I 
113TH CONGRESS 
2D SESSION 
H. R. 4711 
To establish a regulatory framework for the comprehensive protection of 
personal data for individuals under the aegis of the Federal Trade 
Commission, to amend the Children’s Online Privacy Protection Act 
of 1998 to improve provisions relating to collection, use, and disclosure 
of personal information of children, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MAY 21, 2014 
Mr. SIRES introduced the following bill; which was referred to the Committee 
on Energy and Commerce 
A BILL 
To establish a regulatory framework for the comprehensive 
protection of personal data for individuals under the 
aegis of the Federal Trade Commission, to amend the 
Children’s Online Privacy Protection Act of 1998 to im-
prove provisions relating to collection, use, and disclosure 
of personal information of children, and for other pur-
poses. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. TABLE OF CONTENTS. 
The table of contents for this Act is as follows: 
Sec. 1. Table of contents. 
VerDate Mar 15 2010 
02:53 May 29, 2014
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6211
E:\BILLS\H4711.IH
H4711
jbell on DSK7SPTVN1PROD with BILLS
TITLE I—COMMERCIAL PRIVACY 
Sec. 101. Short title. 
Sec. 102. Findings. 
Sec. 103. Definitions. 
Subtitle A—Right to Security and Accountability 
Sec. 111. Security. 
Sec. 112. Accountability. 
Sec. 113. Privacy by design. 
Subtitle B—Right to Notice and Individual Participation 
Sec. 121. Transparent notice of practices and purposes. 
Sec. 122. Individual participation. 
Subtitle C—Rights Relating to Data Minimization, Constraints on 
Distribution, and Data Integrity 
Sec. 131. Data minimization. 
Sec. 132. Constraints on distribution of information. 
Sec. 133. Data integrity. 
Subtitle D—Right to Notice of Breaches of Security 
Sec. 141. Definitions. 
Sec. 142. Notice to individuals. 
Sec. 143. Notice to law enforcement. 
Subtitle E—Enforcement 
Sec. 151. General application. 
Sec. 152. Enforcement by the Federal Trade Commission. 
Sec. 153. Enforcement by Attorney General. 
Sec. 154. Enforcement by States. 
Sec. 155. Civil penalties. 
Sec. 156. Effect on other laws. 
Sec. 157. No private right of action. 
Subtitle F—Co-Regulatory Safe Harbor Programs 
Sec. 161. Establishment of safe harbor programs. 
Sec. 162. Participation in safe harbor program. 
Subtitle G—Application With Other Federal Laws 
Sec. 171. Application with other Federal laws. 
Subtitle H—Development of Commercial Data Privacy Policy in the 
Department of Commerce 
Sec. 181. Direction to develop commercial data privacy policy. 
TITLE II—ONLINE PRIVACY OF CHILDREN 
Sec. 201. Short title. 
Sec. 202. Findings. 
Sec. 203. Definitions. 
VerDate Mar 15 2010 
02:53 May 29, 2014
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6211
E:\BILLS\H4711.IH
H4711
jbell on DSK7SPTVN1PROD with BILLS
Sec. 204. Online collection, use, and disclosure of personal information of chil-
dren. 
Sec. 205. Targeted marketing to children or minors. 
Sec. 206. Digital Marketing Bill of Rights for Teens and Fair Information 
Practices Principles. 
Sec. 207. Online collection of geolocation information of children and minors. 
Sec. 208. Removal of content. 
Sec. 209. Enforcement and applicability. 
Sec. 210. Rule for treatment of users of websites, services, and applications di-
rected to children or minors. 
Sec. 211. Effective dates. 
TITLE I—COMMERCIAL PRIVACY 
SEC. 101. SHORT TITLE. 
This title may be cited as the ‘‘Commercial Privacy 
Bill of Rights Act of 2014’’. 
SEC. 102. FINDINGS. 
The Congress finds the following: 
(1) Personal privacy is worthy of protection 
through appropriate legislation. 
(2) Trust in the treatment of personally identi-
fiable information collected on and off the Internet 
is essential for businesses to succeed. 
(3) Persons interacting with others engaged in 
interstate commerce have a significant interest in 
their personal information, as well as a right to con-
trol how that information is collected, used, stored, 
or transferred. 
(4) Persons engaged in interstate commerce 
and collecting personally identifiable information on 
individuals have a responsibility to treat that infor-
VerDate Mar 15 2010 
02:53 May 29, 2014
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4711.IH
H4711
jbell on DSK7SPTVN1PROD with BILLS
mation with respect and in accordance with common 
standards. 
(5) On the day before the date of the enactment 
of this Act, the laws of the Federal Government and 
State and local governments provided inadequate 
privacy protection for individuals engaging in and 
interacting with persons engaged in interstate com-
merce. 
(6) As of the day before the date of the enact-
ment of this Act, with the exception of Federal 
Trade Commission enforcement of laws against un-
fair and deceptive practices, the Federal Government 
has eschewed general commercial privacy laws in 
favor of industry self-regulation, which has led to 
several self-policing schemes, some of which are en-
forceable, and some of which provide insufficient pri-
vacy protection to individuals. 
(7) As of the day before the date of the enact-
ment of this Act, many collectors of personally iden-
tifiable information have yet to provide baseline fair 
information practice protections for individuals. 
(8) The ease of gathering and compiling per-
sonal information on the Internet and off, both 
overtly and surreptitiously, is becoming increasingly 
efficient and effortless due to advances in technology 
VerDate Mar 15 2010 
02:53 May 29, 2014
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4711.IH
H4711
jbell on DSK7SPTVN1PROD with BILLS
which have provided information gatherers the abil-
ity to compile seamlessly highly detailed personal 
histories of individuals. 
(9) Personal information requires greater pri-
vacy protection than is available on the day before 
the date of the enactment of this Act. Vast amounts 
of personal information, including sensitive informa-
tion, about individuals are collected on and off the 
Internet, often combined and sold or otherwise 
transferred to third parties, for purposes unknown 
to an individual to whom the personally identifiable 
information pertains. 
(10) Toward the close of the 20th century, as 
individuals’ personal information was increasingly 
collected, profiled, and shared for commercial pur-
poses, and as technology advanced to facilitate these 
practices, Congress enacted numerous statutes to 
protect privacy. 
(11) Those statutes apply to the government, 
telephones, cable television, e-mail, video tape rent-
als, and the Internet (but only with respect to chil-
dren and law enforcement requests). 
(12) As in those instances, the Federal Govern-
ment has a substantial interest in creating a level 
playing field of protection across all collectors of per-
VerDate Mar 15 2010 
02:53 May 29, 2014
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4711.IH
H4711
jbell on DSK7SPTVN1PROD with BILLS
sonally identifiable information, both in the United 
States and abroad. 
(13) Enhancing individual privacy protection in 
a balanced way that establishes clear, consistent 
rules, both domestically and internationally, will 
stimulate commerce by instilling greater consumer 
confidence at home and greater confidence abroad as 
more and more entities digitize personally identifi-
able information, whether collected, stored, or used 
online or offline. 
SEC. 103. DEFINITIONS. 
(a) IN GENERAL.—Subject to subsection (b), in this 
title: 
(1) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(2) COVERED ENTITY.—The term ‘‘covered en-
tity’’ means any person to whom this title applies 
under section 151. 
(3) COVERED INFORMATION.— 
(A) IN GENERAL.—Except as provided in 
subparagraph (B), the term ‘‘covered informa-
tion’’ means only the following: 
(i) Personally identifiable information. 
(ii) Unique identifier information. 
VerDate Mar 15 2010 
02:53 May 29, 2014
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4711.IH
H4711
jbell on DSK7SPTVN1PROD with BILLS
(iii) Any information that is collected, 
used, or stored in connection with person-
ally identifiable information or unique 
identifier information in a manner that 
may reasonably be used by the party col-
lecting the information to identify a spe-
cific individual. 
(B) EXCEPTION.—The term ‘‘covered in-
formation’’ does not include the following: 
(i) Personally identifiable information 
obtained from public records that is not 
merged with covered information gathered 
elsewhere. 
(ii) Personally identifiable information 
that is obtained from a forum— 
(I) where the individual volun-
tarily shared the information or au-
thorized the information to be shared; 
and 
(II) that— 
(aa) is widely and publicly 
available and was not made pub-
licly available in bad faith; and 
VerDate Mar 15 2010 
02:53 May 29, 2014
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4711.IH
H4711
jbell on DSK7SPTVN1PROD with BILLS
(bb) contains no restrictions 
on who can access and view such 
information. 
(iii) Personally identifiable informa-
tion reported in public media. 
(iv) Personally identifiable informa-
tion dedicated to contacting an individual 
at the individual’s place of work. 
(4) ESTABLISHED BUSINESS RELATIONSHIP.— 
The term ‘‘established business relationship’’ means, 
with respect to a covered entity and a person, a rela-
tionship formed with or without the exchange of con-
sideration, involving the establishment of an account 
by the person with the covered entity for the receipt 
of products or services offered by the covered entity. 
(5) 
PERSONALLY
IDENTIFIABLE
INFORMA-
TION.—The term ‘‘personally identifiable informa-
tion’’ means only the following: 
(A) Any of the following information about 
an individual: 
(i) The first name (or initial) and last 
name of an individual, whether given at 
birth or time of adoption, or resulting from 
a lawful change of name. 
VerDate Mar 15 2010 
02:53 May 29, 2014
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4711.IH
H4711
jbell on DSK7SPTVN1PROD with BILLS
(ii) The postal address of a physical 
place of residence of such individual. 
(iii) An e-mail address. 
(iv) A telephone number or mobile de-
vice number. 
(v) A social security number or other 
government issued identification number 
issued to such individual. 
(vi) The account number of a credit 
card issued to such individual. 
(vii) Unique identifier information 
that alone can be used to identify a spe-
cific individual. 
(viii) Biometric data about such indi-
vidual, including fingerprints and retina 
scans. 
(B) If used, transferred, or stored in con-
nection with 1 or more of the items of informa-
tion described in subparagraph (A), any of the 
following: 
(i) A date of birth. 
(ii) The number of a certificate of 
birth or adoption. 
(iii) A place of birth. 
VerDate Mar 15 2010 
02:53 May 29, 2014
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4711.IH
H4711
jbell on DSK7SPTVN1PROD with BILLS
(iv) Unique identifier information that 
alone cannot be used to identify a specific 
individual. 
(v) Precise geographic location, at the 
same degree of specificity as a global posi-
tioning system or equivalent system, and 
not including any general geographic infor-
mation that may be derived from an Inter-
net Protocol address. 
(vi) Information about an individual’s 
quantity, technical configuration, type, des-
tination, location, and amount of uses of 
voice services, regardless of technology 
used. 
(vii) Any other information concerning 
an individual that may reasonably be used 
by the party using, collecting, or storing 
that information to identify that individual. 
(6) SENSITIVE PERSONALLY IDENTIFIABLE IN-
FORMATION.—The term ‘‘sensitive personally identi-
fiable information’’ means— 
(A) personally identifiable information 
which, if lost, compromised, or disclosed with-
out authorization either alone or with other in-
VerDate Mar 15 2010 
02:53 May 29, 2014
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4711.IH
H4711
jbell on DSK7SPTVN1PROD with BILLS
formation, carries a significant risk of economic 
or physical harm; or 
(B) information related to— 
(i) a particular medical condition or a 
health record; or 
(ii) the religious affiliation of an indi-
vidual. 
(7) THIRD PARTY.— 
(A) IN GENERAL.—The term ‘‘third party’’ 
means, with respect to a covered entity, a per-
son that— 
(i) is— 
(I) not related to the covered en-
tity by common ownership or cor-
porate control; or 
(II) related to the covered entity 
by common ownership or corporate 
control and an ordinary consumer 
would not understand that the covered 
entity and the person were related by 
common ownership or corporate con-
trol; 
(ii) is not a service provider used by 
the covered entity to receive personally 
identifiable information or sensitive person-
VerDate Mar 15 2010 
02:53 May 29, 2014
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4711.IH
H4711
jbell on DSK7SPTVN1PROD with BILLS
ally identifiable information in performing 
services or functions on behalf of and 
under the instruction of the covered entity; 
and 
(iii) with respect to the collection of 
covered information of an individual, does 
not have an established business relation-
ship with the individual and does not iden-
tify itself to the individual at the time of 
such collection in a clear and conspicuous 
manner that is visible to the individual. 
(B) COMMON BRANDS.—The term ‘‘third 
party’’ may include, with respect to a covered 
entity, a person who operates under a common 
brand with the covered entity. 
(8) UNAUTHORIZED USE.— 
(A) IN GENERAL.—The term ‘‘unauthor-
ized use’’ means the use of covered information 
by a covered entity or its service provider for 
any purpose not authorized by the individual to 
whom such information relates. 
(B) EXCEPTIONS.—Except as provided in 
subparagraph (C), the term ‘‘unauthorized use’’ 
does not include use of covered information re-
VerDate Mar 15 2010 
02:53 May 29, 2014
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4711.IH
H4711
jbell on DSK7SPTVN1PROD with BILLS
lating to an individual by a covered entity or its 
service provider as follows: 
(i) To process and enforce a trans-
action or deliver a service requested by 
that individual. 
(ii) To operate the covered entity that 
is providing a transaction or delivering a 
service requested by that individual, such 
as inventory management, financial report-
ing and accounting, planning, and product 
or service improvement or forecasting. 
(iii) To prevent or detect fraud or to 
provide for a physically or virtually secure 
environment. 
(iv) To investigate a possible crime. 
(v) That is required by a provision of 
law or legal process. 
(vi) To market or advertise to an indi-
vidual from a covered entity within the 
context of a covered entity’s own Internet 
website, services, or products if the covered 
information used for such marketing or ad-
vertising was— 
(I) collected directly by the cov-
ered entity; or 
VerDate Mar 15 2010 
02:53 May 29, 2014
Jkt 039200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H4711.IH
H4711
jbell on DSK7SPTVN1PROD with BILLS
(II) shared with the covered enti-
ty— 
(aa) at the affirmative re-
quest of the individual; or 
(bb) by an entity with which 
the individual has an established 
business relationship. 
(vii) Use that is necessary for the im-
provement of transaction or service deliv-
ery through research, testing, analysis, and 
development. 
(viii) Use that is necessary for inter-
nal operations, including the following: 
(I) Collecting customer satisfac-
tion surveys and conducting customer 
research to improve customer service 
information. 
(II) Information collected by an 
Internet website about the visits to 
such website and the click-through 
rates at such website— 
(aa) 
to 
improve 
website 
navigation and performance; or 
(bb) to understand and im-
prove the interaction of an indi-
VerDate Mar 15 2010 
02:53 May 29, 2014
Jkt 039200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H4711.IH
H4711
jbell on DSK7SPTVN1PROD with BILLS
vidual with the advertising of a 
covered entity. 
(ix) Use— 
(I) by a covered entity with 
which an individual has an established 
business relationship; 
(II) which the individual could 
have reasonably expected, at the time 
such relationship was established, was 
related to a service provided pursuant 
to such relationship; and 
(III) which does not constitute a 
material change in use or practice 
from what could have reasonably been 
expected. 
(C) SAVINGS.—A use of covered informa-
tion regarding an individual by a covered entity 
or its service provider may only be excluded 
under subparagraph (B) from the definition of 
‘‘unauthorized use’’ under subparagraph (A) if 
the use is reasonable and consistent with the 
practices and purposes described in the notice 
given the individual in accordance with section 
121(a)(1). 
VerDate Mar 15 2010 
02:53 May 29, 2014
Jkt 039200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H4711.IH
H4711
jbell on DSK7SPTVN1PROD with BILLS
(9) UNIQUE
IDENTIFIER
INFORMATION.—The 
term ‘‘unique identifier information’’ means a 
unique persistent identifier associated with an indi-
vidual or a networked device, including a customer 
number held in a cookie, a user ID, a processor se-
rial number, or a device serial number. 
(b) MODIFIED DEFINITION BY RULEMAKING.—If the 
Commission determines that a term defined in any of 
paragraphs (3) through (8) is not reasonably sufficient to 
protect an individual from unfair or deceptive acts or prac-
tices, the Commission may by rule modify such definition 
as the Commission considers appropriate to protect such 
individual from an unfair or deceptive act or practice to 
the extent that the Commission determines will not unrea-
sonably impede interstate commerce. 
Subtitle A—Right to Security and 
Accountability 
SEC. 111. SECURITY. 
(a) RULEMAKING REQUIRED.—Not later than 180 
days after the date of the enactment of this Act, the Com-
mission shall initiate a rulemaking proceeding to require 
each covered entity to carry out security measures to pro-
tect the covered information it collects and maintains. 
(b) PROPORTION.—The requirements prescribed 
under subsection (a) shall provide for security measures 
VerDate Mar 15 2010 
02:53 May 29, 2014
Jkt 039200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H4711.IH
H4711
jbell on DSK7SPTVN1PROD with BILLS