Section 1 Short title
This Act may be cited as the “Earning Approval of Voice External Sound Databasing Retained on People Act” or the “EAVESDROP Act”.
Earning Approval of Voice External Sound Databasing Retained on People Act
A BILL
To require notice regarding the collection of ambient noise by certain internet-connected devices, to limit the disclosure and retention of information collected through such noise, and to require a mechanism by which such collection may be deactivated and reactivated, and for other purposes.
Sec. 2 Notices required for collection of ambient noise by covered device
One-Time notice at first power-On— A manufacturer of a covered device shall provide to the user who powers on the device for the first time a notice that contains—
a description of how and under what circumstances covered information is collected by the manufacturer through the covered device; and
a description of the purposes for which the manufacturer processes such covered information, including—
a description of how long and the circumstances under which the manufacturer retains such covered information; and
whether the manufacturer discloses such covered information to third parties or processes such covered information for targeted advertising.
Notice when material change to operating system or firmware— When there is a material change to the operating system or firmware of a covered device, the manufacturer of the covered device shall provide a notice that the covered device collects covered information. Such notice shall include—
a statement informing the user that the covered device is collecting covered information;
a description of—
the covered information collected by the manufacturer through the covered device; and
the covered information collected by the manufacturer through the covered device that the manufacturer processes; and
instructions on how an owner of the covered device can deactivate the collection of covered information by the covered device using the mechanism required by section 3.
Form— The notices required by subsections (a) and (b)—
shall be provided electronically in—
audio format; and
text format, which may include providing a link to a website or other means for accessing the notices online;
shall be clear, easily understood, and provided in plain and concise language; and
when a covered device is powered on for the first time, may be provided to the user as a single, combined notice.
Subsequent availability of information provided in notices— The manufacturer of a covered device shall ensure that the notices required by subsections (a) and (b) are accessible at any time after being provided under such subsections.
Sec. 3 Deactivation and reactivation of collection of ambient noise
A manufacturer of a covered device shall provide a reasonable and easy mechanism by which an owner of the device may—
deactivate the ability of the device to collect covered information; and
if the ability of the device to collect covered information has been deactivated under paragraph (1), reactivate such ability.
Sec. 4 Authorized disclosures of covered information
In general— A manufacturer of a covered device may disclose covered information to a third party only if the manufacturer is acting in good faith and only for the following purposes:
To respond to or comply with a valid subpoena, court order, or warrant (including a subpoena or court order obtained by a person that is not a government entity), or to provide information as otherwise required by law.
To respond to a circumstance that would cause a reasonable person to believe that disclosure of the covered information to the third party is necessary to prevent physical harm to an individual.
Notice of disclosure—
Requirement— Unless prohibited by law, a manufacturer of a covered device shall notify a user of such device whose covered information is disclosed to a third party by such manufacturer.
Contents— The notice required by paragraph (1) shall include—
a description of the covered information disclosed;
a justification for the necessity of the disclosure; and
the name of the third party to which the manufacturer disclosed the covered information.
Timing— The notice required by paragraph (1) shall be provided to the user not later than 7 days after such notice can be legally, safely, and practicably provided.
Form— The notice required by paragraph (1) shall be provided to the user in a written form (such as by mail or e-mail), if the manufacturer has the necessary contact information for the user. If the manufacturer does not have such contact information, the manufacturer shall provide such notice in a manner consistent with how a typical user interacts with the covered device.
Rule of construction— Nothing in this subsection shall be construed to require a manufacturer of a covered device to—
take an action that would convert information that is not covered information into covered information;
collect or retain information that the manufacturer would otherwise not collect or retain; or
retain covered information longer than the manufacturer would otherwise retain such information.
Sec. 5 Retention of covered information
A manufacturer of a covered device may not retain covered information for longer than is reasonably necessary for the express purposes for which the covered information is collected.
Sec. 6 Safe harbor
Deemed compliance— A manufacturer of a covered device shall be deemed to be in compliance with the requirements of this Act if such manufacturer complies with a set of self-regulatory guidelines, issued by representatives of the marketing or covered devices industries, or by other persons, that is approved under subsection (b).
Approval of guidelines—
In general— Not later than 180 days after receiving a request for approval of a set of self-regulatory guidelines described in subsection (a), after notice and comment, the Commission shall—
if the Commission determines that such set of guidelines meets the requirements of this Act, approve such set of guidelines; and
if the Commission determines that such set of guidelines does not meet the requirements of this Act, deny approval of such set of guidelines.
Written conclusions— The Commission shall set forth in writing its conclusions relating to a determination under paragraph (1).
Appeals— Final action by the Commission on a request for approval of a set of self-regulatory guidelines described in subsection (a), or the failure of the Commission to act on such a request by the time required by subsection (b)(1), may be appealed to a district court of the United States of appropriate jurisdiction as provided for in section 706 of title 5, United States Code.
Sec. 7 Enforcement
Enforcement by Federal Trade Commission—
Unfair or deceptive acts or practices— A violation of this Act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
Actions by the Commission— The Commission shall enforce this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act, and any person who violates this Act shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act.
Enforcement by State attorneys general—
In general— If the attorney general of a State has reason to believe that any person has committed or is committing a violation of this Act that affects one or more residents of such State, such attorney general may bring a civil action exclusively in an appropriate district court of the United States to—
enjoin further such violation by the defendant;
enforce compliance with this Act;
obtain civil penalties in the amount provided for under subsection (a);
obtain other remedies permitted under State law; or
obtain damages, restitution, or other compensation on behalf of residents of such State.
Rule of construction— For purposes of bringing a civil action under paragraph (1), nothing in this subsection may be construed to prevent the attorney general of a State from exercising the powers conferred on such attorney general by the laws of such State to conduct investigations, administer oaths or affirmations, or compel the attendance of witnesses or the production of documentary and other evidence.
Actions by other State officials—
In general— In addition to civil actions brought by attorneys general under paragraph (1), any other officer of a State who is authorized by such State to do so, except for any private person on behalf of such State, may bring a civil action under paragraph (1), subject to the same requirements and limitations that apply under this subsection to civil actions brought by attorneys general.
Savings provision— Nothing in this subsection may be construed to prohibit an authorized official of a State from initiating or continuing any proceeding in a court of such State for a violation of any civil or criminal law of such State.
Sec. 8 Definitions
In this Act:
Ambient noise— The term “ambient noise” means human dialogue or any other sound that occurs in the range of the microphone of a covered device, other than during a period that—
begins when a user of the device says a wake word or uses another mechanism (such as pressing a button on the device) to activate any electronic function of the device; and
ends—
when the performance of the task or assistance requested by the user has been completed; or
if the user activates an electronic function of the device as described in subparagraph (A) but does not request the performance of a task or assistance within a reasonable time thereafter, at the expiration of such reasonable time.
Collect— The term “collect” means, with respect to covered information, obtaining such information in any manner, except when solely transmitting, routing, providing intermediate storage for, or providing connections for such covered information through a system or network.
Commission— The term “Commission” means the Federal Trade Commission.
Contents— The term “contents”, when used with respect to a communication, has the meaning given such term in section 2510 of title 18, United States Code.
Covered device— The term “covered device”—
means an internet-connected device—
a component of which is a microphone; and
that collects covered information; and
does not include any device that is solely marketed as a microphone.
Covered information— The term “covered information” means any information (including contents of a communication, date of birth, sex, height, weight, and geolocation information) that—
is obtained through the collection of ambient noise by a covered device; and
is linked or reasonably linkable to an individual.
Data broker— The term “data broker” means a person whose principal source of revenue is derived from processing or transferring the covered information of individuals with whom the person does not have a direct relationship on behalf of third parties and for the use of third parties.
Disclose— The term “disclose” means, with respect to covered information, to sell, release, transfer, share, disseminate, make available, or otherwise communicate or cause to be communicated such information to a third party.
Government entity— The term “government entity” means a Federal agency, State, local government, or other organization, as such terms are defined in section 3371 of title 5, United States Code.
Material— The term “material” means, with respect to a change to the operating system or firmware of a covered device, that—
the change affects the treatment of covered information by the covered device or the manufacturer; and
knowledge of the change may affect the decision of an average consumer of whether or not to continue using the device.
Owner— The term “owner” means, with respect to a covered device, any individual who is in possession of the device.
Process— The term “process” means to perform or cause to be performed any operation or set of operations on covered information, whether or not by automated means.
Retain— The term “retain” means, with respect to covered information, to store, secure, or otherwise maintain or cause the maintenance of such information.
Service provider—
In general— The term “service provider” means a person who collects, uses, or discloses covered information for the sole purpose of, and only to the extent that such person is, conducting business activities on behalf of, for the benefit of, under instruction of, and under contractual agreement with another person.
Limitation of application— A person shall only be considered a service provider in the course of activities described in subparagraph (A).
Exclusion— The term “service provider” does not include a data broker.
State— The term “State” means each State of the United States, the District of Columbia, each commonwealth, territory, or possession of the United States, and each federally recognized Indian Tribe.
Third party— The term “third party” means, with respect to a person, another person (including a government entity) that—
does not (directly or indirectly) control, is not (directly or indirectly) controlled by, and is not (directly or indirectly) under common control with the first person; and
is not a service provider of the first person.
Wake word— The term “wake word” means a word or phrase used to initiate an electronic function of a covered device.
Sec. 9 Effective date
This Act (except for section 6) shall take effect—
if the Commission first approves a set of self-regulatory guidelines under section 6 before the date that is 1 year after the date of the enactment of this Act, on the date that is 1 year after the date of the enactment of this Act;
if the Commission first approves a set of self-regulatory guidelines under section 6 on or after the date that is 1 year after the date of the enactment of this Act but before the date that is 2 years after the date of the enactment of this Act, on the date on which the Commission approves such set of guidelines; or
if the Commission does not approve a set of self-regulatory guidelines under section 6 before the date that is 2 years after the date of the enactment of this Act, on the date that is 2 years after the date of the enactment of this Act.