Section 1 Short title
This Act may be cited as the “Do Not Track Online Act of 2015”.
Do Not Track Online Act of 2015
A BILL
To require the Federal Trade Commission to prescribe regulations regarding the collection and use of personal information obtained by tracking the online activity of an individual, and for other purposes.
Sec. 2 Regulations relating to “Do-Not-Track” mechanisms
In general— Not later than 1 year after the date of the enactment of this Act, the Federal Trade Commission shall promulgate—
regulations that establish standards for the implementation of a mechanism by which an individual can simply and easily indicate whether the individual prefers to have personal information collected by providers of online services, including by providers of mobile applications and services; and
rules that prohibit, except as provided in subsection (b), such providers from—
collecting personal information on individuals who have expressed, via a mechanism that meets the standards promulgated under paragraph (1), a preference not to have such information collected; and
discriminating against individuals described in subparagraph (A).
Exception— The rules promulgated under paragraph (2) of subsection (a) shall allow for the collection and use of personal information on an individual described in such paragraph, notwithstanding the expressed preference of the individual via a mechanism that meets the standards promulgated under paragraph (1) of such subsection, to the extent—
necessary to provide a service requested by the individual, including with respect to such service, basic functionality and effectiveness, so long as such information is anonymized or deleted upon the provision of such service; or
the individual—
receives clear, conspicuous, and accurate notice on the collection and use of such information; and
affirmatively consents to such collection and use.
Factors— In promulgating standards and rules under subsection (a), the Federal Trade Commission shall consider and take into account the following:
The appropriate scope of such standards and rules, including the conduct to which such rules shall apply and the persons required to comply with such rules.
The technical feasibility and costs of—
implementing mechanisms that would meet such standards; and
complying with such rules.
Mechanisms that—
have been developed or used before the date of the enactment of this Act; and
are for individuals to indicate simply and easily whether the individuals prefer to have personal information collected by providers of online services, including by providers of mobile applications and services.
The experience of individuals using the mechanisms regarding the ease of use and practicality of the mechanisms, including the universality, persistence, and stability of preferences expressed through the mechanisms.
How mechanisms that meet such standards should be publicized and offered to individuals.
Whether and how information can be collected and used on an anonymous basis so that the information—
cannot be reasonably linked or identified with a person or device, both on its own and in combination with other information; and
does not qualify as personal information subject to the rules promulgated under subsection (a)(2).
The standards under which personal information may be collected and used, subject to the anonymization or deletion requirements of subsection (b)(1)—
to fulfill the basic functionality and effectiveness of an online service, including a mobile application or service;
to provide the content or services requested by individuals who have otherwise expressed, via a mechanism that meets the standards promulgated under subsection (a)(1), a preference not to have personal information collected; and
for such other purposes as the Commission determines substantially facilitates the functionality and effectiveness of the online service, or mobile application or service, in a manner that does not undermine an individual's preference, expressed via such mechanism, not to collect such information.
Personal information— In this section, the term personal information includes persistent identifiers such as Internet Protocol (IP) addresses, media access control (MAC) addresses, and other unique device identifiers.
Rulemaking— The Federal Trade Commission shall promulgate the standards and rules required by subsection (a) in accordance with section 553 of title 5, United States Code.
Sec. 3 Enforcement of “do-not-track” mechanisms
Enforcement by Federal Trade Commission—
Unfair or deceptive acts or practices— A violation of a rule promulgated under section 2(a)(2) shall be treated as an unfair and deceptive act or practice in violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)) regarding unfair or deceptive acts or practices.
Powers of Commission—
In general— Except as provided in subparagraph (C), the Federal Trade Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act.
Privileges and immunities— Except as provided in subparagraph (C), any person who violates this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).
Nonprofit organizations— The Federal Trade Commission shall enforce this Act with respect to an organization that is not organized to carry on business for its own profit or that of its members as if such organization were a person over which the Commission has authority pursuant to section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)).
Enforcement by States—
In general— In any case in which the attorney general of a State has reason to believe that an interest of the residents of the State has been or is threatened or adversely affected by the engagement of any person subject to a rule promulgated under section 2(a)(2) in a practice that violates the rule, the attorney general of the State may, as parens patriae, bring a civil action on behalf of the residents of the State in an appropriate district court of the United States—
to enjoin further violation of such rule by such person;
to compel compliance with such rule;
to obtain damages, restitution, or other compensation on behalf of such residents;
to obtain such other relief as the court considers appropriate; or
to obtain civil penalties in the amount determined under paragraph (2).
Civil penalties—
Calculation— Subject to subparagraph (B), for purposes of imposing a civil penalty under paragraph (1)(E) with respect to a person that violates a rule promulgated under section 2(a)(2), the amount determined under this paragraph is the amount calculated by multiplying the number of days that the person is not in compliance with the rule by an amount not greater than $16,000.
Maximum total liability— The total amount of civil penalties that may be imposed with respect to a person that violates a rule promulgated under section 2(a)(2) shall not exceed $15,000,000 for all civil actions brought against such person under paragraph (1) for such violation.
Adjustment for inflation— Beginning on the date on which the Bureau of Labor Statistics first publishes the Consumer Price Index after the date that is 1 year after the date of the enactment of this Act, and annually thereafter, the amounts specified in subparagraphs (A) and (B) shall be increased by the percentage increase in the Consumer Price Index published on that date from the Consumer Price Index published the previous year.
Rights of Federal Trade Commission—
Notice to Federal Trade Commission—
In general— Except as provided in clause (iii), the attorney general of a State shall notify the Federal Trade Commission in writing that the attorney general intends to bring a civil action under paragraph (1) before initiating the civil action.
Contents— The notification required by clause (i) with respect to a civil action shall include a copy of the complaint to be filed to initiate the civil action.
Exception— If it is not feasible for the attorney general of a State to provide the notification required by clause (i) before initiating a civil action under paragraph (1), the attorney general shall notify the Federal Trade Commission immediately upon instituting the civil action.
Intervention by Federal Trade Commission— The Federal Trade Commission may—
intervene in any civil action brought by the attorney general of a State under paragraph (1); and
upon intervening—
be heard on all matters arising in the civil action; and
file petitions for appeal of a decision in the civil action.
Investigatory powers— Nothing in this subsection may be construed to prevent the attorney general of a State from exercising the powers conferred on the attorney general by the laws of the State to conduct investigations, to administer oaths or affirmations, or to compel the attendance of witnesses or the production of documentary or other evidence.
Preemptive action by Federal Trade Commission— If the Federal Trade Commission institutes a civil action or an administrative action with respect to a violation of a rule promulgated under section 2(a)(2), the attorney general of a State may not, during the pendency of such action, bring a civil action under paragraph (1) against any defendant named in the complaint of the Commission for the violation with respect to which the Commission instituted such action.
Venue; service of process—
Venue— Any action brought under paragraph (1) may be brought in—
the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code; or
another court of competent jurisdiction.
Service of process— In an action brought under paragraph (1), process may be served in any district in which the defendant—
is an inhabitant; or
may be found.
Actions by other State officials—
In general— In addition to civil actions brought by attorneys general under paragraph (1), any other officer of a State who is authorized by the State to do so may bring a civil action under paragraph (1), subject to the same requirements and limitations that apply under this subsection to civil actions brought by attorneys general.
Savings provision— Nothing in this subsection may be construed to prohibit an authorized official of a State from initiating or continuing any proceeding in a court of the State for a violation of any civil or criminal law of the State.
Private right of action—
In general— A person may, if otherwise permitted by the laws or rules of court of a State, bring in an appropriate court of that State—
an action based on a violation of a rule promulgated under section 2(a)(2) to enjoin such violation;
an action to recover for actual monetary loss from such a violation, or to receive $500 in damages for each such violation, whichever is greater; or
both such actions.
Increased penalties— If the court finds that the defendant willfully or knowingly violated a rule promulgated under section 2(a)(2), the court may, in its discretion, increase the amount of the award to an amount equal to not more than 3 times the amount available under paragraph (1)(B).
Sec. 4 Biennial review and assessment
Not later than 2 years after the effective date of the regulations initially promulgated under section 2, the Federal Trade Commission shall—
review the implementation of this Act;
assess the effectiveness of such regulations, including how such regulations define or interpret the term personal information as such term is used in section 2;
assess the effect of such regulations on online commerce; and
submit to Congress a report on the results of the review and assessments required by this section.