,i  #aag? ,,congress  #a/ ,session  ,h4 
,r4 #edcc  ,,9 ,,! ,,h\se ,,(           
,,repres5tatives  ,septemb] #cj1        
#bjba,mr4 ,posey 7= himself1 ,mr4       
,gohm]t1 & ,mr4 ,mull97 introduc$ !     
foll[+ bill2 :i* 0 ref]r$ to !          
,committee on ,en]gy & ,comm]ce  ,a     
,,bill  ,to protect ! privacy ( int]net 
us]s by re9=c+ onl9e privacy rights &   
?r\gh ! e/abli%m5t ( a national ,d ,n   
,track sy/em1 & = o!r purposes4  #a4    
,%ort title2 table ( cont5ts  7a7 ,%ort 
title ,?is ,act may be cit$ z ! ,r5ew   
,effective ,protection ( ,am]icans'     
,in=mation ,rights ,act or ! ,,repair   
,act4  7b7 ,table ( cont5ts ,! table (  
cont5ts = ?is ,act is z foll[s3 ,sec4   
#a4 ,%ort title2 table ( cont5ts4,title 
,i--,data ,privacy ,bill ( ,rights,sec4 
#aja4 ,%ort title4,sec4 #ajb4 ,policy ( 
! ,unit$ ,/ates4,sec4 #ajc4 ,f9d+s4,sec4
 #ajd4 ,rights relat+ to                
transp>5cy4,sec4 #aje4 ,"r to           
delete4,sec4 #ajf4 ,"r to correct       
inaccuracies4,sec4 #ajg4 ,"r to         

controls4,sec4 #ajh4 ,"r to data        
m9imization4,sec4 #aji4 ,"r to data     
security4,sec4 #aaj4 ,prohibition (     
s]vice (f]s condition$ on waiv]s (      
privacy rights4,sec4 #aaa4 ,scope (     
cov]age4,sec4 #aab4 ,small bus9ess      
exception4,sec4 #aac4 ,application &    
en=cem5t4,sec4 #aad4 ,/ate privacy      
protections4,sec4 #aae4                 
,sev]ability4,sec4 #aaf4                
,def9itions4,sec4 #aag4 ,effective      
date4,title ,,ii--,d ,n ,track,sec4     
#bja4 ,%ort title4,sec4 #bjb4           
,e/abli%m5t ( ,d ,n ,track sy/em4,sec4  
#bjc4 ,d ,n ,track3 requirem5ts =       
op]ators2 prohibit$ acts4,sec4 #bjd4    
,scope ( cov]age4,sec4 #bje4            
,application & en=cem5t4,sec4 #bjf4     
,/ate privacy protections4,sec4 #bjg4   
,sev]ability4,sec4 #bjh4                
,def9itions4,sec4 #bji4 ,effective date4
  ,i ,data ,privacy ,bill ( ,rights     
#aja4 ,%ort title ,?is title may be cit$
 z ! ,data ,privacy ,bill ( ,rights     
,act4  #ajb4 ,policy ( ! ,unit$ ,/ates  

,x is ! policy ( ! ,unit$ ,/ates t      
individuals h fundam5tal rights to      
secure & protect _! privacy 9 data      
collect$ f & ab\t !m by firms do+       
bus9ess ) !m z provid$ = 9 ?is title & t
 x is also a fundam5tal purpose ( !     
,f$]al ,gov]nm5t to def5d & en=ce su*   
privacy rights4  #ajc4 ,f9d+s ,congress 
f9ds ! foll[+3 7#a7 ,individuals are    
end[$ ) rights to secure & protect data 
relat$ to _! lives1 _! patt]ns ( movem5t
 & comm]cial ex*ange & any o!r in=mation
 t is classifi$ z s5sitive pursuant to  
?is title4  7#b7 ,individuals h a "r to 
complete transp>5cy ) respect to !      
ex*anges !y make 9 t]ms ( a complete    
acc\nt+ ( bo? ! nonpecuni>y & pecuni>y  
co/s allocat$ to & collect$ f !m4  7#c7 
,:ile ! int]net & o!r te*nologies h     
produc$ enorm\s b5efits to ! ,nation1 !y
 h also _h un9t5tional consequ5ces 9    
erod+ individual data privacy rights4   
7#d7 ,! ,nation ne$s to update          
individual rights to include adequate & 
effective protections to secure & su/a9 

individual rights to data privacy4  7#e7
 ,t protection ( individual data privacy
 rights %\ld be secur$ ) due            
consid]ation ( ! collat]al rights (     
entities to pursue bus9esses :ile assur+
 complete transp>5cy to individuals z   
relates to _! data & ! role t su* data  
plays 9 ! entities' bus9ess models4     
#ajd4 ,rights relat+ to transp>5cy  7a7 
,"r to access ,^u ! v]ifi$ reque/ ( an  
individual1 a cov]$ entity %all provide 
to ! individual-- 7#a7 9 a portable     
=mat1 )\t lic5s+ re/rictions1 ! cov]$   
data ( ! individual t is collect$1      
process$1 or transf]r$ by ! cov]$       
entity2 &  7#b7 9 a human-readable =mat 
t a reasonable individual c und]/&--    
7,a7 a copy ( ! cov]$ data ( !          
individual t is collect$1 process$1 or  
transf]r$ by ! cov]$ entity2  7,b7 a li/
 ( ea* category ( ?ird p>ty to :i* !    
cov]$ entity has transf]r$ ! cov]$ data 
( ! individual2 &  7,c7 ! id5tity ( ea* 
su* ?ird p>ty & a description ( ! cov]$ 
data t 0 transf]r$ to su* ?ird p>ty & ! 

purpose ( ! transf]4  7b7 ,"r to        
imm$iate notification ( collection  7#a7
 ,9 g5]al ,on e website or application  
l&+ page1 ! second-p>ty op]ator ( a     
cov]$ int]net plat=m %all display1      
imm$iately :5 ! page is access$ by an   
individual1 an easily id5tifiable       
indicator t provides a real-"t          
notification ( :e!r or n ! cov]$ data ( 
! individual is be+ actively collect$ by
 ! cov]$ int]net plat=m or any program (
 a ?ird-p>ty op]ator t appe>s on ! cov]$
 int]net plat=m4  7#b7 ,cont5ts (       
notification ,! notification requir$ by 
p>agraph 7#a7 %all include 7or provide a
 l9k to or o!r conv5i5t means ( access+7
 ! foll[+ in=mation3 7,a7 ,! types (    
data be+ collect$4  7,b7 ,! purposes =  
:i* su* data is process$4  7,c7 ,!      
categories ( su* data transf]r$ to ?ird 
p>ties4  7,d7 ,! categories ( ?ird      
p>ties to :i* su* data is transf]r$4    
7,e7 ,! id5tity ( ea* ?ird p>ty to :i*  
su* data is transf]r$4  7,f7 ,h[ long   
su* data w be reta9$ by ! second-p>ty   

op]ator1 any ?ird-p>ty op]ator1 & any   
?ird p>ty 7z applicable74  7,g7 ,a      
description ( individuals' privacy      
rights "u ?is title4  7,h7 ,! contact   
in=mation = ! repres5tatives = privacy &
 data security inquires ( ! second-p>ty 
op]ator1 any ?ird-p>ty op]ator1 & any   
?ird p>ty 7z applicable74  7#c7         
,responsibility ( ?ird-p>ty op]ators ,a 
?ird-p>ty op]ator ( a program t appe>s  
on a cov]$ int]net plat=m %all1 if !    
program collects any cov]$ data ( a us] 
( ! plat=m1 ensure t ! second-p>ty      
op]ator ( ! plat=m provides !           
notification requir$ by p>agraph 7#a7 & 
t ! notification includes ! in=mation   
requir$ by p>agraph 7#b7 ) respect to ! 
program4  7c7 ,"r ,to receive privacy   
policy  7#a7 ,9 g5]al ,a cov]$ entity   
%all make publicly & p]si/5tly          
available1 9 a conspicu\s & readily     
accessible mann]1 a privacy policy t    
provides a detail$ & accurate           
repres5tation ( ! activities ( ! cov]$  
entity ) respect to ! collection1       

process+1 & transf] ( cov]$ data4  7#b7 
,cont5ts ( privacy policy ,! privacy    
policy requir$ by p>agraph 7#a7 %all    
include1 at a m9imum1 ! foll[+3 7,a7 ,an
 easy-to-und]/& explanation ( ! policy (
 ! cov]$ entity ) respect to !          
collection1 process+1 & transf] ( cov]$ 
data 7includ+ cle> descriptions t avoid 
te*nical & legal j>gon to ! ext5t       
practicable74  7,b7 ,! id5tity ( &      
contact in=mation = ! cov]$ entity1     
includ+ ! contact in=mation = ! cov]$   
entity's repres5tative = privacy & data 
security inquiries4  7,c7 ,ea* category 
( cov]$ data ! cov]$ entity collects & !
 process+ purposes = :i* su* data is    
collect$4  7,d7 ,:e!r ! cov]$ entity    
transf]s cov]$ data &1 if s-- 7i7 ea*   
category ( s]vice provid] or ?ird p>ty  
to :i* ! cov]$ entity transf]s cov]$    
data & ! purposes = :i* su* data is     
transf]r$ to ea* su* category2 &  7ii7 !
 id5tity ( ea* ?ird p>ty to :i* ! cov]$ 
entity transf]s cov]$ data & ! purposes 
= :i* su* data is transf]r$ to su* ?ird 

p>ty4  7,e7 ,h[ long cov]$ data process$
 by ! cov]$ entity w be reta9$ by !     
cov]$ entity or a ?ird p>ty & a         
description ( ! cov]$ entity's data     
m9imization policies4  7,f7 ,h[         
individuals c ex]cise ! individual      
rights describ$ 9 ?is title4  7,g7 ,a   
description ( ! cov]$ entity's data     
security policies4  7,h7 ,! effective   
date ( ! privacy policy4  7#c7          
,languages ,a cov]$ entity %all make !  
privacy policy requir$ "u p>agraph 7#a7 
available to ! public 9 all ( !         
languages 9 :i* ! cov]$ entity provides 
a product or s]vice or c>ries out any   
o!r activities to :i* ! privacy policy  
relates4  7d7 ,"r ,to cons5t to mat]ial 
*anges ,if a mat]ial *ange to ! privacy 
policy ( a cov]$ entity requir$ "u      
subsection 7c7 w\ld weak5 privacy       
protections = cov]$ data1 ! cov]$ entity
 may n apply su* *ange to ! cov]$ data (
 an individual t 0 collect$ be=e ! *ange
 takes effect )\t obta9+ ! affirmative  
express cons5t ( ! individual to !      

*ange4  #aje4 ,"r to delete  7a7 ,9     
g5]al ,a cov]$ entity1 ^u ! v]ifi$      
reque/ ( an individual1 %all-- 7#a7 at !
 option ( ! individual-- 7,a7 delete1 or
 all[ ! individual to delete1 any       
in=mation 9 ! cov]$ data ( ! individual 
t is process$ by ! cov]$ entity2 or     
7,b7 take action to disable or mask !   
id5tification ( ! individual connect$ to
 any in=mation 9 ! cov]$ data ( !       
individual t is process$ by ! cov]$     
entity2  7#b7 in=m any s]vice provid] or
 ?ird p>ty to :i* ! cov]$ entity        
transf]r$ su* data ( ! reque/ ( !       
individual "u p>agraph 7#a72 &  7#c7    
direct ! s]vice provid] or ?ird p>ty to 
honor ! reque/4  7b7 ,s]vice provid]s & 
?ird p>ties ,9 ! case ( a s]vice provid]
 or ?ird p>ty t is in=m$ "u p>agraph    
7#b7 ( subsection 7a7 & direct$ to honor
 "u p>agraph 7#c7 ( su* subsection !    
reque/ ( an individual "u p>agraph 7#a7 
( su* subsection1 ! s]vice provid] or   
?ird p>ty %all1 9 accordance ) ! reque/1
 delete ! in=mation or take action to   

disable or mask ! id5tification ( !     
individual4  #ajf4 ,"r to correct       
inaccuracies  7a7 ,9 g5]al ,a cov]$     
entity1 ^u ! v]ifi$ reque/ ( an         
individual1 %all-- 7#a7 correct1 or all[
 ! individual to correct1 inaccurate or 
incomplete in=mation 9 ! cov]$ data ( ! 
individual t is process$ by ! cov]$     
entity2  7#b7 in=m any s]vice provid] or
 ?ird p>ty to :i* ! cov]$ entity        
transf]r$ su* data ( ! reque/ ( !       
individual "u p>agraph 7#a7 & ( !       
correct$ in=mation2 &  7#c7 direct !    
s]vice provid] or ?ird p>ty to honor !  
reque/4  7b7 ,s]vice provid]s & ?ird    
p>ties ,9 ! case ( a s]vice provid] or  
?ird p>ty t is in=m$ "u p>agraph 7#b7 ( 
subsection 7a7 & direct$ to honor "u    
p>agraph 7#c7 ( su* subsection ! reque/ 
( an individual "u p>agraph 7#a7 ( su*  
subsection1 ! s]vice provid] or ?ird    
p>ty %all1 9 accordance ) ! reque/1     
correct ! in=mation4  #ajg4 ,"r to      
controls  7a7 ,s5se ( ,congress ,x is ! 
s5se ( ,congress t-- 7#a7 ! t]m privacy 

policy is deceptive2  7#b7 su* policies 
are 9 fact data collection policies2 &  
7#c7 cov]$ data is ! private prop]ty ( !
 individual ab\t :om ! data has be5     
collect$ & %\ld be treat$ z su*4  7b7   
,requirem5t = affirmative express cons5t
 = collection1 process+1 or transf] (   
cov]$ data  7#a7 ,9 g5]al ,a cov]$      
entity may n collect1 process1 or       
transf] to a ?ird p>ty ! cov]$ data ( an
 individual )\t obta9+ ! affirmative    
express cons5t ( ! individual to !      
collection1 process+1 or transf] ?r\gh a
 process e/abli%$ "u ! rule issu$ by !  
,commission "u p>agraph 7#c74  7#b7 ,"r 
to )draw affirmative express cons5t ,a  
cov]$ entity %all p]mit an individual to
 )draw ! affirmative express cons5t ( ! 
individual to ! collection1 process+1 or
 transf] to a ?ird p>ty ( ! cov]$ data (
 ! individual ?r\gh a process e/abli%$  
"u ! rule issu$ by ! ,commission "u     
p>agraph 7#c74  7#c7 ,rulemak+  7,a7 ,9 
g5]al ,n lat] ?an #a ye> aft] ! date ( !
 enactm5t ( ?is ,act1 ! ,commission %all

 issue a rule "u section #eec ( title   
#e1 ,unit$ ,/ates ,code1 e/abli%+ "o or 
m acceptable processes = a cov]$ entity 
to foll[ 9 reque/+ ! affirmative express
 cons5t ( an individual to ! collection1
 process+1 or transf] ( ! cov]$ data ( !
 individual & 9 p]mitt+ an individual to
 )draw su* cons5t4  7,b7 ,requirem5ts ,!
 processes e/abli%$ by ! ,commission "u 
subp>agraph 7,a7 %all-- 7i7 include cle>
 & conspicu\s reque/s = affirmative     
express cons5t & consum]-fri5dly        
me*anisms to all[ an individual to      
provide & )draw affirmative express     
cons5t2  7ii7 all[ an individual to     
provide & )draw affirmative express     
cons5t-- 7,i7 = ! collection1 process+1 
or transf] ( "s or all 7at ! option ( ! 
individual7 ( ! cov]$ data ( !          
individual2 &  7,,ii7 = ! transf] ( !   
cov]$ data ( ! individual to "s or all  
7at ! option ( ! individual7 ?ird       
p>ties2  7iii7 all[ an individual to    
view ! /atus ( affirmative express      
cons5t provid$ or )drawn2  7iv7 be      

privacy protective2 &  7v7 be in=m$ by !
 ,commission's exp]i5ce develop+ &      
implem5t+ ! ,national ,d ,n ,call       
,regi/ry4  #ajh4 ,"r to data m9imization
  7a7 ,9 g5]al ,a cov]$ entity may n    
collect1 process1 or transf] ! cov]$    
data ( an individual beyond :at is      
reasonably necess>y1 proportionate1 &   
limit$ to ! purposes = :i* ! individual 
provides affirmative express cons5t to !
 collection1 process+1 or transf]4  7b7 
,rule ( con/ruction ,no?+ 9 subsection  
7a7 may be con/ru$ to au?orize any      
collection1 process+1 or transf] ( cov]$
 data t is prohibit$ by any o!r         
provision ( ?is title4  #aji4 ,"r to    
data security  7a7 ,9 g5]al ,a cov]$    
entity %all e/abli%1 implem5t1 & ma9ta9 
reasonable data security practices to   
protect ! confid5tiality1 integrity1 &  
accessibility ( cov]$ data4 ,su* data   
security practices %all be appropriate  
to ! volume & nature ( ! cov]$ data at  
issue4  7b7 ,specific requirem5ts ,data 
security practices requir$ "u subsection

 7a7 %all include1 at a m9imum1 !       
foll[+3 7#a7 ,assess vuln]abilities     
,id5tify+ & assess+ any reasonably      
=eseeable risks to1 & vuln]abilities 91 
ea* sy/em ma9ta9$ by ! cov]$ entity t   
collects1 processes1 or transf]s cov]$  
data1 includ+ unau?oriz$ access to or   
risks to cov]$ data1 human              
vuln]abilities1 access rights1 & use (  
s]vice provid]s4 ,su* activities %all   
include a plan to receive & respond to  
unsolicit$ reports ( vuln]abilities by  
entities & individuals4  7#b7 ,prev5tive
 & correction action ,tak+ prev5tive &  
corrective action to mitigate any risks 
or vuln]abilities to cov]$ data id5tifi$
 by ! cov]$ entity1 :i* may include     
implem5t+ adm9i/rative1 te*nical1 or    
physical safegu>ds or *anges to data    
security practices or ! ar*itecture1    
in/allation1 or implem5tation ( network 
or op]at+ s(tw>e4  7#c7 ,in=mation      
ret5tion & disposal ,delet+ cov]$ data t
 is requir$ to be delet$ or is no long] 
necess>y = ! purpose = :i* ! data 0     

collect$ unless ! individual to :om !   
data relates provides affirmative       
express cons5t to ! ret5tion ( ! data4  
,su* process %all include data hygi5e   
practices to ensure ongo+ compliance )  
?is p>agraph4  7#d7 ,compreh5sive data  
security program ,implem5tation ( a     
compreh5sive data security program1     
includ+-- 7,a7 designation ( an employee
 responsible = data security2  7,b7     
tra9+ = all employees ) access to cov]$ 
data on h[ to safegu>d cov]$ data &     
protect individual privacy1 & updat+ t  
tra9+ z necess>y2 &  7,c7 due dilig5ce )
 reg>d to ! data security practices (   
s]vice provid]s to :i* ! cov]$ entity   
transf]s cov]$ data4  #aaj4 ,prohibition
 ( s]vice (f]s condition$ on waiv]s (   
privacy rights ,a cov]$ entity may n--  
7#a7 condition1 or effectively          
condition1 provision ( ! s]vice on      
agreem5t by an individual to waive      
privacy rights gu>ante$ by law or       
regulation1 includ+ ?is title2 or  7#b7 
t]m9ate ! s]vice or o!rwise refuse to   

provide ! s]vice z a direct or indirect 
consequ5ce ( ! refusal ( a us] to waive 
any privacy rights describ$ 9 ?is title4
  #aaa4 ,scope ( cov]age  7a7 ,g5]al    
exceptions ,not)/&+ any o!r provision ( 
?is title1 a cov]$ entity may collect1  
process1 or transf] cov]$ data = any ( !
 foll[+ purposes1 if ! collection1      
process+1 or transf] is reasonably      
necess>y1 proportionate1 & limit$ to su*
 purpose3 7#a7 ,to initiate or complete 
a transaction or to fulfill an ord] or  
provide a s]vice specifically reque/$ by
 an individual1 includ+ associat$ r\t9e 
adm9i/rative activities su* z bill+1    
%ipp+1 f9ancial report+1 & acc\nt+4     
7#b7 ,to p]=m int]nal sy/em ma9t5ance1  
diagno/ics1 product or s]vice managem5t1
 inv5tory managem5t1 or network         
managem5t4  7#c7 ,to prev5t1 detect1 or 
respond to a security incid5t or        
trespass+1 provide a secure environm5t1 
or ma9ta9 ! safety & security ( a       
product1 s]vice1 or individual4  7#d7   
,to protect aga9/ malici\s1 deceptive1  

fraudul5t1 or illegal activity4  7#e7   
,to comply ) a legal obligation or !    
e/abli%m5t1 ex]cise1 analysis1 or def5se
 ( legal claims or rights1 or z requir$ 
or specifically au?oriz$ by law4  7#f7  
,to comply ) a civil1 crim9al1 or       
regulatory inquiry1 inve/igation1       
subpo5a1 or summons by an ,executive    
ag5cy4  7#g7 ,to coop]ate ) an          
,executive ag5cy or a law en=cem5t      
(ficial act+ "u ! au?ority ( an         
,executive or ,/ate ag5cy conc]n+       
conduct or activity t ! ,executive ag5cy
 or law en=cem5t (ficial reasonably & 9 
good fai? believes may violate ,f$]al1  
,/ate1 or local law1 or pose a ?reat to 
public safety or national security4     
7#h7 ,to address risks to ! safety ( an 
individual or gr\p ( individuals1 or to 
ensure cu/om] safety1 includ+ by        
au!nticat+ individuals 9 ord] to provide
 access to l>ge v5ues op5 to ! public4  
7#i7 ,to effectuate a product recall    
pursuant to ,f$]al or ,/ate law4  7#aj7 
,to conduct public or pe]-review$       

sci5tific1 hi/orical1 or /ati/ical      
rese>* t-- 7,a7 is 9 ! public int]e/2   
7,b7 adh]es to all applicable e?ics &   
privacy laws2 &  7,c7 is approv$1       
monitor$1 & gov]n$ by an in/itutional   
review bo>d or o!r ov]sight entity t    
meets /&>ds promulgat$ by ! ,commission 
pursuant to section #eec ( title #e1    
,unit$ ,/ates ,code4  7#aa7 ,to transf] 
cov]$ data to a s]vice provid]4  7#ab7  
,= a purpose id5tifi$ by ! ,commission  
pursuant to a regulation promulgat$ "u  
subsection 7b74  7b7 ,additional        
purposes ,! ,commission may promulgate  
regulations "u section #eec ( title #e1 
,unit$ ,/ates ,code1 id5tify+ additional
 purposes = :i* a cov]$ entity may      
collect1 process1 or transf] cov]$ data 
& protect individual rights to data     
privacy 9 accordance ) ?is title4  #aab4
 ,small bus9ess exception ,sections     
#ajc1 #ajd1 #aje1 & #ajf d n apply 9 !  
case ( a p]son :o c e/abli% t1 = ! #c   
prec$+ cal5d> ye>s 7or = ! p]iod dur+   
:i* ! p]son has be5 9 exi/5ce if su*    

p]iod is less ?an #c ye>s7-- 7#a7 !     
av]age annual gross rev5ues ( ! p]son   
did n exce$ #ej1jjj1jjj2  7#b7 on       
av]age1 ! p]son annually process$ !     
cov]$ data ( less ?an #a1jjj1jjj        
individuals2  7#c7 ! p]son nev] employ$ 
m ?an #ejj individuals at any "o "t2 &  
7#d7 ! p]son d]iv$ less ?an #ej p]c5t ( 
! rev5ues ( ! p]son f transf]r+ cov]$   
data4  #aac4 ,application & en=cem5t    
7a7 ,g5]al ,application ,! requirem5ts (
 ?is title apply1 accord+ to _! t]ms1   
to-- 7#a7 ^? p]sons1 p>tn]%ips1 &       
corporations ov] :i* ! ,commission has  
au?ority pursuant to section #e7;a77#b7 
( ! ,f$]al ,trade ,commission ,act 7#ae 
,u4,s4,c4 #de7;a77#b772 &  7#b7 not)/&+ 
sections #d & #e7;a77#b7 ( su* ,act 7#ae
 ,u4,s4,c4 #dd2 #de7;a77#b77-- 7,a7     
common c>ri]s describ$ 9 su* section    
#e7;a77#b72 &  7,b7 organizations n     
organiz$ to c>ry on bus9ess = _! own    
pr(it or t ( _! memb]s4  7b7 ,en=cem5t  
by ! commission  7#a7 ,9 g5]al ,except z
 o!rwise provid$1 ?is title & !         

regulations prescrib$ "u ?is title %all 
be en=c$ by ! ,commission "u ! ,f$]al   
,trade ,commission ,act 7#ae ,u4,s4,c4  
#da et seq474  7#b7 ,unfair or deceptive
 acts or practices ,a violation ( ?is   
title or a regulation prescrib$ "u ?is  
title %all be treat$ z a violation ( a  
rule def9+ an unfair or deceptive act or
 practice prescrib$ "u section          
#ah7;a77#a77;,b7 ( ! ,f$]al ,trade      
,commission ,act 7#ae ,u4,s4,c4         
#eg;a7a77#a77;,b774  7#c7 ,actions by ! 
commission  7,a7 ,9 g5]al ,except z     
provid$ 9 subp>agraph 7,b7 & subsection 
7a71 ! ,commission %all prev5t any p]son
 f violat+ ?is title or a regulation    
prescrib$ "u ?is title 9 ! same mann]1  
by ! same means1 & ) ! same             
jurisdiction1 p[]s1 & duties z ?\gh all 
applicable t]ms & provisions ( ! ,f$]al 
,trade ,commission ,act 7#ae ,u4,s4,c4  
#da et seq47 7 incorporat$ into & made a
 "p ( ?is title1 & any p]son :o violates
 ?is title or a regulation prescrib$ "u 
?is title %all be subject to ! p5alties 

& entitl$ to ! privileges & immunities  
provid$ 9 ! ,f$]al ,trade ,commission   
,act4  7,b7 ,p5alties  7i7 ,9 g5]al     
,not)/&+ section #e7m7 ( ! ,f$]al ,trade
 ,commission ,act 7#ae ,u4,s4,c4        
#de7m771 a civil p5alty recov]$ = a     
violation ( ?is title or a regulation   
prescrib$ "u ?is title may be 9 excess (
 ! am\nts provid$ = 9 t section1 if su* 
p5alty meets ! requirem5ts ( ?is        
subp>agraph4  7ii7 ,p5alty = neglig5t   
violation ,9 ! case ( a p]son :o        
neglig5tly violates ?is title or a      
regulation prescrib$ "u ?is title1 su*  
p]son %all be liable = a civil p5alty t 
does n exce$ #ej = e individual affect$ 
by su* violation = e day dur+ :i* !     
p]son is 9 violation ( ?is title or su* 
regulation z describ$ 9 ?is clause4     
7iii7 ,p5alty = willful or reckless     
violation ,9 ! case ( a p]son :o        
willfully or recklessly violates ?is    
title or a regulation prescrib$ "u ?is  
title1 su* p]son %all be liable = a     
civil p5alty t-- 7,i7 is n less ?an     

#ajj1jjj2 &  7,,ii7 does n exce$ #a1jjj 
= e individual affect$ by su* violation 
= e day dur+ :i* ! p]son is 9 violation 
( ?is title or su* regulation z describ$
 9 ?is clause4  7c7 ,en=cem5t by /ate   
attorneys g5]al  7#a7 ,9 g5]al  7,a7    
,civil actions ,9 any case 9 :i* !      
attorney g5]al ( a ,/ate has reason to  
believe t an int]e/ ( ! resid5ts ( t    
,/ate has be5 or is ?reat5$ or adv]sely 
affect$ by ! engagem5t ( any p]son 9 an 
act or practice t violates ?is title or 
a regulation prescrib$ "u ?is title1 !  
,/ate1 z p>5s patriae1 may br+ a civil  
action on behalf ( ! resid5ts ( ! ,/ate 
9 a di/rict c\rt ( ! ,unit$ ,/ates or a 
,/ate c\rt ( appropriate jurisdiction   
to-- 7i7 enjo9 t act or practice2  7ii7 
en=ce compliance ) ?is title or su*     
regulation2  7iii7 obta9 damages1       
/atutory damages 9 ! same am\nt z !     
p5alties t ! ,commission may obta9 "u   
section #e7m7 ( ! ,f$]al ,trade         
,commission ,act 7#ae ,u4,s4,c4 #de7m77 
& subsection 7b77#c77;,b7 ( ?is section1

 re/itution1 or o!r comp5sation on      
behalf ( resid5ts ( ! ,/ate2 or  7iv7   
obta9 su* o!r relief z ! c\rt may       
consid] to be appropriate4  7,b7 ,notice
  7i7 ,9 g5]al ,be=e fil+ an action "u  
subp>agraph 7,a71 ! attorney g5]al ( !  
,/ate involv$ %all provide to !         
,commission-- 7,i7 writt5 notice ( t    
action2 &  7,,ii7 a copy ( ! compla9t = 
t action4  7ii7 ,exemption  7,i7 ,9     
g5]al ,clause 7i7 does n apply ) respect
 to ! fil+ ( an action by an attorney   
g5]al ( a ,/ate "u ?is p>agraph if !    
attorney g5]al ( ! ,/ate det]m9es t x is
 n feasible to provide ! notice describ$
 9 t clause be=e ! fil+ ( ! action4     
7,,ii7 ,notification ,9 an action       
describ$ 9 subclause 7,i71 ! attorney   
g5]al ( a ,/ate %all provide notice & a 
copy ( ! compla9t to ! ,commission at ! 
same "t z ! attorney g5]al files !      
action4  7#b7 ,int]v5tion  7,a7 ,9 g5]al
 ,on receiv+ notice "u p>agraph         
7#a77;,b71 ! ,commission %all h ! "r to 
int]v5e 9 ! action t is ! subject ( !   

notice4  7,b7 ,effect ( int]v5tion ,if !
 ,commission int]v5es 9 an action "u    
p>agraph 7#a71 x %all h ! "r-- 7i7 to be
 he>d ) respect to any matt] t arises 9 
t action2 &  7ii7 to file a petition =  
appeal4  7#c7 ,con/ruction ,= purposes (
 br++ any civil action "u p>agraph 7#a71
 no?+ 9 ?is title %all be con/ru$ to    
prev5t an attorney g5]al ( a ,/ate f    
ex]cis+ ! p[]s conf]r$ on ! attorney    
g5]al by ! laws ( t ,/ate to-- 7,a7     
conduct inve/igations2  7,b7 adm9i/]    
oa?s or affirmations2 or  7,c7 compel ! 
att5dance ( witnesses or ! production ( 
docum5t>y & o!r evid5ce4  7#d7 ,actions 
by ! commission ,9 any case 9 :i* an    
action is in/itut$ by or on behalf ( !  
,commission = violation ( ?is title or a
 regulation prescrib$ "u ?is title1 no  
,/ate may1 dur+ ! p5d5cy ( t action1    
in/itute an action "u p>agraph 7#a7     
aga9/ any def5dant nam$ 9 ! compla9t 9 !
 action in/itut$ by or on behalf ( !    
,commission = t violation4  7#e7 ,v5ue2 
s]vice ( process  7,a7 ,v5ue ,any action

 br\ght "u p>agraph 7#a7 may be br\ght  
9-- 7i7 a di/rict c\rt ( ! ,unit$ ,/ates
 t meets applicable requirem5ts relat+  
to v5ue "u section #acia ( title #bh1   
,unit$ ,/ates ,code2 or  7ii7 a ,/ate   
c\rt ( compet5t jurisdiction4  7,b7     
,s]vice ( process ,9 an action br\ght "u
 p>agraph 7#a7 9 a di/rict c\rt ( !     
,unit$ ,/ates1 process may be s]v$ :]ev]
 ! def5dant-- 7i7 is an inhabitant2 or  
7ii7 may be f\nd4  #aad4 ,/ate privacy  
protections ,no?+ 9 ?is title %all      
preempt any ,/ate law1 regulation1 or   
o!r requirem5t hav+ ! =ce or effect (   
law t is m protective ( ! privacy (     
individuals ?an ! requirem5ts ( ?is     
title4  #aae4 ,sev]ability ,if any      
provision ( ?is title or ! application (
 a provision ( ?is title to any p]son or
 circum/ance is held to be invalid or   
uncon/itutional1 ! rema9d] ( ?is title1 
or ! application ( su* provision to any 
o!r p]son or circum/ance1 %all n be     
affect$4  #aaf4 ,def9itions ,9 ?is      
title3 7#a7 ,affirmative express cons5t 

7,a7 ,9 g5]al ,! t]m affirmative express
 cons5t means an affirmative act by an  
individual t cle>ly communicates !      
individual's au?orization = an act or   
practice1 9 response to a specific      
reque/ t meets ! requirem5ts (          
subp>agraph 7,b74  7,b7 ,reque/         
requirem5ts ,! requirem5ts ( ?is        
subp>agraph ) respect to a reque/ f a   
cov]$ entity to an individual are !     
foll[+3 7i7 ,! reque/ is provid$ to !   
individual 9 a /&alone disclosure4  7ii7
 ,! reque/ includes a description ( ea* 
act or practice = :i* ! individual's    
cons5t is s\ght &-- 7,i7 cle>ly         
di/+ui%es betwe5 an act or practice :i* 
is necess>y to fulfill a reque/ ( !     
individual & an act or practice :i* is =
 ano!r purpose2 &  7,,ii7 is writt5 9   
easy-to-und]/& language & includes a    
prom95t head+ t w\ld enable a reasonable
 individual to id5tify & und]/& ! act or
 practice4  7iii7 ,! reque/ cle>ly      
expla9s ! individual's applicable rights
 relat$ to cons5t4  7,c7 ,express cons5t

 requir$ ,a cov]$ entity may n inf] t an
 individual has provid$ affirmative     
express cons5t to an act or practice f !
 inaction ( ! individual or !           
individual's cont9u$ use ( a s]vice or  
product provid$ by ! cov]$ entity4  7,d7
 ,prior cons5t requir$ ,9 ! case ( any  
requirem5t ( ?is title = a cov]$ entity 
to obta9 affirmative express cons5t = an
 act or practice1 ! cov]$ entity %all   
obta9 su* cons5t be=e engag+ 9 ! act or 
practice4  7#b7 ,collect2 collection ,! 
t]ms collect & collection mean1 )       
respect to ! cov]$ data ( an individual1
 buy+1 r5t+1 ga!r+1 obta9+1 receiv+1    
access+1 or o!rwise acquir+ su* data by 
any means1 includ+ by passively or      
actively obs]v+ ! individual's behavior4
  7#c7 ,commission ,! t]m ,commission   
means ! ,f$]al ,trade ,commission4  7#d7
 ,connect$ device ,! t]m connect$ device
 means a physical object t-- 7,a7 is    
capable ( connect+ to ! int]net1 ei!r   
directly or indirectly ?r\gh a network1 
to communicate in=mation at ! direction 

( an individual2 &  7,b7 has comput]    
process+ capabilities = collect+1 s5d+1 
receiv+1 or analyz+ data4  7#e7 ,control
 ,! t]m control means1 ) respect to an  
entity-- 7,a7 own]%ip (1 or ! p[] to    
vote1 m ?an #ej p]c5t ( ! out/&+ %>es ( 
any class ( vot+ security ( ! entity2   
7,b7 control 9 any mann] ov] ! election 
( a majority ( ! directors ( ! entity   
7or ( individuals ex]cis+ simil>        
functions72 or  7,c7 ! p[] to ex]cise a 
controll+ influ5ce ov] ! managem5t ( !  
entity4  7#f7 ,cov]$ data  7,a7 ,9 g5]al
 ,! t]m cov]$ data means in=mation t    
id5tifies or is l9k$ or reasonably      
l9kable to an individual or a connect$  
device t is l9k$ or reasonably l9kable  
to an individual4  7,b7 ,l9k$ or        
reasonably l9kable ,= purposes (        
subp>agraph 7,a71 in=mation held by a   
cov]$ entity is l9k$ or reasonably      
l9kable to an individual or a connect$  
device if1 z a practical matt]1 x c be  
us$ on its own or 9 comb9ation ) o!r    
in=mation held by1 or readily accessible

 to1 ! cov]$ entity to id5tify su*      
individual or su* device4  7,c7         
,exclusions ,su* t]m does n include--   
7i7 aggregat$ data2  7ii7 de-id5tifi$   
data2  7iii7 data ( an individual       
process$ by ! cov]$ entity 9 ! capacity 
( ! cov]$ entity z ! employ] ( !        
individual2 or  7iv7 publicly available 
in=mation4  7#g7 ,cov]$ entity ,! t]m   
cov]$ entity means any p]son :o-- 7,a7  
collects1 processes1 or transf]s cov]$  
data2 &  7,b7 det]m9es ! purposes &     
means ( su* collection1 process+1 or    
transf]4  7#h7 ,cov]$ int]net plat=m    
7,a7 ,9 g5]al ,! t]m cov]$ int]net      
plat=m means any public-fac+ website1   
int]net application1 or mobile          
application1 includ+ a social network   
site1 video %>+ s]vice1 se>* eng9e1 or  
cont5t aggregation s]vice4  7,b7        
,exclusion ,su* t]m does n include a    
plat=m t is op]at$ = ! sole purpose (   
conduct+ rese>* t is n conduct$ = pr(it1
 ei!r directly or indirectly4  7#i7     
,delete ,! t]m delete means to remove or

 de/roy in=mation su* t x is n ma9ta9$ 9
 human or ma*9e-readable =m & _c be     
retriev$ or utiliz$ 9 su* =m 9 ! normal 
c\rse ( bus9ess4  7#aj7 ,executive ag5cy
 ,! t]m ,executive ag5cy has ! mean+    
giv5 su* t]m 9 section #aje ( title #e1 
,unit$ ,/ates ,code4  7#aa7 ,individual 
,! t]m individual means a natural p]son 
resid+ 9 ! ,unit$ ,/ates1 h[ev]         
id5tifi$1 includ+ by any unique         
id5tifi]4  7#ab7 ,mat]ial ,! t]m mat]ial
 means1 ) respect to an act1 practice1  
or repres5tation ( a cov]$ entity       
7includ+ a repres5tation made by ! cov]$
 entity 9 a privacy policy or simil>    
disclosure to individuals71 t su* act1  
practice1 or repres5tation is likely to 
affect an individual's decision or      
conduct reg>d+ a product or s]vice4     
7#ac7 ,process ,! t]m process means to  
p]=m any op]ation or set ( op]ations on 
cov]$ data1 includ+ collection1         
analysis1 organization1 /ructur+1       
reta9+1 us+1 transf]r+1 or o!rwise h&l+ 
cov]$ data4  7#ad7 ,process+ purpose ,! 

t]m process+ purpose means an adequately
 specific & granul> reason = :i* a cov]$
 entity processes cov]$ data t cle>ly   
describes ! process+ activity4  7#ae7   
,program ,! t]m program means1 ) respect
 to a cov]$ int]net plat=m1 any program 
t appe>s on ! plat=m1 includ+ a program 
t deliv]s adv]tisem5ts to us]s ( !      
plat=m & a program us$ to log into !    
plat=m4  7#af7 ,publicly available      
in=mation ,! t]m publicly available     
in=mation means in=mation t is available
 to ! g5]al public1 includ+-- 7,a7 any  
in=mation to :i* ! s\rce all[s access by
 anyone ^u reque/2 &  7,b7 any in=mation
 t a cov]$ entity has a reasonable basis
 to believe is lawfully made available  
to ! g5]al public f ,f$]al1 ,/ate1 or   
local gov]nm5t records1 widely di/ribut$
 m$ia1 or disclosures to ! g5]al public 
t are requir$ to be made by ,f$]al1     
,/ate1 or local law4  7#ag7 ,rese>* ,!  
t]m rese>* means ! sci5tific analysis ( 
in=mation1 includ+ cov]$ data1 by a     
cov]$ entity or ^? ) :om ! cov]$ entity 

is coop]at+ or o!rs act+ at ! direction 
or on behalf ( ! cov]$ entity1 t is     
conduct$ = ! prim>y purpose ( advanc+   
sci5tific k & may be = ! comm]cial      
b5efit ( ! cov]$ entity4  7#ah7         
,second-p>ty op]ator ,! t]m second-p>ty 
op]ator means ! op]ator ( a cov]$       
int]net plat=m ) :i* a us] int5ds to    
connect1 b does n include ! op]ator ( a 
program t appe>s on ! plat=m 7if !      
op]ator ( ! program is diff]5t f !      
op]ator ( ! plat=m74  7#ai7 ,s]vice     
provid] ,! t]m s]vice provid] means1 )  
respect to a set ( cov]$ data1 a cov]$  
entity t collects1 processes1 or        
transf]s su* cov]$ data = ! purpose (   
p]=m+ "o or m s]vices or functions on   
behalf (1 & at ! direction (1 ano!r     
cov]$ entity t-- 7,a7 is n relat$ to !  
cov]$ entity provid+ ! s]vice or        
function by common own]%ip or corporate 
control2 &  7,b7 does n %>e common br&+ 
) ! cov]$ entity provid+ ! s]vice or    
function4  7#bj7 ,/ate ,! t]m ,/ate     
means ea* ,/ate ( ! ,unit$ ,/ates1 !    

,di/rict ( ,columbia1 ea* commonweal?1  
t]ritory1 or possession ( ! ,unit$      
,/ates1 & ea* f$]ally recogniz$ ,indian 
,tribe4  7#ba7 ,?ird p>ty ,! t]m ?ird   
p>ty means ) respect to a set ( cov]$   
data1 a cov]$ entity-- 7,a7 t is n a    
s]vice provid] ) respect to su* cov]$   
data2 &  7,b7 t receiv$ su* cov]$ data f
 ano!r cov]$ entity-- 7i7 t is n relat$ 
to ! cov]$ entity by common own]%ip or  
corporate control2 &  7ii7 t does n %>e 
common br&+ ) ! cov]$ entity4  7#bb7    
,?ird-p>ty op]ator ,! t]m ?ird-p>ty     
op]ator means ! op]ator ( a program t   
appe>s on a cov]$ int]net plat=m 7if !  
op]ator ( ! program is diff]5t f !      
op]ator ( ! plat=m74  7#bc7 ,transf] ,! 
t]m transf] means1 ) respect to cov]$   
data1 to disclose1 release1 %>e1        
dissem9ate1 make available1 or lic5se   
su* data1 9 writ+1 electronically1 or by
 any o!r means1 = consid]ation ( any k9d
 or = a comm]cial purpose4  #aag4       
,effective date ,?is title %all take    
effect on ! date t is #f mon?s aft] !   

date ( ! enactm5t ( ?is ,act4  ,,ii ,d  
,n ,track  #bja4 ,%ort title ,?is title 
may be cit$ z ! ,d ,n ,track ,act4      
#bjb4 ,e/abli%m5t ( ,d ,n ,track sy/em  
7a7 ,9 g5]al ,n lat] ?an #f mon?s aft] !
 date ( ! enactm5t ( ?is ,act1 !        
,commission %all implem5t & en=ce a ,d  
,n ,track 7,,dnt7 sy/em1 includ+ !      
program describ$ 9 subsection 7b71 to   
protect consum]s f unwant$ onl9e data   
h>ve/+ & t>get$ adv]tis+4  7b7 ,d ,n    
,track program ,z "p ( ! ,d ,n ,track   
sy/em requir$ "u ?is section1 !         
,commission %all designate ! ,,dnt      
signal & make available on ! public     
website ( ! ,commission a simple program
 t-- 7#a7 c be d[nload$ to any common   
connect$ device2  7#b7 s5ds ! ,,dnt     
signal to e cov]$ int]net plat=m 7except
 = a cov]$ int]net plat=m designat$ "u  
p>agraph 7#c77 to :i* ! device connects 
ea* "t ! device connects to ! plat=m2 & 
7#c7 p]mits ! us] ( ! device to         
designate cov]$ int]net plat=ms to :i* !
 ,,dnt signal %\ld n be s5t1 b does n   

exempt any cov]$ int]net plat=m f       
receiv+ ! signal if ! plat=m is n s     
designat$4  7c7 ,o!r d n track sy/ems   
,no?+ 9 ?is title may be con/ru$ to     
prohibit ! op]ator ( any web br[s] or   
simil> int]face or a connect$ device    
design] or manufactur] f (f]+ a program 
t s5ds ! ,,dnt signal to cov]$ int]net  
plat=ms1 if ! program p]mits us]s to    
designate cov]$ int]net plat=ms to :i* !
 ,,dnt signal %\ld n be s5t4  7d7       
,rulemak+ au?ority ,! ,commission may   
promulgate regulations1 9 accordance )  
section #eec ( title #e1 ,unit$ ,/ates  
,code1 to c>ry out ?is section4  #bjc4  
,d ,n ,track3 requirem5ts = op]ators2   
prohibit$ acts  7a7 ,requirem5ts  7#a7  
,se>* = dnt signal ,:5 a connect$ device
 connects to a cov]$ int]net plat=m--   
7,a7 ! second-p>ty op]ator ( ! plat=m   
%all ensure t ! plat=m se>*es = ! ,,dnt 
signal2 &  7,b7 ! ?ird-p>ty op]ator (   
any program t appe>s on ! plat=m %all   
ensure t ! program se>*es = ! ,,dnt     
signal4  7#b7 ,m&atory notification     

7,a7 ,9 g5]al ,subject to subp>agraph   
7,b71 if a second-p>ty op]ator ( a cov]$
 int]net plat=m collects m data f a us] 
( ! plat=m ?an is necess>y to op]ate !  
plat=m1 or if a ?ird-p>ty op]ator ( a   
program t appe>s on ! plat=m collects m 
data f a us] ( ! plat=m ?an is necess>y 
to op]ate ! plat=m1 ! second-p>ty       
op]ator or ?ird-p>ty op]ator1           
respectively1 %all1 ?r\gh a pop-up      
notification1 provide any us] ^:        
connect$ device is n s5d+ ! ,,dnt signal
 )-- 7i7 notice ( ! policy ( ! plat=m or
 program ( collect+ data beyond :at is  
necess>y to op]ate ! plat=m2  7ii7      
notice ( ! protections f data collection
 & t>get$ adv]tis+ available to us]s "u 
?is title2  7iii7 notice t ! us] may1   
?r\gh ! public website ( ! ,commission1 
d[nload ! ,d ,n ,track program describ$ 
9 section #bjb7;b71 includ+ a l9k to su*
 website2 &  7iv7 notice t ! us] may be 
able to activate ! ,,dnt signal ?r\gh ! 
us]'s device or br[s]4  7,b7 ,numb] &   
tim+ ,a second-p>ty op]ator or ?ird-p>ty

 op]ator1 respectively1 %all provide !  
notification requir$ by subp>agraph     
7,a7-- 7i7 ! fir/ "t a connect$ device  
connects to ! cov]$ int]net plat=m2 &   
7ii7 unless ! us] ( ! connect$ device   
opts out ( receiv+ ! notification       
requir$ by subp>agraph 7,a71 at lea/ e  
#cj? "t ! connect$ device connects to ! 
cov]$ int]net plat=m4  7,c7 ,collection 
( data = t>get$ adv]tis+ ,= purposes (  
?is p>agraph1 ! second-p>ty op]ator ( a 
cov]$ int]net plat=m1 or ! ?ird-p>ty    
op]ator ( a program t appe>s on !       
plat=m1 t collects data = ! purpose (   
design+ or display+ adv]tisem5ts =      
t>get$ adv]tis+ %all be consid]$ to be  
collect+ m data ?an is necess>y to      
op]ate ! plat=m4  7b7 ,prohibition on   
data collection & t>get$ adv]tis+  7#a7 
,second-p>ty op]ators ,subject to       
p>agraph 7#c71 x %all be unlawful = a   
second-p>ty op]ator ( a cov]$ int]net   
plat=m t receives ! ,,dnt signal f !    
connect$ device ( a us] to-- 7,a7       
collect any data 7o!r ?an su* data z is 

necess>y to op]ate ! plat=m7 f ! us]2   
7,b7 use any data collect$ f ! us] = a  
second>y purpose1 includ+ = ! purpose ( 
t>get$ adv]tis+2 or  7,c7 transf] any   
data collect$ f ! us] to a ?ird p>ty1   
unless ! us] provides affirmative       
express cons5t to ! transf] ( data 9 a  
mann] t demon/rates ! us]'s int5t = !   
second-p>ty op]ator to be an int]m$i>y  
betwe5 ! us] & ! ?ird p>ty4  7#b7       
,?ird-p>ty op]ators  7,a7 ,9 g5]al ,x   
%all be unlawful = a ?ird-p>ty op]ator (
 a program t receives ! ,,dnt signal f !
 connect$ device ( a us] ( a cov]$      
int]net plat=m on :i* ! program appe>s  
to collect any data f ! us]1 o!r ?an1   
subject to subp>agraph 7,b71 data       
collect$ = ! purpose ( analyz+ h[ or    
:e!r ! us] engag$ ) ! program4  7,b7    
,limitations on collection ( data =     
engagem5t analytics ,data collect$ = !  
purpose ( analyz+ h[ or :e!r ! us]      
engag$ ) ! program1 z describ$ 9        
subp>agraph 7,a7-- 7i7 may only be      
collect$ 9 a de-id5tifi$ mann]2 &  7ii7 

may n be us$ to create or contribute to 
a pr(ile ( ! us]4  7#c7 ,exception =    
complem5t>y s]vices ,not)/&+ p>agraph   
7#a71 a second-p>ty op]ator ( a cov]$   
int]net plat=m may collect additional   
data f a us] beyond :at is necess>y = ! 
op]ation ( ! plat=m if ! additional data
 is necess>y = ! op]ation ( a diff]5t   
cov]$ int]net plat=m t is-- 7,a7 bo?    
own$ & op]at$ by ! second-p>ty op]ator2 
7,b7 design$ to complem5t ! cov]$       
int]net plat=m access$ by ! us]2 &  7,c7
 br&$ z a complem5t>y cov]$ int]net     
plat=m to ! cov]$ int]net plat=m access$
 by ! us]4  7c7 ,int]f]+ ) ,,dnt signal 
,x %all be unlawful = any p]son to--    
7#a7 block or imp$e ! ability ( a cov]$ 
int]net plat=m1 or a program t appe>s on
 a cov]$ int]net plat=m1 to receive !   
,,dnt signal2 or  7#b7 block or imp$e ! 
ability ( a connect$ device to s5d !    
,,dnt signal4  7d7 ,discrim9ation bas$  
on ,,dnt pref]5ces ,x %all be unlawful =
 a second-p>ty op]ator ( a cov]$ int]net
 plat=m to-- 7#a7 d5y a us] access to1  

or s]vice f1 ! plat=m on ! basis (      
receiv+ ! ,,dnt signal f ! us]2 or  7#b7
 provide a us] f :om ! plat=m receives !
 ,,dnt signal ) a diff]5t level ( access
 or s]vice ?an ! level ( access or      
s]vice provid$ to a us] f :om ! plat=m  
does n receive ! ,,dnt signal4  #bjd4   
,scope ( cov]age  7a7 ,g5]al exceptions 
,not)/&+ any o!r provision ( ?is title1 
a cov]$ entity may collect1 process1 or 
transf] cov]$ data = any ( ! foll[+     
purposes1 if ! collection1 process+1 or 
transf] is reasonably necess>y1         
proportionate1 & limit$ to su* purpose3 
7#a7 ,to initiate or complete a         
transaction or to fulfill an ord] or    
provide a s]vice specifically reque/$ by
 an individual1 includ+ associat$ r\t9e 
adm9i/rative activities su* z bill+1    
%ipp+1 f9ancial report+1 & acc\nt+4     
7#b7 ,to p]=m int]nal sy/em ma9t5ance1  
diagno/ics1 product or s]vice managem5t1
 inv5tory managem5t1 or network         
managem5t4  7#c7 ,to prev5t1 detect1 or 
respond to a security incid5t or        

trespass+1 provide a secure environm5t1 
or ma9ta9 ! safety & security ( a       
product1 s]vice1 or individual4  7#d7   
,to protect aga9/ malici\s1 deceptive1  
fraudul5t1 or illegal activity4  7#e7   
,to comply ) a legal obligation or !    
e/abli%m5t1 ex]cise1 analysis1 or def5se
 ( legal claims or rights1 or z requir$ 
or specifically au?oriz$ by law4  7#f7  
,to comply ) a civil1 crim9al1 or       
regulatory inquiry1 inve/igation1       
subpo5a1 or summons by an ,executive    
ag5cy4  7#g7 ,to coop]ate ) an          
,executive ag5cy or a law en=cem5t      
(ficial act+ "u ! au?ority ( an         
,executive or ,/ate ag5cy conc]n+       
conduct or activity t ! ,executive ag5cy
 or law en=cem5t (ficial reasonably & 9 
good fai? believes may violate ,f$]al1  
,/ate1 or local law1 or pose a ?reat to 
public safety or national security4     
7#h7 ,to address risks to ! safety ( an 
individual or gr\p ( individuals1 or to 
ensure cu/om] safety1 includ+ by        
au!nticat+ individuals 9 ord] to provide

 access to l>ge v5ues op5 to ! public4  
7#i7 ,to effectuate a product recall    
pursuant to ,f$]al or ,/ate law4  7#aj7 
,to conduct public or pe]-review$       
sci5tific1 hi/orical1 or /ati/ical      
rese>* t-- 7,a7 is 9 ! public int]e/2   
7,b7 adh]es to all applicable e?ics &   
privacy laws2 &  7,c7 is approv$1       
monitor$1 & gov]n$ by an in/itutional   
review bo>d or o!r ov]sight entity t    
meets /&>ds promulgat$ by ! ,commission 
pursuant to section #eec ( title #e1    
,unit$ ,/ates ,code4  7#aa7 ,to transf] 
cov]$ data to a s]vice provid]4  7#ab7  
,= a purpose id5tifi$ by ! ,commission  
pursuant to a regulation promulgat$ "u  
subsection 7b74  7b7 ,additional        
purposes ,! ,commission may promulgate  
regulations "u section #eec ( title #e1 
,unit$ ,/ates ,code1 id5tify+ additional
 purposes = :i* a cov]$ entity may      
collect1 process1 or transf] cov]$ data 
& protect individual rights to data     
privacy 9 accordance ) ?is title4  #bje4
 ,application & en=cem5t  7a7 ,g5]al    

,application ,! requirem5ts ( ?is title 
apply1 accord+ to _! t]ms1 to-- 7#a7 ^? 
p]sons1 p>tn]%ips1 & corporations ov]   
:i* ! ,commission has au?ority pursuant 
to section #e7;a77#b7 ( ! ,f$]al ,trade 
,commission ,act 7#ae ,u4,s4,c4         
#de7;a77#b772 &  7#b7 not)/&+ sections  
#d & #e7;a77#b7 ( su* ,act 7#ae         
,u4,s4,c4 #dd2 #de7;a77#b77-- 7,a7      
common c>ri]s describ$ 9 su* section    
#e7;a77#b72 &  7,b7 organizations n     
organiz$ to c>ry on bus9ess = _! own    
pr(it or t ( _! memb]s4  7b7 ,en=cem5t  
by ! commission  7#a7 ,9 g5]al ,except z
 o!rwise provid$1 ?is title & !         
regulations prescrib$ "u ?is title %all 
be en=c$ by ! ,commission "u ! ,f$]al   
,trade ,commission ,act 7#ae ,u4,s4,c4  
#da et seq474  7#b7 ,unfair or deceptive
 acts or practices ,a violation ( ?is   
title or a regulation prescrib$ "u ?is  
title %all be treat$ z a violation ( a  
rule def9+ an unfair or deceptive act or
 practice prescrib$ "u section          
#ah7;a77#a77;,b7 ( ! ,f$]al ,trade      

,commission ,act 7#ae ,u4,s4,c4         
#eg;a7a77#a77;,b774  7#c7 ,actions by ! 
commission  7,a7 ,9 g5]al ,except z     
provid$ 9 subp>agraph 7,b7 & subsection 
7a71 ! ,commission %all prev5t any p]son
 f violat+ ?is title or a regulation    
prescrib$ "u ?is title 9 ! same mann]1  
by ! same means1 & ) ! same             
jurisdiction1 p[]s1 & duties z ?\gh all 
applicable t]ms & provisions ( ! ,f$]al 
,trade ,commission ,act 7#ae ,u4,s4,c4  
#da et seq47 7 incorporat$ into & made a
 "p ( ?is title1 & any p]son :o violates
 ?is title or a regulation prescrib$ "u 
?is title %all be subject to ! p5alties 
& entitl$ to ! privileges & immunities  
provid$ 9 ! ,f$]al ,trade ,commission   
,act4  7,b7 ,p5alties  7i7 ,9 g5]al     
,not)/&+ section #e7m7 ( ! ,f$]al ,trade
 ,commission ,act 7#ae ,u4,s4,c4        
#de7m771 a civil p5alty recov]$ = a     
violation ( ?is title or a regulation   
prescrib$ "u ?is title may be 9 excess (
 ! am\nts provid$ = 9 t section1 if su* 
p5alty meets ! requirem5ts ( ?is        

subp>agraph4  7ii7 ,p5alty = neglig5t   
violation ,9 ! case ( a p]son :o        
neglig5tly violates ?is title or a      
regulation prescrib$ "u ?is title1 su*  
p]son %all be liable = a civil p5alty t 
does n exce$ #ej = e individual affect$ 
by su* violation = e day dur+ :i* !     
p]son is 9 violation ( ?is title or su* 
regulation z describ$ 9 ?is clause4     
7iii7 ,p5alty = willful or reckless     
violation ,9 ! case ( a p]son :o        
willfully or recklessly violates ?is    
title or a regulation prescrib$ "u ?is  
title1 su* p]son %all be liable = a     
civil p5alty t-- 7,i7 is n less ?an     
#ajj1jjj2 &  7,,ii7 does n exce$ #a1jjj 
= e individual affect$ by su* violation 
= e day dur+ :i* ! p]son is 9 violation 
( ?is title or su* regulation z describ$
 9 ?is clause4  7c7 ,en=cem5t by /ate   
attorneys g5]al  7#a7 ,9 g5]al  7,a7    
,civil actions ,9 any case 9 :i* !      
attorney g5]al ( a ,/ate has reason to  
believe t an int]e/ ( ! resid5ts ( t    
,/ate has be5 or is ?reat5$ or adv]sely 

affect$ by ! engagem5t ( any p]son 9 an 
act or practice t violates ?is title or 
a regulation prescrib$ "u ?is title1 !  
,/ate1 z p>5s patriae1 may br+ a civil  
action on behalf ( ! resid5ts ( ! ,/ate 
9 a di/rict c\rt ( ! ,unit$ ,/ates or a 
,/ate c\rt ( appropriate jurisdiction   
to-- 7i7 enjo9 t act or practice2  7ii7 
en=ce compliance ) ?is title or su*     
regulation2  7iii7 obta9 damages1       
/atutory damages 9 ! same am\nt z !     
p5alties t ! ,commission may obta9 "u   
section #e7m7 ( ! ,f$]al ,trade         
,commission ,act 7#ae ,u4,s4,c4 #de7m77 
& subsection 7b77#c77;,b7 ( ?is section1
 re/itution1 or o!r comp5sation on      
behalf ( resid5ts ( ! ,/ate2 or  7iv7   
obta9 su* o!r relief z ! c\rt may       
consid] to be appropriate4  7,b7 ,notice
  7i7 ,9 g5]al ,be=e fil+ an action "u  
subp>agraph 7,a71 ! attorney g5]al ( !  
,/ate involv$ %all provide to !         
,commission-- 7,i7 writt5 notice ( t    
action2 &  7,,ii7 a copy ( ! compla9t = 
t action4  7ii7 ,exemption  7,i7 ,9     

g5]al ,clause 7i7 does n apply ) respect
 to ! fil+ ( an action by an attorney   
g5]al ( a ,/ate "u ?is p>agraph if !    
attorney g5]al ( ! ,/ate det]m9es t x is
 n feasible to provide ! notice describ$
 9 t clause be=e ! fil+ ( ! action4     
7,,ii7 ,notification ,9 an action       
describ$ 9 subclause 7,i71 ! attorney   
g5]al ( a ,/ate %all provide notice & a 
copy ( ! compla9t to ! ,commission at ! 
same "t z ! attorney g5]al files !      
action4  7#b7 ,int]v5tion  7,a7 ,9 g5]al
 ,on receiv+ notice "u p>agraph         
7#a77;,b71 ! ,commission %all h ! "r to 
int]v5e 9 ! action t is ! subject ( !   
notice4  7,b7 ,effect ( int]v5tion ,if !
 ,commission int]v5es 9 an action "u    
p>agraph 7#a71 x %all h ! "r-- 7i7 to be
 he>d ) respect to any matt] t arises 9 
t action2 &  7ii7 to file a petition =  
appeal4  7#c7 ,con/ruction ,= purposes (
 br++ any civil action "u p>agraph 7#a71
 no?+ 9 ?is title %all be con/ru$ to    
prev5t an attorney g5]al ( a ,/ate f    
ex]cis+ ! p[]s conf]r$ on ! attorney    

g5]al by ! laws ( t ,/ate to-- 7,a7     
conduct inve/igations2  7,b7 adm9i/]    
oa?s or affirmations2 or  7,c7 compel ! 
att5dance ( witnesses or ! production ( 
docum5t>y & o!r evid5ce4  7#d7 ,actions 
by ! commission ,9 any case 9 :i* an    
action is in/itut$ by or on behalf ( !  
,commission = violation ( ?is title or a
 regulation prescrib$ "u ?is title1 no  
,/ate may1 dur+ ! p5d5cy ( t action1    
in/itute an action "u p>agraph 7#a7     
aga9/ any def5dant nam$ 9 ! compla9t 9 !
 action in/itut$ by or on behalf ( !    
,commission = t violation4  7#e7 ,v5ue2 
s]vice ( process  7,a7 ,v5ue ,any action
 br\ght "u p>agraph 7#a7 may be br\ght  
9-- 7i7 a di/rict c\rt ( ! ,unit$ ,/ates
 t meets applicable requirem5ts relat+  
to v5ue "u section #acia ( title #bh1   
,unit$ ,/ates ,code2 or  7ii7 a ,/ate   
c\rt ( compet5t jurisdiction4  7,b7     
,s]vice ( process ,9 an action br\ght "u
 p>agraph 7#a7 9 a di/rict c\rt ( !     
,unit$ ,/ates1 process may be s]v$ :]ev]
 ! def5dant-- 7i7 is an inhabitant2 or  

7ii7 may be f\nd4  #bjf4 ,/ate privacy  
protections ,no?+ 9 ?is title %all      
preempt any ,/ate law1 regulation1 or   
o!r requirem5t hav+ ! =ce or effect (   
law t is m protective ( ! privacy (     
individuals ?an ! requirem5ts ( ?is     
title4  #bjg4 ,sev]ability ,if any      
provision ( ?is title or ! application (
 a provision ( ?is title to any p]son or
 circum/ance is held to be invalid or   
uncon/itutional1 ! rema9d] ( ?is title1 
or ! application ( su* provision to any 
o!r p]son or circum/ance1 %all n be     
affect$4  #bjh4 ,def9itions ,9 ?is      
title3 7#a7 ,affirmative express cons5t 
7,a7 ,9 g5]al ,! t]m affirmative express
 cons5t means an affirmative act by an  
individual t cle>ly communicates !      
individual's au?orization = an act or   
practice1 9 response to a specific      
reque/ t meets ! requirem5ts (          
subp>agraph 7,b74  7,b7 ,reque/         
requirem5ts ,! requirem5ts ( ?is        
subp>agraph ) respect to a reque/ f a   
cov]$ entity to an individual are !     

foll[+3 7i7 ,! reque/ is provid$ to !   
individual 9 a /&alone disclosure4  7ii7
 ,! reque/ includes a description ( ea* 
act or practice = :i* ! individual's    
cons5t is s\ght &-- 7,i7 cle>ly         
di/+ui%es betwe5 an act or practice :i* 
is necess>y to fulfill a reque/ ( !     
individual & an act or practice :i* is =
 ano!r purpose2 &  7,,ii7 is writt5 9   
easy-to-und]/& language & includes a    
prom95t head+ t w\ld enable a reasonable
 individual to id5tify & und]/& ! act or
 practice4  7iii7 ,! reque/ cle>ly      
expla9s ! individual's applicable rights
 relat$ to cons5t4  7,c7 ,express cons5t
 requir$ ,a cov]$ entity may n inf] t an
 individual has provid$ affirmative     
express cons5t to an act or practice f !
 inaction ( ! individual or !           
individual's cont9u$ use ( a s]vice or  
product provid$ by ! cov]$ entity4  7,d7
 ,prior cons5t requir$ ,9 ! case ( any  
requirem5t ( ?is title = a cov]$ entity 
to obta9 affirmative express cons5t = an
 act or practice1 ! cov]$ entity %all   

obta9 su* cons5t be=e engag+ 9 ! act or 
practice4  7#b7 ,collect2 collection ,! 
t]ms collect & collection mean1 )       
respect to ! cov]$ data ( an individual1
 buy+1 r5t+1 ga!r+1 obta9+1 receiv+1    
access+1 or o!rwise acquir+ su* data by 
any means1 includ+ by passively or      
actively obs]v+ ! individual's behavior4
  7#c7 ,commission ,! t]m ,commission   
means ! ,f$]al ,trade ,commission4  7#d7
 ,connect$ device ,! t]m connect$ device
 means a physical object t-- 7,a7 is    
capable ( connect+ to ! int]net1 ei!r   
directly or indirectly ?r\gh a network1 
to communicate in=mation at ! direction 
( an individual2 &  7,b7 has comput]    
process+ capabilities = collect+1 s5d+1 
receiv+1 or analyz+ data4  7#e7 ,control
 ,! t]m control means1 ) respect to an  
entity-- 7,a7 own]%ip (1 or ! p[] to    
vote1 m ?an #ej p]c5t ( ! out/&+ %>es ( 
any class ( vot+ security ( ! entity2   
7,b7 control 9 any mann] ov] ! election 
( a majority ( ! directors ( ! entity   
7or ( individuals ex]cis+ simil>        

functions72 or  7,c7 ! p[] to ex]cise a 
controll+ influ5ce ov] ! managem5t ( !  
entity4  7#f7 ,cov]$ data  7,a7 ,9 g5]al
 ,! t]m cov]$ data means in=mation t    
id5tifies or is l9k$ or reasonably      
l9kable to an individual or a connect$  
device t is l9k$ or reasonably l9kable  
to an individual4  7,b7 ,l9k$ or        
reasonably l9kable ,= purposes (        
subp>agraph 7,a71 in=mation held by a   
cov]$ entity is l9k$ or reasonably      
l9kable to an individual or a connect$  
device if1 z a practical matt]1 x c be  
us$ on its own or 9 comb9ation ) o!r    
in=mation held by1 or readily accessible
 to1 ! cov]$ entity to id5tify su*      
individual or su* device4  7,c7         
,exclusions ,su* t]m does n include--   
7i7 aggregat$ data2  7ii7 de-id5tifi$   
data2  7iii7 data ( an individual       
process$ by ! cov]$ entity 9 ! capacity 
( ! cov]$ entity z ! employ] ( !        
individual2 or  7iv7 publicly available 
in=mation4  7#g7 ,cov]$ entity ,! t]m   
cov]$ entity means any p]son :o-- 7,a7  

collects1 processes1 or transf]s cov]$  
data2 &  7,b7 det]m9es ! purposes &     
means ( su* collection1 process+1 or    
transf]4  7#h7 ,cov]$ int]net plat=m    
7,a7 ,9 g5]al ,! t]m cov]$ int]net      
plat=m means any public-fac+ website1   
int]net application1 or mobile          
application1 includ+ a social network   
site1 video %>+ s]vice1 se>* eng9e1 or  
cont5t aggregation s]vice4  7,b7        
,exclusion ,su* t]m does n include a    
plat=m t is op]at$ = ! sole purpose (   
conduct+ rese>* t is n conduct$ = pr(it1
 ei!r directly or indirectly4  7#i7     
,,dnt signal ,! t]m ,,dnt signal means a
 signal s5t by a connect$ device1 su* z 
! hyp]text transf] protocol develop$ by 
! ,_w ,wide ,web ,consortium ,work+     
,gr\p on ,track+ ,pref]5ce ,expression1 
t is designat$ by ! ,commission =       
purposes ( ! ,d ,n ,track program       
requir$ "u section #bjb7;b74  7#aj7     
,executive ag5cy ,! t]m ,executive ag5cy
 has ! mean+ giv5 su* t]m 9 section #aje
 ( title #e1 ,unit$ ,/ates ,code4  7#aa7

 ,individual ,! t]m individual means a  
natural p]son resid+ 9 ! ,unit$ ,/ates1 
h[ev] id5tifi$1 includ+ by any unique   
id5tifi]4  7#ab7 ,process ,! t]m process
 means to p]=m any op]ation or set (    
op]ations on cov]$ data1 includ+        
collection1 analysis1 organization1     
/ructur+1 reta9+1 us+1 transf]r+1 or    
o!rwise h&l+ cov]$ data4  7#ac7 ,program
 ,! t]m program means1 ) respect to a   
cov]$ int]net plat=m1 any program t     
appe>s on ! plat=m1 includ+ a program t 
deliv]s adv]tisem5ts to us]s ( ! plat=m 
& a program us$ to log into ! plat=m4   
7#ad7 ,publicly available in=mation ,!  
t]m publicly available in=mation means  
in=mation t is available to ! g5]al     
public1 includ+-- 7,a7 any in=mation to 
:i* ! s\rce all[s access by anyone ^u   
reque/2 &  7,b7 any in=mation t a cov]$ 
entity has a reasonable basis to believe
 is lawfully made available to ! g5]al  
public f ,f$]al1 ,/ate1 or local        
gov]nm5t records1 widely di/ribut$ m$ia1
 or disclosures to ! g5]al public t are 

requir$ to be made by ,f$]al1 ,/ate1 or 
local law4  7#ae7 ,rese>* ,! t]m rese>* 
means ! sci5tific analysis ( in=mation1 
includ+ cov]$ data1 by a cov]$ entity or
 ^? ) :om ! cov]$ entity is coop]at+ or 
o!rs act+ at ! direction or on behalf ( 
! cov]$ entity1 t is conduct$ = ! prim>y
 purpose ( advanc+ sci5tific k & may be 
= ! comm]cial b5efit ( ! cov]$ entity4  
7#af7 ,second-p>ty op]ator ,! t]m       
second-p>ty op]ator means ! op]ator ( a 
cov]$ int]net plat=m ) :i* a us] int5ds 
to connect1 b does n include ! op]ator (
 a program t appe>s on ! plat=m 7if !   
op]ator ( ! program is diff]5t f !      
op]ator ( ! plat=m74  7#ag7 ,s]vice     
provid] ,! t]m s]vice provid] means1 )  
respect to a set ( cov]$ data1 a cov]$  
entity t collects1 processes1 or        
transf]s su* cov]$ data = ! purpose (   
p]=m+ "o or m s]vices or functions on   
behalf (1 & at ! direction (1 ano!r     
cov]$ entity t-- 7,a7 is n relat$ to !  
cov]$ entity provid+ ! s]vice or        
function by common own]%ip or corporate 

control2 &  7,b7 does n %>e common br&+ 
) ! cov]$ entity provid+ ! s]vice or    
function4  7#ah7 ,/ate ,! t]m ,/ate     
means ea* ,/ate ( ! ,unit$ ,/ates1 !    
,di/rict ( ,columbia1 ea* commonweal?1  
t]ritory1 or possession ( ! ,unit$      
,/ates1 & ea* f$]ally recogniz$ ,indian 
,tribe4  7#ai7 ,t>get$ adv]tis+  7,a7 ,9
 g5]al ,! t]m t>get$ adv]tis+ means a =m
 ( adv]tis+ 9 :i* adv]tisem5ts are      
display$ to a us] bas$ on ! us]'s       
traits1 in=mation f a pr(ile ab\t ! us] 
t is creat$ = ! purpose ( sell+         
adv]tisem5ts1 or ! us]'s previ\s onl9e  
or (fl9e behavior4  7,b7 ,limitation    
,su* t]m does n include contextual      
adv]tis+1 includ+-- 7i7 adv]tis+ t is   
direct$ to a us] bas$ on ! cont5t ( !   
cov]$ int]net plat=m t ! us] is connect$
 to2 or  7ii7 adv]tis+ t is direct$ to a
 us] by ! second-p>ty op]ator ( a cov]$ 
int]net plat=m1 or by ! ?ird-p>ty       
op]ator ( a program t appe>s on !       
plat=m1 bas$ on ! se>* t]ms t ! us] us$ 
to arrive at ! plat=m4  7#bj7 ,?ird p>ty

 ,! t]m ?ird p>ty means ) respect to a  
set ( cov]$ data1 a cov]$ entity-- 7,a7 
t is n a s]vice provid] ) respect to su*
 cov]$ data2 &  7,b7 t receiv$ su* cov]$
 data f ano!r cov]$ entity-- 7i7 t is n 
relat$ to ! cov]$ entity by common      
own]%ip or corporate control2 &  7ii7 t 
does n %>e common br&+ ) ! cov]$ entity4
  7#ba7 ,?ird-p>ty op]ator ,! t]m       
?ird-p>ty op]ator means ! op]ator ( a   
program t appe>s on a cov]$ int]net     
plat=m 7if ! op]ator ( ! program is     
diff]5t f ! op]ator ( ! plat=m74  7#bb7 
,transf] ,! t]m transf] means1 ) respect
 to cov]$ data1 to disclose1 release1   
%>e1 dissem9ate1 make available1 or     
lic5se su* data1 9 writ+1               
electronically1 or by any o!r means1 =  
consid]ation ( any k9d or = a comm]cial 
purpose4  #bji4 ,effective date ,?is    
title %all take effect on ! date t is #f
 mon?s aft] ! date ( ! enactm5t ( ?is   
,act4