[Congressional Bills 116th Congress]
[From the U.S. Government Publishing Office]
[S. 1578 Introduced in Senate (IS)]
<DOC>
116th CONGRESS
1st Session
S. 1578
To protect the privacy of internet users through the establishment of a
national Do Not Track system, and for other purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
May 21, 2019
Mr. Hawley introduced the following bill; which was read twice and
referred to the Committee on Commerce, Science, and Transportation
_______________________________________________________________________
A BILL
To protect the privacy of internet users through the establishment of a
national Do Not Track system, and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Do Not Track Act''.
SEC. 2. DEFINITIONS.
In this Act:
(1) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(2) Connected device.--The term ``connected device'' means
a device that is capable of connecting to the internet,
directly or indirectly.
(3) Covered website, service, or application.--The term
``covered website, service, or application'' means a website on
the internet, an online service, an online application, or a
mobile application that--
(A) is operated or provided for commercial
purposes, in interstate or foreign commerce; and
(B) is not operated by a nonprofit entity that
would otherwise be exempt from coverage under section 5
of the Federal Trade Commission Act (15 U.S.C. 45).
(4) DNT signal.--The term ``DNT signal'' means a signal
sent by a connected device, such as the hypertext transfer
protocol developed by the World Wide Web Consortium Working
Group on Tracking Preference Expression, that is designated by
the Commission for purposes of the Do Not Track program
required under section 3(b).
(5) First-party operator.--The term ``first-party
operator'' means an operator of a website on the internet, an
online service, an online application, or a mobile application
with which a user intends to connect, but does not include an
operator of an advertisement that appears on such a website,
service, or application or a program used to log in to such a
website, service, or application (if the operator of such
advertisement or program is different from the operator of the
website, service, or application).
(6) Targeted advertising.--
(A) In general.--The term ``targeted advertising''
means a form of advertising where advertisements are
displayed to a user based on the user's traits,
information from a profile about the user that is
created for the purpose of selling advertisements, or
the user's previous online or offline behavior.
(B) Limitation.--Such term shall not include
contextual advertising, including--
(i) advertising that is directed to a user
based on the content of the website, online
service, online application, or mobile
application that the user is connected to; or
(ii) advertising that is directed to a user
by the operator of a website, online service,
online application, or mobile application based
on the search terms that the user used to
arrive at such website, service, or
application.
(7) Third-party operator.--The term ``third-party
operator'' means any operator of a program that appears on a
website, service, or application with respect to which the
operator is not a first-party operator.
SEC. 3. ESTABLISHMENT OF DO NOT TRACK SYSTEM.
(a) In General.--Not later than 6 months after the date of
enactment of this Act, the Commission shall implement and enforce a Do
Not Track system, including the program described in subsection (b), to
protect consumers from unwanted online data harvesting and targeted
advertising.
(b) Do Not Track Program.--As part of the Do Not Track system
required under this section, the Commission shall designate the DNT
signal and make available on the public website of the Commission a
simple program that--
(1) can be downloaded to any common connected device;
(2) sends the DNT signal to every website, online service,
or online application to which the device connects each time
the device connects to such website, service, or application;
and
(3) permits the user of the connected device to designate
websites, services, or applications to which such signal should
not be sent, but does not exempt any website, service, or
application from receiving such signal if it is not so
designated.
(c) Other Do Not Track Systems.--Nothing in this Act shall be
construed as prohibiting the operator of any web browser or similar
interface or a device designer or manufacturer from offering a program
that sends the DNT signal to websites, services, or applications,
provided that such program permits users to designate websites,
services, or applications to which such signal should not be sent.
(d) Rulemaking Authority.--The Commission may promulgate
regulations, in accordance with section 553 of title 5, United States
Code, to carry out this section.
SEC. 4. REQUIREMENTS FOR OPERATORS; PROHIBITED ACTS.
(a) Requirements.--
(1) Search for dnt signal.--The operator of any covered
website, service, or application (or any program that appears
in such a website, application, or service) shall ensure that
the website, service, or application (or program) searches for
the DNT signal whenever a connected device connects to the
website, service, or application.
(2) Mandatory disclosure.--
(A) In general.--Subject to subparagraph (B), if
the operator of a covered website, service, or
application collects more data from a user of such
website, service, or application than is necessary to
operate such website, service, or application the
operator shall, through a pop-up notification, provide
any user whose connected device is not sending the DNT
signal with--
(i) notice of the website, service, or
application's policy of collecting data beyond
what is necessary to operate the website,
service, or application;
(ii) notice of the protections from data
collection and targeted advertising available
to users under this Act;
(iii) notice that the user may, through the
public website of the Federal Trade Commission,
download the Do Not Track program described in
section 3(b), and a link to such website; and
(iv) notice that the user may be able to
activate the DNT signal through the user's
device or browser.
(B) Number and timing of disclosures.--The operator
of a covered website, service, or application shall
make the disclosures required under subparagraph (A)--
(i) the first time a connected device
connects to such website, service, or
application; and
(ii) unless the user of the connected
device opts out of receiving such disclosures,
at least every 30th time a connected device
connects to such website, service, or
application.
(C) Collection of data for targeted advertising.--
For purposes of this subsection, a covered website,
service, or application that collects data for the
purpose of designing or displaying targeted
advertisements shall be considered to be collecting
more data than is necessary to operate such website,
service, or application.
(b) Prohibition on Data Collection and Targeted Advertising.--
(1) In general.--Subject to paragraph (3), it shall be
unlawful for a first-party operator of a covered website,
service, or application that receives the DNT signal from the
connected device of a user to--
(A) collect data (other than such data as is
necessary for the operation of the website, service, or
application) from the user;
(B) use any data collected from the user for a
secondary purpose, including for the purpose of
targeted advertising; or
(C) share any data collected from the user with a
third party unless the user expressly consents to the
sharing of data in a manner that demonstrates the
user's intent for the first-party operator to be an
intermediary between the user and the third party.
(2) Prohibition on collection of data by other operators.--
(A) In general.--It shall be unlawful for a third-
party operator of a program (including a program that
is an advertisement or a portal used to log in to a
website, service, or application) that receives the DNT
signal from the connected device of a user of a covered
website, service, or application to collect any data
from such user, other than, subject to subparagraph
(B), data collected for the purpose of analyzing how or
whether the user engaged with such program.
(B) Limitations on collection of data for
engagement analytics.--Data collected for the purpose
of analyzing user engagement with a program described
in subparagraph (A)--
(i) shall be collected only in a de-
identified manner; and
(ii) may not be used to create or
contribute to a profile of the user from which
it is collected.
(3) Exceptions.--
(A) Law enforcement.--The prohibitions on data
collection described in paragraph (1) shall not apply
where data is collected for the purpose of assisting a
law enforcement agency.
(B) Complementary services.--Notwithstanding
paragraph (1), a first-party operator of a covered
website, service, or application may collect additional
data from a user beyond what is necessary for the
operation of such website, service, or application if
such additional data is necessary for the operation of
a different covered website, service, or application
that is--
(i) both owned and operated by such first-
party operator;
(ii) designed to complement the covered
website, service, or application accessed by
the user; and
(iii) branded as a complementary website,
service, or application to the covered website,
service, or application accessed by the user.
(c) Interfering With DNT Signal.--It shall be unlawful for any
person to--
(1) block or impede the ability of a covered website,
service, or application to receive the DNT signal; or
(2) block or impede the ability of a connected device to
send the DNT signal.
(d) Discrimination Based on DNT Preferences.--It shall be unlawful
for a first-party operator of a covered website, service, or
application to--
(1) deny a user access to, or service from, such website,
service, or application on the basis that the website, service,
or application received the DNT signal from the user; or
(2) provide a user from whom such website, service, or
application received the DNT signal with a different level of
access or service than the level of access or service provided
to a user from whom the website, service, or application does
not receive the DNT signal.
(e) Effective Date.--This section shall take effect on the date
that is 6 months after the date of enactment of this Act.
SEC. 5. ENFORCEMENT AND APPLICABILITY.
(a) Enforcement by the Commission.--
(1) In general.--Except as otherwise provided, this Act and
the regulations prescribed under this Act shall be enforced by
the Commission under the Federal Trade Commission Act (15
U.S.C. 41 et seq.).
(2) Unfair or deceptive acts or practices.--A violation of
this Act or a regulation prescribed under this Act shall be
treated as a violation of a rule defining an unfair or
deceptive act or practice prescribed under section 18(a)(1)(B)
of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
(3) Actions by the commission.--
(A) In general.--Except as provided in subsection
(b)(1), the Commission shall prevent any person from
violating this Act or a regulation prescribed under
this Act in the same manner, by the same means, and
with the same jurisdiction, powers, and duties as
though all applicable terms and provisions of the
Federal Trade Commission Act (15 U.S.C. 41 et seq.)
were incorporated into and made a part of this Act,
and, except as provided in subparagraph (B), any person
who violates this Act or a regulation prescribed under
this Act shall be subject to the penalties and entitled
to the privileges and immunities provided in the
Federal Trade Commission Act.
(B) Penalties.--
(i) In general.--Notwithstanding section
5(m) of the Federal Trade Commission Act (15
U.S.C. 45(m)), a civil penalty recovered for a
violation of this Act or a regulation
prescribed under this Act may be in excess of
the amounts provided for in that section,
provided that such penalty meets the
requirements of this subparagraph.
(ii) Penalty for negligent violation.--In
the case of a person that negligently violates
this Act or a regulation prescribed under this
Act, such person shall be liable for a civil
penalty that shall not exceed $50 for every
user affected by such violation for every day
during which the person is in violation of this
Act under this clause.
(iii) Penalty for willful or reckless
violation.--In the case of a person that
willfully or recklessly violates this Act or a
regulation prescribed under this Act, such
person shall be liable for a civil penalty
that--
(I) shall not be less than
$100,000; and
(II) shall not exceed $1,000 for
every user affected by such violation
for every day during which the person
is in violation of this Act under this
clause.
(b) Enforcement by State Attorneys General.--
(1) In general.--
(A) Civil actions.--In any case in which the
attorney general of a State has reason to believe that
an interest of the residents of that State has been or
is threatened or adversely affected by the engagement
of any person in a practice that violates this Act or a
regulation prescribed under this Act, the State, as
parens patriae, may bring a civil action on behalf of
the residents of the State in a district court of the
United States or a State court of appropriate
jurisdiction to--
(i) enjoin that practice;
(ii) enforce compliance with this Act or
such regulation;
(iii) obtain damages, statutory damage,
restitution, or other compensation on behalf of
residents of the State; or
(iv) obtain such other relief as the court
may consider to be appropriate.
(B) Notice.--
(i) In general.--Before filing an action
under subparagraph (A), the attorney general of
the State involved shall provide to the
Commission--
(I) written notice of that action;
and
(II) a copy of the complaint for
that action.
(ii) Exemption.--
(I) In general.--Clause (i) shall
not apply with respect to the filing of
an action by an attorney general of a
State under this paragraph if the
attorney general of the State
determines that it is not feasible to
provide the notice described in that
clause before the filing of the action.
(II) Notification.--In an action
described in subclause (I), the
attorney general of a State shall
provide notice and a copy of the
complaint to the Commission at the same
time as the attorney general files the
action.
(2) Intervention.--
(A) In general.--On receiving notice under
paragraph (1)(B), the Commission shall have the right
to intervene in the action that is the subject of the
notice.
(B) Effect of intervention.--If the Commission
intervenes in an action under paragraph (1), it shall
have the right--
(i) to be heard with respect to any matter
that arises in that action; and
(ii) to file a petition for appeal.
(3) Construction.--For purposes of bringing any civil
action under paragraph (1), nothing in this Act shall be
construed to prevent an attorney general of a State from
exercising the powers conferred on the attorney general by the
laws of that State to--
(A) conduct investigations;
(B) administer oaths or affirmations; or
(C) compel the attendance of witnesses or the
production of documentary and other evidence.
(4) Actions by the commission.--In any case in which an
action is instituted by or on behalf of the Commission for
violation of this Act or a regulation prescribed under this
Act, no State may, during the pendency of that action,
institute an action under paragraph (1) against any defendant
named in the complaint in the action instituted by or on behalf
of the Commission for that violation.
(5) Venue; service of process.--
(A) Venue.--Any action brought under paragraph (1)
may be brought in--
(i) the district court of the United States
that meets applicable requirements relating to
venue under section 1391 of title 28, United
States Code; or
(ii) a State court of competent
jurisdiction.
(B) Service of process.--In an action brought under
paragraph (1) in a district court of the United States,
process may be served wherever defendant--
(i) is an inhabitant; or
(ii) may be found.
SEC. 6. SEVERABILITY.
If any provision of this Act or the application of a provision of
this Act to any person or circumstance is held to be invalid or
unconstitutional, the remainder of this Act, or the application of such
provision to any other person or circumstance, shall not be affected.
<all>