This bill restricts the use of information reasonably linked to an individual (or the individual's internet-connected device) that is collected, processed, or transferred by certain entities subject to unfair competition laws.

Individuals must affirmatively and expressly consent to the use of their information and may withdraw their consent. Entities may only use information as reasonably necessary and for the allowable purposes (e.g., completing transactions at an individual's request, complying with legal obligations, and other purposes specified in the bill) to which the individual consented. The Federal Trade Commission (FTC) may allow additional purposes through rulemaking. Entities must also establish data security practices.

Additionally, entities must make their privacy policies publicly available, and individuals must consent to a policy change that weakens privacy protections before the change takes effect. Further, entities must (1) notify individuals in real-time when their information is being used; and (2) provide copies of, delete, mask, or correct information at an individual's request. However, these requirements shall not apply to entities that have revenues, staffing levels, and related indicators below specified limits.

The FTC must also develop a downloadable program that allows individuals to opt out of unwanted data harvesting and targeted advertising by public-facing websites, applications, and related operators (e.g., social networks and search engines). Operators must comply with requirements related to the program.

Along with existing remedies, the bill provides civil penalties for violations of the bill and allows enforcement by the FTC, states, Indian tribes, and territories.