HR 29 RFS 
language, set forth as the Commission shall provide, 
that meets all of the following requirements: 
(A) The notice clearly distinguishes such 
notice from any other information visually pre-
sented contemporaneously on the computer. 
(B) The notice contains one of the fol-
lowing statements, as applicable, or a substan-
tially similar statement: 
(i) With respect to an information col-
lection program described in subsection 
(b)(1)(A): ‘‘This program will collect and 
transmit information about you. Do you 
accept?’’. 
(ii) With respect to an information 
collection program described in subsection 
(b)(1)(B): ‘‘This program will collect infor-
mation about Web pages you access and 
will use that information to display adver-
tising on your computer. Do you accept?’’. 
(iii) With respect to an information 
collection program that performs the ac-
tions described in both subparagraphs (A) 
and (B) of subsection (b)(1): ‘‘This pro-
gram will collect and transmit information 
about you and will collect information
HR 29 RFS 
about Web pages you access and use that 
information to display advertising on your 
computer. Do you accept?’’. 
(C) The notice provides for the user—
(i) to grant or deny consent referred 
to in subsection (a) by selecting an option 
to grant or deny such consent; and 
(ii) to abandon or cancel the trans-
mission or execution referred to in sub-
section (a) without granting or denying 
such consent. 
(D) The notice provides an option for the 
user to select to display on the computer, before 
granting or denying consent using the option 
required under subparagraph (C), a clear de-
scription of—
(i) the types of information to be col-
lected and sent (if any) by the information 
collection program; 
(ii) the purpose for which such infor-
mation is to be collected and sent; and 
(iii) in the case of an information col-
lection program that first executes any of 
the information collection functions of the 
program together with the first execution
HR 29 RFS 
of other computer software, the identity of 
any such software that is an information 
collection program. 
(E) The notice provides for concurrent dis-
play of the information required under subpara-
graphs (B) and (C) and the option required 
under subparagraph (D) until the user—
(i) grants or denies consent using the 
option required under subparagraph (C)(i); 
(ii) abandons or cancels the trans-
mission or execution pursuant to subpara-
graph (C)(ii); or 
(iii) selects the option required under 
subparagraph (D). 
(2) SINGLE
NOTICE.—The Commission shall 
provide that, in the case in which multiple informa-
tion collection programs are provided to the pro-
tected computer together, or as part of a suite of 
functionally related software, the notice require-
ments of paragraphs (1)(A) and (2)(A) of subsection 
(a) may be met by providing, before execution of any 
of the information collection functions of the pro-
grams, clear and conspicuous notice in plain lan-
guage in accordance with paragraph (1) of this sub-
section by means of a single notice that applies to
HR 29 RFS 
all such information collection programs, except that 
such notice shall provide the option under subpara-
graph (D) of paragraph (1) of this subsection with 
respect to each such information collection program. 
(3) CHANGE IN INFORMATION COLLECTION.—If 
an owner or authorized user has granted consent to 
execution of an information collection program pur-
suant to a notice in accordance with this subsection: 
(A) IN
GENERAL.—No subsequent such 
notice is required, except as provided in sub-
paragraph (B). 
(B) SUBSEQUENT
NOTICE.—The person 
who transmitted the program shall provide an-
other notice in accordance with this subsection 
and obtain consent before such program may be 
used to collect or send information of a type or 
for a purpose that is materially different from, 
and outside the scope of, the type or purpose 
set forth in the initial or any previous notice. 
(4) REGULATIONS.—The Commission shall 
issue regulations to carry out this subsection. 
(d) REQUIRED FUNCTIONS.—The functions required 
under this subsection to be included in an information col-
lection program that executes any information collection
HR 29 RFS 
functions with respect to a protected computer are as fol-
lows: 
(1) DISABLING
FUNCTION.—With respect to 
any information collection program, a function of 
the program that allows a user of the program to re-
move the program or disable operation of the pro-
gram with respect to such protected computer by a 
function that—
(A) is easily identifiable to a user of the 
computer; and 
(B) can be performed without undue effort 
or knowledge by the user of the protected com-
puter. 
(2) IDENTITY FUNCTION.—
(A) IN GENERAL.—With respect only to an 
information collection program that uses infor-
mation collected in the manner described in 
subparagraph (A)(ii)(II) or (B)(ii) of subsection 
(b)(1) and subject to subparagraph (B) of this 
paragraph, a function of the program that pro-
vides that each display of an advertisement di-
rected or displayed using such information, 
when the owner or authorized user is accessing 
a Web page or online location other than of the 
provider of the computer software, is accom-
HR 29 RFS 
panied by the name of the information collec-
tion program, a logogram or trademark used 
for the exclusive purpose of identifying the pro-
gram, or a statement or other information suffi-
cient to clearly identify the program. 
(B) EXEMPTION FOR EMBEDDED ADVER-
TISEMENTS.—The Commission shall, by regula-
tion, exempt from the applicability of subpara-
graph (A) the embedded display of any adver-
tisement on a Web page that contempora-
neously displays other information. 
(3) RULEMAKING.—The Commission may issue 
regulations to carry out this subsection. 
(e) LIMITATION
ON LIABILITY.—A telecommuni-
cations carrier, a provider of information service or inter-
active computer service, a cable operator, or a provider 
of transmission capability shall not be liable under this 
section to the extent that the carrier, operator, or pro-
vider—
(1) transmits, routes, hosts, stores, or provides 
connections for an information collection program 
through a system or network controlled or operated 
by or for the carrier, operator, or provider; or 
(2) provides an information location tool, such 
as a directory, index, reference, pointer, or hypertext
HR 29 RFS 
link, through which the owner or user of a protected 
computer locates an information collection program. 
SEC. 4. ENFORCEMENT. 
(a) UNFAIR OR DECEPTIVE ACT OR PRACTICE.—
This Act shall be enforced by the Commission under the 
Federal Trade Commission Act (15 U.S.C. 41 et seq.). 
A violation of any provision of this Act or of a regulation 
issued under this Act shall be treated as an unfair or de-
ceptive act or practice violating a rule promulgated under 
section 18 of the Federal Trade Commission Act (15 
U.S.C. 57a). 
(b) PENALTY FOR PATTERN OR PRACTICE VIOLA-
TIONS.—
(1) IN GENERAL.—Notwithstanding subsection 
(a) and the Federal Trade Commission Act, in the 
case of a person who engages in a pattern or prac-
tice that violates section 2 or 3, the Commission 
may, in its discretion, seek a civil penalty for such 
pattern or practice of violations in an amount, as de-
termined by the Commission, of not more than—
(A) $3,000,000 for each violation of sec-
tion 2; and 
(B) $1,000,000 for each violation of sec-
tion 3.
HR 29 RFS 
(2) TREATMENT OF SINGLE ACTION OR CON-
DUCT.—In applying paragraph (1)—
(A) any single action or conduct that vio-
lates section 2 or 3 with respect to multiple 
protected computers shall be treated as a single 
violation; and 
(B) any single action or conduct that vio-
lates more than one paragraph of section 2(a) 
shall be considered multiple violations, based on 
the number of such paragraphs violated. 
(c) REQUIRED SCIENTER.—Civil penalties sought 
under this section for any action may not be granted by 
the Commission or any court unless the Commission or 
court, respectively, establishes that the action was com-
mitted with actual knowledge or knowledge fairly implied 
on the basis of objective circumstances that such act is 
unfair or deceptive or violates this Act. 
(d) FACTORS IN AMOUNT OF PENALTY.—In deter-
mining the amount of any penalty pursuant to subsection 
(a) or (b), the court shall take into account the degree 
of culpability, any history of prior such conduct, ability 
to pay, effect on ability to continue to do business, and 
such other matters as justice may require. 
(e) EXCLUSIVENESS OF REMEDIES.—The remedies 
in this section (including remedies available to the Com-
HR 29 RFS 
mission under the Federal Trade Commission Act) are the 
exclusive remedies for violations of this Act. 
(f) EFFECTIVE DATE.—To the extent only that this 
section applies to violations of section 2(a), this section 
shall take effect upon the expiration of the 6-month period 
that begins on the date of the enactment of this Act. 
SEC. 5. LIMITATIONS. 
(a) LAW ENFORCEMENT AUTHORITY.—Sections 2 
and 3 shall not apply to—
(1) any act taken by a law enforcement agent 
in the performance of official duties; or 
(2) the transmission or execution of an infor-
mation collection program in compliance with a law 
enforcement, investigatory, national security, or reg-
ulatory agency or department of the United States 
or any State in response to a request or demand 
made under authority granted to that agency or de-
partment, including a warrant issued under the Fed-
eral Rules of Criminal Procedure, an equivalent 
State warrant, a court order, or other lawful proc-
ess. 
(b) EXCEPTION RELATING TO SECURITY.—Nothing 
in this Act shall apply to—
(1) any monitoring of, or interaction with, a 
subscriber’s Internet or other network connection or
HR 29 RFS 
service, or a protected computer, by a telecommuni-
cations carrier, cable operator, computer hardware 
or software provider, or provider of information serv-
ice or interactive computer service, to the extent that 
such monitoring or interaction is for network or 
computer security purposes, diagnostics, technical 
support, or repair, or for the detection or prevention 
of fraudulent activities; or 
(2) a discrete interaction with a protected com-
puter by a provider of computer software solely to 
determine whether the user of the computer is au-
thorized to use such software, that occurs upon—
(A) initialization of the software; or 
(B) an affirmative request by the owner or 
authorized user for an update of, addition to, or 
technical service for, the software. 
(c) GOOD SAMARITAN PROTECTION.—No provider of 
computer software or of interactive computer service may 
be held liable under this Act on account of any action vol-
untarily taken, or service provided, in good faith to remove 
or disable a program used to violate section 2 or 3 that 
is installed on a computer of a customer of such provider, 
if such provider notifies the customer and obtains the con-
sent of the customer before undertaking such action or 
providing such service.