Title: Do Not Track Act
Policy area: Commerce

Summary:
Do Not Track Act
This bill requires the Federal Trade Commission (FTC) to implement and enforce a do not track (DNT) system to protect consumers from unwanted online data harvesting and targeted advertising.
Specifically, the bill requires the FTC to designate a DNT signal (sent by a connected device) and make publicly available a program that (1) is available for download to any common connected device; and (2) sends the DNT signal to every website, online service, or online application to which a user does not want their data sent each time the device connects to it.
The bill further requires an operator of a website, service, or application to search for the DNT signal each time a device connects to it and, if it receives such signal, makes it unlawful for the operator to collect data (other than what is necessary for operation) from a user, use any data collected for targeted advertising, or share any data with a third party without consent. An operator shall not discriminate against a user based on DNT preference. If an operator collects more data than is necessary for operation and does not detect the signal, it must provide a user with notice of the user's rights under the DNT program.
Additionally, the bill prohibits a third-party operator of a program that receives the DNT signal through the connected device of a user of a covered website, service, or application from collecting user data other than data collected to analyze how or whether the user engaged with the program.

[Congressional Bills 116th Congress]
[From the U.S. Government Publishing Office]
[S. 1578 Introduced in Senate (IS)]

<DOC>






116th CONGRESS
  1st Session
                                S. 1578

To protect the privacy of internet users through the establishment of a 
         national Do Not Track system, and for other purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                              May 21, 2019

  Mr. Hawley introduced the following bill; which was read twice and 
   referred to the Committee on Commerce, Science, and Transportation

_______________________________________________________________________

                                 A BILL


 
To protect the privacy of internet users through the establishment of a 
         national Do Not Track system, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Do Not Track Act''.

SEC. 2. DEFINITIONS.

    In this Act:
            (1) Commission.--The term ``Commission'' means the Federal 
        Trade Commission.
            (2) Connected device.--The term ``connected device'' means 
        a device that is capable of connecting to the internet, 
        directly or indirectly.
            (3) Covered website, service, or application.--The term 
        ``covered website, service, or application'' means a website on 
        the internet, an online service, an online application, or a 
        mobile application that--
                    (A) is operated or provided for commercial 
                purposes, in interstate or foreign commerce; and
                    (B) is not operated by a nonprofit entity that 
                would otherwise be exempt from coverage under section 5 
                of the Federal Trade Commission Act (15 U.S.C. 45).
            (4) DNT signal.--The term ``DNT signal'' means a signal 
        sent by a connected device, such as the hypertext transfer 
        protocol developed by the World Wide Web Consortium Working 
        Group on Tracking Preference Expression, that is designated by 
        the Commission for purposes of the Do Not Track program 
        required under section 3(b).
            (5) First-party operator.--The term ``first-party 
        operator'' means an operator of a website on the internet, an 
        online service, an online application, or a mobile application 
        with which a user intends to connect, but does not include an 
        operator of an advertisement that appears on such a website, 
        service, or application or a program used to log in to such a 
        website, service, or application (if the operator of such 
        advertisement or program is different from the operator of the 
        website, service, or application).
            (6) Targeted advertising.--
                    (A) In general.--The term ``targeted advertising'' 
                means a form of advertising where advertisements are 
                displayed to a user based on the user's traits, 
                information from a profile about the user that is 
                created for the purpose of selling advertisements, or 
                the user's previous online or offline behavior.
                    (B) Limitation.--Such term shall not include 
                contextual advertising, including--
                            (i) advertising that is directed to a user 
                        based on the content of the website, online 
                        service, online application, or mobile 
                        application that the user is connected to; or
                            (ii) advertising that is directed to a user 
                        by the operator of a website, online service, 
                        online application, or mobile application based 
                        on the search terms that the user used to 
                        arrive at such website, service, or 
                        application.
            (7) Third-party operator.--The term ``third-party 
        operator'' means any operator of a program that appears on a 
        website, service, or application with respect to which the 
        operator is not a first-party operator.

SEC. 3. ESTABLISHMENT OF DO NOT TRACK SYSTEM.

    (a) In General.--Not later than 6 months after the date of 
enactment of this Act, the Commission shall implement and enforce a Do 
Not Track system, including the program described in subsection (b), to 
protect consumers from unwanted online data harvesting and targeted 
advertising.
    (b) Do Not Track Program.--As part of the Do Not Track system 
required under this section, the Commission shall designate the DNT 
signal and make available on the public website of the Commission a 
simple program that--
            (1) can be downloaded to any common connected device;
            (2) sends the DNT signal to every website, online service, 
        or online application to which the device connects each time 
        the device connects to such website, service, or application; 
        and
            (3) permits the user of the connected device to designate 
        websites, services, or applications to which such signal should 
        not be sent, but does not exempt any website, service, or 
        application from receiving such signal if it is not so 
        designated.
    (c) Other Do Not Track Systems.--Nothing in this Act shall be 
construed as prohibiting the operator of any web browser or similar 
interface or a device designer or manufacturer from offering a program 
that sends the DNT signal to websites, services, or applications, 
provided that such program permits users to designate websites, 
services, or applications to which such signal should not be sent.
    (d) Rulemaking Authority.--The Commission may promulgate 
regulations, in accordance with section 553 of title 5, United States 
Code, to carry out this section.

SEC. 4. REQUIREMENTS FOR OPERATORS; PROHIBITED ACTS.

    (a) Requirements.--
            (1) Search for dnt signal.--The operator of any covered 
        website, service, or application (or any program that appears 
        in such a website, application, or service) shall ensure that 
        the website, service, or application (or program) searches for 
        the DNT signal whenever a connected device connects to the 
        website, service, or application.
            (2) Mandatory disclosure.--
                    (A) In general.--Subject to subparagraph (B), if 
                the operator of a covered website, service, or 
                application collects more data from a user of such 
                website, service, or application than is necessary to 
                operate such website, service, or application the 
                operator shall, through a pop-up notification, provide 
                any user whose connected device is not sending the DNT 
                signal with--
                            (i) notice of the website, service, or 
                        application's policy of collecting data beyond 
                        what is necessary to operate the website, 
                        service, or application;
                            (ii) notice of the protections from data 
                        collection and targeted advertising available 
                        to users under this Act;
                            (iii) notice that the user may, through the 
                        public website of the Federal Trade Commission, 
                        download the Do Not Track program described in 
                        section 3(b), and a link to such website; and
                            (iv) notice that the user may be able to 
                        activate the DNT signal through the user's 
                        device or browser.
                    (B) Number and timing of disclosures.--The operator 
                of a covered website, service, or application shall 
                make the disclosures required under subparagraph (A)--
                            (i) the first time a connected device 
                        connects to such website, service, or 
                        application; and
                            (ii) unless the user of the connected 
                        device opts out of receiving such disclosures, 
                        at least every 30th time a connected device 
                        connects to such website, service, or 
                        application.
                    (C) Collection of data for targeted advertising.--
                For purposes of this subsection, a covered website, 
                service, or application that collects data for the 
                purpose of designing or displaying targeted 
                advertisements shall be considered to be collecting 
                more data than is necessary to operate such website, 
                service, or application.
    (b) Prohibition on Data Collection and Targeted Advertising.--
            (1) In general.--Subject to paragraph (3), it shall be 
        unlawful for a first-party operator of a covered website, 
        service, or application that receives the DNT signal from the 
        connected device of a user to--
                    (A) collect data (other than such data as is 
                necessary for the operation of the website, service, or 
                application) from the user;
                    (B) use any data collected from the user for a 
                secondary purpose, including for the purpose of 
                targeted advertising; or
                    (C) share any data collected from the user with a 
                third party unless the user expressly consents to the 
                sharing of data in a manner that demonstrates the 
                user's intent for the first-party operator to be an 
                intermediary between the user and the third party.
            (2) Prohibition on collection of data by other operators.--
                    (A) In general.--It shall be unlawful for a third-
                party operator of a program (including a program that 
                is an advertisement or a portal used to log in to a 
                website, service, or application) that receives the DNT 
                signal from the connected device of a user of a covered 
                website, service, or application to collect any data 
                from such user, other than, subject to subparagraph 
                (B), data collected for the purpose of analyzing how or 
                whether the user engaged with such program.
                    (B) Limitations on collection of data for 
                engagement analytics.--Data collected for the purpose 
                of analyzing user engagement with a program described 
                in subparagraph (A)--
                            (i) shall be collected only in a de-
                        identified manner; and
                            (ii) may not be used to create or 
                        contribute to a profile of the user from which 
                        it is collected.
            (3) Exceptions.--
                    (A) Law enforcement.--The prohibitions on data 
                collection described in paragraph (1) shall not apply 
                where data is collected for the purpose of assisting a 
                law enforcement agency.
                    (B) Complementary services.--Notwithstanding 
                paragraph (1), a first-party operator of a covered 
                website, service, or application may collect additional 
                data from a user beyond what is necessary for the 
                operation of such website, service, or application if 
                such additional data is necessary for the operation of 
                a different covered website, service, or application 
                that is--
                            (i) both owned and operated by such first-
                        party operator;
                            (ii) designed to complement the covered 
                        website, service, or application accessed by 
                        the user; and
                            (iii) branded as a complementary website, 
                        service, or application to the covered website, 
                        service, or application accessed by the user.
    (c) Interfering With DNT Signal.--It shall be unlawful for any 
person to--
            (1) block or impede the ability of a covered website, 
        service, or application to receive the DNT signal; or
            (2) block or impede the ability of a connected device to 
        send the DNT signal.
    (d) Discrimination Based on DNT Preferences.--It shall be unlawful 
for a first-party operator of a covered website, service, or 
application to--
            (1) deny a user access to, or service from, such website, 
        service, or application on the basis that the website, service, 
        or application received the DNT signal from the user; or
            (2) provide a user from whom such website, service, or 
        application received the DNT signal with a different level of 
        access or service than the level of access or service provided 
        to a user from whom the website, service, or application does 
        not receive the DNT signal.
    (e) Effective Date.--This section shall take effect on the date 
that is 6 months after the date of enactment of this Act.

SEC. 5. ENFORCEMENT AND APPLICABILITY.

    (a) Enforcement by the Commission.--
            (1) In general.--Except as otherwise provided, this Act and 
        the regulations prescribed under this Act shall be enforced by 
        the Commission under the Federal Trade Commission Act (15 
        U.S.C. 41 et seq.).
            (2) Unfair or deceptive acts or practices.--A violation of 
        this Act or a regulation prescribed under this Act shall be 
        treated as a violation of a rule defining an unfair or 
        deceptive act or practice prescribed under section 18(a)(1)(B) 
        of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
            (3) Actions by the commission.--
                    (A) In general.--Except as provided in subsection 
                (b)(1), the Commission shall prevent any person from 
                violating this Act or a regulation prescribed under 
                this Act in the same manner, by the same means, and 
                with the same jurisdiction, powers, and duties as 
                though all applicable terms and provisions of the 
                Federal Trade Commission Act (15 U.S.C. 41 et seq.) 
                were incorporated into and made a part of this Act, 
                and, except as provided in subparagraph (B), any person 
                who violates this Act or a regulation prescribed under 
                this Act shall be subject to the penalties and entitled 
                to the privileges and immunities provided in the 
                Federal Trade Commission Act.
                    (B) Penalties.--
                            (i) In general.--Notwithstanding section 
                        5(m) of the Federal Trade Commission Act (15 
                        U.S.C. 45(m)), a civil penalty recovered for a 
                        violation of this Act or a regulation 
                        prescribed under this Act may be in excess of 
                        the amounts provided for in that section, 
                        provided that such penalty meets the 
                        requirements of this subparagraph.
                            (ii) Penalty for negligent violation.--In 
                        the case of a person that negligently violates 
                        this Act or a regulation prescribed under this 
                        Act, such person shall be liable for a civil 
                        penalty that shall not exceed $50 for every 
                        user affected by such violation for every day 
                        during which the person is in violation of this 
                        Act under this clause.
                            (iii) Penalty for willful or reckless 
                        violation.--In the case of a person that 
                        willfully or recklessly violates this Act or a 
                        regulation prescribed under this Act, such 
                        person shall be liable for a civil penalty 
                        that--
                                    (I) shall not be less than 
                                $100,000; and
                                    (II) shall not exceed $1,000 for 
                                every user affected by such violation 
                                for every day during which the person 
                                is in violation of this Act under this 
                                clause.
    (b) Enforcement by State Attorneys General.--
            (1) In general.--
                    (A) Civil actions.--In any case in which the 
                attorney general of a State has reason to believe that 
                an interest of the residents of that State has been or 
                is threatened or adversely affected by the engagement 
                of any person in a practice that violates this Act or a 
                regulation prescribed under this Act, the State, as 
                parens patriae, may bring a civil action on behalf of 
                the residents of the State in a district court of the 
                United States or a State court of appropriate 
                jurisdiction to--
                            (i) enjoin that practice;
                            (ii) enforce compliance with this Act or 
                        such regulation;
                            (iii) obtain damages, statutory damage, 
                        restitution, or other compensation on behalf of 
                        residents of the State; or
                            (iv) obtain such other relief as the court 
                        may consider to be appropriate.
                    (B) Notice.--
                            (i) In general.--Before filing an action 
                        under subparagraph (A), the attorney general of 
                        the State involved shall provide to the 
                        Commission--
                                    (I) written notice of that action; 
                                and
                                    (II) a copy of the complaint for 
                                that action.
                            (ii) Exemption.--
                                    (I) In general.--Clause (i) shall 
                                not apply with respect to the filing of 
                                an action by an attorney general of a 
                                State under this paragraph if the 
                                attorney general of the State 
                                determines that it is not feasible to 
                                provide the notice described in that 
                                clause before the filing of the action.
                                    (II) Notification.--In an action 
                                described in subclause (I), the 
                                attorney general of a State shall 
                                provide notice and a copy of the 
                                complaint to the Commission at the same 
                                time as the attorney general files the 
                                action.
            (2) Intervention.--
                    (A) In general.--On receiving notice under 
                paragraph (1)(B), the Commission shall have the right 
                to intervene in the action that is the subject of the 
                notice.
                    (B) Effect of intervention.--If the Commission 
                intervenes in an action under paragraph (1), it shall 
                have the right--
                            (i) to be heard with respect to any matter 
                        that arises in that action; and
                            (ii) to file a petition for appeal.
            (3) Construction.--For purposes of bringing any civil 
        action under paragraph (1), nothing in this Act shall be 
        construed to prevent an attorney general of a State from 
        exercising the powers conferred on the attorney general by the 
        laws of that State to--
                    (A) conduct investigations;
                    (B) administer oaths or affirmations; or
                    (C) compel the attendance of witnesses or the 
                production of documentary and other evidence.
            (4) Actions by the commission.--In any case in which an 
        action is instituted by or on behalf of the Commission for 
        violation of this Act or a regulation prescribed under this 
        Act, no State may, during the pendency of that action, 
        institute an action under paragraph (1) against any defendant 
        named in the complaint in the action instituted by or on behalf 
        of the Commission for that violation.
            (5) Venue; service of process.--
                    (A) Venue.--Any action brought under paragraph (1) 
                may be brought in--
                            (i) the district court of the United States 
                        that meets applicable requirements relating to 
                        venue under section 1391 of title 28, United 
                        States Code; or
                            (ii) a State court of competent 
                        jurisdiction.
                    (B) Service of process.--In an action brought under 
                paragraph (1) in a district court of the United States, 
                process may be served wherever defendant--
                            (i) is an inhabitant; or
                            (ii) may be found.

SEC. 6. SEVERABILITY.

    If any provision of this Act or the application of a provision of 
this Act to any person or circumstance is held to be invalid or 
unconstitutional, the remainder of this Act, or the application of such 
provision to any other person or circumstance, shall not be affected.
                                 <all>