,i  #aaf? ,,congress  #a/ ,session  ,h4 
,r4 #bjac  ,,9 ,,! ,,h\se ,,(           
,,repres5tatives  ,april #a1 #bjai,ms4  
,del,bene 7= h]self1 ,miss ,rice ( ,new 
,york1 & ,mr4 ,suozzi7 introduc$ !      
foll[+ bill2 :i* 0 ref]r$ to !          
,committee on ,en]gy & ,comm]ce  ,a     
,,bill  ,to require ! ,f$]al ,trade     
,commission to promulgate regulations   
relat$ to s5sitive p]sonal in=mation1 & 
= o!r purposes4  #a4 ,%ort title ,?is   
,act may be cit$ z ! ,in=mation         
,transp>5cy  ,p]sonal ,data ,control    
,act4  #b4 ,s5se ( ,congress ,x is !    
,s5se ( ,congress t--  7#a7 ! ,unit$    
,/ates mu/ develop a balanc$1 high-/&>d 
digital framework t e/abli%es global    
/&>ds2  7#b7 a key elem5t ( ?is         
framework is a /rong national /&>d t    
combats anti-consum] practices2  7#c7 x 
is critical t ! ,f$]al ,gov]nm5t provide
 guidance on ! collection & /orage (    
s5sitive data2  7#d7 x is important to  
provide our c\ntry ) fair & ?\ghtful    
digital consum] rights2 &  7#e7 x is    

important to ensure t our en=cem5t      
au?orities h ! res\rces ne$$ to protect 
consum]s f bad actors 9 ! privacy &     
security space4  #c4 ,requirem5ts =     
s5sitive p]sonal in=mation  7a7         
,regulations ,n lat] ?an #a ye> aft] !  
date ( ! enactm5t ( ?is ,act1 ! ,f$]al  
,trade ,commission %all promulgate      
regulations "u section #eec ( title #e1 
,unit$ ,/ates ,code1 to require1 except 
z provid$ 9 subsection 7b71 any         
controll] t provides s]vices to ! public
 involv+ ! collection1 /orage1 process+1
 sale1 %>+ ) ?ird p>ties1 or o!r use (  
s5sitive p]sonal in=mation f ,unit$     
,/ates p]sons or p]sons locat$ 9 !      
,unit$ ,/ates :5 ! data is collect$1 to 
meet ! foll[+ requirem5ts3  7#a7        
,affirmative1 express1 & opt-9 cons5t   
,provide us]s ) notice ?r\gh a privacy &
 data use policy ( a specific reque/ to 
use _! s5sitive p]sonal in=mation &     
require t us]s provide affirmative1     
express1 & opt-9 cons5t to any          
functionality t involves ! collection1  

/orage1 process+1 sale1 %>+1 or o!r use 
( s5sitive p]sonal in=mation1 includ+   
%>+ s5sitive p]sonal in=mation ) ?ird   
p>ties4  7#b7 ,privacy & data use policy
 ,provide us]s ) an up-to-date1         
transp>5t privacy1 security1 & data use 
policy t meets g5]al requirem5ts1       
includ+ t su* policy1 pres5t$ to us]s 9 
! context :]e x applies--  7,a7 is      
concise & intelligible2  7,b7 is cle> & 
prom95t 9 appe>ance2  7,c7 uses cle> &  
pla9 language2  7,d7 uses visualizations
 :]e appropriate to make complex        
in=mation und]/&able by ! ord9>y us]2 & 
7,e7 is provid$ free ( *>ge4  7#c7      
,additional requirem5ts = privacy & data
 use policy ,! privacy1 security1 & data
 use policy requir$ "u p>agraph 7#b7    
%all include ! foll[+3  7,a7 ,id5tity & 
contact in=mation ( ! entity collect+ ! 
s5sitive p]sonal in=mation4  7,b7 ,!    
purpose or use = collect+1 /or+1        
process+1 sell+1 %>+1 or o!rwise us+ !  
s5sitive p]sonal in=mation4  7,c7 ,?ird 
p>ties ) :om ! s5sitive p]sonal         

in=mation w be %>$ & = :at purposes4    
7,d7 ,! /orage p]iod = h[ long !        
s5sitive p]sonal in=mation w be reta9$  
by ! controll] & any ?ird p>ty1 z       
applicable4  7,e7 ,h[ cons5t to         
collect+1 /or+1 process+1 sell+1 %>+1 or
 o!rwise us+ ! s5sitive p]sonal         
in=mation1 includ+ %>+ ) ?ird p>ties1   
may be )drawn4  7,f7 ,h[ a us] c view or
 obta9 ! s5sitive p]sonal in=mation t !y
 h provid$ to a controll] & :e!r x c be 
export$ to o!r web-bas$ plat=ms4  7,g7  
,:at k9d ( s5sitive p]sonal in=mation is
 collect$ & %>$4  7,h7 ,:e!r ! s5sitive 
p]sonal in=mation w be us$ to create    
pr(iles ab\t us]s & :e!r !y w be        
integrat$ across plat=ms4  7,i7 ,h[     
s5sitive p]sonal in=mation is protect$ f
 unau?oriz$ access or acquisition4  7#d7
 ,opt-out cons5t ,= any collection1     
/orage1 process+1 sell+1 %>+1 or o!r use
 ( non-s5sitive p]sonal in=mation1      
includ+ %>+ ) ?ird p>ties1 controll]s   
%all provide us]s ) ! ability to opt out
 at any "t4  7#e7 ,privacy audits  7,a7 

,9 g5]al ,except z provid$ 9            
subp>agraphs 7,c7 & 7,d71 annually1 ea* 
controll] collect+1 /or+1 process+1     
sell+1 %>+1 or o!rwise us+ s5sitive     
p]sonal in=mation %all--  7i7 obta9 a   
privacy audit f a qualifi$1 objective1  
indep5d5t ?ird-p>ty2 &  7ii7 %all make  
public :e!r or n ! privacy audit f\nd ! 
controll] compliant4  7,b7 ,audit       
requirem5ts ,ea* su* audit %all-- 7i7   
set =? ! privacy1 security1 & data use  
controls t ! controll] has implem5t$ &  
ma9ta9$ dur+ ! report+ p]iod2  7ii7     
describe :e!r su* controls are          
appropriate to ! size & complexity ( !  
controll]1 ! nature & scope ( !         
activities ( ! controll]1 & ! nature ( !
 s5sitive p]sonal in=mation or          
behavioral data collect$ by ! controll]2
  7iii7 c]tify :e!r ! privacy & security
 controls op]ate ) suffici5t            
effectiv5ess to provide reasonable      
assurance to protect ! privacy &        
security ( s5sitive p]sonal in=mation or
 behavioral data1 includ+ ) respect to  

data %>$ ) ?ird p>ties1 & t ! controls h
 s op]at$ ?r\gh\t ! report+ p]iod2  7iv7
 be prep>$ & complet$ )9 #fj days aft] !
 end ( ! report+ p]iod to :i* ! audit   
applies2 &  7v7 be provid$ to ! ,f$]al  
,trade ,commission or to ! attorney     
g5]al ( a ,/ate1 or o!r au?oriz$ ,/ate  
(fic]1 )9 #aj days ( notification by !  
,commission or ! attorney g5]al ( a     
,/ate1 or o!r au?oriz$ ,/ate (fic] :]e  
su* p]son has pres5t$ to ! controll]    
allegations t a violation ( ?is ,act or 
any regulation issu$ "u ?is ,act has be5
 committ$ by ! controll]4  7,c7 ,small  
bus9ess audit exemption ,! audit        
requirem5ts describ$ 9 ?is p>agraph %all
 n apply to controll]s :o collect1 /ore1
 process1 sell1 %>e1 or o!rwise use     
s5sitive p]sonal in=mation relat+ to    
#e1jjj or few] individuals4  7,d7       
,non-s5sitive p]sonal in=mation         
exemption ,! audit requirem5ts set =?   
above %all n apply to controll]s :o d n 
collect1 /ore1 process1 sell1 %>e1 or   
o!rwise use s5sitive p]sonal in=mation4 

7b7 ,exemptions  7#a7 ,necess>y         
op]ations & security purposes           
,subsection 7a7 %all n apply to !       
process+1 collect+1 /or+1 %>+1 sell+ (  
s5sitive p]sonal in=mation = ! foll[+   
purposes3  7,a7 ,prev5t+ or detect+     
fraud1 id5tity !ft1 or crim9al activity4
  7,b7 ,! use ( su* in=mation to id5tify
 errors t impair functionality or       
o!rwise enhanc+ or ma9ta9+ !            
availability ( ! s]vices or in=mation   
sy/ems ( ! controll] = au?oriz$ access &
 use4  7,c7 ,protect+ ! vital int]e/s ( 
! consum] or ano!r natural p]son4  7,d7 
,respond+ 9 good fai? to valid legal    
process or provid+ in=mation z o!rwise  
requir$ or au?oriz$ by law4  7,e7       
,monitor+ or en=c+ agreem5ts betwe5 !   
controll] & an individual1 includ+ b n  
limit$ to1 t]ms ( s]vice1 t]ms ( use1   
us] agreem5ts1 or agreem5ts conc]n+     
monitor+ crim9al activity4  7,f7        
,protect+ ! prop]ty1 s]vices1 or        
in=mation sy/ems ( ! controll] aga9/    
unau?oriz$ access or use4  7,g7 ,advanc+

 a sub/antial public int]e/1 includ+    
ar*ival purposes1 sci5tific or hi/orical
 rese>*1 & public heal?1 if su* process+
 does n create a significant risk ( h>m 
to consum]s4  7#b7 ,reasonable          
expectation ( us]s ,! regulations       
promulgat$ pursuant to subsection 7a7 ) 
respect to ! requirem5t to provide opt-9
 cons5t %all n apply to ! process+1     
/orage1 & collection ( s5sitive p]sonal 
in=mation or behavioral data 9 :i* su*  
process+ does n deviate f purposes      
consi/5t ) a controll]'s relation%ip )  
us]s z und]/ood by ! reasonable us]4    
#d4 ,application & en=cem5t by ! ,f$]al 
,trade ,commission  7a7 ,common c>ri]s  
,not)/&+ ! limitations 9 ! ,f$]al ,trade
 ,commission ,act 7#ae ,u4,s4,c4 #da et 
seq47 on ,commission au?ority ) respect 
to common c>ri]s1 ?is ,act applies1     
accord+ to its t]ms1 to common c>ri]s   
subject to ! ,communications ,act (     
#aicd 7#dg ,u4,s4,c4 #aea et seq47 & all
 ,acts am5datory !re( & supplem5t>y     
!reto4  7b7 ,en=cem5t  7#a7 ,unfair or  

deceptive acts or practices ,a violation
 ( ?is ,act or a regulation promulgat$  
"u ?is ,act %all be treat$ z a violation
 ( a rule "u section #ah7;a77#a77;,b7 ( 
! ,f$]al ,trade ,commission ,act 7#ae   
,u4,s4,c4 #eg;a7a77#a77;,b77 reg>d+     
unfair or deceptive acts or practices4  
7#b7 ,p[]s ( ,commission ,except z      
provid$ 9 subsection 7a71 ! ,f$]al      
,trade ,commission %all en=ce ?is ,act &
 ! regulations promulgat$ "u ?is ,act 9 
! same mann]1 by ! same means1 & ) !    
same jurisdiction1 p[]s1 & duties z ?\gh
 all applicable t]ms & provisions ( !   
,f$]al ,trade ,commission ,act 7#ae     
,u4,s4,c4 #da et seq47 7 incorporat$    
into & made a "p ( ?is ,act4 ,any p]son 
:o violates ?is ,act or a regulation    
promulgat$ "u ?is ,act %all be subject  
to ! p5alties & entitl$ to ! privileges 
& immunities provid$ 9 ! ,f$]al ,trade  
,commission ,act4  7c7 ,con/ruction     
,no?+ 9 ?is ,act %all be con/ru$ to     
limit ! au?ority ( ! ,f$]al ,trade      
,commission "u any o!r provision ( law4 

#e4 ,"r ( action  7a7 ,"r ( action      
,except z provid$ 9 subsection 7e71 !   
attorney g5]al ( a ,/ate1 or o!r        
au?oriz$ ,/ate (fic]1 alleg+ a violation
 ( ?is ,act or any regulation issu$ "u  
?is ,act t affects or may affect su*    
,/ate or its resid5ts may br+ an action 
on behalf ( ! resid5ts ( ! ,/ate 9 any  
,unit$ ,/ates di/rict c\rt = ! di/rict 9
 :i* ! def5dant is f\nd1 resides1 or    
transacts bus9ess1 or :]ev] v5ue is     
prop] "u section #acia ( title #bh1 to  
obta9 appropriate injunctive relief4    
7b7 ,notice to ,commission requir$ ,a   
,/ate %all provide prior writt5 notice  
to ! ,f$]al ,trade ,commission ( any    
civil action "u subsection 7a7 toge!r ) 
a copy ( its compla9t1 except t if x is 
n feasible = ! ,/ate to provide su*     
prior notice1 ! ,/ate %all provide su*  
notice imm$iately ^u in/itut+ su*       
action4  7c7 ,int]v5tion by !           
,commission ,! ,commission may int]v5e 9
 su* civil action & ^u int]v5+-- 7#a7 be
 he>d on all matt]s aris+ 9 su* civil   

action2 &  7#b7 file petitions = appeal 
( a decision 9 su* civil action4  7d7   
,con/ruction ,no?+ 9 ?is section %all be
 con/ru$--  7#a7 to prev5t ! attorney   
g5]al ( a ,/ate1 or o!r au?oriz$ ,/ate  
(fic]1 f ex]cis+ ! p[]s conf]r$ on !    
attorney g5]al1 or o!r au?oriz$ ,/ate   
(fic]1 by ! laws ( su* ,/ate2 or  7#b7  
to prohibit ! attorney g5]al ( a ,/ate1 
or o!r au?oriz$ ,/ate (fic]1 f proce$+ 9
 ,/ate or ,f$]al c\rt on ! basis ( an   
alleg$ violation ( any civil or crim9al 
/atute ( t ,/ate4  7e7 ,limitation  7#a7
 ,no sep>ate action ,an action may n be 
br\ght "u subsection 7a7 if ! same      
alleg$ violation is ! subject ( a p5d+  
action by ! ,commission or ! ,unit$     
,/ates4  7#b7 ,exclusive p]iod to act by
 ,commission ,an action-- 7,a7 may n be 
br\ght "u subsection 7a7 until !        
expiration ( ! #fj-;day p]iod t beg9s on
 ! date on :i* a violation is discov]$  
by ! ,commission or ! date on :i* !     
,commission is notifi$ ( ! violation2 & 
7,b7 may only be br\ght "u subsection   

7a7 if ! ,commission does n br+ an      
action relat$ to ! violation dur+ su*   
p]iod4  #f4 ,privacy & data security    
employees & fund+ = ! ,commission  7a7  
,employm5t au?ority ,! ,commission %all 
hire #ej new full-"t employees to focus 
on privacy & data security1 #ae ( :i*   
%all h te*nology exp]tise4  7b7         
,additional fund+ = privacy & data      
security ,!re is au?oriz$ to be         
appropriat$ to ! ,commission #ce1jjj1jjj
 = issues relat$ to privacy & data      
security4  #g4 ,def9itions ,9 ?is ,act3 
7#a7 ,call detail record ,! t]m call    
detail record--  7,a7 means             
session-id5tify+ in=mation 7includ+ an  
orig9at+ or t]m9at+ telephone numb]1 an 
,int]national ,mobile ,subscrib]        
,id5tity numb]1 or an ,int]national     
,mobile ,/ation ,equipm5t ,id5tity      
numb]71 a telephone call+ c>d numb]1 or 
! "t or duration ( a call2  7,b7 does n 
include-- 7i7 ! cont5ts 7z def9$ 9      
section #beaj7h7 ( title #ah1 ,unit$    
,/ates ,code7 ( any communication2  7ii7

 ! "n1 address1 or f9ancial in=mation ( 
a subscrib] or cu/om]2  7iii7 cell site 
location or global position+ sy/em      
in=mation2 or  7iv7 bus9ess cu/om]s4    
7#b7 ,cle> & prom95t ,! t]m cle> &      
prom95t means 9 any communication m$ium1
 ! requir$ disclosure is--  7,a7 ( a    
type1 size1 & location suffici5tly      
noticeable = an ord9>y consum] to read &
 compreh5d ! communication2  7,b7       
provid$ 9 a mann] su* t an ord9>y       
consum] is able to read & compreh5d !   
communication2  7,c7 is pres5t$ 9 an    
und]/&able language & syntax2  7,d7     
includes no?+ contr>y to1 inconsi/5t )1 
or t mitigates any /atem5t conta9$ )9 ! 
disclosure or )9 any docum5t l9k$ to or 
ref]5c$ !re92 &  7,e7 includes an option
 t is compliant ) applicable obligations
 ( ! controll] "u title ,,iii ( !       
,am]icans ) ,disabilities ,act ( #aiij  
7#db ,u4,s4,c4 #abaha et seq474  7#c7   
,commission ,! t]m ,commission means !  
,f$]al ,trade ,commission4  7#d7        
,controll] ,! t]m controll] means a     

p]son t1 on its own or jo9tly ) o!r     
entities1 det]m9es ! purposes & means ( 
process+ s5sitive p]sonal in=mation4    
7#e7 ,processor ,! t]m processor means a
 p]son t processes data on behalf ( !   
controll]4  7#f7 ,s5sitive p]sonal      
in=mation  7,a7 ,! t]m s5sitive p]sonal 
in=mation means in=mation relat+ to an  
id5tifi$ or id5tifiable individual1     
includ+ ! foll[+3  7i7 ,f9ancial acc\nt 
in=mation4  7ii7 ,heal? in=mation4      
7iii7 ,g5etic data4  7iv7 ,in=mation    
p]ta9+ to *ildr5 "u #ac ye>s ( age4  7v7
 ,social ,security numb]s4  7vi7 ,unique
 gov]nm5t-issu$ id5tifi]s  7vii7        
,au!ntication cr$5tials1 su* z a us]name
 & password4  7viii7 ,precise           
geolocation in=mation4  7ix7 ,cont5t ( a
 wire communication1 oral communication1
 or electronic communication ) respect  
to any entity t is n ! int5d$ recipi5t (
 ! communication4  7x7 ,call detail     
records4  7xi7 ,web br[s+ hi/ory1       
application usage hi/ory1 & ! functional
 equival5t ( ei!r4  7xii7 ,biometric    

in=mation4  7xiii7 ,sexual ori5tation4  
7xiv7 ,religi\s beliefs4  7,b7 ,! t]m   
s5sitive p]sonal in=mation does n       
include--  7i7 de-id5tifi$ in=mation 7or
 ! process ( trans=m+ p]sonal data s t x
 is n directly relatable to an id5tifi$ 
or id5tifiable consum]72  7ii7 in=mation
 relat$ to employm5t2 or  7iii7 publicly
 available in=mation4  7#g7 ,/ate ,! t]m
 ,/ate means ea* ,/ate ( ! ,unit$       
,/ates1 ! ,di/rict ( ,columbia1 & ea*   
commonweal?1 t]ritory1 or possession ( !
 ,unit$ ,/ates4  7#h7 ,?ird p>ty ,! t]m 
?ird p>ty means an individual or entity 
t uses or receives s5sitive p]sonal     
in=mation or behavioral data obta9$ by  
or on behalf ( a controll]1 o!r ?an--   
7,a7 a s]vice provid] ( a controll] to  
:om ! controll] discloses ! consum]'s   
s5sitive p]sonal in=mation = an         
op]ational purpose pursuant to an       
agreem5t t prohibits ! s]vice provid]   
receiv+ ! s5sitive p]sonal in=mation f  
us+ or disclos+ ! s5sitive p]sonal      
in=mation = ! b5efit ( ! provid]2 &     

7,b7 any entity t uses s5sitive p]sonal 
in=mation only z reasonably necess>y--  
7i7 to comply ) applicable law1         
regulation1 or legal process2  7ii7 to  
en=ce ! t]ms ( use ( a controll]2 or    
7iii7 to detect1 prev5t1 or mitigate    
fraud or security vuln]abilities4  #h4  
,rule ( con/ruction ,no?+ 9 ?is ,act may
 be con/ru$ to preclude ! acquisition by
 ! ,f$]al ,gov]nm5t (-- 7#a7 ! cont5ts (
 a wire or electronic communication     
pursuant to o!r lawful au?orities1      
includ+ ! au?orities "u *apt] #aai (    
title #ah1 ,unit$ ,/ates ,code 7commonly
 kn[n z ! ,wiretap ,act71 ! ,=eign      
,intellig5ce ,surveillance ,act ( #aigh 
7#ej ,u4,s4,c4 #ahja et seq471 or any   
o!r provision ( ,f$]al law n            
specifically am5d$ by ?is ,act2 or  7#b7
 records or o!r in=mation relat+ to a   
subscrib] or cu/om] ( any electronic    
communication s]vice or remote comput+  
s]vice 7n includ+ ! cont5t ( su*        
communications7 pursuant to ! ,=eign    
,intellig5ce ,surveillance ,act ( #aigh 

7#ej ,u4,s4,c4 #ahja et seq471 *apt]    
#aai ( title #ah1 ,unit$ ,/ates ,code   
7commonly kn[n z ! ,wiretap ,act71 or   
any o!r provision ( ,f$]al law n        
specifically am5d$ by ?is ,act4  #i4    
,national /&>d  7a7 ,preemption ,= a    
controll] t is subject to ?is ,act1 or  
any regulation promulgat$ pursuant to   
?is ,act1 ! provisions ( ?is ,act1 or   
any su* regulation1 %all preempt any    
civil provision ( ! law ( any ,/ate or  
political subdivision ( a ,/ate to !    
degree ! law is focus$ on ! r$uction (  
privacy risk ?r\gh ! regulation ( !     
collection ( s5sitive p]sonal in=mation 
& ! collection1 /orage1 process+1 sale1 
%>+ ) ?ird p>ties1 or o!r use ( su*     
in=mation4  7b7 ,consum] protection laws
 ,except z provid$ 9 subsection 7a71 ?is
 section may n be con/ru$ to limit !    
en=cem5t1 or ! br++ ( a claim pursuant  
to any ,/ate consum] protection law by  
an attorney g5]al ( a ,/ate1 o!r ?an !  
ext5t to :i* any su* law regulates !    
collection ( s5sitive p]sonal in=mation 

& ! collection1 /orage1 process+1 sale1 
%>+ ) ?ird p>ties1 or o!r use ( su*     
in=mation4  7c7 ,protection ( c]ta9     
,/ate law ,no?+ 9 ?is ,act may be       
con/ru$ to preempt ! applicability ( any
 ( ! foll[+3 7#a7 ,/ate con/itutional1  
trespass1 contract1 data brea*          
notification1 or tort law1 o!r ?an to ! 
degree su* law is sub/antially int5d$ to
 gov]n ! collection ( s5sitive p]sonal  
in=mation & ! collection1 /orage1       
process+1 sale1 %>+ ) ?ird p>ties1 or   
o!r use ( su* in=mation4  7#b7 ,any o!r 
,/ate law to ! ext5t t ! law relates to 
acts ( fraud1 wiretapp+1 or ! protection
 ( social security numb]s4  7#c7 ,any   
,/ate law to ! ext5t ! law provides     
additional provisions to specifically   
regulate ! cov]$ entities z def9$ =     
purposes ( ! regulations promulgat$     
pursuant to section #bfd7;c7 ( ! ,heal? 
,insurance ,portability & ,acc\ntability
 ,act ( #aiif 7,public ,law #ajd-aia71  
section #ddd ( ! ,g5]al ,education      
,provisions ,act 7commonly kn[n z !     

,family ,educational ,rights & ,privacy 
,act ( #aigd7 7#bj ,u4,s4,c4 #abcb;g71 !
 ,fair ,cr$it ,report+ ,act 7#ae        
,u4,s4,c4 #afha et seq471 or !          
,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4
 #fgja et seq474  7#d7 ,any private     
contract bas$ on a ,/ate law t requires 
a p>ty to provide additional or great]  
privacy = s5sitive p]sonal in=mation or 
data security protections to an         
individual ?an ?is ,act1 or any         
regulation promulgat$ pursuant to ?is   
,act4  #aj4 ,effective date ,?is ,act   
%all take effect #ahj days aft] ! date (
 ! enactm5t ( ?is ,act4