1. Short title
This Act may be cited as the “Do Not Track Act”.
Do Not Track Act
A BILL
To protect the privacy of internet users through the establishment of a national Do Not Track system, and for other purposes.
2. Definitions
In this Act:
Commission— The term Commission means the Federal Trade Commission.
Connected device— The term connected device means a device that is capable of connecting to the internet, directly or indirectly.
Covered website, service, or application— The term covered website, service, or application means a website on the internet, an online service, an online application, or a mobile application that—
is operated or provided for commercial purposes, in interstate or foreign commerce; and
is not operated by a nonprofit entity that would otherwise be exempt from coverage under section 5 of the Federal Trade Commission Act (15 U.S.C. 45).
DNT signal— The term DNT signal means a signal sent by a connected device, such as the hypertext transfer protocol developed by the World Wide Web Consortium Working Group on Tracking Preference Expression, that is designated by the Commission for purposes of the Do Not Track program required under section 3(b).
First-party operator— The term first-party operator means an operator of a website on the internet, an online service, an online application, or a mobile application with which a user intends to connect, but does not include an operator of an advertisement that appears on such a website, service, or application or a program used to log in to such a website, service, or application (if the operator of such advertisement or program is different from the operator of the website, service, or application).
Targeted advertising—
In general— The term targeted advertising means a form of advertising where advertisements are displayed to a user based on the user's traits, information from a profile about the user that is created for the purpose of selling advertisements, or the user's previous online or offline behavior.
Limitation— Such term shall not include contextual advertising, including—
advertising that is directed to a user based on the content of the website, online service, online application, or mobile application that the user is connected to; or
advertising that is directed to a user by the operator of a website, online service, online application, or mobile application based on the search terms that the user used to arrive at such website, service, or application.
Third-party operator— The term third-party operator means any operator of a program that appears on a website, service, or application with respect to which the operator is not a first-party operator.
3. Establishment of Do Not Track system
In general— Not later than 6 months after the date of enactment of this Act, the Commission shall implement and enforce a Do Not Track system, including the program described in subsection (b), to protect consumers from unwanted online data harvesting and targeted advertising.
Do Not Track program— As part of the Do Not Track system required under this section, the Commission shall designate the DNT signal and make available on the public website of the Commission a simple program that—
can be downloaded to any common connected device;
sends the DNT signal to every website, online service, or online application to which the device connects each time the device connects to such website, service, or application; and
permits the user of the connected device to designate websites, services, or applications to which such signal should not be sent, but does not exempt any website, service, or application from receiving such signal if it is not so designated.
Other do not track systems— Nothing in this Act shall be construed as prohibiting the operator of any web browser or similar interface or a device designer or manufacturer from offering a program that sends the DNT signal to websites, services, or applications, provided that such program permits users to designate websites, services, or applications to which such signal should not be sent.
Rulemaking authority— The Commission may promulgate regulations, in accordance with section 553 of title 5, United States Code, to carry out this section.
4. Requirements for operators; prohibited acts
Requirements—
Search for DNT signal— The operator of any covered website, service, or application (or any program that appears in such a website, application, or service) shall ensure that the website, service, or application (or program) searches for the DNT signal whenever a connected device connects to the website, service, or application.
Mandatory disclosure—
In general— Subject to subparagraph (B), if the operator of a covered website, service, or application collects more data from a user of such website, service, or application than is necessary to operate such website, service, or application the operator shall, through a pop-up notification, provide any user whose connected device is not sending the DNT signal with—
notice of the website, service, or application's policy of collecting data beyond what is necessary to operate the website, service, or application;
notice of the protections from data collection and targeted advertising available to users under this Act;
notice that the user may, through the public website of the Federal Trade Commission, download the Do Not Track program described in section 3(b), and a link to such website; and
notice that the user may be able to activate the DNT signal through the user's device or browser.
Number and timing of disclosures— The operator of a covered website, service, or application shall make the disclosures required under subparagraph (A)—
the first time a connected device connects to such website, service, or application; and
unless the user of the connected device opts out of receiving such disclosures, at least every 30th time a connected device connects to such website, service, or application.
Collection of data for targeted advertising— For purposes of this subsection, a covered website, service, or application that collects data for the purpose of designing or displaying targeted advertisements shall be considered to be collecting more data than is necessary to operate such website, service, or application.
Prohibition on data collection and targeted advertising—
In general— Subject to paragraph (3), it shall be unlawful for a first-party operator of a covered website, service, or application that receives the DNT signal from the connected device of a user to—
collect data (other than such data as is necessary for the operation of the website, service, or application) from the user;
use any data collected from the user for a secondary purpose, including for the purpose of targeted advertising; or
share any data collected from the user with a third party unless the user expressly consents to the sharing of data in a manner that demonstrates the user's intent for the first-party operator to be an intermediary between the user and the third party.
Prohibition on collection of data by other operators—
In general— It shall be unlawful for a third-party operator of a program (including a program that is an advertisement or a portal used to log in to a website, service, or application) that receives the DNT signal from the connected device of a user of a covered website, service, or application to collect any data from such user, other than, subject to subparagraph (B), data collected for the purpose of analyzing how or whether the user engaged with such program.
Limitations on collection of data for engagement analytics— Data collected for the purpose of analyzing user engagement with a program described in subparagraph (A)—
shall be collected only in a de-identified manner; and
may not be used to create or contribute to a profile of the user from which it is collected.
Exceptions—
Law enforcement— The prohibitions on data collection described in paragraph (1) shall not apply where data is collected for the purpose of assisting a law enforcement agency.
Complementary services— Notwithstanding paragraph (1), a first-party operator of a covered website, service, or application may collect additional data from a user beyond what is necessary for the operation of such website, service, or application if such additional data is necessary for the operation of a different covered website, service, or application that is—
both owned and operated by such first-party operator;
designed to complement the covered website, service, or application accessed by the user; and
branded as a complementary website, service, or application to the covered website, service, or application accessed by the user.
Interfering with DNT signal— It shall be unlawful for any person to—
block or impede the ability of a covered website, service, or application to receive the DNT signal; or
block or impede the ability of a connected device to send the DNT signal.
Discrimination based on DNT preferences— It shall be unlawful for a first-party operator of a covered website, service, or application to—
deny a user access to, or service from, such website, service, or application on the basis that the website, service, or application received the DNT signal from the user; or
provide a user from whom such website, service, or application received the DNT signal with a different level of access or service than the level of access or service provided to a user from whom the website, service, or application does not receive the DNT signal.
Effective date— This section shall take effect on the date that is 6 months after the date of enactment of this Act.
5. Enforcement and applicability
Enforcement by the Commission—
In general— Except as otherwise provided, this Act and the regulations prescribed under this Act shall be enforced by the Commission under the Federal Trade Commission Act (15 U.S.C. 41 et seq.).
Unfair or deceptive acts or practices— A violation of this Act or a regulation prescribed under this Act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
Actions by the Commission—
In general— Except as provided in subsection (b)(1), the Commission shall prevent any person from violating this Act or a regulation prescribed under this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act, and, except as provided in subparagraph (B), any person who violates this Act or a regulation prescribed under this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act.
Penalties—
In general— Notwithstanding section 5(m) of the Federal Trade Commission Act (15 U.S.C. 45(m)), a civil penalty recovered for a violation of this Act or a regulation prescribed under this Act may be in excess of the amounts provided for in that section, provided that such penalty meets the requirements of this subparagraph.
Penalty for negligent violation— In the case of a person that negligently violates this Act or a regulation prescribed under this Act, such person shall be liable for a civil penalty that shall not exceed $50 for every user affected by such violation for every day during which the person is in violation of this Act under this clause.
Penalty for willful or reckless violation— In the case of a person that willfully or recklessly violates this Act or a regulation prescribed under this Act, such person shall be liable for a civil penalty that—
shall not be less than $100,000; and
shall not exceed $1,000 for every user affected by such violation for every day during which the person is in violation of this Act under this clause.
Enforcement by State attorneys general—
In general—
Civil actions— In any case in which the attorney general of a State has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the engagement of any person in a practice that violates this Act or a regulation prescribed under this Act, the State, as parens patriae, may bring a civil action on behalf of the residents of the State in a district court of the United States or a State court of appropriate jurisdiction to—
enjoin that practice;
enforce compliance with this Act or such regulation;
obtain damages, statutory damage, restitution, or other compensation on behalf of residents of the State; or
obtain such other relief as the court may consider to be appropriate.
Notice—
In general— Before filing an action under subparagraph (A), the attorney general of the State involved shall provide to the Commission—
written notice of that action; and
a copy of the complaint for that action.
Exemption—
In general— Clause (i) shall not apply with respect to the filing of an action by an attorney general of a State under this paragraph if the attorney general of the State determines that it is not feasible to provide the notice described in that clause before the filing of the action.
Notification— In an action described in subclause (I), the attorney general of a State shall provide notice and a copy of the complaint to the Commission at the same time as the attorney general files the action.
Intervention—
In general— On receiving notice under paragraph (1)(B), the Commission shall have the right to intervene in the action that is the subject of the notice.
Effect of intervention— If the Commission intervenes in an action under paragraph (1), it shall have the right—
to be heard with respect to any matter that arises in that action; and
to file a petition for appeal.
Construction— For purposes of bringing any civil action under paragraph (1), nothing in this Act shall be construed to prevent an attorney general of a State from exercising the powers conferred on the attorney general by the laws of that State to—
conduct investigations;
administer oaths or affirmations; or
compel the attendance of witnesses or the production of documentary and other evidence.
Actions by the Commission— In any case in which an action is instituted by or on behalf of the Commission for violation of this Act or a regulation prescribed under this Act, no State may, during the pendency of that action, institute an action under paragraph (1) against any defendant named in the complaint in the action instituted by or on behalf of the Commission for that violation.
Venue; service of process—
Venue— Any action brought under paragraph (1) may be brought in—
the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code; or
a State court of competent jurisdiction.
Service of process— In an action brought under paragraph (1) in a district court of the United States, process may be served wherever defendant—
is an inhabitant; or
may be found.
6. Severability
If any provision of this Act or the application of a provision of this Act to any person or circumstance is held to be invalid or unconstitutional, the remainder of this Act, or the application of such provision to any other person or circumstance, shall not be affected.