorney 
general, official, or agency of a State from exercising 
the powers conferred on the attorney general, offi-
cial, or agency by the laws of that State to conduct 
investigations, administer oaths and affirmations, or 
compel the attendance of witnesses or the production 
of documentary and other evidence. 
(e) PRIVATE RIGHT OF ACTION.— 
(1) IN GENERAL.—A person injured by an act 
in violation of a regulation promulgated under sec-
tion 2, 3, 4, or 5 may bring in an appropriate State 
court or an appropriate district court of the United 
States— 
(A) an action to enjoin such violation; 
(B) an action to recover damages for ac-
tual monetary loss from such violation, or to re-
ceive up to $1,000 in damages for each such 
violation, whichever is greater; or 
(C) both such actions. 
VerDate Mar 15 2010 
23:28 Sep 12, 2012
Jkt 019200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H6377.IH
H6377
tjames on DSK6SPTVN1PROD with BILLS
(2) WILLFUL OR KNOWING VIOLATIONS.—If the 
court finds that the defendant acted willfully or 
knowingly in committing a violation described in 
paragraph (1), the court may, in its discretion, in-
crease the amount of the award to an amount equal 
to not more than 3 times the amount available 
under paragraph (1)(B). 
(3) COSTS.—The court shall award to a pre-
vailing plaintiff in an action under this subsection 
the costs of such action and reasonable attorney’s 
fees, as determined by the court. 
(4) LIMITATION.—An action may be com-
menced under this subsection not later than 2 years 
after the date on which the person first discovered 
or had a reasonable opportunity to discover the vio-
lation. 
(5) NONEXCLUSIVE REMEDY.—The remedy pro-
vided by this subsection shall be in addition to any 
other remedies available to the person, except that, 
in the case of a violation or series of related viola-
tions by a common carrier subject to title II of the 
Communications Act of 1934 (47 U.S.C. 201 et 
seq.), the person may pursue either the remedy pro-
vided by this subsection or any remedies provided by 
such title, but not both. 
VerDate Mar 15 2010 
23:28 Sep 12, 2012
Jkt 019200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H6377.IH
H6377
tjames on DSK6SPTVN1PROD with BILLS
SEC. 7. DEFINITIONS. 
In this Act: 
(1) APPROPRIATE
COMMISSION.—The term 
‘‘appropriate Commission’’ means either the Federal 
Trade Commission or the Federal Communications 
Commission, or both, depending on which Commis-
sion has jurisdiction under section 6 with respect to 
the person and activity involved. 
(2) COMMERCIAL MOBILE DATA SERVICE.—The 
term ‘‘commercial mobile data service’’ has the 
meaning given such term in section 6001 of the Mid-
dle Class Tax Relief and Job Creation Act of 2012 
(47 U.S.C. 1401). 
(3) COMMERCIAL MOBILE SERVICE.—The term 
‘‘commercial mobile service’’ has the meaning given 
such term in section 332 of the Communications Act 
of 1934 (47 U.S.C. 332). 
(4) MOBILE
DEVICE.—The term ‘‘mobile de-
vice’’ means a personal electronic device that has the 
capability of transmitting and receiving voice, video, 
or data communications by means of commercial 
mobile service or commercial mobile data service. 
(5) MONITORING SOFTWARE.—The term ‘‘mon-
itoring software’’ means software that has the capa-
bility to monitor the usage of a mobile device or the 
location of the user and to transmit the information 
VerDate Mar 15 2010 
23:28 Sep 12, 2012
Jkt 019200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H6377.IH
H6377
tjames on DSK6SPTVN1PROD with BILLS
collected to another device or system, whether or not 
such capability is the primary function of the soft-
ware or the purpose for which the software is mar-
keted. 
Æ 
VerDate Mar 15 2010 
23:28 Sep 12, 2012
Jkt 019200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6301
E:\BILLS\H6377.IH
H6377
tjames on DSK6SPTVN1PROD with BILLS