Prevent Recording of Individuals with Video and Audio Technologies when not Enabled Act or the PRIVATE Act
This bill generally prohibits collecting, transmitting, disclosing, or otherwise using data from a camera or microphone of an internet-connected device.
A device manufacturer or software application developer may not use such data unless the use is (1) reasonably required for the device's functionality, and (2) limited to instances when the individual is actively operating the device. For voice-activated functionality, the bill also prohibits data use before the functionality is activated. Additionally, individuals must expressly and affirmatively consent to data use and may revoke this consent.
To obtain consent, manufacturers and developers must provide individuals with a brief notice that describes the data use and meets other requirements. They must also maintain a separate privacy policy that details how the entity specifically uses data from a device's camera or microphone.
The Federal Trade Commission (FTC) must (1) issue guidance and sample language for brief notices, and (2) enforce the bill's prohibitions as an unfair or deceptive act or practice.
The bill provides a safe harbor from such enforcement if a manufacturer or developer obtains FTC approval for the requisite brief notice and privacy policy.
[Congressional Bills 117th Congress]
[From the U.S. Government Publishing Office]
[H.R. 5696 Introduced in House (IH)]
<DOC>
117th CONGRESS
1st Session
H. R. 5696
To provide for certain requirements for the collection, transmission,
processing, or disclosure of camera or microphone data by the
manufacturer of an internet-connected device or developer of an
application installed on such a device, and for other purposes.
_______________________________________________________________________
IN THE HOUSE OF REPRESENTATIVES
October 22, 2021
Mr. Jacobs of New York (for himself, Mr. Case, and Mr. Rutherford)
introduced the following bill; which was referred to the Committee on
Energy and Commerce
_______________________________________________________________________
A BILL
To provide for certain requirements for the collection, transmission,
processing, or disclosure of camera or microphone data by the
manufacturer of an internet-connected device or developer of an
application installed on such a device, and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Prevent Recording of Individuals
with Video and Audio Technologies when not Enabled Act'' or the
``PRIVATE Act''.
SEC. 2. TREATMENT OF CAMERA AND MICROPHONE DATA BY INTERNET-CONNECTED
DEVICES AND APPLICATIONS.
(a) Prohibition.--
(1) In general.--A covered entity may not collect any data
using the camera or microphone of a covered device of an
individual, cause any data so collected to be transmitted from
the device, or process or disclose to another person any data
so collected, unless--
(A) the collection, transmission, processing, or
disclosure is consistent with reasonable consumer
expectations within the context of the interaction
between the covered entity and the individual; or
(B) the covered entity obtains the express,
affirmative consent of the individual to the
collection, transmission, processing, or disclosure in
the manner required by subsection (b).
(2) Reasonable consumer expectations.--For purposes of
paragraph (1)(A), the collection, transmission, processing, or
disclosure of data is not consistent with reasonable consumer
expectations if--
(A) the collection, transmission, processing, or
disclosure is not reasonably required for the
functionality of the covered device manufactured by the
covered entity or the covered application developed by
the covered entity (as the case may be); or
(B) the data is collected, transmitted, or
processed (regardless of whether the processing occurs
on the covered device or on the systems of the covered
entity) when the individual is not actively using the
covered device or covered application (as the case may
be).
(b) Requirements for Obtaining Express, Affirmative Consent.--
(1) In general.--To obtain the express, affirmative consent
of an individual to the collection of data using the camera or
microphone of a covered device of the individual, the causing
of any data so collected to be transmitted from the device, or
the processing or disclosure to another person of any data so
collected, a covered entity shall--
(A) provide to the individual a brief notice of the
collection, transmission, processing, or disclosure
that meets the requirements of paragraph (2); and
(B) obtain an affirmative response from the
individual indicating that the individual consents to
the collection, transmission, processing, or
disclosure.
(2) Brief notice.--The brief notice required by paragraph
(1)(A) shall--
(A) briefly describe the collection, transmission,
processing, or disclosure for which consent is sought;
(B) be provided in a conspicuous manner;
(C) be separate from any other privacy policy or
terms or conditions relating to the covered device or
covered application;
(D) be in plain language;
(E) be provided--
(i) in the case of a covered device that
has a screen (or a covered application
installed on a covered device that has a
screen)--
(I) in the form of text displayed
on the screen; and
(II) if the individual so chooses,
in spoken form; and
(ii) in the case of a covered device that
does not have a screen (or a covered
application installed on a covered device that
does not have a screen)--
(I) in spoken form; and
(II) if the individual so chooses,
in an alternative form that is
accessible to individuals with a
hearing impairment; and
(F) clearly and conspicuously direct the individual
to a website on which the individual may access the
privacy policy required by paragraph (3).
(3) Privacy policy for camera and microphone data.--A
covered entity that collects any data using the camera or
microphone of a covered device of an individual, causes any
data so collected to be transmitted from the device, or
processes or discloses to another person any data so collected,
shall maintain on a publicly available website a privacy policy
that describes in detail, but using plain language, the
collection, transmission, processing, or disclosure, including
the purposes of the collection, transmission, processing, or
disclosure. The privacy policy shall be separate from any other
privacy policy or terms or conditions relating to the covered
device or covered application and shall be displayed in a
conspicuous manner on the website.
(c) Voice-Activated Functionality.--
(1) In general.--Notwithstanding subsection (a)(1)(A)--
(A) if the covered device of an individual has
voice-activated functionality, the covered entity that
manufactured the covered device may not, in connection
with such functionality, collect any data using the
camera or microphone of the covered device, cause any
data so collected to be transmitted from the device, or
process or disclose to another person any data so
collected, unless, before such functionality is
activated, the covered entity obtains the express,
affirmative consent of the individual to the
collection, transmission, processing, or disclosure;
and
(B) if a covered application installed on the
covered device of an individual has voice-activated
functionality, the covered entity that developed the
covered application may not, in connection with such
functionality, collect any data using the camera or
microphone of the covered device, cause any data so
collected to be transmitted from the device, or process
or disclose to another person any data so collected,
unless, before such functionality is activated, the
covered entity obtains the express, affirmative consent
of the individual to the collection, transmission,
processing, or disclosure.
(2) Requirements.--The express, affirmative consent
required by paragraph (1) shall be obtained in the manner
required by subsection (b), except that the brief notice
required by subparagraph (A) of paragraph (1) of such
subsection and the affirmative response required by
subparagraph (B) of such paragraph shall be specific to the
collection, transmission, processing, or disclosure of data in
connection with the voice-activated functionality and separate
from the notice provided and response obtained under such
subparagraphs with respect to the collection, transmission,
processing, or disclosure of data not in connection with such
functionality.
(d) Status of Consent; Revocation.--A covered entity shall provide
a convenient means, on the covered device manufactured by the covered
entity or within the covered application developed by the covered
entity (as the case may be), for an individual--
(1) to revoke any consent provided under this section to
the collection, transmission, processing, or disclosure of
data; and
(2) to view whether the individual has provided or revoked
any such consent.
(e) Federal Trade Commission Guidance; Safe Harbor.--
(1) Guidance.--The Commission shall issue guidance
containing examples of language for the brief notice required
by subsection (b)(1)(A) (including text and spoken versions)
and the privacy policy required by subsection (b)(3).
(2) Safe harbor.--
(A) Submission of brief notice or privacy policy to
commission.--A covered entity may submit to the
Commission for approval a brief notice that the covered
entity intends to use to comply with subsection
(b)(1)(A) or a privacy policy that the covered entity
intends to use to comply with subsection (b)(3) with
respect to the collection, transmission, processing, or
disclosure of data. The covered entity shall include
with the submission such information as the Commission
may require about the collection, transmission,
processing, or disclosure, as the Commission considers
necessary to evaluate the adequacy of the brief notice
or privacy policy.
(B) Approval or rejection.--Not later than 120 days
after receiving a brief notice or privacy policy from a
covered entity under subparagraph (A), the Commission
shall approve or reject the brief notice or privacy
policy and inform the covered entity of the approval or
rejection.
(C) Effect.--If the Commission approves a brief
notice or privacy policy under subparagraph (B), the
brief notice or privacy policy shall be considered to
meet the requirements of subsection (b)(1)(A) or
(b)(3), respectively, with respect to the collection,
transmission, processing, or disclosure of data to
which the brief notice or privacy policy relates, to
the extent the covered entity conducts the collection,
transmission, processing, or disclosure in a manner
that is consistent in all material respects with the
information provided to the Commission under
subparagraph (A).
(f) Enforcement by Federal Trade Commission.--
(1) Unfair or deceptive acts or practices.--A violation of
this section or a regulation promulgated under this section
shall be treated as a violation of a regulation under section
18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C.
57a(a)(1)(B)) regarding unfair or deceptive acts or practices.
(2) Powers of commission.--The Commission shall enforce
this section and the regulations promulgated under this section
in the same manner, by the same means, and with the same
jurisdiction, powers, and duties as though all applicable terms
and provisions of the Federal Trade Commission Act (15 U.S.C.
41 et seq.) were incorporated into and made a part of this
section. Any person who violates this section or a regulation
promulgated under this section shall be subject to the
penalties and entitled to the privileges and immunities
provided in the Federal Trade Commission Act.
(g) Rulemaking.--The Commission may promulgate regulations under
section 553 of title 5, United States Code, to implement this section.
(h) Definitions.--In this section:
(1) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(2) Covered application.--The term ``covered application''
means a software application that is designed to be installed
on a covered device.
(3) Covered device.--The term ``covered device'' means a
device that--
(A) is capable of connecting to the internet,
either directly or indirectly through a network;
(B) has computer processing capabilities for
collecting, transmitting, or otherwise processing data;
and
(C) has a camera or microphone.
(4) Covered entity.--The term ``covered entity'' means--
(A) a manufacturer of a covered device; and
(B) a developer of a covered application.
(5) Voice-activated functionality.--The term ``voice-
activated functionality'' means a functionality of a covered
device or covered application that--
(A) allows an individual to control the covered
device or covered application using voice commands; and
(B) uses the microphone of the covered device being
controlled, or the microphone of the covered device on
which the covered application being controlled is
installed, to listen for such commands when the
individual is not actively using the covered device or
covered application, respectively.
<all>
Introduced in House
Introduced in House
Referred to the House Committee on Energy and Commerce.
Referred to the Subcommittee on Consumer Protection and Commerce.
Llama 3.2 · runs locally in your browser
Ask anything about this bill. The AI reads the full text to answer.
Enter to send · Shift+Enter for new line