HR 29 RFS 
(d) LIMITATION ON LIABILITY.—A manufacturer or 
retailer of computer equipment shall not be liable under 
this Act to the extent that the manufacturer or retailer 
is providing third party branded computer software that 
is installed on the equipment the manufacturer or retailer 
is manufacturing or selling. 
SEC. 6. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE LAW.—
(1) PREEMPTION
OF
SPYWARE
LAWS.—This 
Act supersedes any provision of a statute, regula-
tion, or rule of a State or political subdivision of a 
State that expressly regulates—
(A) unfair or deceptive conduct with re-
spect to computers similar to that described in 
section 2(a); 
(B) the transmission or execution of a 
computer program similar to that described in 
section 3; or 
(C) the use of computer software that dis-
plays advertising content based on the Web 
pages accessed using a computer. 
(2) ADDITIONAL PREEMPTION.—
(A) IN GENERAL.—No person other than 
the Attorney General of a State may bring a 
civil action under the law of any State if such
HR 29 RFS 
action is premised in whole or in part upon the 
defendant violating any provision of this Act. 
(B) PROTECTION OF CONSUMER PROTEC-
TION LAWS.—This paragraph shall not be con-
strued to limit the enforcement of any State 
consumer protection law by an Attorney Gen-
eral of a State. 
(3) PROTECTION OF CERTAIN STATE LAWS.—
This Act shall not be construed to preempt the ap-
plicability of—
(A) State trespass, contract, or tort law; or 
(B) other State laws to the extent that 
those laws relate to acts of fraud. 
(b) PRESERVATION OF FTC AUTHORITY.—Nothing 
in this Act may be construed in any way to limit or affect 
the Commission’s authority under any other provision of 
law, including the authority to issue advisory opinions 
(under part 1 of volume 16 of the Code of Federal Regula-
tions), policy statements, or guidance regarding this Act. 
SEC. 7. ANNUAL FTC REPORT. 
For the 12-month period that begins upon the effec-
tive date under section 12(a) and for each 12-month pe-
riod thereafter, the Commission shall submit a report to 
the Congress that—
HR 29 RFS 
(1) specifies the number and types of actions 
taken during such period to enforce section 2(a) and 
section 3, the disposition of each such action, any 
penalties levied in connection with such actions, and 
any penalties collected in connection with such ac-
tions; and 
(2) describes the administrative structure and 
personnel and other resources committed by the 
Commission for enforcement of this Act during such 
period. 
Each report under this subsection for a 12-month period 
shall be submitted not later than 90 days after the expira-
tion of such period. 
SEC. 8. FTC REPORT ON COOKIES. 
(a) IN GENERAL.—Not later than the expiration of 
the 6-month period that begins on the date of the enact-
ment of this Act, the Commission shall submit a report 
to the Congress regarding the use of cookies, including 
tracking cookies, in the delivery or display of advertising 
to the owners and users of computers. The report shall 
examine and describe the methods by which cookies and 
the Web sites that place them on computers function sepa-
rately and together, and shall compare the use of cookies 
with the use of information collection programs (as such 
term is defined in section 3) to determine the extent to
HR 29 RFS 
which such uses are similar or different. The report may 
include such recommendations as the Commission con-
siders necessary and appropriate, including treatment of 
cookies under this Act or other laws. 
(b) DEFINITION.—For purposes of this section, the 
term ‘‘tracking cookie’’ means a cookie or similar text or 
data file used alone or in conjunction with one or more 
Web sites to transmit or convey, to a party other than 
the intended recipient, personally identifiable information 
of a computer owner or user, information regarding Web 
pages accessed by the owner or user, or information re-
garding advertisements previously delivered to a computer, 
for the purpose of—
(1) delivering or displaying advertising to the 
owner or user; or 
(2) assisting the intended recipient to deliver or 
display advertising to the owner, user, or others. 
(c) EFFECTIVE DATE.—This section shall take effect 
on the date of the enactment of this Act. 
SEC. 9. FTC REPORT ON INFORMATION COLLECTION PRO-
GRAMS 
INSTALLED 
BEFORE 
EFFECTIVE 
DATE. 
Not later than the expiration of the 6-month period 
that begins on the date of the enactment of this Act, the 
Commission shall submit a report to the Congress on the
HR 29 RFS 
extent to which there are installed on protected computers 
information collection programs that, but for installation 
prior to the effective date under section 12(a), would be 
subject to the requirements of section 3. The report shall 
include recommendations regarding the means of afford-
ing computer users affected by such information collection 
programs the protections of section 3, including rec-
ommendations regarding requiring a one-time notice and 
consent by the owner or authorized user of a computer 
to the continued collection of information by such a pro-
gram so installed on the computer. 
SEC. 10. REGULATIONS. 
(a) IN GENERAL.—The Commission shall issue the 
regulations required by this Act not later than the expira-
tion of the 6-month period beginning on the date of the 
enactment of this Act. In exercising its authority to issue 
any regulation under this Act, the Commission shall deter-
mine that the regulation is consistent with the public in-
terest and the purposes of this Act. Any regulations issued 
pursuant to this Act shall be issued in accordance with 
section 553 of title 5, United States Code. 
(b) EFFECTIVE DATE.—This section shall take effect 
on the date of the enactment of this Act. 
SEC. 11. DEFINITIONS. 
For purposes of this Act:
HR 29 RFS 
(1) CABLE OPERATOR.—The term ‘‘cable oper-
ator’’ has the meaning given such term in section 
602 of the Communications Act of 1934 (47 U.S.C. 
522). 
(2) COLLECT.—The term ‘‘collect’’, when used 
with respect to information and for purposes only of 
section 3(b)(1)(A), does not include obtaining of the 
information by a party who is intended by the owner 
or authorized user of a protected computer to receive 
the information or by a third party authorized by 
such intended recipient to receive the information, 
pursuant to the owner or authorized user—
(A) transferring the information to such 
intended recipient using the protected com-
puter; or 
(B) storing the information on the pro-
tected computer in a manner so that it is acces-
sible by such intended recipient. 
(3) COMPUTER; PROTECTED COMPUTER.—The 
terms ‘‘computer’’ and ‘‘protected computer’’ have 
the meanings given such terms in section 1030(e) of 
title 18, United States Code. 
(4) COMPUTER SOFTWARE.—
(A) IN GENERAL.—Except as provided in 
subparagraph (B), the term ‘‘computer soft-
HR 29 RFS 
ware’’ means a set of statements or instructions 
that can be installed and executed on a com-
puter for the purpose of bringing about a cer-
tain result. 
(B) EXCEPTION.—Such term does not in-
clude computer software that is placed on the 
computer system of a user by an Internet serv-
ice provider, interactive computer service, or 
Internet Web site solely to enable the user sub-
sequently to use such provider or service or to 
access such Web site. 
(C) RULE OF CONSTRUCTION REGARDING 
COOKIES.—This paragraph may not be con-
strued to include, as computer software—
(i) a cookie; or 
(ii) any other type of text or data file 
that solely may be read or transferred by 
a computer. 
(5) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(6) DAMAGE.—The term ‘‘damage’’ has the 
meaning given such term in section 1030(e) of title 
18, United States Code. 
(7) DECEPTIVE
ACTS
OR
PRACTICES.—The 
term ‘‘deceptive acts or practices’’ has the meaning
HR 29 RFS 
applicable to such term for purposes of section 5 of 
the Federal Trade Commission Act (15 U.S.C. 45). 
(8) DISABLE.—The term ‘‘disable’’ means, with 
respect to an information collection program, to per-
manently prevent such program from executing any 
of the functions described in section 3(b)(1) that 
such program is otherwise capable of executing (in-
cluding by removing, deleting, or disabling the pro-
gram), unless the owner or operator of a protected 
computer takes a subsequent affirmative action to 
enable the execution of such functions. 
(9) INFORMATION COLLECTION FUNCTIONS.—
The term ‘‘information collection functions’’ means, 
with respect to an information collection program, 
the functions of the program described in subsection 
(b)(1) of section 3. 
(10) INFORMATION SERVICE.—The term ‘‘infor-
mation service’’ has the meaning given such term in 
section 3 of the Communications Act of 1934 (47 
U.S.C. 153). 
(11) INTERACTIVE
COMPUTER
SERVICE.—The 
term ‘‘interactive computer service’’ has the meaning 
given such term in section 230(f) of the Communica-
tions Act of 1934 (47 U.S.C. 230(f)).
HR 29 RFS 
(12) INTERNET.—The term ‘‘Internet’’ means 
collectively the myriad of computer and tele-
communications facilities, including equipment and 
operating software, which comprise the inter-
connected world-wide network of networks that em-
ploy the Transmission Control Protocol/Internet 
Protocol, or any predecessor or successor protocols 
to such protocol, to communicate information of all 
kinds by wire or radio. 
(13) PERSONALLY
IDENTIFIABLE
INFORMA-
TION.—
(A) IN GENERAL.—The term ‘‘personally 
identifiable information’’ means the following 
information, to the extent only that such infor-
mation allows a living individual to be identified 
from that information: 
(i) First and last name of an indi-
vidual. 
(ii) A home or other physical address 
of an individual, including street name, 
name of a city or town, and zip code. 
(iii) An electronic mail address. 
(iv) A telephone number. 
(v) A social security number, tax iden-
tification number, passport number, driv-
HR 29 RFS 
er’s license number, or any other govern-
ment-issued identification number. 
(vi) A credit card number. 
(vii) Any access code, password, or ac-
count number, other than an access code 
or password transmitted by an owner or 
authorized user of a protected computer to 
the intended recipient to register for, or 
log onto, a Web page or other Internet 
service or a network connection or service 
of a subscriber that is protected by an ac-
cess code or password. 
(viii) Date of birth, birth certificate 
number, or place of birth of an individual, 
except in the case of a date of birth trans-
mitted or collected for the purpose of com-
pliance with the law. 
(B) RULEMAKING.—The Commission may, 
by regulation, add to the types of information 
described in subparagraph (A) that shall be 
considered personally identifiable information 
for purposes of this Act, except that such addi-
tional types of information shall be considered 
personally identifiable information only to the 
extent that such information allows living indi-
HR 29 RFS 
viduals, particular computers, particular users 
of computers, or particular email addresses or 
other locations of computers to be identified 
from that information. 
(14) SUITE OF FUNCTIONALLY RELATED SOFT-
WARE.—The term suite of ‘‘functionally related soft-
ware’’ means a group of computer software pro-
grams distributed to an end user by a single pro-
vider, which programs are necessary to enable fea-
tures or functionalities of an integrated service of-
fered by the provider. 
(15) 
TELECOMMUNICATIONS
CARRIER.—The 
term ‘‘telecommunications carrier’’ has the meaning 
given such term in section 3 of the Communications 
Act of 1934 (47 U.S.C. 153). 
(16) TRANSMIT.—The term ‘‘transmit’’ means, 
with respect to an information collection program, 
transmission by any means. 
(17) WEB PAGE.—The term ‘‘Web page’’ means 
a location, with respect to the World Wide Web, that 
has a single Uniform Resource Locator or another 
single location with respect to the Internet, as the 
Federal Trade Commission may prescribe. 
(18) WEB SITE.—The term ‘‘web site’’ means a 
collection of Web pages that are presented and made
HR 29 RFS 
available by means of the World Wide Web as a sin-
gle Web site (or a single Web page so presented and 
made available), which Web pages have any of the 
following characteristics: 
(A) A common domain name. 
(B) Common ownership, management, or 
registration. 
SEC. 12. APPLICABILITY AND SUNSET. 
(a) EFFECTIVE DATE.—Except as specifically pro-
vided otherwise in this Act, this Act shall take effect upon 
the expiration of the 12-month period that begins on the 
date of the enactment of this Act. 
(b) APPLICABILITY.—Section 3 shall not apply to an 
information collection program installed on a protected 
computer before the effective date under subsection (a) of 
this section. 
(c) SUNSET.—This Act shall not apply after Decem-
ber 31, 2011.
Passed the House of Representatives May 23, 2005. 
Attest: 
JEFF TRANDAHL, 
Clerk.