,,ii  #aaf? ,,congress  #a/ ,session    
,s4 #bifa  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,decemb] #b1 #bjai,mr4 
,s*atz 7= himself1 ,mr4 ,b5net1 ,ms4    
,cortez ,ma/o1 ,mr4 ,m>key1 ,ms4        
,duckwor?1 ,ms4 ,baldw91 ,mr4 ,man*91   
,mr4 ,durb91 ,mr4 ,br[n1 ,mr4 ,book]1   
,ms4 ,klobu*>1 ,ms4 ,hassan1 ,mr4       
,he9ri*1 ,mrs4 ,murray1 ,mr4 ,s&]s1 &   
,mr4 ,murphy7 introduc$ ! foll[+ bill2  
:i* 0 read twice & ref]r$ to !          
,committee on ,comm]ce1 ,sci5ce1 &      
,transportation  ,a ,,bill  ,to e/abli% 
duties = onl9e s]vice provid]s ) respect
 to end us] data t su* provid]s collect 
& use4  #a4 ,%ort title ,?is ,act may be
 cit$ z ! ,data ,c>e ,act ( #bjai4  #b4 
,def9itions ,9 ?is ,act3 7#a7           
,commission ,! t]m ,commission means !  
,f$]al ,trade ,commission4  7#b7 ,end   
us] ,! t]m end us] means an individual  
:o engages ) an onl9e s]vice provid] or 
logs into or uses s]vices provid$ by !  
onl9e s]vice provid] ov] ! int]net or   
any o!r digital network4  7#c7          

,individual id5tify+ data ,! t]m        
individual id5tify+ data means any data 
t is-- 7,a7 collect$ ov] ! int]net or   
any o!r digital network2 &  7,b7 l9k$1  
or reasonably l9kable1 to-- 7i7 a       
specific end us]2 or  7ii7 a comput+    
device t is associat$ ) or r\t9ely us$  
by an end us]4  7#d7 ,onl9e s]vice      
provid] ,! t]m onl9e s]vice provid]     
means an entity t--  7,a7 is engag$ 9   
int]/ate comm]ce ov] ! int]net or any   
o!r digital network2 &  7,b7 9 ! c\rse (
 bus9ess1 collects individual id5tify+  
data ab\t end us]s1 includ+ 9 a mann] t 
is incid5tal to ! bus9ess conduct$4     
7#e7 ,s5sitive data ,! t]m s5sitive data
 means any data t includes-- 7,a7 a     
social security numb]2  7,b7 p]sonal    
in=mation 7z def9$ 9 section #acjb ( !  
,*ildr5's ,onl9e ,privacy ,protection   
,act ( #aiih 7#ae ,u4,s4,c4 #feja77     
collect$ f a *ild 7z def9$ 9 su* section
 #acjb72  7,c7 a driv]'s lic5se numb]1  
passport numb]1 milit>y id5tification   
numb]1 or any o!r simil> numb] issu$ on 

a gov]nm5t docum5t us$ to v]ify id5tity2
  7,d7 a f9ancial acc\nt numb]1 cr$it or
 debit c>d numb]1 or any requir$        
security code1 access code1 or password 
t is necess>y to p]mit access to a      
f9ancial acc\nt ( an individual2  7,e7  
unique biometric data su* z a f+] pr9t1 
voice pr9t1 a ret9a or iris image1 or   
any o!r unique physical repres5tation2  
7,f7 in=mation suffici5t to access an   
acc\nt ( an individual1 su* z us] "n &  
password or email address & password2   
7,g7 ! fir/ & la/ "n ( an individual1 or
 fir/ initial & la/ "n1 or o!r unique   
id5tifi] 9 comb9ation )--  7i7 ! mon?1  
day1 & ye> ( bir? ( ! individual2  7ii7 
! maid5 "n ( ! "m ( ! individual2 or    
7iii7 ! pa/ or pres5t precise           
geolocation ( ! individual2  7,h7       
in=mation t relates to--  7i7 ! pa/1    
pres5t1 or future physical or m5tal     
heal? or condition ( an individual2 or  
7ii7 ! provision ( heal? c>e to an      
individual2 &  7,i7 ! nonpublic         
communications or o!r nonpublic         

us]-creat$ cont5t ( an individual4  #c4 
,provid] duties  7a7 ,9 g5]al ,an onl9e 
s]vice provid] %all fulfill ! duties (  
c>e1 loyalty1 & confid5tiality "u       
p>agraphs 7#a71 7#b71 & 7#c71           
respectively1 ( subsection 7b74  7b7    
,duties  7#a7 ,duty ( c>e ,an onl9e     
s]vice provid] %all-- 7,a7 reasonably   
secure individual id5tify+ data f       
unau?oriz$ access2 &  7,b7 subject to   
subsection 7d71 promptly in=m an end us]
 ( any brea* ( ! duty describ$ 9        
subp>agraph 7,a7 ( ?is p>agraph )       
respect to s5sitive data ( t end us]4   
7#b7 ,duty ( loyalty ,an onl9e s]vice   
provid] may n use individual id5tify+   
data1 or data d]iv$ f individual        
id5tify+ data1 9 any way t--  7,a7 w    
b5efit ! onl9e s]vice provid] to !      
detrim5t ( an end us]2 &  7,b7 7i7 w    
result 9 reasonably =eseeable & mat]ial 
physical or f9ancial h>m to an end us]2 
or  7ii7 w\ld be unexpect$ & highly     
(f5sive to a reasonable end us]4  7#c7  
,duty ( confid5tiality ,an onl9e s]vice 

provid]--  7,a7 may n disclose or sell  
individual id5tify+ data to1 or %>e     
individual id5tify+ data )1 any o!r     
p]son except z consi/5t ) ! duties ( c>e
 & loyalty "u p>agraphs 7#a7 & 7#b71    
respectively2  7,b7 may n disclose or   
sell individual id5tify+ data to1 or %>e
 individual id5tify+ data )1 any o!r    
p]son unless t p]son ent]s into a       
contract ) ! onl9e s]vice provid] t     
imposes on ! p]son ! same duties ( c>e1 
loyalty1 & confid5tiality t[>d !        
applicable end us] z are impos$ on !    
onl9e s]vice provid] "u ?is subsection2 
&  7,c7 %all take reasonable /eps to    
ensure t ! practices ( any p]son to :om 
! onl9e s]vice provid] discloses or     
sells1 or ) :om ! onl9e s]vice provid]  
%>es1 individual id5tify+ data fulfill !
 duties ( c>e1 loyalty1 & confid5tiality
 assum$ by ! p]son "u ! contract        
describ$ 9 subp>agraph 7,b71 includ+ by 
audit+1 on a regul> basis1 ! data       
security & data in=mation practices (   
any su* p]son4  7c7 ,application (      

duties to ?ird p>ties ,if an onl9e      
s]vice provid] transf]s or o!rwise      
provides access to individual id5tify+  
data to ano!r p]son1 ! requirem5ts (    
p>agraphs 7#a71 7#b71 & 7#c7 (          
subsection 7b7 %all apply to su* p]son )
 respect to su* data 9 ! same mann] t   
su* requirem5ts apply to ! onl9e s]vice 
provid]4  7d7 ,expansion ( duty ,to in=m
 reg>d+ brea*es ,! ,commission may      
promulgate regulations "u section #eec (
 title #e1 ,unit$ ,/ates ,code1 to apply
 ! brea* notification requirem5t "u     
subsection 7b77#a77;,b7 ) respect to    
specific categories ( individual        
id5tify+ data o!r ?an s5sitive data1 z !
 ,commission det]m9es necess>y4  7e7    
,exceptions  7#a7 ,regulations ,!       
,commission may promulgate regulations  
"u section #eec ( title #e1 ,unit$      
,/ates ,code1 to exempt categories (    
onl9e s]vice provid]s or p]sons describ$
 9 subsection 7c7 f ! requirem5t "u     
subsection 7a7 or subsection 7c7 7z     
applicable74  7#b7 ,consid]ations ,9    

promulgat+ regulations "u p>agraph 7#a71
 ! ,commission %all consid]1 among o!r  
factors--  7,a7 ! privacy risks pos$ by 
! use ( individual id5tify+ data by an  
onl9e s]vice provid] or p]son describ$ 9
 subsection 7c7 bas$ on--  7i7 ! size ( 
! provid] or p]son2  7ii7 ! complexity (
 ! (f]+s ( ! provid]2  7iii7 ! nature & 
scope ( ! activities ( ! provid] or     
p]son2 &  7iv7 ! s5sitivity ( ! consum] 
in=mation h&l$ by ! provid] or p]son2 & 
7,b7 ! co/s & b5efits ( apply+ !        
requirem5t "u subsection 7a7 or         
subsection 7c7 7z applicable7 to onl9e  
s]vice provid]s or p]sons ) p>ticul>    
comb9ations ( *>act]i/ics consid]$ "u   
subp>agraph 7,a7 ( ?is p>agraph4  #d4   
,en=cem5t  7a7 ,en=cem5t by ,commission 
7#a7 ,unfair or deceptive acts or       
practices ,a violation ( section #c by  
an onl9e s]vice provid] or a p]son      
describ$ 9 section #c7;c7 %all be treat$
 z a violation ( a rule def9+ an unfair 
or deceptive act or practice prescrib$  
"u section #ah7;a77#a77;,b7 ( ! ,f$]al  

,trade ,commission ,act 7#ae ,u4,s4,c4  
#eg;a7a77#a77;,b774  7#b7 ,p[]s (       
,commission  7,a7 ,9 g5]al ,except z    
provid$ 9 subp>agraph 7,c71 !           
,commission %all en=ce ?is ,act 9 ! same
 mann]1 by ! same means1 & ) ! same     
jurisdiction1 p[]s1 & duties z ?\gh all 
applicable t]ms & provisions ( ! ,f$]al 
,trade ,commission ,act 7#ae ,u4,s4,c4  
#da et seq47 7 incorporat$ into & made a
 "p ( ?is ,act4  7,b7 ,privileges &     
immunities ,except z provid$ 9          
subp>agraph 7,c71 any p]son :o violates 
section #c %all be subject to ! p5alties
 & entitl$ to ! privileges & immunities 
provid$ 9 ! ,f$]al ,trade ,commission   
,act 7#ae ,u4,s4,c4 #da et seq474  7,c7 
,nonpr(it organizations & common c>ri]s 
,not)/&+ section #d or #e7;a77#b7 ( !   
,f$]al ,trade ,commission ,act 7#ae     
,u4,s4,c4 #dd1 #de7;a77#b77 or any      
jurisdictional limitation ( !           
,commission1 ! ,commission %all also    
en=ce ?is ,act1 9 ! same mann] provid$ 9
 subp>agraphs 7,a7 & 7,b7 ( ?is         

p>agraph1 ) respect to--  7i7           
organizations n organiz$ to c>ry on     
bus9ess = _! own pr(it or t ( _! memb]s2
 &  7ii7 common c>ri]s subject to !     
,communications ,act ( #aicd 7#dg       
,u4,s4,c4 #aea et seq474  7#c7 ,rulemak+
 au?ority ,! ,commission %all promulgate
 regulations "u ?is ,act 9 accordance ) 
section #eec ( title #e1 ,unit$ ,/ates  
,code4  7b7 ,en=cem5t by ,/ates  7#a7   
,au?orization ,subject to p>agraph 7#c71
 9 any case 9 :i* ! attorney g5]al ( a  
,/ate has reason to believe t an int]e/ 
( ! resid5ts ( ! ,/ate has be5 or is    
?reat5$ or adv]sely affect$ by !        
engagem5t ( an onl9e s]vice provid] or a
 p]son describ$ 9 section #c7;c7 9 a    
practice t violates section #c1 !       
attorney g5]al ( ! ,/ate may1 z p>5s    
patriae1 br+ a civil action aga9/ !     
onl9e s]vice provid] or p]son on behalf 
( ! resid5ts ( ! ,/ate 9 an appropriate 
di/rict c\rt ( ! ,unit$ ,/ates to obta9 
appropriate relief1 includ+ civil       
p5alties 9 ! am\nt det]m9$ "u p>agraph  

7#b74  7#b7 ,civil p5alties ,an onl9e   
s]vice provid] or p]son describ$ 9      
section #c7;c7 t is f\nd1 9 an action   
br\ght "u p>agraph 7#a71 to h kn[+ly or 
repeat$ly violat$ section #c %all1 9    
addition to any o!r p5alty o!rwise      
applicable to a violation ( section #c1 
be liable = a civil p5alty equal to !   
am\nt calculat$ by multiply+--  7,a7 !  
great] (-- 7i7 ! numb] ( days dur+ :i* !
 onl9e s]vice provid] or p]son 0 n 9    
compliance ) t section2 or  7ii7 ! numb]
 ( end us]s :o 7 h>m$ z a result ( !    
violation1 by  7,b7 an am\nt n to exce$ 
! maximum civil p5alty = :i* a p]son1   
p>tn]%ip1 or corporation may be liable  
"u section #e7m77#a77;,a7 ( ! ,f$]al    
,trade ,commission ,act 7#ae ,u4,s4,c4  
#de7m77#a77;,a77 7includ+ any adju/m5ts 
= inflation74  7#c7 ,rights ( ,f$]al    
,trade ,commission  7,a7 ,notice to     
,f$]al ,trade ,commission  7i7 ,9 g5]al 
,except z provid$ 9 clause 7iii71 !     
attorney g5]al ( a ,/ate %all notify !  
,commission 9 writ+ t ! attorney g5]al  

int5ds to br+ a civil action "u p>agraph
 7#a7 be=e initiat+ ! civil action4     
7ii7 ,cont5ts ,! notification requir$ "u
 clause 7i7 ) respect to a civil action 
%all include a copy ( ! compla9t to be  
fil$ to initiate ! civil action4  7iii7 
,exception ,if x is n feasible = !      
attorney g5]al ( a ,/ate to provide !   
notification requir$ "u clause 7i7 be=e 
initiat+ a civil action "u p>agraph     
7#a71 ! attorney g5]al %all notify !    
,commission imm$iately ^u in/itut+ !    
civil action4  7,b7 ,int]v5tion by      
,f$]al ,trade ,commission ,! ,commission
 may-- 7i7 int]v5e 9 any civil action   
br\ght by ! attorney g5]al ( a ,/ate "u 
p>agraph 7#a72 &  7ii7 ^u int]v5+-- 7,i7
 be he>d on all matt]s aris+ 9 ! civil  
action2 &  7,,ii7 file petitions =      
appeal ( a decision 9 ! civil action4   
7#d7 ,inve/igatory p[]s ,no?+ 9 ?is     
subsection may be con/ru$ to prev5t !   
attorney g5]al ( a ,/ate f ex]cis+ !    
p[]s conf]r$ on ! attorney g5]al by !   
laws ( ! ,/ate to--  7,a7 conduct       

inve/igations2  7,b7 adm9i/] oa?s or    
affirmations2 or  7,c7 compel !         
att5dance ( witnesses or ! production ( 
docum5t>y or o!r evid5ce4  7#e7         
,preemptive action by ,f$]al ,trade     
,commission ,if ! ,commission in/itutes 
a civil action or an adm9i/rative action
 ) respect to a violation ( section #c1 
! attorney g5]al ( a ,/ate may n1 dur+ !
 p5d5cy ( ! action1 br+ a civil action  
"u p>agraph 7#a7 aga9/ any def5dant nam$
 9 ! compla9t ( ! ,commission bas$ on ! 
same set ( facts giv+ rise to ! alleg$  
violation ) respect to :i* ! ,commission
 in/itut$ ! action4  7#f7 ,v5ue2 s]vice 
( process  7,a7 ,v5ue ,any action br\ght
 "u p>agraph 7#a7 may be br\ght 9-- 7i7 
! di/rict c\rt ( ! ,unit$ ,/ates t meets
 applicable requirem5ts relat+ to v5ue  
"u section #acia ( title #bh1 ,unit$    
,/ates ,code2 or  7ii7 ano!r c\rt (     
compet5t jurisdiction4  7,b7 ,s]vice (  
process ,9 an action br\ght "u p>agraph 
7#a71 process may be s]v$ 9 any di/rict 
9 :i* ! def5dant--  7i7 is an           

inhabitant2 or  7ii7 may be f\nd4  7#g7 
,actions by o!r ,/ate (ficials  7,a7 ,9 
g5]al ,9 addition to civil actions      
br\ght by attorneys g5]al "u p>agraph   
7#a71 any o!r consum] protection (fic] (
 a ,/ate :o is au?oriz$ by ! ,/ate to d 
s may br+ a civil action "u p>agraph    
7#a71 subject to ! same requirem5ts &   
limitations t apply "u ?is subsection to
 civil actions br\ght by attorneys      
g5]al4  7,b7 ,sav+s provision ,no?+ 9   
?is subsection may be con/ru$ to        
prohibit an au?oriz$ (ficial ( a ,/ate f
 initiat+ or cont9u+ any proce$+ 9 a    
c\rt ( ! ,/ate = a violation ( any civil
 or crim9al law ( ! ,/ate4  #e4         
,non5=ceability ( c]ta9 provisions waiv+
 rights & rem$ies ,! rights & rem$ies   
provid$ "u ?is ,act may n be waiv$ or   
limit$ by contract or o!rwise4  #f4     
,relation to o!r privacy & security laws
 ,no?+ 9 ?is ,act may be con/ru$ to--   
7#a7 modify1 limit1 or sup]s$e !        
op]ation ( any privacy or security      
provision 9 any o!r ,f$]al or ,/ate     

/atute or regulation2 or  7#b7 limit !  
au?ority ( ! ,commission "u any o!r     
provision ( law4  #g4 ,effective date   
7a7 ,9 g5]al ,?is ,act %all take effect 
on ! date ( enactm5t ( ?is ,act4  7b7   
,applicability ,section #c %all apply ) 
respect to an onl9e s]vice provid] or   
p]son describ$ 9 section #c7;c7 on &    
aft] ! date t is #ahj days aft] ! date (
 enactm5t ( ?is ,act4