,i  #aae? ,,congress  #b;d ,session  ,h4
 ,r4 #fhfd  ,,9 ,,! ,,h\se ,,(          
,,repres5tatives  ,septemb] #bd1        
#bjah,ms4 ,del,bene 7= h]self & ,mr4    
,jeffries7 introduc$ ! foll[+ bill2 :i* 
0 ref]r$ to ! ,committee on ,en]gy &    
,comm]ce  ,a ,,bill  ,to require !      
,f$]al ,trade ,commission to promulgate 
regulations relat$ to s5sitive p]sonal  
in=mation or behavioral data1 & = o!r   
purposes4  #a4 ,%ort title ,?is ,act may
 be cit$ z ! ,in=mation ,transp>5cy     
,p]sonal ,data ,control ,act4  #b4      
,requirem5ts = s5sitive p]sonal         
in=mation or behavioral data  7a7       
,regulations ,n lat] ?an #a ye> aft] !  
date ( ! enactm5t ( ?is ,act1 ! ,f$]al  
,trade ,commission %all promulgate      
regulations "u section #eec ( title #e1 
,unit$ ,/ates ,code1 to require1 except 
z provid$ 9 subsection 7b71 any op]ator 
t provides s]vices to ! public involv+ !
 collection1 /orage1 process+1 sale1 %>+
 ) ?ird p>ties1 or o!r use ( s5sitive   
p]sonal in=mation f ,unit$ ,/ates p]sons

 or p]sons locat$ 9 ! ,unit$ ,/ates :5 !
 data is collect$1 to meet ! foll[+     
requirem5ts3  7#a7 ,affirmative1        
express1 & opt 9 cons5t ,provide us]s ) 
notice ?r\gh a privacy & data use policy
 ( a specific reque/ to use _! data &   
require t us]s provide affirmative1     
express1 & opt 9 cons5t to any          
functionality t involves ! collection1  
/orage1 process+1 sale1 %>+1 or o!r use 
( s5sitive p]sonal in=mation1 includ+   
%>+ p]sonal data ) ?ird p>ties4  7#b7   
,privacy & data use policy ,provide us]s
 ) an up-to-date1 transp>5t privacy1    
security1 & data use policy t meets     
g5]al requirem5ts1 includ+ t su* policy1
 pres5t$ to us]s 9 ! context :]e x      
applies--  7,a7 is concise &            
intelligible2  7,b7 is cle> & prom95t 9 
appe>ance2  7,c7 uses cle> & pla9       
language2  7,d7 uses visualizations :]e 
appropriate to make complex in=mation   
und]/&able by ! ord9>y us]2 &  7,e7 is  
provid$ free ( *>ge4  7#c7 ,additional  
requirem5ts = privacy & data use policy 

,! privacy1 security1 & data use policy 
requir$ "u p>agraph 7#b7 %all include ! 
foll[+3  7,a7 ,id5tity & contact        
in=mation ( ! entity collect+ ! s5sitive
 p]sonal in=mation4  7,b7 ,! purpose or 
use = collect+1 /or+1 process+1 sell+1  
%>+1 or o!rwise us+ ! p]sonal in=mation1
 includ+ h[ ! s5sitive p]sonal in=mation
 is %>$ ) ?ird p>ties4  7,c7 ,?ird      
p>ties ) :om ! s5sitive p]sonal         
in=mation w be %>$ & = :at purposes4    
7,d7 ,! /orage p]iod = h[ long ! p]sonal
 in=mation w be reta9$ by ! op]ator &   
any ?ird p>ty1 z applicable4  7,e7 ,h[  
cons5t to collect+1 /or+1 process+1     
sell+1 %>+1 or o!rwise us+ ! s5sitive   
p]sonal in=mation1 includ+ %>+ ) ?ird   
p>ties1 may be )drawn4  7,f7 ,h[ a us] c
 view ! s5sitive p]sonal in=mation t !y 
h provid$ to an op]ator & :e!r x c be   
export$ to o!r web-bas$ plat=ms4  7,g7  
,:at k9d ( s5sitive p]sonal in=mation is
 collect$4  7,h7 ,:e!r ! s5sitive       
p]sonal in=mation w be us$ to create    
pr(iles ab\t us]s4  7,i7 ,h[ s5sitive   

p]sonal in=mation is protect$ f         
unau?oriz$ access or acquisition4  7#d7 
,opt out cons5t ,= any collection1      
/orage1 process+1 sell+1 %>+1 or o!r use
 ( non-s5sitive p]sonal in=mation1      
includ+ %>+ ) ?ird p>ties1 ,op]ators    
%all provide us]s ) ! ability to opt out
 at any "t4  7#e7 ,privacy audits  7,a7 
,9 g5]al ,annually1 ,op]ators collect+1 
/or+1 process+1 sell+1 %>+1 or o!rwise  
us+ s5sitive p]sonal in=mation %all     
obta9 a privacy audit f an objective1   
indep5d5t ?ird-p>ty pr(essional )       
sub/antial exp]i5ce 9 ! field ( privacy 
& data protection1 :o uses proc$ures &  
/&>ds g5]ally accept$ 9 su* field4  7,b7
 ,audit requirem5ts ,ea* su* audit      
%all-- 7i7 set =? ! privacy1 security1 &
 data use controls t ! op]ator has      
implem5t$ & ma9ta9$ dur+ ! report+      
p]iod2  7ii7 describe :e!r su* controls 
are appropriate to ! size & complexity (
 ! op]ator1 ! nature & scope ( !        
activities ( ! op]ator1 & ! nature ( !  
s5sitive p]sonal in=mation or behavioral

 data collect$ by ! op]ator2  7iii7     
c]tify :e!r ! privacy & security        
controls op]ate ) suffici5t effectiv5ess
 to provide reasonable assurance to     
protect ! privacy & security ( s5sitive 
p]sonal in=mation or behavioral data & t
 ! controls h s op]at$ ?r\gh\t ! report+
 p]iod2  7iv7 be prep>$ & complet$ )9   
#fj days aft] ! end ( ! report+ p]iod to
 :i* ! audit applies2 &  7v7 be provid$ 
to ! ,f$]al ,trade ,commission or to !  
attorney g5]al ( a ,/ate1 or o!r        
au?oriz$ ,/ate (fic]1 )9 #aj days (     
notification by ! ,commission or !      
attorney g5]al ( a ,/ate1 or o!r        
au?oriz$ ,/ate (fic] :]e su* p]son has  
pres5t$ to ! ,op]ator allegations t a   
violation ( ?is ,act or any regulation  
issu$ "u ?is ,act has be5 committ$ by ! 
,op]ator4  7,c7 ,small bus9ess exemption
 ,not)/&+ o!r au?orities ( ! ,,ftc1 !   
audit requirem5ts set =? above %all n   
apply to ,op]ators ) #ejj or few]       
employees4  7,d7 ,non-s5sitive p]sonal  
in=mation exemption ,! audit requirem5ts

 set =? above %all n apply to ,op]ators 
:o d n collect1 /ore1 process1 sell1    
%>e1 or o!rwise use s5sitive p]sonal    
in=mation4  7b7 ,exemptions  7#a7       
,necess>y op]ations & security purposes 
,subsection 7a7 %all n apply to !       
process+1 collect+1 /or+1 %>+1 sell+ (  
s5sitive p]sonal in=mation = ! foll[+   
purposes3  7,a7 ,prev5t+ or detect+     
fraud4  7,b7 ,protect+ ! security ( p1  
devices1 networks1 or facilities4  7,c7 
,protect+ ! heal?1 safety1 rights1 or   
prop]ty ( ! cov]$ entity or ano!r p]son4
  7,d7 ,respond+ 9 good fai? to valid   
legal process or provid+ in=mation z    
o!rwise requir$ or au?oriz$ by law4     
7,e7 ,monitor+ or en=c+ agreem5ts betwe5
 ! cov]$ entity & an individual1 includ+
 b n limit$ to1 t]ms ( s]vice1 t]ms (   
use1 us] agreem5ts1 or agreem5ts conc]n+
 monitor+ crim9al activity4  7#b7       
,reasonable expectation ( us]s ,!       
regulations promulgat$ pursuant to      
subsection 7a7 ) respect to ! requirem5t
 to provide opt 9 cons5t %all n apply to

 ! process+ ( s5sitive p]sonal in=mation
 or behavioral data 9 :i* su* process+  
does n deviate f purposes consi/5t ) an 
op]ator's relation%ip ) us]s z und]/ood 
by ! reasonable us]4  #c4 ,application &
 en=cem5t by ! ,f$]al ,trade ,commission
  7a7 ,g5]al application ,?is ,act      
applies1 accord+ to its t]ms1 to ^?     
p]sons1 p>tn]%ips1 & corporations ov]   
:i* ! ,f$]al ,trade ,commission has     
au?ority pursuant to section #e7;a77#b7 
( ! ,f$]al ,trade ,commission ,act 7#ae 
,u4,s4,c4 #de7;a77#b774 ,not)/&+ !      
limitations 9 ! ,f$]al ,trade           
,commission ,act on ,commission au?ority
 ) respect to common c>ri]s1 ?is ,act   
also applies1 accord+ to its t]ms1 to   
common c>ri]s subject to !              
,communications ,act ( #aicd 7#dg       
,u4,s4,c4 #aea et seq47 & ,acts         
am5datory !re( & supplem5t>y !reto4  7b7
 ,en=cem5t  7#a7 ,unfair or deceptive   
acts or practices ,a violation ( ?is    
,act or a regulation promulgat$ "u ?is  
,act %all be treat$ z a violation ( a   

regulation "u section #ah7;a77#a77;,b7 (
 ! ,f$]al ,trade ,commission ,act 7#ae  
,u4,s4,c4 #eg;a7a77#a77;,b77 reg>d+     
unfair or deceptive acts or practices4  
7#b7 ,p[]s ( ,commission ,except z      
provid$ 9 subsection 7a71 ! ,f$]al      
,trade ,commission %all en=ce ?is ,act &
 ! regulations promulgat$ "u ?is ,act 9 
! same mann]1 by ! same means1 & ) !    
same jurisdiction1 p[]s1 & duties z ?\gh
 all applicable t]ms & provisions ( !   
,f$]al ,trade ,commission ,act 7#ae     
,u4,s4,c4 #da et seq47 7 incorporat$    
into & made a "p ( ?is ,act4 ,any p]son 
:o violates ?is ,act or a regulation    
promulgat$ "u ?is ,act %all be subject  
to ! p5alties & entitl$ to ! privileges 
& immunities provid$ 9 ! ,f$]al ,trade  
,commission ,act4  7c7 ,con/ruction     
,no?+ 9 ?is ,act %all be con/ru$ to     
limit ! au?ority ( ! ,f$]al ,trade      
,commission "u any o!r provision ( law4 
#d4 ,def9itions ,9 ?is ,act3 7#a7 ,call 
detail record ,! t]m call detail        
record--  7,a7 means session-id5tify+   

in=mation 7includ+ an orig9at+ or       
t]m9at+ telephone numb]1 an             
,int]national ,mobile ,subscrib]        
,id5tity numb]1 or an ,int]national     
,mobile ,/ation ,equipm5t ,id5tity      
numb]71 a telephone call+ c>d numb]1 or 
! "t or duration ( a call2  7,b7 does n 
include-- 7i7 ! cont5ts 7z def9$ 9      
section #beaj7h7 ( title #ah1 ,unit$    
,/ates ,code7 ( any communication2  7ii7
 ! "n1 address1 or f9ancial in=mation ( 
a subscrib] or cu/om]2 or  7iii7 cell   
site location or global position+ sy/em 
in=mation4  7#b7 ,cle> & prom95t ,! t]m 
cle> & prom95t means 9 any communication
 m$ium1 ! requir$ disclosure is-- 7,a7 (
 a type1 size1 & location suffici5tly   
noticeable = an ord9>y consum] to read &
 compreh5d ! communication2  7,b7       
provid$ 9 a mann] su* t an ord9>y       
consum] is able to read & compreh5d !   
communication2  7,c7 is pres5t$ 9 an    
und]/&able language & syntax2  7,d7     
includes no?+ contr>y to1 inconsi/5t )1 
or t mitigates any /atem5t conta9$ )9 ! 

disclosure or )9 any docum5t l9k$ to or 
ref]5c$ !re92 &  7,e7 includes an option
 t is compliant ) applicable obligations
 ( ! op]ator "u title ,,iii ( !         
,am]icans ) ,disabilities ,act ( #aiij  
7#db ,u4,s4,c4 #abaha et seq474  7#c7   
,commission ,! t]m ,commission means !  
,f$]al ,trade ,commission4  7#d7        
,op]ator ,! t]m op]ator means any entity
 :o op]ates a website locat$ on !       
int]net or an onl9e s]vice & :o collects
 or ma9ta9s p]sonal in=mation f or ab\t 
individuals1 or on ^: behalf su*        
in=mation is collect$ or ma9ta9$1 :]e   
su* website or onl9e s]vice is op]at$ = 
comm]cial purposes1 includ+ any entity t
 buys & sells consum] data )\t direct   
consum] int]action1 & any entity (f]+   
products or s]vices = sale ?r\gh t      
website or onl9e s]vice1 involv+ comm]ce
 among ! ,/ates or ) "o or m =eign      
nations4  7#e7 ,s5sitive p]sonal        
in=mation ,! t]m s5sitive p]sonal       
in=mation means in=mation relat+ to an  
id5tifi$ or id5tifiable individual1     

includ+ ! foll[+3 7,a7 ,f9ancial        
in=mation4  7,b7 ,heal? in=mation4  7,c7
 ,relation%ips4  7,d7 ,in=mation p]ta9+ 
to *ildr5 "u #ac ye>s ( age4  7,e7      
,social ,security numb]s4  7,f7 ,driv]'s
 lic5se or o!r gov]nm5t-issu$           
id5tification numb]4  7,g7 ,au!ntication
 cr$5tials1 su* z a us]name & password4 
7,h7 ,precise geolocation in=mation4    
7,i7 ,cont5t ( communications4  7,j7    
,call detail records4  7,k7 ,web br[s+  
hi/ory1 application usage hi/ory1 & !   
functional equival5t ( ei!r4  7,l7      
,biometric in=mation4  7,m7 ,sexual     
ori5tation4  7,n7 ,political pref]5ces4 
7,o7 ,religi\s beliefs4  7,p7 ,any o!r  
p]sonal or behavioral in=mation t !     
,commission det]m9es to be s5sitive4    
7#f7 ,/ate ,! t]m ,/ate means ea* ,/ate 
( ! ,unit$ ,/ates1 ! ,di/rict (         
,columbia1 & ea* commonweal?1 t]ritory1 
or possession ( ! ,unit$ ,/ates4  7#g7  
,?ird p>ty ,! t]m ?ird p>ty means an    
individual or entity t uses or receives 
s5sitive p]sonal in=mation or behavioral

 data obta9$ by or on behalf ( an       
op]ator1 o!r ?an--  7,a7 a s]vice       
provid] ( an op]ator to :om ! op]ator   
discloses ! consum]'s s5sitive p]sonal  
in=mation = an op]ational purpose       
pursuant to an agreem5t t prohibits !   
p]son receiv+ ! p]sonal in=mation f us+ 
or disclos+ ! p]sonal in=mation = any   
purpose o!r ?an ! purposes contemplat$  
by ! agreem5t2 &  7,b7 any entity t uses
 su* data only z reasonably necess>y--  
7i7 to comply ) applicable law1         
regulation1 or legal process2  7ii7 to  
en=ce an op]ator's t]ms ( use2 or  7iii7
 to detect1 prev5t1 or mitigate fraud or
 security vuln]abilities4  #e4 ,rule (  
con/ruction ,no?+ 9 ?is ,act %all be    
con/ru$ to preclude ! acquisition by !  
,f$]al ,gov]nm5t (-- 7#a7 ! cont5ts ( a 
wire or electronic communication        
pursuant to o!r lawful au?orities1      
includ+ ! au?orities "u *apt] #aai (    
title #ah1 ,unit$ ,/ates ,code 7commonly
 kn[n z ! ,wiretap ,act71 ! ,=eign      
,intellig5ce ,surveillance ,act ( #aigh 

7#ej ,u4,s4,c4 #ahja et seq471 or any   
o!r provision ( ,f$]al law n            
specifically am5d$ by ?is ,act2 or  7#b7
 records or o!r in=mation relat+ to a   
subscrib] or cu/om] ( any electronic    
communication s]vice or remote comput+  
s]vice 7n includ+ ! cont5t ( su*        
communications7 pursuant to ! ,=eign    
,intellig5ce ,surveillance ,act ( #aigh 
7#ej ,u4,s4,c4 #ahja et seq471 *apt]    
#aai ( title #ah1 ,unit$ ,/ates ,code   
7commonly kn[n z ! ,wiretap ,act71 or   
any o!r provision ( ,f$]al law n        
specifically am5d$ by ?is ,act4  #f4 ,"r
 ( action  7a7 ,"r ( action ,except z   
provid$ 9 subsection 7e71 ! attorney    
g5]al ( a ,/ate1 or o!r au?oriz$ ,/ate  
(fic]1 alleg+ a violation ( ?is ,act or 
any regulation issu$ "u ?is ,act t      
affects or may affect su* ,/ate or its  
resid5ts may br+ an action on behalf ( !
 resid5ts ( ! ,/ate 9 any ,unit$ ,/ates 
di/rict c\rt = ! di/rict 9 :i* !        
def5dant is f\nd1 resides1 or transacts 
bus9ess1 or :]ev] v5ue is prop] "u      

section #acia ( title #bh1 to obta9     
appropriate injunctive relief4  7b7     
,notice to commission requir$ ,a ,/ate  
%all provide prior writt5 notice to !   
,f$]al ,trade ,commission ( any civil   
action "u subsection 7a7 toge!r ) a copy
 ( its compla9t1 except t if x is n     
feasible = ! ,/ate to provide su* prior 
notice1 ! ,/ate %all provide su* notice 
imm$iately ^u in/itut+ su* action4  7c7 
,int]v5tion by ! ,commission ,!         
,commission may int]v5e 9 su* civil     
action & ^u int]v5+-- 7#a7 be he>d on   
all matt]s aris+ 9 su* civil action2 &  
7#b7 file petitions = appeal ( a        
decision 9 su* civil action4  7d7       
,con/ruction ,no?+ 9 ?is section %all be
 con/ru$--  7#a7 to prev5t ! attorney   
g5]al ( a ,/ate1 or o!r au?oriz$ ,/ate  
(fic]1 f ex]cis+ ! p[]s conf]r$ on !    
attorney g5]al1 or o!r au?oriz$ ,/ate   
(fic]1 by ! laws ( su* ,/ate2 or  7#b7  
to prohibit ! attorney g5]al ( a ,/ate1 
or o!r au?oriz$ ,/ate (fic]1 f proce$+ 9
 ,/ate or ,f$]al c\rt on ! basis ( an   

alleg$ violation ( any civil or crim9al 
/atute ( t ,/ate4  7e7 ,limitation ,no  
sep>ate suit %all be br\ght "u ?is      
section if1 at ! "t ! suit is br\ght1 ! 
same alleg$ violation is ! subject ( a  
p5d+ action by ! ,f$]al ,trade          
,commission or ! ,unit$ ,/ates "u ?is   
*apt]4  #g4 ,effective date ,?is ,act   
%all take effect #ahj days aft] ! date (
 ! enactm5t ( ?is ,act4