,i  #aacth ,,congress  #ast ,session    
,h4 ,r4 #aiac  ,,in ,,the ,,house ,,of  
,,representatives  ,may #i1 #bjac ,mr4  
,johnson of ,georgia 7for himself1 ,ms4 
,jackson ,lee1 ,mr4 ,engel1 ,mr4        
,conyers1 and ,mr4 ,chabot7 introduced  
the following bill2 which was referred  
to the ,committee on ,energy and        
,commerce  ,a ,,bill  ,to provide for   
greater transparency in and user control
 over the treatment of data collected by
 mobile applications and to enhance the 
security of such data4  #a4 ,short title
 ,this ,act may be cited as the         
,application ,privacy1 ,protection1 and 
,security ,act of #bjac or the ,,apps   
,act of #bjac4  #b4 ,transparency1 user 
control1 and security  7a7 ,consent to  
terms and conditions  7#a7 ,in general  
,before a mobile application collects   
personal data about a user of the       
application1 the developer of the       
application shall--  7,a7 provide the   
user with notice of the terms and       
conditions governing the collection1    

use1 storage1 and sharing of the        
personal data2 and  7,b7 obtain the     
consent of the user to such terms and   
conditions4  7#b7 ,required content ,the
 notice required by paragraph 7#a77;,a7 
shall include the following3  7,a7 ,the 
categories of personal data that will be
 collected4  7,b7 ,the categories of    
purposes for which the personal data    
will be used4  7,c7 ,the categories of  
third parties with which the personal   
data will be shared4  7,d7 ,a data      
retention policy that governs the length
 for which the personal data will be    
stored and the terms and conditions     
applicable to storage1 including a      
description of the rights of the user   
under subsection 7b7 and the process by 
which the user may exercise such rights4
  7#c7 ,additional specifications and   
flexibility ,the ,commission shall by   
regulation specify the format1 manner1  
and timing of the notice required by    
paragraph 7#a77;,a74 ,in promulgating   
the regulations1 the ,commission shall  

consider how to ensure the most         
effective and efficient communication to
 the user regarding the treatment of    
personal data4  7#d7 ,direct access to  
data by third parties ,for purposes of  
this ,act1 if the developer of a mobile 
application allows a third party to     
access personal data collected by the   
application1 such personal data shall be
 considered to be shared with the third 
party1 whether or not such personal data
 are first transmitted to the developer4
  7b7 ,withdrawal of consent ,the       
developer of a mobile application       
shall--  7#a7 provide a user of the     
application with a means of--  7,a7     
notifying the developer that the user   
intends to stop using the application2  
and  7,b7 requesting the developer--    
7i7 to refrain from any further         
collection of personal data through the 
application2 and  7ii7 at the option of 
the user1 either--  7,i7 to the extent  
practicable1 to delete any personal data
 collected by the application that is   

stored by the developer2 or  7,,ii7 to  
refrain from any further use or sharing 
of such data2 and  7#b7 within a        
reasonable and appropriate time after   
receiving a request under paragraph     
7#a77;,b71 comply with such request4    
7c7 ,security of personal data and      
de-,identified data ,the developer of a 
mobile application shall take reasonable
 and appropriate measures to prevent    
unauthorized access to personal data and
 de-identified data collected by the    
application4  7d7 ,exception ,nothing in
 this ,act prohibits the developer of a 
mobile application from disclosing or   
preserving personal data or             
de-identified data as required by--     
7#a7 other ,federal law 7including a    
court order72 or  7#b7 except as        
provided in section #f1 the law of a    
,state or a political subdivision of a  
,state 7including a court order74  #c4  
,application and enforcement  7a7       
,general application ,the requirements  
of this ,act and the regulations        

promulgated under this ,act apply1      
according to their terms1 to those      
persons1 partnerships1 and corporations 
over which the ,commission has authority
 pursuant to section #e7;a77#b7 of the  
,federal ,trade ,commission ,act 7#ae   
,u4,s4,c4 #de7;a77#b774  7b7            
,enforcement by ,federal ,trade         
,commission  7#a7 ,unfair or deceptive  
acts or practices ,a violation of this  
,act or a regulation promulgated under  
this ,act shall be treated as a         
violation of a regulation under section 
#ah7;a77#a77;,b7 of the ,federal ,trade 
,commission ,act 7#ae ,u4,s4,c4         
#eg;a7a77#a77;,b77 regarding unfair or  
deceptive acts or practices4  7#b7      
,powers of ,commission ,the ,commission 
shall enforce this ,act and the         
regulations promulgated under this ,act 
in the same manner1 by the same means1  
and with the same jurisdiction1 powers1 
and duties as though all applicable     
terms and provisions of the ,federal    
,trade ,commission ,act 7#ae ,u4,s4,c4  

#da et seq47 were incorporated into and 
made a part of this ,act4 ,any person   
who violates this ,act or a regulation  
promulgated under this ,act shall be    
subject to the penalties and entitled to
 the privileges and immunities provided 
in the ,federal ,trade ,commission ,act4
  7c7 ,actions by ,states  7#a7 ,in     
general ,in any case in which the       
attorney general of a ,state1 or an     
official or agency of a ,state1 has     
reason to believe that an interest of   
the residents of such ,state has been or
 is threatened or adversely affected by 
an act or practice in violation of this 
,act or a regulation promulgated under  
this ,act1 the ,state1 as parens        
patriae1 may bring a civil action on    
behalf of the residents of the ,state in
 an appropriate district court of the   
,united ,states to--  7,a7 enjoin such  
act or practice2  7,b7 enforce          
compliance with this ,act or such       
regulation2  7,c7 obtain damages1       
restitution1 or other compensation on   

behalf of residents of the ,state2 or   
7,d7 obtain such other legal and        
equitable relief as the court may       
consider to be appropriate4  7#b7       
,notice ,before filing an action under  
this subsection1 the attorney general1  
official1 or agency of the ,state       
involved shall provide to the           
,commission a written notice of such    
action and a copy of the complaint for  
such action4 ,if the attorney general1  
official1 or agency determines that it  
is not feasible to provide the notice   
described in this paragraph before the  
filing of the action1 the attorney      
general1 official1 or agency shall      
provide written notice of the action and
 a copy of the complaint to the         
,commission immediately upon the filing 
of the action4  7#c7 ,authority of      
,commission  7,a7 ,in general ,on       
receiving notice under paragraph 7#b7 of
 an action under this subsection1 the   
,commission shall have the right--  7i7 
to intervene in the action2  7ii7 upon  

so intervening1 to be heard on all      
matters arising therein2 and  7iii7 to  
file petitions for appeal4  7,b7        
,limitation on ,state action while      
,federal action is pending ,if the      
,commission or the ,attorney ,general of
 the ,united ,states has instituted a   
civil action for violation of this ,act 
or a regulation promulgated under this  
,act 7referred to in this subparagraph  
as the ,federal action71 no ,state      
attorney general1 official1 or agency   
may bring an action under this          
subsection during the pendency of the   
,federal action against any defendant   
named in the complaint in the ,federal  
action for any violation of this ,act or
 such regulation alleged in such        
complaint4  7#d7 ,rule of construction  
,for purposes of bringing a civil action
 under this subsection1 nothing in this 
,act shall be construed to prevent an   
attorney general1 official1 or agency of
 a ,state from exercising the powers    
conferred on the attorney general1      

official1 or agency by the laws of such 
,state to conduct investigations1       
administer oaths and affirmations1 or   
compel the attendance of witnesses or   
the production of documentary and other 
evidence4  #d4 ,regulations ,not later  
than #a year after the date of the      
enactment of this ,act1 the ,commission 
shall promulgate regulations in         
accordance with section #eec of title   
#e1 ,united ,states ,code1 to implement 
and enforce this ,act4  #e4 ,safe harbor
  7a7 ,in general ,the developer of a   
mobile application may satisfy the      
requirements of this ,act and the       
regulations promulgated under this ,act 
by adopting and following a code of     
conduct for consumer data privacy       
7insofar as such code relates to data   
collected by a mobile application7      
that--  7#a7 was developed in a         
multistakeholder process convened by the
 ,national ,telecommunications and      
,information ,administration1 as        
described in the document issued by the 

,president on ,february #bc1 #bjab1     
entitled ,consumer ,data ,privacy in a  
,networked ,world3 ,a ,framework for    
,protecting ,privacy and ,promoting     
,innovation in the ,global ,digital     
,economy2 and  7#b7 the ,commission has 
approved as meeting the requirements of 
the regulations promulgated under       
section #d4  7b7 ,regulations ,the      
,commission shall promulgate regulations
 in accordance with section #eec of     
title #e1 ,united ,states ,code1 to     
govern the consideration and approval of
 codes of conduct under subsection      
7a77#b74  #f4 ,relationship to ,state   
law ,this ,act and the regulations      
promulgated under this ,act supercede a 
provision of law of a ,state or a       
political subdivision of a ,state only  
to the extent that such provision--     
7#a7 conflicts with this ,act or such   
regulations1 as determined without      
regard to section #b7;d77#b72  7#b7     
specifically relates to the treatment of
 personal data or de-identified data2   

and  7#c7 provides a level of           
transparency1 user control1 or security 
in the treatment of personal data or    
de-identified data that is less than the
 level provided by this ,act and such   
regulations4  #g4 ,preservation of ,,ftc
 authority ,nothing in this ,act may be 
construed in any way to limit or affect 
the authority of the ,commission under  
any other provision of law4  #h4        
,definitions ,in this ,act3  7#a7       
,commission ,the term ,commission means 
the ,federal ,trade ,commission4  7#b7  
,de-identified data ,the term           
de-identified data means data that      
cannot reasonably be used to identify or
 infer information about1 or otherwise  
be linked to1 a particular individual or
 mobile device1 as determined with a    
reasonable level of justified confidence
 based on the available methods and     
technologies1 the nature of the data at 
issue1 and the purposes for which the   
data will be used4  7#c7 ,developer ,the
 term developer shall have the meaning  

given such term by the ,commission by   
regulation4  7#d7 ,mobile application   
,the term mobile application means a    
software program that--  7,a7 runs on   
the operating system of a mobile device2
 and  7,b7 collects data from a user4   
7#e7 ,mobile device ,the term mobile    
device means a smartphone1 tablet       
computer1 or similar portable computing 
device that transmits data over a       
wireless connection4  7#f7 ,personal    
data ,the term personal data shall have 
the meaning given such term by the      
,commission by regulation1 except that  
such term shall not include             
de-identified data4  7#g7 ,state ,the   
term ,state means each of the several   
,states1 the ,district of ,columbia1    
each commonwealth1 territory1 or        
possession of the ,united ,states1 and  
each federally recognized ,indian tribe4
  7#h7 ,third party ,the term third     
party means1 with respect to the        
developer of an application1 an entity  
that holds itself out to the public as  

separate from the developer such that a 
user of the application acting          
reasonably under the circumstances would
 not expect the entity to be related to 
the developer or to have access to      
personal data the user provides to the  
developer4 ,such term includes an       
affiliate of the developer unless the   
affiliation is reasonably clear to users
 of the application4  #i4 ,effective    
date ,this ,act shall apply with respect
 to any collection1 use1 storage1 or    
sharing of personal data or             
de-identified data that occurs after the
 date that is #cj days after the        
promulgation of final regulations under 
section #d4