IB 
Union Calendar No. 101 
110TH CONGRESS 
1ST SESSION 
H. R. 964 
[Report No. 110–169] 
To protect users of the Internet from unknowing transmission of their person-
ally identifiable information through spyware programs, and for other 
purposes. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 8, 2007 
Mr. TOWNS (for himself, Mrs. BONO, Mr. DINGELL, Mr. BARTON of Texas, 
Mr. RUSH, Mr. STEARNS, Mr. MARKEY, Ms. SCHAKOWSKY, Mr. BOU-
CHER, Mr. GORDON of Tennessee, Ms. ESHOO, Mr. STUPAK, Mr. GENE 
GREEN of Texas, Ms. DEGETTE, Mrs. CAPPS, Mr. DOYLE, Ms. SOLIS, 
Mr. GONZALEZ, Mr. INSLEE, Ms. HOOLEY, Mr. WEINER, Mr. MATHE-
SON, Mr. BUTTERFIELD, Mr. HASTERT, Mr. RADANOVICH, Mr. TERRY, 
Mrs. MYRICK, Mr. BURGESS, and Mr. ENGEL) introduced the following 
bill; which was referred to the Committee on Energy and Commerce 
MAY 24, 2007 
Additional sponsors: Mr. UPTON, Mrs. CUBIN, Mr. MCCAUL of Texas, Mr. 
MCCOTTER, Mr. FARR, Mr. MCHUGH, Mr. MCNERNEY, Mr. PRICE of 
North Carolina, Ms. WATSON, Mr. MOORE of Kansas, Mr. BUYER, Mr. 
FOSSELLA, and Mr. CALVERT 
MAY 24, 2007 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on February 8, 2007] 
A BILL 
To protect users of the Internet from unknowing trans-
mission of their personally identifiable information 
through spyware programs, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Securely Protect Yourself 
Against Cyber Trespass Act’’ or the ‘‘Spy Act’’. 
SEC. 2. PROHIBITION OF UNFAIR OR DECEPTIVE ACTS OR 
PRACTICES RELATING TO SPYWARE. 
(a) PROHIBITION.—It is unlawful for any person, who 
is not the owner or authorized user of a protected computer, 
to engage in unfair or deceptive acts or practices that in-
volve any of the following conduct with respect to the pro-
tected computer: 
(1) Taking control of the computer by— 
(A) utilizing such computer to send unsolic-
ited information or material from the computer 
to others; 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(B) diverting the Internet browser of the 
computer, or similar program of the computer 
used to access and navigate the Internet— 
(i) without authorization of the owner 
or authorized user of the computer; and 
(ii) away from the site the user in-
tended to view, to one or more other Web 
pages, such that the user is prevented from 
viewing the content at the intended Web 
page, unless such diverting is otherwise au-
thorized; 
(C) accessing, hijacking, or otherwise using 
the modem, or Internet connection or service, for 
the computer and thereby causing damage to the 
computer or causing the owner or authorized 
user or a third party defrauded by such conduct 
to incur charges or other costs for a service that 
is not authorized by such owner or authorized 
user; 
(D) using the computer as part of an activ-
ity performed by a group of computers that 
causes damage to another computer; or 
(E) delivering advertisements or a series of 
advertisements that a user of the computer can-
not close or terminate without undue effort or 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
nent of computer software is necessary to open, view, 
or play a particular type of content. 
(7) Inducing the owner or authorized user to in-
stall or execute computer software by misrepresenting 
the identity or authority of the person or entity pro-
viding the computer software to the owner or user. 
(8) Inducing the owner or authorized user to 
provide personally identifiable, password, or account 
information to another person— 
(A) by misrepresenting the identity of the 
person seeking the information; or 
(B) without the authority of the intended 
recipient of the information. 
(9) Removing, disabling, or rendering inoper-
ative a security, anti-spyware, or anti-virus tech-
nology installed on the computer. 
(10) Installing or executing on the computer one 
or more additional components of computer software 
with the intent of causing a person to use such com-
ponents in a way that violates any other provision of 
this section. 
(b) GUIDANCE.—The Commission shall issue guidance 
regarding compliance with and violations of this section. 
This subsection shall take effect upon the date of the enact-
ment of this Act. 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(c) EFFECTIVE DATE.—Except as provided in sub-
section (b), this section shall take effect upon the expiration 
of the 6-month period that begins on the date of the enact-
ment of this Act. 
SEC. 3. PROHIBITION OF COLLECTION OF CERTAIN INFOR-
MATION WITHOUT NOTICE AND CONSENT. 
(a) OPT-IN REQUIREMENT.—Except as provided in 
subsection (e), it is unlawful for any person— 
(1) to transmit to a protected computer, which 
is not owned by such person and for which such per-
son is not an authorized user, any information collec-
tion program, unless— 
(A) such information collection program 
provides notice in accordance with subsection (c) 
before downloading or installing any of the in-
formation collection program; and 
(B) such information collection program in-
cludes the functions required under subsection 
(d); or 
(2) to execute any information collection pro-
gram installed on such a protected computer unless— 
(A) before execution of any of the informa-
tion collection functions of the program, the 
owner or an authorized user of the protected 
computer has consented to such execution pursu-
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
ant to notice in accordance with subsection (c); 
and 
(B) such information collection program in-
cludes the functions required under subsection 
(d). 
(b) INFORMATION COLLECTION PROGRAM.— 
(1) IN GENERAL.—For purposes of this section, 
the term ‘‘information collection program’’ means 
computer software that performs either of the fol-
lowing functions: 
(A) COLLECTION OF PERSONALLY IDENTIFI-
ABLE INFORMATION.—The computer software— 
(i) collects personally identifiable in-
formation; and 
(ii)(I) sends such information to a per-
son other than the owner or authorized user 
of the computer, or 
(II) uses such information to deliver 
advertising to, or display advertising on, 
the computer. 
(B) COLLECTION OF INFORMATION REGARD-
ING
INTERNET
ACTIVITY
TO
DELIVER
ADVER-
TISING.—The computer software— 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(i) collects information regarding the 
user’s Internet activity using the computer; 
and 
(ii) uses such information to deliver 
advertising to, or display advertising on, 
the computer. 
(2) EXCEPTION FOR SOFTWARE COLLECTING IN-
FORMATION REGARDING INTERNET ACTIVITY WITHIN A 
PARTICULAR WEB SITE.—Computer software that oth-
erwise would be considered an information collection 
program by reason of paragraph (1)(B) shall not be 
considered such a program if— 
(A) the only information collected by the 
software regarding the user’s internet activity, 
and used to deliver advertising to, or display ad-
vertising on, the protected computer, is— 
(i) information regarding Web pages 
within a particular Web site; or 
(ii) in the case of any Internet-based 
search function, user-supplied search terms 
necessary to complete the search and return 
results to the user; 
(B) such information collected is not sent to 
a person other than— 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(i) the provider of the Web site accessed 
or Internet-based search function; or 
(ii) a party authorized to facilitate the 
display or functionality of Web pages with-
in the Web site accessed; and 
(C) the only advertising delivered to or dis-
played on the computer using such information 
is advertising on Web pages within that par-
ticular Web site. 
(c) NOTICE AND CONSENT.— 
(1) IN GENERAL.—Notice in accordance with this 
subsection with respect to an information collection 
program is clear and conspicuous notice in plain lan-
guage, set forth as the Commission shall provide, that 
meets all of the following requirements: 
(A) The notice clearly distinguishes a state-
ment required under subparagraph (B) from any 
other information visually presented contempora-
neously on the computer. 
(B) The notice contains one of the following 
statements, as applicable, or a substantially 
similar statement: 
(i) With respect to an information col-
lection program described in subsection 
(b)(1)(A): ‘‘This program will collect and 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
transmit information about you. Do you ac-
cept?’’. 
(ii) With respect to an information col-
lection program described in subsection 
(b)(1)(B): ‘‘This program will collect infor-
mation about Web pages you access and 
will use that information to display adver-
tising on your computer. Do you accept?’’. 
(iii) With respect to an information 
collection program that performs the actions 
described in both subparagraphs (A) and 
(B) of subsection (b)(1): ‘‘This program will 
collect and transmit information about you 
and will collect information about Web 
pages you access and use that information 
to display advertising on your computer. 
Do you accept?’’. 
(C) The notice provides for the user— 
(i) to grant or deny consent referred to 
in subsection (a) by selecting an option to 
grant or deny such consent; and 
(ii) to abandon or cancel the trans-
mission or execution referred to in sub-
section (a) without granting or denying 
such consent. 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(D) The notice provides an option for the 
user to select to display on the computer, before 
granting or denying consent using the option re-
quired under subparagraph (C), a clear descrip-
tion of— 
(i) the types of information to be col-
lected and sent (if any) by the information 
collection program; 
(ii) the purpose for which such infor-
mation is to be collected and sent; and 
(iii) in the case of an information col-
lection program that first executes any of 
the information collection functions of the 
program together with the first execution of 
other computer software, the identity of any 
such software that is an information collec-
tion program. 
(E) The notice provides for concurrent dis-
play of the information required under subpara-
graphs (B) and (C) and the option required 
under subparagraph (D) until the user— 
(i) grants or denies consent using the 
option required under subparagraph (C)(i); 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(ii) abandons or cancels the trans-
mission or execution pursuant to subpara-
graph (C)(ii); or 
(iii) selects the option required under 
subparagraph (D). 
(2) SINGLE NOTICE.—The Commission shall pro-
vide that, in the case in which multiple information 
collection programs are provided to the protected com-
puter together, or as part of a suite of functionally re-
lated software, the notice requirements of paragraphs 
(1)(A) and (2)(A) of subsection (a) may be met by 
providing, before execution of any of the information 
collection functions of the programs, clear and con-
spicuous notice in plain language in accordance with 
paragraph (1) of this subsection by means of a single 
notice that applies to all such information collection 
programs, except that such notice shall provide the 
option under subparagraph (D) of paragraph (1) of 
this subsection with respect to each such information 
collection program. 
(3) CHANGE IN INFORMATION COLLECTION.—If 
an owner or authorized user has granted consent to 
execution of an information collection program pur-
suant to a notice in accordance with this subsection: 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(A) IN GENERAL.—No subsequent such no-
tice is required, except as provided in subpara-
graph (B). 
(B) SUBSEQUENT NOTICE.—The person who 
transmitted the program shall provide another 
notice in accordance with this subsection and ob-
tain consent before such program may be used to 
collect or send information of a type or for a 
purpose that is materially different from, and 
outside the scope of, the type or purpose set forth 
in the initial or any previous notice. 
(4) REGULATIONS.—The Commission shall issue 
regulations to carry out this subsection. 
(d) REQUIRED FUNCTIONS.—The functions required 
under this subsection to be included in an information col-
lection program that executes any information collection 
functions with respect to a protected computer are as fol-
lows: 
(1) DISABLING FUNCTION.—With respect to any 
information collection program, a function of the pro-
gram that allows a user of the program to remove the 
program or disable operation of the program with re-
spect to such protected computer by a function that— 
(A) is easily identifiable to a user of the 
computer; and 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(B) can be performed without undue effort 
or knowledge by the user of the protected com-
puter. 
(2) IDENTITY FUNCTION.— 
(A) IN GENERAL.—With respect only to an 
information collection program that uses infor-
mation collected in the manner described in sub-
paragraph (A)(ii)(II) or (B)(ii) of subsection 
(b)(1) and subject to subparagraph (B) of this 
paragraph, a function of the program that pro-
vides that each display of an advertisement di-
rected or displayed using such information, when 
the owner or authorized user is accessing a Web 
page or online location other than of the provider 
of the computer software, is accompanied by the 
name of the information collection program, a 
logogram or trademark used for the exclusive 
purpose of identifying the program, or a state-
ment or other information sufficient to clearly 
identify the program. 
(B) EXEMPTION
FOR
EMBEDDED
ADVER-
TISEMENTS.—The Commission shall, by regula-
tion, exempt from the applicability of subpara-
graph (A) the embedded display of any advertise-
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
ment on a Web page that contemporaneously dis-
plays other information. 
(3) RULEMAKING.—The Commission may issue 
regulations to carry out this subsection. 
(e) LIMITATION ON LIABILITY.—A telecommunications 
carrier, a provider of information service or interactive 
computer service, a cable operator, or a provider of trans-
mission capability shall not be liable under this section to 
the extent that the carrier, operator, or provider— 
(1) transmits, routes, hosts, stores, or provides 
connections for an information collection program 
through a system or network controlled or operated by 
or for the carrier, operator, or provider; or 
(2) provides an information location tool, such 
as a directory, index, reference, pointer, or hypertext 
link, through which the owner or user of a protected 
computer locates an information collection program. 
(f) STUDY AND ADDITIONAL EXEMPTION.— 
(1) STUDY AND REPORT.—The Commission shall 
conduct a study to determine the applicability of the 
information collection prohibitions of this section to 
information that is input directly by users in a field 
provided on a website. The study shall examine— 
(A) the nature of such fields for user input; 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(B) the use of a user’s information once 
input and whether such information is sent to a 
person other than the provider of the Web site; 
(C) whether such information is used to de-
liver advertisements to the user’s computer; and 
(D) the extent of any notice provided to the 
user prior to such input. 
(2) REPORT.—The Commission shall transmit a 
report on such study to the Committee on Energy and 
Commerce of the House of Representatives and the 
Committee on Commerce, Science, and Transpor-
tation of the Senate not later than the expiration of 
the 6-month period that begins on the date on which 
final regulations are issued under section 9. The re-
quirements of subchapter I of chapter 35 of title 44, 
United States Code, shall not apply to the report re-
quired under this subsection. 
(3) REGULATION.—If the Commission finds that 
users have adequate notice regarding the uses of any 
information input directly by the user in a field pro-
vided on a website, such that an exemption from the 
requirements of this section, or a modification of the 
notice required by this section is appropriate for such 
information, and that such an exemption or modifica-
tion is consistent with the public interest, the protec-
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
tion of consumers, and the purposes of this Act, the 
Commission may prescribe such an exemption or 
modification by regulation. 
SEC. 4. ENFORCEMENT. 
(a) UNFAIR OR DECEPTIVE ACT OR PRACTICE.—This 
Act shall be enforced by the Commission under the Federal 
Trade Commission Act (15 U.S.C. 41 et seq.). A violation 
of any provision of this Act or of a regulation issued under 
this Act shall be treated as an unfair or deceptive act or 
practice violating a rule promulgated under section 18 of 
the Federal Trade Commission Act (15 U.S.C. 57a). 
(b) PENALTY
FOR PATTERN
OR PRACTICE VIOLA-
TIONS.— 
(1) IN
GENERAL.—Notwithstanding subsection 
(a) and the Federal Trade Commission Act, in the 
case of a person who engages in a pattern or practice 
that violates section 2 or 3, the Commission may, in 
its discretion, seek a civil penalty for such pattern or 
practice of violations in an amount, as determined by 
the Commission, of not more than— 
(A) $3,000,000 for each violation of section 
2; and 
(B) $1,000,000 for each violation of section 
3. 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(2) TREATMENT
OF
SINGLE
ACTION
OR
CON-
DUCT.—In applying paragraph (1)— 
(A) any single action or conduct that vio-
lates section 2 or 3 with respect to multiple pro-
tected computers shall be treated as a single vio-
lation; and 
(B) any single action or conduct that vio-
lates more than one paragraph of section 2(a) 
shall be considered multiple violations, based on 
the number of such paragraphs violated. 
(c) REQUIRED
SCIENTER.—Civil penalties sought 
under this section for any action may not be granted by 
the Commission or any court unless the Commission or 
court, respectively, establishes that the action was com-
mitted with actual knowledge or knowledge fairly implied 
on the basis of objective circumstances that such act is un-
fair or deceptive or violates this Act. 
(d) FACTORS
IN AMOUNT
OF PENALTY.—In deter-
mining the amount of any penalty pursuant to subsection 
(a) or (b), the court shall take into account the degree of 
culpability, any history of prior such conduct, ability to 
pay, effect on ability to continue to do business, and such 
other matters as justice may require. 
(e) EXCLUSIVENESS OF REMEDIES.—The remedies in 
this section (and other remedies available to the Commis-
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
sion in an enforcement action against unfair and deceptive 
acts and practices) are the exclusive remedies for violations 
of this Act. 
(f) EFFECTIVE DATE.—To the extent only that this sec-
tion applies to violations of section 2(a), this section shall 
take effect upon the expiration of the 6-month period that 
begins on the date of the enactment of this Act. 
SEC. 5. LIMITATIONS. 
(a) LAW ENFORCEMENT AUTHORITY.—Sections 2 and 
3 shall not apply to— 
(1) any act taken by a law enforcement agent in 
the performance of official duties; or 
(2) the transmission or execution of an informa-
tion collection program in compliance with a law en-
forcement, investigatory, national security, or regu-
latory agency or department of the United States or 
any State in response to a request or demand made 
under authority granted to that agency or depart-
ment, including a warrant issued under the Federal 
Rules of Criminal Procedure, an equivalent State 
warrant, a court order, or other lawful process. 
(b) EXCEPTION RELATING TO SECURITY.—Nothing in 
this Act shall apply to— 
(1) any monitoring of, or interaction with, a 
protected computer— 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(A) in connection with the provision of a 
network access service or other service or product 
with respect to which the user of the protected 
computer is an actual or prospective customer, 
subscriber, registered user, or account holder; 
(B) by the provider of that service or prod-
uct or with such provider’s authorization; and 
(C) that involves or enables the collection of 
information about the user’s activities only with 
respect to the user’s relationship with or use of 
such service or product, 
to the extent that such monitoring or interaction is 
for the purpose of network security, computer secu-
rity, diagnostics, technical support or repair, network 
management, authorized updates of software, or for 
the detection or prevention of fraudulent activities; or 
(2) a discrete interaction with a protected com-
puter by a provider of computer software solely to de-
termine whether the user of the computer is author-
ized to use such software, that occurs upon— 
(A) initialization of the software; or 
(B) an affirmative request by the owner or 
authorized user for an update of, addition to, or 
technical service for, the software. 
(c) GOOD SAMARITAN PROTECTION.— 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(1) IN GENERAL.—No provider of computer soft-
ware or of interactive computer service may be held 
liable under this Act on account of any action volun-
tarily taken, or service provided, in good faith to re-
move or disable a program used to violate section 2 
or 3 that is installed on a computer of a customer of 
such provider, if such provider notifies the customer 
and obtains the consent of the customer before under-
taking such action or providing such service. 
(2) CONSTRUCTION.—Nothing in this subsection 
shall be construed to limit the liability of a provider 
of computer software or of an interactive computer 
service for any anti-competitive act otherwise prohib-
ited by law. 
(d) LIMITATION ON LIABILITY.—A manufacturer or re-
tailer of computer equipment shall not be liable under this 
Act to the extent that the manufacturer or retailer is pro-
viding third party branded computer software that is in-
stalled on the equipment the manufacturer or retailer is 
manufacturing or selling. 
(e) SERVICES PROVIDED BY CABLE OPERATORS AND 
SATELLITE CARRIERS.—It shall not be a violation of sec-
tion 3 for a satellite carrier (as such term is defined in 
section 338(k) of the Communications Act of 1934 (47 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
U.S.C. 338(k)) or cable operator (as such term is defined 
in section 631(a)(2) of such Act (47 U.S.C. 551(a)(2))) to— 
(1) utilize a navigation device (as such term is 
defined in the rules of the Federal Communications 
Commission); 
(2) interact with such a navigation device; or 
(3) transmit software to or execute software in-
stalled on such a navigation device to provide service 
or collect or disclose subscriber information, 
if the provision of such service, the utilization of or the 
interaction with such device, or the collection of or disclo-
sure of such information, is subject to section 338(i) or sec-
tion 631 of the Communications Act of 1934. 
SEC. 6. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE LAW.— 
(1) PREEMPTION OF SPYWARE LAWS.—This Act 
supersedes any provision of a statute, regulation, or 
rule of a State or political subdivision of a State that 
expressly regulates— 
(A) unfair or deceptive conduct with respect 
to computers similar to that described in section 
2(a); 
(B) the transmission or execution of a com-
puter program similar to that described in sec-
tion 3; or 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(C) the use of computer software that dis-
plays advertising content based on the Web pages 
accessed using a computer. 
(2) ADDITIONAL PREEMPTION.— 
(A) IN GENERAL.—No person other than the 
Attorney General of a State may bring a civil 
action under the law of any State if such action 
is premised in whole or in part upon the defend-
ant violating any provision of this Act. 
(B) PROTECTION
OF
CONSUMER
PROTEC-
TION LAWS.—This paragraph shall not be con-
strued to limit the enforcement of any State con-
sumer protection law by an Attorney General of 
a State. 
(3) PROTECTION
OF
CERTAIN
STATE
LAWS.— 
This Act shall not be construed to preempt the appli-
cability of— 
(A) State trespass, contract, or tort law; or 
(B) other State laws to the extent that those 
laws relate to acts of fraud. 
(4) EFFECTIVE DATE.—The preemption provided 
for under this subsection shall take effect, with respect 
to specific provisions of this Act, on the effective date 
for such provisions. 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(b) PRESERVATION OF FTC AUTHORITY.—Nothing in 
this Act may be construed in any way to limit or affect 
the Commission’s authority under any other provision of 
law, including the authority to issue advisory opinions 
(under part 1 of volume 16 of the Code of Federal Regula-
tions), policy statements, or guidance regarding this Act. 
SEC. 7. FTC REPORT ON COOKIES. 
(a) IN GENERAL.—Not later than the expiration of the 
6-month period that begins on the date on which final regu-
lations are issued under section 9, the Commission shall 
submit a report to the Congress regarding the use of cookies 
in the delivery or display of advertising to the owners and 
users of computers. The report shall examine the extent to 
which cookies are or may be used to transmit to a third 
party personally identifiable information of a computer 
owner or user, information regarding Web pages accessed 
by the owner or user, or information regarding advertise-
ments previously delivered to a computer, for the purpose 
of— 
(1) delivering or displaying advertising to the 
owner or user; or 
(2) assisting the intended recipient to deliver or 
display advertising to the owner, user, or others. 
The report shall examine and describe the methods by which 
cookies and the Web sites that place them on computers 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
function separately and together, and shall compare the use 
of cookies with the use of information collection programs 
(as such term is defined in section 3) to determine the extent 
to which such uses are similar or different. The report may 
include such recommendations as the Commission considers 
necessary and appropriate, including treatment of cookies 
under this Act or other laws. 
(b) EFFECTIVE DATE.—This section shall take effect 
on the date of the enactment of this Act. 
(c) PAPERWORK REDUCTION REQUIREMENTS.—The 
requirements of subchapter I of chapter 35 of title 44, 
United States Code, shall not apply to the report required 
under this section. 
SEC. 8. FTC REPORT ON INFORMATION COLLECTION PRO-
GRAMS INSTALLED BEFORE EFFECTIVE DATE. 
Not later than the expiration of the 6-month period 
that begins on the date on which final regulations are issued 
under section 9, the Commission shall submit a report to 
the Congress on the extent to which there are installed on 
protected computers information collection programs that, 
but for installation prior to the effective date under section 
11(a), would be subject to the requirements of section 3. The 
report shall include recommendations regarding the means 
of affording computer users affected by such information 
collection programs the protections of section 3, including 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
recommendations regarding requiring a one-time notice 
and consent by the owner or authorized user of a computer 
to the continued collection of information by such a pro-
gram so installed on the computer. The requirements of sub-
chapter I of chapter 35 of title 44, United States Code, shall 
not apply to the report required under this section. 
SEC. 9. REGULATIONS. 
(a) IN GENERAL.—The Commission shall issue the reg-
ulations required by this Act not later than the expiration 
of the 9-month period beginning on the date of the enact-
ment of this Act. In exercising its authority to issue any 
regulation under this Act, the Commission shall determine 
that the regulation is consistent with the public interest and 
the purposes of this Act. Any regulations issued pursuant 
to this Act shall be issued in accordance with section 553 
of title 5, United States Code. 
(b) EFFECTIVE DATE.—This section shall take effect 
on the date of the enactment of this Act. 
SEC. 10. DEFINITIONS. 
For purposes of this Act: 
(1) CABLE OPERATOR.—The term ‘‘cable oper-
ator’’ has the meaning given such term in section 602 
of the Communications Act of 1934 (47 U.S.C. 522). 
(2) COLLECT.—The term ‘‘collect’’, when used 
with respect to information and for purposes only of 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
section 3(b)(1)(A), does not include obtaining of the 
information by a party who is intended by the owner 
or authorized user of a protected computer to receive 
the information or by a third party authorized by 
such intended recipient to receive the information, 
pursuant to the owner or authorized user— 
(A) transferring the information to such in-
tended recipient using the protected computer; or 
(B) storing the information on the protected 
computer in a manner so that it is accessible by 
such intended recipient. 
(3) COMPUTER; PROTECTED
COMPUTER.—The 
terms ‘‘computer’’ and ‘‘protected computer’’ have the 
meanings given such terms in section 1030(e) of title 
18, United States Code. 
(4) COMPUTER SOFTWARE.— 
(A) IN GENERAL.—Except as provided in 
subparagraph (B), the term ‘‘computer software’’ 
means a set of statements or instructions that 
can be installed and executed on a computer for 
the purpose of bringing about a certain result. 
(B) EXCEPTIONS.—Such term does not in-
clude— 
(i) computer software that is placed on 
the computer system of a user by an Inter-
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
net service provider, interactive computer 
service, or Internet Web site solely to enable 
the user subsequently to use such provider 
or service or to access such Web site; or 
(ii) a text or data file known as a 
cookie, to the extent that the text or data 
file— 
(I) is used, written to, or placed 
on the computer of a user by an Inter-
net service provider, interactive com-
puter service, or Internet website, or 
any entity acting with the authoriza-
tion of and on behalf of such Internet 
service provider, interactive computer 
service, or Internet website; and 
(II) can be read or recognized 
solely to return information to such 
Internet service provider, interactive 
computer service, or Internet website, 
or any entity acting with the author-
ization of and on behalf of such Inter-
net service provider, interactive com-
puter service, or Internet website. 
(5) 
COMMISSION.—The 
term 
‘‘Commission’’ 
means the Federal Trade Commission. 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(6) DAMAGE.—The term ‘‘damage’’ has the 
meaning given such term in section 1030(e) of title 
18, United States Code. 
(7) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—The term ‘‘unfair or deceptive acts or prac-
tices’’ has the meaning applicable to such term for 
purposes of section 5 of the Federal Trade Commis-
sion Act (15 U.S.C. 45). 
(8) DISABLE.—The term ‘‘disable’’ means, with 
respect to an information collection program, to per-
manently prevent such program from executing any 
of the functions described in section 3(b)(1) that such 
program is otherwise capable of executing (including 
by removing, deleting, or disabling the program), un-
less the owner or operator of a protected computer 
takes a subsequent affirmative action to enable the 
execution of such functions. 
(9) INFORMATION COLLECTION FUNCTIONS.—The 
term ‘‘information collection functions’’ means, with 
respect to an information collection program, the 
functions of the program described in subsection 
(b)(1) of section 3. 
(10) INFORMATION SERVICE.—The term ‘‘infor-
mation service’’ has the meaning given such term in 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
section 3 of the Communications Act of 1934 (47 
U.S.C. 153). 
(11) INTERACTIVE
COMPUTER
SERVICE.—The 
term ‘‘interactive computer service’’ has the meaning 
given such term in section 230(f) of the Communica-
tions Act of 1934 (47 U.S.C. 230(f)). 
(12) INTERNET.—The term ‘‘Internet’’ means 
collectively the myriad of computer and telecommuni-
cations facilities, including equipment and operating 
software, which comprise the interconnected world- 
wide network of networks that employ the Trans-
mission Control Protocol/Internet Protocol, or any 
predecessor or successor protocols to such protocol, to 
communicate information of all kinds by wire or 
radio. 
(13) 
PERSONALLY
IDENTIFIABLE
INFORMA-
TION.— 
(A) IN
GENERAL.—The term ‘‘personally 
identifiable information’’ means the following in-
formation, to the extent only that such informa-
tion allows a living individual to be identified 
from that information: 
(i) First and last name of an indi-
vidual. 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(ii) A home or other physical address 
of an individual, including street name, 
name of a city or town, and zip code. 
(iii) An electronic mail address. 
(iv) A telephone number. 
(v) A social security number, tax iden-
tification number, passport number, driver’s 
license number, or any other government- 
issued identification number. 
(vi) A credit card number. 
(vii) Any access code, password, or ac-
count number, other than an access code or 
password transmitted by an owner or au-
thorized user of a protected computer to the 
intended recipient to register for, or log 
onto, a Web page or other Internet service 
or a network connection or service of a sub-
scriber that is protected by an access code or 
password. 
(viii) Date of birth, birth certificate 
number, or place of birth of an individual, 
except in the case of a date of birth trans-
mitted or collected for the purpose of com-
pliance with the law. 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(B) RULEMAKING.—The Commission may, 
by regulation, add to the types of information 
described in subparagraph (A) that shall be con-
sidered personally identifiable information for 
purposes of this Act, except that such additional 
types of information shall be considered person-
ally identifiable information only to the extent 
that such information allows living individuals, 
particular computers, particular users of com-
puters, or particular email addresses or other lo-
cations of computers to be identified from that 
information. 
(14) SUITE OF FUNCTIONALLY RELATED SOFT-
WARE.—The term suite of ‘‘functionally related soft-
ware’’ means a group of computer software programs 
distributed to an end user by a single provider, which 
programs enable features or functionalities of an inte-
grated service offered by the provider. 
(15) TELECOMMUNICATIONS CARRIER.—The term 
‘‘telecommunications carrier’’ has the meaning given 
such term in section 3 of the Communications Act of 
1934 (47 U.S.C. 153). 
(16) TRANSMIT.—The term ‘‘transmit’’ means, 
with respect to an information collection program, 
transmission by any means. 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
(17) WEB PAGE.—The term ‘‘Web page’’ means 
a location, with respect to the World Wide Web, that 
has a single Uniform Resource Locator or another 
single location with respect to the Internet, as the 
Federal Trade Commission may prescribe. 
(18) WEB SITE.—The term ‘‘web site’’ means a 
collection of Web pages that are presented and made 
available by means of the World Wide Web as a single 
Web site (or a single Web page so presented and made 
available), which Web pages have any of the following 
characteristics: 
(A) A common domain name. 
(B) Common ownership, management, or 
registration. 
SEC. 11. APPLICABILITY AND SUNSET. 
(a) EFFECTIVE DATE.—Except as specifically pro-
vided otherwise in this Act, this Act shall take effect upon 
the expiration of the 12-month period that begins on the 
date of the enactment of this Act. 
(b) APPLICABILITY.—Section 3 shall not apply to an 
information collection program installed on a protected 
computer before the effective date under subsection (a) of 
this section. 
(c) SUNSET.—This Act shall not apply after December 
31, 2013. 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6203
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS
Union Calendar No. 101 
110TH CONGRESS 
1ST SESSION 
H. R. 964 
[Report No. 110–169] 
A BILL 
To protect users of the Internet from unknowing 
transmission of their personally identifiable infor-
mation through spyware programs, and for other 
purposes. 
MAY 24, 2007 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Aug 31 2005 
03:11 May 26, 2007
Jkt 059200
PO 00000
Frm 00036
Fmt 6651
Sfmt 6651
E:\BILLS\H964.RH
H964
bajohnson on PROD1PC77 with BILLS