print and broadcast media that com-
plies with subparagraph (B)(iii) of 
such paragraph. 
(e) OTHER OBLIGATIONS FOLLOWING BREACH.— 
(1) IN GENERAL.—Subject to the provisions of 
this subsection, not later than 60 days after the date 
of a request by an individual who received notifica-
tion under subsection (a)(1) and quarterly thereafter 
for 2 years, a covered entity required to provide no-
tification under such subsection to such individual 
shall provide, or arrange for the provision of, to such 
individual at no cost to such individual, consumer 
credit reports from at least 1 major credit reporting 
agency. 
(2) LIMITATION.—Paragraph (1) shall not 
apply if the only personally identifiable information 
that is the subject of the breach of security is the 
individual’s first name or initial and last name, or 
address, or phone number, in combination with a 
credit or debit card number, and any required secu-
rity code. 
(3) RULEMAKING.—Not later than 1 year after 
the date of enactment of this Act, the Commission 
shall prescribe the following: 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(A) Criteria for determining the cir-
cumstances under which a covered entity re-
quired to provide notification under subsection 
(a)(1) must provide or arrange for the provision 
of free consumer credit reports under this sub-
section. 
(B) A simple process under which a cov-
ered entity that is a small business concern or 
small nonprofit organization may request a full 
or a partial waiver or a modified or an alter-
native means of complying with this subsection 
if providing free consumer credit reports is not 
feasible due to excessive costs relative to the re-
sources of such covered entity and relative to 
the level of harm, to affected individuals, 
caused by the breach of security. 
(4) DEFINITIONS.—In this subsection: 
(A) SMALL
BUSINESS
CONCERN.—The 
term ‘‘small business concern’’ has the meaning 
given such term under section 3 of the Small 
Business Act (15 U.S.C. 632). 
(B) SMALL NONPROFIT ORGANIZATION.— 
The term ‘‘small nonprofit organization’’ has 
the meaning the Commission shall give such 
term for purposes of this subsection. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(f) DELAY OF NOTIFICATION AUTHORIZED FOR NA-
TIONAL
SECURITY
AND
LAW
ENFORCEMENT
PUR-
POSES.— 
(1) IN GENERAL.—If the United States Secret 
Service or the Federal Bureau of Investigation de-
termines that notification under this section would 
impede a criminal investigation or a national secu-
rity activity, such notification shall be delayed upon 
written notice from the United States Secret Service 
or the Federal Bureau of Investigation to the cov-
ered entity that experienced the breach of security. 
The notification from the United States Secret Serv-
ice or the Federal Bureau of Investigation shall 
specify the period of delay requested for national se-
curity or law enforcement purposes. 
(2) SUBSEQUENT DELAY OF NOTIFICATION.— 
(A) IN GENERAL.—If the notification re-
quired under subsection (a)(1) is delayed pursu-
ant to paragraph (1), a covered entity shall give 
notice not more than 30 days after the day 
such law enforcement or national security delay 
was invoked unless a Federal law enforcement 
or intelligence agency provides written notifica-
tion that further delay is necessary. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(B) WRITTEN
JUSTIFICATION
REQUIRE-
MENTS.— 
(i) UNITED
STATES
SECRET
SERV-
ICE.—If the United States Secret Service 
instructs a covered entity to delay notifica-
tion under this section beyond the 30-day 
period set forth in subparagraph (A) (re-
ferred to in this clause as ‘‘subsequent 
delay’’), the United States Secret Service 
shall submit written justification for the 
subsequent delay to the Secretary of 
Homeland Security before the subsequent 
delay begins. 
(ii) FEDERAL BUREAU OF INVESTIGA-
TION.—If the Federal Bureau of Investiga-
tion instructs a covered entity to delay no-
tification under this section beyond the 30- 
day period set forth in subparagraph (A) 
(referred to in this clause as ‘‘subsequent 
delay’’), the Federal Bureau of Investiga-
tion shall submit written justification for 
the subsequent delay to the Attorney Gen-
eral before the subsequent delay begins. 
(3) LAW ENFORCEMENT IMMUNITY.—No cause 
of action shall lie in any court against any Federal 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
agency for acts relating to the delay of notification 
for national security or law enforcement purposes 
under this subtitle. 
(g) GENERAL EXEMPTION.— 
(1) IN GENERAL.—A covered entity shall be ex-
empt from the requirements under this section if, 
following a breach of security, the covered entity 
reasonably concludes that there is no reasonable risk 
of identity theft, fraud, or other unlawful conduct. 
(2) FTC GUIDANCE.—Not later than 1 year 
after the date of enactment of this Act, the Commis-
sion, after consultation with the Director of the Na-
tional Institute of Standards and Technology, shall 
issue guidance regarding the application of the ex-
emption under paragraph (1). 
(h) EXEMPTIONS
FOR NATIONAL SECURITY
AND 
LAW ENFORCEMENT PURPOSES.— 
(1) IN GENERAL.—A covered entity shall be ex-
empt from the notice requirements under this sec-
tion if— 
(A) a determination is made— 
(i) by the United States Secret Serv-
ice or the Federal Bureau of Investigation 
that notification of the breach of security 
could be reasonably expected to reveal sen-
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
sitive sources and methods or similarly im-
pede the ability of the Government to con-
duct law enforcement or intelligence inves-
tigations; or 
(ii) by the Federal Bureau of Inves-
tigation that notification of the breach of 
security could be reasonably expected to 
cause damage to the national security; and 
(B) the United States Secret Service or the 
Federal Bureau of Investigation, as the case 
may be, provides written notice of its deter-
mination under subparagraph (A) to the cov-
ered entity. 
(2) UNITED STATES SECRET SERVICE.—If the 
United States Secret Service invokes an exemption 
under paragraph (1), the United States Secret Serv-
ice shall submit written justification for invoking the 
exemption to the Secretary of Homeland Security 
before the exemption is invoked. 
(3) FEDERAL BUREAU OF INVESTIGATION.—If 
the Federal Bureau of Investigation invokes an ex-
emption under paragraph (1), the Federal Bureau of 
Investigation shall submit written justification for 
invoking the exemption to the Attorney General be-
fore the exemption is invoked. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(4) IMMUNITY.—No cause of action shall lie in 
any court against any Federal agency for acts relat-
ing to the exemption from notification for national 
security or law enforcement purposes under this sub-
title. 
(5) REPORTS.—Not later than 540 days after 
the date of enactment of this Act, and upon request 
by Congress thereafter, the United States Secret 
Service and the Federal Bureau of Investigation 
shall submit to Congress a report on the number 
and nature of breaches of security subject to the ex-
emptions for national security and law enforcement 
purposes under this subsection. 
(i) FINANCIAL FRAUD PREVENTION EXEMPTION.— 
(1) IN GENERAL.—A covered entity shall be ex-
empt from the notice requirements under this sec-
tion if the covered entity utilizes or participates in 
a security program that— 
(A) effectively blocks the use of the person-
ally identifiable information to initiate an unau-
thorized financial transaction before it is 
charged to the account of the individual; and 
(B) provides notice to each affected indi-
vidual after a breach of security that resulted in 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
attempted fraud or an attempted unauthorized 
transaction. 
(2) LIMITATIONS.—An exemption under para-
graph (1) shall not apply if— 
(A) the breach of security includes person-
ally identifiable information, other than a credit 
card number or credit card security code, of 
any type; or 
(B) the breach of security includes both 
the individual’s credit card number and the in-
dividual’s first and last name. 
(j) FINANCIAL INSTITUTIONS REGULATED BY FED-
ERAL FUNCTIONAL REGULATORS.— 
(1) IN GENERAL.—A covered financial institu-
tion shall be deemed in compliance with this section 
if— 
(A) the Federal functional regulator with 
jurisdiction over the covered financial institu-
tion has issued a standard by regulation or 
guideline under title V of the Gramm-Leach- 
Bliley Act (15 U.S.C. 6801 et seq.) that— 
(i) requires financial institutions with-
in its jurisdiction to provide notification to 
individuals following a breach of security; 
and 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(ii) provides protections substantially 
similar to, or greater than, those required 
under this Act; and 
(B) the covered financial institution is in 
compliance with the standard under subpara-
graph (A). 
(2) DEFINITIONS.—In this subsection: 
(A) COVERED FINANCIAL INSTITUTION.— 
The term ‘‘covered financial institution’’ means 
a financial institution that is subject to— 
(i) the data security requirements of 
the Gramm-Leach-Bliley Act (15 U.S.C. 
6801 et seq.); 
(ii) any implementing standard issued 
by regulation or guideline issued under 
that Act; and 
(iii) the jurisdiction of a Federal func-
tional regulator under that Act. 
(B) FEDERAL FUNCTIONAL REGULATOR.— 
The term ‘‘Federal functional regulator’’ has 
the meaning given the term in section 509 of 
the Gramm-Leach-Bliley Act (15 U.S.C. 6809). 
(C) FINANCIAL
INSTITUTION.—The term 
‘‘financial institution’’ has the meaning given 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
the term in section 509 of the Gramm-Leach- 
Bliley Act (15 U.S.C. 6809). 
(k) EXEMPTION; HEALTH PRIVACY.— 
(1) COVERED ENTITY OR BUSINESS ASSOCIATE 
UNDER HITECH ACT.—To the extent that a covered 
entity under this section acts as a covered entity or 
a business associate under section 13402 of the 
Health Information Technology for Economic and 
Clinical Health Act (42 U.S.C. 17932), has the obli-
gation to provide notification to individuals following 
a breach of security under that Act or its imple-
menting regulations, and is in compliance with that 
obligation, the covered entity shall be deemed in 
compliance with this section. 
(2) ENTITY SUBJECT TO HITECH ACT.—To the 
extent that a covered entity under this section acts 
as a vendor of personal health records, a third party 
service provider, or other entity subject to section 
13407 of the Health Information Technology for Ec-
onomical and Clinical Health Act (42 U.S.C. 
17937), has the obligation to provide notification to 
individuals following a breach of security under that 
Act or its implementing regulations, and is in com-
pliance with that obligation, the covered entity shall 
be deemed in compliance with this section. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(3) LIMITATION
OF
STATUTORY
CONSTRUC-
TION.—Nothing in this subtitle may be construed in 
any way to give effect to the sunset provision under 
section 13407(g)(2) of the Health Information Tech-
nology for Economic and Clinical Health Act (42 
U.S.C. 17937(g)(2)) or to otherwise limit or affect 
the applicability, under section 13407 of that Act, of 
the requirement to provide notification to individuals 
following a breach of security for vendors of personal 
health records and each entity described in clause 
(ii), (iii), or (iv) of section 13424(b)(1)(A) of that 
Act (42 U.S.C. 17953(b)(1)(A)). 
(l) INTERNET WEBSITE NOTICE OF FEDERAL TRADE 
COMMISSION.—If the Commission, upon receiving notifi-
cation of any breach of security that is reported to the 
Commission, finds that notification of the breach of secu-
rity via the Commission’s Internet website would be in the 
public interest or for the protection of consumers, the 
Commission shall place such a notice in a clear and con-
spicuous location on its Internet website. 
(m) FTC STUDY ON NOTIFICATION IN LANGUAGES 
IN ADDITION TO ENGLISH.—Not later than 1 year after 
the date of enactment of this Act, the Commission shall 
conduct a study on the feasibility and advisability of re-
quiring notification provided pursuant to subsection (d)(1) 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
to be provided in a language in addition to English to indi-
viduals known to speak only such other language. 
SEC. 143. NOTICE TO LAW ENFORCEMENT. 
(a) DESIGNATION OF GOVERNMENT ENTITY TO RE-
CEIVE NOTICE.—Not later than 60 days after the date 
of enactment of this Act, the Secretary of Homeland Secu-
rity shall designate a Federal Government entity to receive 
notice under this section. 
(b) NOTICE TO DESIGNATED ENTITY.—A covered en-
tity shall notify the designated entity of a breach of secu-
rity if— 
(1) the number of individuals whose personally 
identifiable information was, or is reasonably be-
lieved to have been, acquired or accessed as a result 
of the breach of security exceeds 10,000; 
(2) the breach of security involves a database, 
networked or integrated databases, or other data 
system containing the personally identifiable infor-
mation of more than 1,000,000 individuals; 
(3) the breach of security involves databases 
owned by the Federal Government; or 
(4) the breach of security involves primarily 
personally identifiable information of individuals 
known to the covered entity to be employees or con-
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
tractors of the Federal Government involved in na-
tional security or law enforcement. 
(c) CONTENT OF NOTICES.— 
(1) IN
GENERAL.—Each notice under sub-
section (b) shall contain the following: 
(A) The date, estimated date, or estimated 
date range of the breach of security. 
(B) A description of the nature of the 
breach of security. 
(C) A description of each type of person-
ally identifiable information that was or is rea-
sonably believed to have been acquired or 
accessed as a result of the breach of security. 
(D) A statement of each paragraph under 
subsection (b) that applies to the breach of se-
curity. 
(2) CONSTRUCTION.—Nothing in this section 
shall be construed to require a covered entity to re-
veal specific or identifying information about an in-
dividual as part of the notice under paragraph (1). 
(d) NOTICE
BY DESIGNATED ENTITY.—The des-
ignated entity shall promptly provide each notice it re-
ceives under subsection (b) to the following: 
(1) The United States Secret Service. 
(2) The Federal Bureau of Investigation. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(3) The Commission. 
(4) The United States Postal Inspection Serv-
ice, if the breach of security involves mail fraud. 
(5) The attorney general of each State affected 
by the breach of security. 
(6) Such other Federal agencies as the des-
ignated entity considers appropriate for law enforce-
ment, national security, or data security purposes. 
(e) TIMING OF NOTICES.—Notice under this section 
shall be delivered as follows: 
(1) Notice under subsection (b) shall be deliv-
ered as promptly as possible, but— 
(A) not less than 3 business days before 
notification to an individual section 142(a)(1); 
and 
(B) not later than 10 days after the date 
of discovery of the events requiring notice. 
(2) Notice under subsection (d) shall be deliv-
ered as promptly as possible, but not later than 1 
business day after the date that the designated enti-
ty receives notice of a breach of security from a cov-
ered entity. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
Subtitle E—Enforcement 
SEC. 151. GENERAL APPLICATION. 
The requirements of this title shall apply to any per-
son who— 
(1) collects, uses, transfers, or stores covered 
information concerning more than 5,000 individuals 
during any consecutive 12-month period; and 
(2) is— 
(A) a person over which the Commission 
has authority pursuant to section 5(a)(2) of the 
Federal Trade Commission Act (15 U.S.C. 
45(a)(2)); 
(B) a common carrier subject to the Com-
munications Act of 1934 (47 U.S.C. 151 et 
seq.), notwithstanding the definition of the term 
‘‘Acts to regulate commerce’’ in section 4 of the 
Federal Trade Commission Act (15 U.S.C. 44) 
and the exception provided by section 5(a)(2) of 
the Federal Trade Commission Act (15 U.S.C. 
45(a)(2)) for such carriers; or 
(C) a nonprofit organization, including any 
organization described in section 501(c) of the 
Internal Revenue Code of 1986 that is exempt 
from taxation under section 501(a) of such 
Code, notwithstanding the definition of the 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
term ‘‘Acts to regulate commerce’’ in section 4 
of the Federal Trade Commission Act (15 
U.S.C. 44) and the exception provided by sec-
tion 5(a)(2) of the Federal Trade Commission 
Act (15 U.S.C. 45(a)(2)) for such organiza-
tions. 
SEC. 152. ENFORCEMENT BY THE FEDERAL TRADE COM-
MISSION. 
(a) UNFAIR OR DECEPTIVE ACTS OR PRACTICES.— 
A reckless or repetitive violation of a provision of this title, 
except section 143, shall be treated as an unfair or decep-
tive act or practice in violation of a regulation under sec-
tion 18(a)(1)(B) of the Federal Trade Commission Act 
(15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive 
acts or practices. 
(b) POWERS OF COMMISSION.— 
(1) IN GENERAL.—Except as provided in para-
graph (3), the Commission shall enforce this title, 
except section 143, in the same manner, by the same 
means, and with the same jurisdiction, powers, and 
duties as though all applicable terms and provisions 
of the Federal Trade Commission Act (15 U.S.C. 41 
et seq.) were incorporated into and made a part of 
this title. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(2) PRIVILEGES AND IMMUNITIES.—Except as 
provided in paragraph (3), any person who violates 
a provision of this title, except section 143, shall be 
subject to the penalties and entitled to the privileges 
and immunities provided in the Federal Trade Com-
mission Act (15 U.S.C. 41 et seq.). 
(3) COMMON CARRIERS AND NONPROFIT ORGA-
NIZATIONS.—The Commission shall enforce this 
title, except section 143, with respect to common 
carriers and nonprofit organizations described in 
section 151 to the extent necessary to effectuate the 
purposes of this title as if such carriers and non-
profit organizations were persons over which the 
Commission has authority pursuant to section 
5(a)(2) of the Federal Trade Commission Act (15 
U.S.C. 45(a)(2)). 
(c) RULEMAKING AUTHORITY.— 
(1) LIMITATION.—In promulgating rules under 
this title, the Commission may not require the de-
ployment or use of any specific products or tech-
nologies, including any specific computer software or 
hardware. 
(2) ADMINISTRATIVE PROCEDURE.—The Com-
mission shall promulgate regulations under this title 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
in accordance with section 553 of title 5, United 
States Code. 
(d) RULE OF CONSTRUCTION.—Nothing in this title 
shall be construed to limit the authority of the Commission 
under any other provision of law. 
SEC. 153. ENFORCEMENT BY ATTORNEY GENERAL. 
(a) IN GENERAL.—The Attorney General may bring 
a civil action in the appropriate United States district 
court against any covered entity that engages in conduct 
constituting a violation of section 143. 
(b) PENALTIES.— 
(1) IN GENERAL.—Upon proof of such conduct 
by a preponderance of the evidence, a covered entity 
shall be subject to a civil penalty of not more than 
$1,000 per individual whose personally identifiable 
information was or is reasonably believed to have 
been accessed or acquired as a result of the breach 
of security that is the basis of the violation, up to 
a maximum of $100,000 per day while such violation 
persists. 
(2) LIMITATIONS.—The total amount of the 
civil penalty assessed under this subsection against 
a covered entity for acts or omissions relating to a 
single 
breach 
of 
security 
shall 
not 
exceed 
$3,000,000, unless the conduct constituting a viola-
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
tion of subtitle D was reckless or repeated, in which 
case an additional civil penalty of up to $3,000,000 
may be imposed. 
(3) ADJUSTMENT FOR INFLATION.—Beginning 
on the date that the Consumer Price Index is first 
published by the Bureau of Labor Statistics that is 
after 1 year after the date of enactment of this Act, 
and each year thereafter, the amounts specified in 
paragraphs (1) and (2) shall be increased by the 
percentage increase in the Consumer Price Index 
published on that date from the Consumer Price 
Index published the previous year. 
(c) INJUNCTIVE ACTIONS.—If it appears that a cov-
ered entity has engaged, or is engaged, in any act or prac-
tice that constitutes a violation of subtitle D, the Attorney 
General may petition an appropriate United States district 
court for an order enjoining such practice or enforcing 
compliance with such subtitle. 
(d) ISSUANCE OF ORDER.—A court may issue such 
an order under paragraph (c) if it finds that the conduct 
in question constitutes a violation of subtitle D. 
SEC. 154. ENFORCEMENT BY STATES. 
(a) CIVIL ACTION.—In any case in which the attor-
ney general of a State has reason to believe that an inter-
est of the residents of that State has been or is adversely 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
affected by a covered entity who violates any part of this 
title in a manner that results in economic or physical harm 
to an individual or engages in a pattern or practice that 
violates any part of this title other than section 143, the 
attorney general may, as parens patriae, bring a civil ac-
tion on behalf of the residents of the State in an appro-
priate district court of the United States— 
(1) to enjoin further violation of this title or a 
regulation promulgated under this title by the de-
fendant; 
(2) to compel compliance with this title or a 
regulation promulgated under this title; or 
(3) for violations of this title or a regulation 
promulgated under this title to obtain civil penalties 
in the amount determined under section title. 
(b) RIGHTS OF FEDERAL TRADE COMMISSION.— 
(1) NOTICE
TO
FEDERAL
TRADE
COMMIS-
SION.— 
(A) IN GENERAL.—Except as provided in 
subparagraph (C), the attorney general of a 
State shall notify the Commission in writing of 
any civil action under subsection (b), prior to 
initiating such civil action. 
(B) CONTENTS.—The notice required by 
subparagraph (A) shall include a copy of the 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
complaint to be filed to initiate such civil ac-
tion. 
(C) EXCEPTION.—If it is not feasible for 
the attorney general of a State to provide the 
notice required by subparagraph (A), the State 
shall provide notice immediately upon insti-
tuting a civil action under subsection (b). 
(2) INTERVENTION BY FEDERAL TRADE COM-
MISSION.—Upon receiving notice required by para-
graph (1) with respect to a civil action, the Commis-
sion may— 
(A) intervene in such action; and 
(B) upon intervening— 
(i) be heard on all matters arising in 
such civil action; and 
(ii) file petitions for appeal of a deci-
sion in such action. 
(c) PREEMPTIVE ACTION BY FEDERAL TRADE COM-
MISSION.—If the Commission institutes a civil action for 
violation of this title or a regulation promulgated under 
this title, no attorney general of a State may bring a civil 
action under subsection (a) against any defendant named 
in the complaint of the Commission for violation of this 
title or a regulation promulgated under this title that is 
alleged in such complaint. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00062
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(d) INVESTIGATORY POWERS.—Nothing in this sec-
tion may be construed to prevent the attorney general of 
a State from exercising the powers conferred on such at-
torney general by the laws of such State to conduct inves-
tigations or to administer oaths or affirmations or to com-
pel the attendance of witnesses or the production of docu-
mentary and other evidence. 
(e) VENUE; SERVICE OF PROCESS.— 
(1) VENUE.—Any action brought under sub-
section (a) may be brought in— 
(A) the district court of the United States 
that meets applicable requirements relating to 
venue under section 1391 of title 28, United 
States Code; or 
(B) another court of competent jurisdic-
tion. 
(2) SERVICE
OF
PROCESS.—In an action 
brought under subsection (a), process may be served 
in any district in which the defendant— 
(A) is an inhabitant; or 
(B) may be found. 
(f) ACTIONS BY OTHER STATE OFFICIALS.— 
(1) IN GENERAL.—In addition to civil actions 
brought by attorneys general under subsection (a), 
any other officer of a State who is authorized by the 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00063
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
State to do so may bring a civil action under sub-
section (a), subject to the same requirements and 
limitations that apply under this section to civil ac-
tions brought by attorneys general. 
(2) SAVINGS PROVISION.—Nothing in this sec-
tion may be construed to prohibit an authorized offi-
cial of a State from initiating or continuing any pro-
ceeding in a court of the State for a violation of any 
civil or criminal law of the State. 
SEC. 155. CIVIL PENALTIES. 
(a) IN GENERAL.—In an action brought under sec-
tion 154, in addition to any other penalty otherwise appli-
cable to a violation of this title or any regulation promul-
gated under this title, the following civil penalties shall 
apply: 
(1) SUBTITLE A VIOLATIONS.—A covered entity 
that recklessly or repeatedly violates subtitle A is lia-
ble for a civil penalty equal to the amount calculated 
by multiplying the number of days that the entity is 
not in compliance with such subtitle by an amount 
not to exceed $33,000. 
(2) SUBTITLE B VIOLATIONS.—A covered entity 
that recklessly or repeatedly violates subtitle B is 
liable for a civil penalty equal to the amount cal-
culated by multiplying the number of days that such 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00064
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
an entity is not in compliance with such subtitle, or 
the number of individuals for whom the entity failed 
to obtain consent as required by such subtitle, 
whichever is greater, by an amount not to exceed 
$33,000. 
(3) SUBTITLE D VIOLATIONS.—A covered entity 
that recklessly or repeatedly violates section 142 is 
liable for a civil penalty equal to the amount cal-
culated by multiplying the number of violations of 
such section by an amount not to exceed $33,000. 
Each failure to send notification as required under 
such section to a resident of the State shall be treat-
ed as a separate violation. 
(b) ADJUSTMENT
FOR INFLATION.—Beginning on 
the date that the Consumer Price Index for All Urban 
Consumers is first published by the Bureau of Labor Sta-
tistics that is after 1 year after the date of enactment of 
this Act, and each year thereafter, each of the amounts 
specified in subsection (a) shall be increased by the per-
centage increase in the Consumer Price Index published 
on that date from the Consumer Price Index published 
the previous year. 
(c) MAXIMUM TOTAL LIABILITY.—Notwithstanding 
the number of actions which may be brought against a 
covered entity under section 154, the maximum civil pen-
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
alty for which any covered entity may be liable under this 
section in such actions shall not exceed— 
(1) $6,000,000 for any related series of viola-
tions of any rule promulgated under subtitle A; 
(2) $6,000,000 for any related series of viola-
tions of subtitle B; and 
(3) $6,000,000 for any related series of viola-
tions of section 142. 
SEC. 156. EFFECT ON OTHER LAWS. 
(a) PREEMPTION OF STATE LAWS.—The provisions 
of this title shall supersede any provisions of the law of 
any State relating to those entities covered by the regula-
tions issued pursuant to this title, to the extent that such 
provisions relate to the collection, use, or disclosure of— 
(1) covered information addressed in this title; 
or 
(2) personally identifiable information or per-
sonal identification information addressed in provi-
sions of the law of a State. 
(b) UNAUTHORIZED CIVIL ACTIONS; CERTAIN STATE 
LAWS.— 
(1) 
UNAUTHORIZED
ACTIONS.—No 
person 
other than a person specified in section 154 may 
bring a civil action under the laws of any State if 
such action is premised in whole or in part upon the 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00066
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
defendant violating this title or a regulation promul-
gated under this title. 
(2) PROTECTION OF CERTAIN STATE LAWS.— 
This title shall not be construed to preempt the ap-
plicability of— 
(A) State laws that address the collection, 
use, or disclosure of health information or fi-
nancial information; or 
(B) other State laws to the extent that 
those laws relate to acts of fraud. 
(c) RULE
OF CONSTRUCTION RELATING
TO RE-
QUIRED DISCLOSURES
TO GOVERNMENT ENTITIES.— 
This title shall not be construed to expand or limit the 
duty or authority of a covered entity or third party to dis-
close personally identifiable information to a Government 
entity under any provision of law. 
SEC. 157. NO PRIVATE RIGHT OF ACTION. 
This title may not be construed to provide any private 
right of action. 
Subtitle F—Co-Regulatory Safe 
Harbor Programs 
SEC. 161. ESTABLISHMENT OF SAFE HARBOR PROGRAMS. 
(a) IN GENERAL.—Not later than 1 year after the 
date of enactment of this Act, the Commission shall ini-
tiate a rulemaking proceeding to establish requirements 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
for the establishment and administration of safe harbor 
programs under which a nongovernmental organization 
will administer a program that— 
(1) establishes a mechanism for participants to 
implement the requirements of this title with regards 
to— 
(A) certain types of unauthorized uses of 
covered information as described in paragraph 
(2); or 
(B) any unauthorized use of covered infor-
mation; and 
(2) offers consumers a clear, conspicuous, per-
sistent, and effective means of opting out of the 
transfer of covered information by a covered entity 
participating in the safe harbor program to a third 
party for— 
(A) behavioral advertising purposes; 
(B) location-based advertising purposes; 
(C) other specific types of unauthorized 
use; or 
(D) any unauthorized use. 
(b) SELECTION OF NONGOVERNMENTAL ORGANIZA-
TIONS TO ADMINISTER PROGRAM.— 
(1) SUBMITTAL OF APPLICATIONS.—An appli-
cant seeking to administer a program under the re-
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
quirements established pursuant to subsection (a) 
shall submit to the Commission an application there-
for at such time, in such manner, and containing 
such information as the Commission may require. 
(2) NOTICE AND RECEIPT OF APPLICATIONS.— 
Upon completion of the rulemaking proceedings re-
quired by subsection (a), the Commission shall— 
(A) publish a notice in the Federal Reg-
ister that it will receive applications for ap-
proval of safe harbor programs under this sub-
title; and 
(B) begin receiving applications under 
paragraph (1). 
(3) SELECTION.—Not later than 270 days after 
the date on which the Commission receives a com-
pleted application under this subsection, the Com-
mission shall grant or deny the application on the 
basis of the Commission’s evaluation of the appli-
cant’s capacity to provide protection of individuals’ 
covered information with regard to specific types of 
unauthorized uses of covered information as de-
scribed in subsection (a)(2) that is substantially 
equivalent to or superior to the protection otherwise 
provided under this title. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(4) WRITTEN FINDINGS.—Any decision reached 
by the Commission under this subsection shall be ac-
companied by written findings setting forth the basis 
for and reasons supporting such decision. 
(c) SCOPE
OF SAFE HARBOR PROTECTION.—The 
scope of protection offered by safe harbor programs ap-
proved by the Commission that establish mechanisms for 
participants to implement the requirements of the title 
only for certain uses of covered information as described 
in subsection (a)(2) shall be limited to participating enti-
ties’ use of those particular types of covered information. 
(d) SUPERVISION
BY FEDERAL TRADE COMMIS-
SION.— 
(1) IN GENERAL.—The Commission shall exer-
cise oversight and supervisory authority of a safe 
harbor 
program 
approved 
under 
this 
section 
through— 
(A) ongoing review of the practices of the 
nongovernmental 
organization 
administering 
the program; 
(B) the imposition of civil penalties on the 
nongovernmental organization if it is not com-
pliant with the requirements established under 
subsection (a); and 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00070
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(C) withdrawal of authorization to admin-
ister the safe harbor program under this sub-
title. 
(2) ANNUAL REPORTS BY NONGOVERNMENTAL 
ORGANIZATIONS.—Each year, each nongovernmental 
organization administering a safe harbor program 
under this section shall submit to the Commission a 
report on its activities under this subtitle during the 
preceding year. 
SEC. 162. PARTICIPATION IN SAFE HARBOR PROGRAM. 
(a) EXEMPTION.—Any covered entity that partici-
pates in, and demonstrates compliance with, a safe harbor 
program administered under section 161 shall be exempt 
from any provision of subtitle B or subtitle C if the Com-
mission finds that the requirements of the safe harbor pro-
gram are substantially the same as or more protective of 
privacy of individuals than the requirements of the provi-
sion from which the exemption is granted. 
(b) LIMITATION.—Nothing in this subtitle shall be 
construed to exempt any covered entity participating in 
a safe harbor program from compliance with any other 
requirement of the regulations promulgated under this 
title for which the safe harbor does not provide an excep-
tion. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
Subtitle G—Application With Other 
Federal Laws 
SEC. 171. APPLICATION WITH OTHER FEDERAL LAWS. 
(a) QUALIFIED EXEMPTION FOR PERSONS SUBJECT 
TO OTHER FEDERAL PRIVACY LAWS.—If a person is sub-
ject to a provision of this title and a provision of a Federal 
privacy law described in subsection (d), such provision of 
this title shall not apply to such person to the extent that 
such provision of Federal privacy law applies to such per-
son. 
(b) PROTECTION
OF OTHER FEDERAL PRIVACY 
LAWS.—Nothing in this title may be construed to modify, 
limit, or supersede the operation of the Federal privacy 
laws described in subsection (d) or the provision of infor-
mation permitted or required, expressly or by implication, 
by such laws, with respect to Federal rights and practices. 
(c) COMMUNICATIONS INFRASTRUCTURE AND PRI-
VACY.—If a person is subject to a provision of section 222 
or 631 of the Communications Act of 1934 (47 U.S.C. 
222 and 551) and a provision of this title, such provision 
of such section 222 or 631 shall not apply to such person 
to the extent that such provision of this title applies to 
such person. 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(d) OTHER FEDERAL PRIVACY LAWS DESCRIBED.— 
The Federal privacy laws described in this subsection are 
as follows: 
(1) Section 552a of title 5, United States Code 
(commonly known as the Privacy Act of 1974). 
(2) The Right to Financial Privacy Act of 1978 
(12 U.S.C. 3401 et seq.). 
(3) The Fair Credit Reporting Act (15 U.S.C. 
1681 et seq.). 
(4) The Fair Debt Collection Practices Act (15 
U.S.C. 1692 et seq.). 
(5) The Children’s Online Privacy Protection 
Act of 1998 (15 U.S.C. 6501 et seq.). 
(6) Title V of the Gramm-Leach-Bliley Act of 
1999 (15 U.S.C. 6801 et seq.). 
(7) Chapters 119, 123, and 206 of title 18, 
United States Code. 
(8) Section 2710 of title 18, United States 
Code. 
(9) Section 444 of the General Education Pro-
visions Act (20 U.S.C. 1232g) (commonly referred 
to as the ‘‘Family Educational Rights and Privacy 
Act of 1974’’). 
(10) Section 445 of the General Education Pro-
visions Act (20 U.S.C. 1232h). 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
(11) The Privacy Protection Act of 1980 (42 
U.S.C. 2000aa et seq.). 
(12) The regulations promulgated under section 
264(c) of the Health Insurance Portability and Ac-
countability Act of 1996 (42 U.S.C. 1320d–2 note), 
as such regulations relate to a person described in 
section 1172(a) of the Social Security Act (42 
U.S.C. 1320d–1(a)) or to transactions referred to in 
section 1173(a)(1) of such Act (42 U.S.C. 1320d– 
2(a)(1)). 
(13) The Communications Assistance for Law 
Enforcement Act (47 U.S.C. 1001 et seq.). 
(14) Section 227 of the Communications Act of 
1934 (47 U.S.C. 227). 
Subtitle H—Development of Com-
mercial Data Privacy Policy in 
the Department of Commerce 
SEC. 181. DIRECTION TO DEVELOP COMMERCIAL DATA PRI-
VACY POLICY. 
The Secretary of Commerce shall contribute to the 
development of commercial data privacy policy by— 
(1) convening private sector stakeholders, in-
cluding members of industry, civil society groups, 
academia, in open forums, to develop codes of con-
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00074
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
duct in support of applications for safe harbor pro-
grams under subtitle F; 
(2) expanding interoperability between the 
United States commercial data privacy framework 
and other national and regional privacy frameworks; 
(3) conducting research related to improving 
privacy protection under this title; and 
(4) conducting research related to improving 
data sharing practices, including the use of 
anonymised data, and growing the information econ-
omy. 
TITLE II—ONLINE PRIVACY OF 
CHILDREN 
SEC. 201. SHORT TITLE. 
This title may be cited as the ‘‘Do Not Track Kids 
Act of 2017’’. 
SEC. 202. FINDINGS. 
Congress finds the following: 
(1) Since the enactment of the Children’s On-
line Privacy Protection Act of 1998, the World Wide 
Web has changed dramatically, with the creation of 
tens of millions of websites, the proliferation of en-
tirely new media platforms, and the emergence of a 
diverse ecosystem of services, devices, and applica-
tions that enable users to connect wirelessly within 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00075
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
an online environment without being tethered to a 
desktop computer. 
(2) The explosive growth of the Internet eco-
system has unleashed a wide array of opportunities 
to learn, communicate, participate in civic life, ac-
cess entertainment, and engage in commerce. 
(3) In addition to these significant benefits, the 
Internet also presents challenges, particularly with 
respect to the efforts of entities to track the online 
activities of children and minors and to collect, use, 
and disclose personal information about them, in-
cluding their geolocation, for commercial purposes. 
(4) Children and teens are visiting numerous 
companies’ websites, and marketers are using multi-
media games, online quizzes, and mobile phone and 
tablet applications to create ties to children and 
teens. 
(5) According to a study by the Wall Street 
Journal in 2010, websites directed to children and 
teens were more likely to use cookies and other 
tracking tools than sites directed to a general audi-
ence. 
(6) This study examined 50 popular websites 
for children and teens in the United States and 
found that these 50 sites placed 4,123 cookies, bea-
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00076
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
cons, and other tracking tools on the test computer 
used for the study. 
(7) This is 30-percent greater than the number 
of such tracking tools that were placed on the test 
computer in a similar study of the 50 overall most 
popular websites in the United States, which are 
generally directed to adults. 
(8) Children and teens lack the cognitive ability 
to distinguish advertising from program content and 
to understand that the purpose of advertising is to 
persuade them, making them unable to activate the 
defenses on which adults rely. 
(9) Children and teens are less able than adults 
to understand the potential long-term consequences 
of having their information available to third parties, 
including advertisers, and other individuals. 
(10) According to Common Sense Media and 
the Center for Digital Democracy, 90 percent of 
teens have used some form of social media, 75 per-
cent have a social networking site, and 51 percent 
check their social networking site at least once a 
day. 
(11) Ninety-one percent of parents and 91 per-
cent of adults believe it is not okay for advertisers 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00077
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
to collect information about a child’s location from 
that child’s mobile phone. 
(12) Ninety-four percent of parents and 91 per-
cent of adults agree that advertisers should receive 
the parent’s permission before putting tracking soft-
ware on a child’s computer. 
(13) Ninety-six percent of parents and 94 per-
cent of adults expressed disapproval when asked if 
it is ‘‘okay for a website to ask children for personal 
information about their friends’’. 
(14) Eighty-eight percent of parents would sup-
port a law that requires search engines and social 
networking sites to get users’ permission before 
using their personal information. 
(15) A Commonsense Media/Zogby poll found 
that 94 percent of parents and 94 percent of adults 
believe individuals should have the ability to request 
the deletion, after a specific period of time, of all of 
their personal information held by an online search 
engine, social networking site, or marketing com-
pany. 
(16) According to a Pew/Berkman Center poll, 
69 percent of parents of teens who engage in online 
activity are concerned about how that activity might 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
affect their children’s future academic or employ-
ment opportunities. 
(17) Eighty-one percent of parents of teens who 
engage in online activity say they are concerned 
about how much information advertisers can learn 
about their children’s online activity. 
SEC. 203. DEFINITIONS. 
(a) IN GENERAL.—In this title: 
(1) MINOR.—The term ‘‘minor’’ means an indi-
vidual who is older than 12 years of age and young-
er than 16 years of age. 
(2) TARGETED
MARKETING.—The term ‘‘tar-
geted marketing’’ means advertising or other efforts 
to market a product or service that are directed to 
a specific individual or device— 
(A) based on the personal information of 
the individual or a unique identifier of the de-
vice; and 
(B) as a result of use by the individual, or 
access by the device, of a website, online serv-
ice, online application, or mobile application. 
(b) TERMS DEFINED BY COMMISSION.—In this title, 
the terms ‘‘directed to minors’’ and ‘‘geolocation informa-
tion’’ shall have the meanings given such terms by the 
Commission by regulation. Not later than 1 year after the 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00079
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
date of enactment of this Act, the Commission shall pro-
mulgate, under section 553 of title 5, United States Code, 
regulations that define such terms broadly enough so that 
they are not limited to current technology, consistent with 
the principles articulated by the Commission regarding the 
definition of the term ‘‘Internet’’ in its statement of basis 
and purpose on the final rule under the Children’s Online 
Privacy Protection Act of 1998 (15 U.S.C. 6501 et seq.) 
promulgated on November 3, 1999 (64 Fed. Reg. 59891). 
(c) OTHER DEFINITIONS.—The definitions set forth 
in section 1302 of the Children’s Online Privacy Protec-
tion Act of 1998 (15 U.S.C. 6501), as amended by section 
3(a), shall apply in this title, except to the extent the Com-
mission provides otherwise by regulations issued under 
section 553 of title 5, United States Code. 
SEC. 204. ONLINE COLLECTION, USE, AND DISCLOSURE OF 
PERSONAL INFORMATION OF CHILDREN. 
(a) DEFINITIONS.—Section 1302 of the Children’s 
Online Privacy Protection Act of 1998 (15 U.S.C. 6501) 
is amended— 
(1) by amending paragraph (2) to read as fol-
lows: 
‘‘(2) OPERATOR.—The term ‘operator’— 
‘‘(A) means any person who, for commer-
cial purposes, in interstate or foreign commerce, 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00080
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
operates or provides a website on the Internet, 
online service, online application, or mobile ap-
plication, and who— 
‘‘(i) collects or maintains, either di-
rectly or through a service provider, per-
sonal information from or about the users 
of such website, service, or application; 
‘‘(ii) allows another person to collect 
personal information directly from users of 
such website, service, or application (in 
which case the operator is deemed to have 
collected the information); or 
‘‘(iii) allows users of such website, 
service, or application to publicly disclose 
personal information (in which case the op-
erator is deemed to have collected the in-
formation); and 
‘‘(B) does not include any nonprofit entity 
that would otherwise be exempt from coverage 
under section 5 of the Federal Trade Commis-
sion Act (15 U.S.C. 45).’’; 
(2) in paragraph (4)— 
(A) by amending subparagraph (A) to read 
as follows: 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00081
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS
‘‘(A) the release of personal information 
for any purpose, except where such information 
is provided to a person other than an operator 
who provides support for the internal operations 
of the website, online service, online application, 
or mobile application of the operator and does 
not disclose or use that information for any 
other purpose; and’’; and 
(B) in subparagraph (B), by striking 
‘‘website or online service’’ and inserting 
‘‘website, online service, online application, or 
mobile application’’; 
(3) in paragraph (8)— 
(A) by amending subparagraph (G) to read 
as follows: 
‘‘(G) information concerning a child or the 
parents of that child (including any unique or 
substantially unique identifier, such as a cus-
tomer number) that an operator collects online 
from the child and combines with an identifier 
described in subparagraphs (A) through (G).’’; 
(B) by redesignating subparagraphs (F) 
and (G) as subparagraphs (G) and (H), respec-
tively; and 
VerDate Sep 11 2014 
04:25 Dec 08, 2017
Jkt 079200
PO 00000
Frm 00082
Fmt 6652
Sfmt 6201
E:\BILLS\H4543.IH
H4543
SSpencer on DSKBBXCHB2PROD with BILLS