Summary

Creates baseline privacy duties for online service providers that handle identifying and sensitive data. Providers must exercise care, loyalty, and confidentiality when handling such data, secure sensitive data, notify users of breaches, avoid using data to harm or unfairly advantage themselves against users, and limit disclosures to parties that adopt the same duties or are supervised. Gives the Federal Trade Commission rulemaking and enforcement authority to implement and enforce the law, lets state attorneys general and certain state consumer protection officers sue for violations and seek civil penalties, and prevents companies from contractually waiving the law’s rights and remedies. The core provider obligations begin 180 days after enactment, while other provisions are effective on signature.

Key Points

• Establishes duties of care, loyalty, and confidentiality for online service providers handling individual identifying and sensitive data.
• Requires reasonable security for sensitive data and breach notifications to users; FTC can expand or tailor notice rules.
• Prohibits using user data to harm users or to unfairly benefit the provider against users.
• Limits disclosure of covered data to third parties unless they adopt the same duties or are supervised.
• FTC has rulemaking and enforcement authority; violations treated as unfair or deceptive acts under the FTC Act.
• State attorneys general and designated state consumer protection officers may sue and seek civil penalties for knowing or repeated violations.
• Contractual waivers of the law’s rights and remedies are invalid; users cannot be forced to give up protections.
• The Act operates alongside existing federal and state privacy laws and preserves other legal authorities.
• Core provider obligations become enforceable 180 days after enactment to allow compliance time.

Categories & Tags