User Data Protection Act
Bill: H.R.4240 | Sponsor: Rep. Schweikert, David (R-AZ)
Policy area: Commerce

Summary:
User Data Protection Act
This bill establishes requirements for websites and other digital platforms that collect and store information about their users, including information saved to a web browser to track a user over time (i.e., cookies).
Specifically, a website may not (1) use cookies or otherwise collect information about a user without the user's consent, (2) restrict access to the website if a user declines such consent, (3) use pixel-sized images that are hidden or embedded in a web page that collect data about a user (i.e., tracking pixels), or (4) share a user's information with other websites or online businesses.
Further, if a user consents to the collection of information, the website must (1) disclose to the user what the information will be used for, and (2) treat any such information as an exclusive property right owned by the user.
The bill provides for enforcement of these provisions by the Federal Trade Commission, state attorneys general, and private right of action.

To prohibit digital platforms from using information about a user 
unless the user consents to such use, to ensure personal information is 
          considered a property right, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``User Data Protection Act''.

SEC. 2. PROHIBITION ON REQUIREMENT TO ACCEPT COOKIES.

    (a) In General.--
            (1) Tracking and user property rights.--It shall be 
        unlawful for the operator of a digital platform or any third-
        party platform to do any of the following:
                    (A) Without the consent of the user--
                            (i) use cookies for the digital platform;
                            (ii) collect and store any information 
                        about the user, including any habit or 
                        preference of the user; and
                            (iii) deliver content to the user that 
                        corresponds with any of the personal 
                        information of the user.
                    (B) Restrict a user from using a digital platform 
                if the user declines to consent to any of the 
                activities described in subparagraph (A).
                    (C) Use tracking pixels.
                    (D) Share information about a user with other 
                digital platforms or online businesses.
            (2) Property rights for user information.--The operator of 
        a digital platform shall do the following:
                    (A) If a user consents to the digital platform 
                collecting, storing, or using the information about the 
                user, provide a disclosure statement--
                            (i) that includes a description of the 
                        information that the digital platform intends 
                        to collect, store, or use, what the information 
                        will be used for, and what the digital platform 
                        determines the economic value of the 
                        information to be;
                            (ii) that is consistent across all digital 
                        platforms; and
                            (iii) the form of which shall be determined 
                        by the Commission.
                    (B) Make the disclosure statement accessible to the 
                individual on the platform.
                    (C) Treat any information collected, stored, or 
                used by the digital platform or information that a user 
                generates on the digital platform as an exclusive 
                property right owned by that user.
                    (D) Determine the economic value of the information 
                described under subparagraph (A) as a property right.
                    (E) Provide an update to users if there is any 
                change in the collection, storage, or use of the 
                information described under subparagraph (A) or the 
                economic value determined under subparagraph (D).
    (b) Enforcement.--
            (1) Enforcement by the federal trade commission.--
                    (A) Unfair or deceptive acts or practices.--A 
                violation of subsection (a) shall be treated as a 
                violation of a regulation under section 18(a)(1)(B) of 
                the Federal Trade Commission Act (15 U.S.C. 
                57a(a)(1)(B)) regarding unfair or deceptive acts or 
                practices.
                    (B) Powers of commission.--The Commission shall 
                enforce subsection (a) in the same manner, by the same 
                means, and with the same jurisdiction, powers, and 
                duties as though all applicable terms and provisions of 
                the Federal Trade Commission Act (15 U.S.C. 41 et seq.) 
                were incorporated into and made a part of this Act. Any 
                person who violates such subsection shall be subject to 
                the penalties and entitled to the privileges and 
                immunities provided in the Federal Trade Commission 
                Act.
            (2) Effect on other laws.--Nothing in this section shall be 
        construed in any way to limit the authority of the Commission 
        under any other provision of law or to limit the application of 
        any Federal or State law.
            (3) Enforcement by state attorneys general.--
                    (A) In general.--If the chief law enforcement 
                officer of a State, or an official or agency designated 
                by a State, has reason to believe that any person has 
                violated or is violating subsection (a), the attorney 
                general, official, or agency of the State, in addition 
                to any authority it may have to bring an action in 
                State court under its consumer protection law, may 
                bring a civil action in any appropriate United States 
                district court or in any other court of competent 
                jurisdiction, including a State court, to--
                            (i) enjoin further such violation by such 
                        person;
                            (ii) enforce compliance with such 
                        subsection;
                            (iii) obtain civil penalties; and
                            (iv) obtain damages, restitution, or other 
                        compensation on behalf of residents of the 
                        State.
                    (B) Notice and intervention by the federal trade 
                commission.--The attorney general of a State shall 
                provide prior written notice of any action under 
                subparagraph (A) to the Commission and provide the 
                Commission with a copy of the complaint in the action, 
                except in any case in which such prior notice is not 
                feasible, in which case the attorney general shall 
                serve such notice immediately upon instituting such 
                action. The Commission shall have the right--
                            (i) to intervene in the action;
                            (ii) upon so intervening, to be heard on 
                        all matters arising therein; and
                            (iii) to file petitions for appeal.
                    (C) Limitation on state action while federal action 
                is pending.--If the Commission has instituted a civil 
                action for violation of this section, no State attorney 
                general, or official or agency of a State, may bring an 
                action under this paragraph during the pendency of that 
                action against any defendant named in the complaint of 
                the Commission for any violation of this section 
                alleged in the complaint.
    (c) Private Cause of Action.--
            (1) Action.--A user who suffers harm as a result of a 
        violation of subsection (a) may bring an action against the 
        operator of a digital platform in the appropriate district 
        court of the United States to enjoin such violation and for 
        damages.
            (2) Damages.--A user who suffers harm as a result of a 
        violation of subsection (a) shall not receive less than 90 
        percent of total damages.
            (3) Attorney's fees.--The amount of an award of attorney's 
        fees under this subsection may not exceed an amount equal to 33 
        percent of the damages awarded to the user.
    (d) Federal Preemption.--This Act preempts any State law relating 
to the requirements described under this Act.
    (e) Definitions.--In this section:
            (1) Commission.--The term ``Commission'' means the Federal 
        Trade Commission.
            (2) Cookies.--The term ``cookies'' means information saved 
        by a web browser that allows the browser to recognize a device 
        and track a user over time.
            (3) Digital platform.--The term ``digital platform'' means 
        any technology-enabled content producer and includes a website, 
        an online business, and an application for a device.
            (4) Third-party platform.--The term ``third-party 
        platform'' means an entity that contracts with a digital 
        platform to use their website, online business, or application 
        for a device for advertising or other purposes.
            (5) Tracking pixel.--The term ``tracking pixel'' means a 
        tiny pixel-sized image, hidden or embedded in an online page 
        and used for collecting data about a user.
                                 <all>