Treatment of camera and microphone data by internet-connected devices and applications

(a)

Prohibition

(1)

In general

A covered entity may not collect any data using the camera or microphone of a covered device of an individual, cause any data so collected to be transmitted from the device, or process or disclose to another person any data so collected, unless—(A)the collection, transmission, processing, or disclosure is consistent with reasonable consumer expectations within the context of the interaction between the covered entity and the individual; or(B)the covered entity obtains the express, affirmative consent of the individual to the collection, transmission, processing, or disclosure in the manner required by subsection (b).(2)

Reasonable consumer expectations

For purposes of paragraph (1)(A), the collection, transmission, processing, or disclosure of data is not consistent with reasonable consumer expectations if—(A)the collection, transmission, processing, or disclosure is not reasonably required for the functionality of the covered device manufactured by the covered entity or the covered application developed by the covered entity (as the case may be); or(B)the data is collected, transmitted, or processed (regardless of whether the processing occurs on the covered device or on the systems of the covered entity) when the individual is not actively using the covered device or covered application (as the case may be).(b)

Requirements for obtaining express, affirmative consent

(1)

In general

To obtain the express, affirmative consent of an individual to the collection of data using the camera or microphone of a covered device of the individual, the causing of any data so collected to be transmitted from the device, or the processing or disclosure to another person of any data so collected, a covered entity shall—(A)provide to the individual a brief notice of the collection, transmission, processing, or disclosure that meets the requirements of paragraph (2); and(B)obtain an affirmative response from the individual indicating that the individual consents to the collection, transmission, processing, or disclosure.(2)

Brief notice

The brief notice required by paragraph (1)(A) shall—(A)briefly describe the collection, transmission, processing, or disclosure for which consent is sought;(B)be provided in a conspicuous manner;(C)be separate from any other privacy policy or terms or conditions relating to the covered device or covered application;(D)be in plain language;(E)be provided—(i)in the case of a covered device that has a screen (or a covered application installed on a covered device that has a screen)—(I)in the form of text displayed on the screen; and(II)if the individual so chooses, in spoken form; and(ii)in the case of a covered device that does not have a screen (or a covered application installed on a covered device that does not have a screen)—(I)in spoken form; and(II)if the individual so chooses, in an alternative form that is accessible to individuals with a hearing impairment; and(F)clearly and conspicuously direct the individual to a website on which the individual may access the privacy policy required by paragraph (3).(3)

A covered entity that collects any data using the camera or microphone of a covered device of an individual, causes any data so collected to be transmitted from the device, or processes or discloses to another person any data so collected, shall maintain on a publicly available website a privacy policy that describes in detail, but using plain language, the collection, transmission, processing, or disclosure, including the purposes of the collection, transmission, processing, or disclosure. The privacy policy shall be separate from any other privacy policy or terms or conditions relating to the covered device or covered application and shall be displayed in a conspicuous manner on the website.(c)

Voice-Activated functionality

(1)

In general

Notwithstanding subsection (a)(1)(A)—(A)if the covered device of an individual has voice-activated functionality, the covered entity that manufactured the covered device may not, in connection with such functionality, collect any data using the camera or microphone of the covered device, cause any data so collected to be transmitted from the device, or process or disclose to another person any data so collected, unless, before such functionality is activated, the covered entity obtains the express, affirmative consent of the individual to the collection, transmission, processing, or disclosure; and(B)if a covered application installed on the covered device of an individual has voice-activated functionality, the covered entity that developed the covered application may not, in connection with such functionality, collect any data using the camera or microphone of the covered device, cause any data so collected to be transmitted from the device, or process or disclose to another person any data so collected, unless, before such functionality is activated, the covered entity obtains the express, affirmative consent of the individual to the collection, transmission, processing, or disclosure.(2)

Requirements

The express, affirmative consent required by paragraph (1) shall be obtained in the manner required by subsection (b), except that the brief notice required by subparagraph (A) of paragraph (1) of such subsection and the affirmative response required by subparagraph (B) of such paragraph shall be specific to the collection, transmission, processing, or disclosure of data in connection with the voice-activated functionality and separate from the notice provided and response obtained under such subparagraphs with respect to the collection, transmission, processing, or disclosure of data not in connection with such functionality.(d)

Status of consent; revocation

A covered entity shall provide a convenient means, on the covered device manufactured by the covered entity or within the covered application developed by the covered entity (as the case may be), for an individual—(1)to revoke any consent provided under this section to the collection, transmission, processing, or disclosure of data; and(2)to view whether the individual has provided or revoked any such consent.(e)

Federal Trade Commission guidance; safe harbor

(1)

Guidance

The Commission shall issue guidance containing examples of language for the brief notice required by subsection (b)(1)(A) (including text and spoken versions) and the privacy policy required by subsection (b)(3).(2)

Safe harbor

(A)

Submission of brief notice or privacy policy to Commission

A covered entity may submit to the Commission for approval a brief notice that the covered entity intends to use to comply with subsection (b)(1)(A) or a privacy policy that the covered entity intends to use to comply with subsection (b)(3) with respect to the collection, transmission, processing, or disclosure of data. The covered entity shall include with the submission such information as the Commission may require about the collection, transmission, processing, or disclosure, as the Commission considers necessary to evaluate the adequacy of the brief notice or privacy policy.(B)

Approval or rejection

Not later than 120 days after receiving a brief notice or privacy policy from a covered entity under subparagraph (A), the Commission shall approve or reject the brief notice or privacy policy and inform the covered entity of the approval or rejection.(C)

Effect

If the Commission approves a brief notice or privacy policy under subparagraph (B), the brief notice or privacy policy shall be considered to meet the requirements of subsection (b)(1)(A) or (b)(3), respectively, with respect to the collection, transmission, processing, or disclosure of data to which the brief notice or privacy policy relates, to the extent the covered entity conducts the collection, transmission, processing, or disclosure in a manner that is consistent in all material respects with the information provided to the Commission under subparagraph (A).(f)

Enforcement by Federal Trade Commission

(1)

Unfair or deceptive acts or practices

A violation of this section or a regulation promulgated under this section shall be treated as a violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices. (2)

Powers of Commission

The Commission shall enforce this section and the regulations promulgated under this section in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this section. Any person who violates this section or a regulation promulgated under this section shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act.(g)

Rulemaking

The Commission may promulgate regulations under section 553 of title 5, United States Code, to implement this section.(h)

Definitions

In this section:(1)

Commission

The term Commission means the Federal Trade Commission.(2)

Covered application

The term covered application means a software application that is designed to be installed on a covered device.(3)

Covered device

The term covered device means a device that—(A)is capable of connecting to the internet, either directly or indirectly through a network;(B)has computer processing capabilities for collecting, transmitting, or otherwise processing data; and(C)has a camera or microphone.(4)

Covered entity

The term covered entity means—(A)a manufacturer of a covered device; and(B)a developer of a covered application.(5)

Voice-activated functionality

The term voice-activated functionality means a functionality of a covered device or covered application that—(A)allows an individual to control the covered device or covered application using voice commands; and(B)uses the microphone of the covered device being controlled, or the microphone of the covered device on which the covered application being controlled is installed, to listen for such commands when the individual is not actively using the covered device or covered application, respectively.