bles, graphic icons, hyperlinks, or other means 
as the Commission may require; and 
(B) may be presented differently depend-
ing on the interface or type of device on which 
the statement is being accessed by the user. 
(2) LOCATION OF SUMMARY STATEMENT AND 
GRAPHIC
DATA
FLOW
DIAGRAM.—The summary 
statement shall be placed at the top of the perma-
nent terms of service page of the covered entity and 
any graphic data flow diagram shall be located im-
mediately below the statement. 
(3) CONTENTS OF SUMMARY STATEMENT.—The 
summary statement shall include the following: 
(A) The categories of sensitive information 
that the covered entity processes. 
(B) The sensitive information that is re-
quired for the basic functioning of the service 
and what sensitive information is needed for ad-
ditional features and future feature develop-
ment. 
(C) A summary of the legal liabilities of a 
user and any rights transferred from the user 
to the covered entity, such as mandatory arbi-
tration, class action waiver, any licensing or 
VerDate Sep 11 2014 
22:36 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4568.IH
H4568
kjohnson on DSK79L0C42PROD with BILLS
sale by the covered entity of the content of the 
user, and any waiver of moral rights. 
(D) Historical versions of the terms of 
service and change logs. 
(E) If the covered entity provides user de-
letion services, directions for how the user can 
delete sensitive information or discontinue the 
use of sensitive information. 
(F) A list of data breaches from the pre-
vious 3 years reported to consumers under ex-
isting Federal and State laws. 
(G) The effort required by a user to read 
the entire terms of service text, such as through 
the total word count and approximate time to 
read the statement. 
(H) Any other information the Commission 
determines to be necessary if that information 
is included in the terms of service by the cov-
ered entity. 
(4) ADDITIONAL INFORMATION REQUIRED BY 
THE COMMISSION.—The Commission shall include in 
the rule a list of other information the Commission 
determines to be necessary under paragraph (3)(H). 
(d) GUIDANCE
ON
GRAPHIC
DATA
FLOW
DIA-
GRAMS.—Not later than 360 days after the date of the 
VerDate Sep 11 2014 
22:36 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4568.IH
H4568
kjohnson on DSK79L0C42PROD with BILLS
enactment of this Act, the Commission shall publish guide-
lines on how a covered entity can graphically display how 
sensitive information of a user is shared with a subsidiary 
or corporate affiliate of such entity and how sensitive in-
formation is shared with third parties. 
(e) INTERACTIVE DATA FORMAT TERMS OF SERV-
ICE.—Not later than 360 days after the date of the enact-
ment of this Act, the Commission shall issue a rule under 
section 553 of title 5, United States Code, that requires 
a covered entity to tag portions of the terms of services 
of the entity according to an interactive data format. 
(f) ENFORCEMENT.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of this section or a regulation 
promulgated under this section shall be treated as a 
violation of a regulation under section 18(a)(1)(B) 
of the Federal Trade Commission Act (15 U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices. 
(2) POWERS OF THE COMMISSION.—The Com-
mission shall enforce this section and the regulations 
promulgated under this section in the same manner, 
by the same means, and with the same jurisdiction, 
powers, and duties as though all applicable terms 
and provisions of the Federal Trade Commission Act 
VerDate Sep 11 2014 
22:36 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4568.IH
H4568
kjohnson on DSK79L0C42PROD with BILLS
(15 U.S.C. 41 et seq.) were incorporated into and 
made a part of this section, and any person who vio-
lates this section or a regulation promulgated under 
this section shall be subject to the penalties and en-
titled to the privileges and immunities provided in 
the Federal Trade Commission Act. 
(3) ENFORCEMENT BY STATE ATTORNEYS GEN-
ERAL.—In any case in which the attorney general of 
a State has reason to believe that an interest of at 
least 1,000 residents of that State has been or is 
threatened or adversely affected by the engagement 
of any person in a practice that violates this section 
or a regulation promulgated under this section, the 
State, as parens patriae, may bring a civil action on 
behalf of the residents of the State in a district 
court of the United States of appropriate jurisdic-
tion to— 
(A) enjoin that practice; 
(B) enforce compliance with the regulation; 
(C) obtain damage, restitution, or other 
compensation on behalf of residents of the 
State; or 
(D) obtain such other relief as the court 
may consider to be appropriate. 
(4) NOTICE.— 
VerDate Sep 11 2014 
22:36 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4568.IH
H4568
kjohnson on DSK79L0C42PROD with BILLS
(A) IN GENERAL.—Before filing an action 
under paragraph (3), the attorney general of 
the State involved shall provide to the Commis-
sion— 
(i) written notice of that action; and 
(ii) a copy of the complaint for that 
action. 
(B) EXEMPTION.— 
(i) IN GENERAL.—Subparagraph (A) 
shall not apply with respect to the filing of 
an action by an attorney general of a State 
under this subsection, if the attorney gen-
eral determines that it is not feasible to 
provide the notice described in that sub-
paragraph before the filing of the action. 
(ii) NOTIFICATION.—In an action de-
scribed in clause (i), the attorney general 
of a State shall provide notice and a copy 
of the complaint to the Commission at the 
same time as the attorney general files the 
action. 
(5) INTERVENTION BY THE COMMISSION.— 
(A) AUTHORITY
TO
INTERVENE.—The 
Commission may intervene in any action 
brought under paragraph (3). 
VerDate Sep 11 2014 
22:36 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4568.IH
H4568
kjohnson on DSK79L0C42PROD with BILLS
(B) EFFECT
OF
INTERVENTION.—If the 
Commission intervenes in an action under para-
graph (3), the Commission shall have the 
right— 
(i) to be heard with respect to any 
matter that arises in that action; and 
(ii) to file a petition for appeal. 
(6) CONSTRUCTION.—For purposes of bringing 
any civil action under paragraph (3), nothing in this 
section may be construed to prevent an attorney 
general of a State from exercising the powers con-
ferred on the attorney general by the laws of that 
State to— 
(A) conduct investigations; 
(B) administer oaths or affirmations; or 
(C) compel the attendance of witnesses or 
the production of documentary and other evi-
dence. 
(7) ACTIONS
BY
THE
COMMISSION.—In any 
case in which an action is instituted by or on behalf 
of the Commission for a violation of this section or 
a regulation promulgated under this section, a State 
may not, during the pendency of that action, insti-
tute a separate action under paragraph (3) against 
any defendant named in the complaint in the action 
VerDate Sep 11 2014 
22:36 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4568.IH
H4568
kjohnson on DSK79L0C42PROD with BILLS
instituted by or on behalf of the Commission for 
that violation. 
(g) RULE OF CONSTRUCTION.—Nothing in this sec-
tion shall be construed to limit the authority of the Com-
mission under any other provision of law. 
(h) DEFINITIONS.—In this section: 
(1) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(2) COVERED ENTITY.—The term ‘‘covered en-
tity’’— 
(A) means any person or entity that oper-
ates a website located on the internet or an on-
line service, that is operated for commercial 
purposes; and 
(B) does not include a small business con-
cern (as defined in section 3 of the Small Busi-
ness Act (15 U.S.C. 632)). 
(3) DISABILITY.—The term ‘‘disability’’ has the 
meaning given the term in section 3 of the Ameri-
cans with Disabilities Act of 1990 (42 U.S.C. 
12102). 
(4) INTERACTIVE
DATA
FORMAT.—The term 
‘‘interactive data format’’ means an electronic data 
format in which pieces of information are identified 
using an interactive data standard, such as eXten-
VerDate Sep 11 2014 
22:36 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4568.IH
H4568
kjohnson on DSK79L0C42PROD with BILLS
sible Markup Language (XML), that is a standard-
ized list of electronic tags that mark the information 
described in subsection (c)(3) within the terms of 
service of a covered entity. 
(5) MORAL RIGHTS.—The term ‘‘moral rights’’ 
means the rights conferred by section 106A(a) of 
title 17, United States Code. 
(6) PROCESS.—The term ‘‘process’’ means any 
operation or set of operations performed on sensitive 
information, including collection, analysis, organiza-
tion, structuring, retaining, using, or otherwise han-
dling sensitive information. 
(7) SENSITIVE INFORMATION.—The term ‘‘sen-
sitive information’’ means any of the following: 
(A) Health information. 
(B) Biometric information. 
(C) Precise geolocation information. 
(D) Social security number. 
(E) Information concerning the race, color, 
religion, national origin, sex, age, or disability 
of an individual. 
(F) The content and parties to a commu-
nication. 
(G) Audio and video recordings captured 
through a consumer device. 
VerDate Sep 11 2014 
22:36 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4568.IH
H4568
kjohnson on DSK79L0C42PROD with BILLS
(H) Financial information, including a 
bank account number, credit card number, 
debit card number, or insurance policy number. 
(I) Online browsing history, which means 
information revealing online activities over time 
or across websites or online services not owned 
or operated by the covered entity. 
(8) STATE.—The term ‘‘State’’ means each of 
the several States, the District of Columbia, each 
commonwealth, territory, or possession of the United 
States, and each federally recognized Indian Tribe. 
(9) THIRD
PARTY.—The term ‘‘third party’’ 
means, with respect to a covered entity, a person— 
(A) to which the covered entity disclosed 
sensitive information; and 
(B) that is not— 
(i) the covered entity; 
(ii) a subsidiary or corporate affiliate 
of the covered entity; or 
(iii) a service provider of the covered 
entity. 
Æ 
VerDate Sep 11 2014 
22:36 Aug 05, 2023
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6301
E:\BILLS\H4568.IH
H4568
kjohnson on DSK79L0C42PROD with BILLS