(1)–(9) In this Act: (1) ARTIFICIAL INTELLIGENCE SYSTEMArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that— (A) is capable of influencing the environment by producing an output, including predictions, recommendations or decisions, for a given set of objectives; and (B) uses machine or human-based data and inputs to— (i) perceive real or virtual environments; (ii) abstract these perceptions into models through analysis in an automated manner (such as by using machine learning) or manually; and (iii) use model inference to formulate options for outcomes.Sec. 2(1).—The term ''artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that— (A) is capable of influencing the environment by producing an output, including predictions, recommendations or decisions, for a given set of objectives; and (B) uses machine or human-based data and inputs to— (i) perceive real or virtual environments; (ii) abstract these perceptions into models through analysis in an automated manner (such as by using machine learning) or manually; and (iii) use model inference to formulate options for outcomes.Sec. 2(1)'' means a machine-based system that— (A) is capable of influencing the environment by producing an output, including predictions, recommendations or decisions, for a given set of objectives; and (B) uses machine or human-based data and inputs to— (i) perceive real or virtual environments; (ii) abstract these perceptions into models through analysis in an automated manner (such as by using machine learning) or manually; and (iii) use model inference to formulate options for outcomes. (2) COMMISSIONCommissionThe term "Commission" means the Federal Trade Commission.Sec. 2(2).—The term ''CommissionCommissionThe term "Commission" means the Federal Trade Commission.Sec. 2(2)'' means the Federal Trade CommissionCommissionThe term "Commission" means the Federal Trade Commission.Sec. 2(2). (3) COVERED DATACovered dataThe term "covered data" means information relating to an individual that— (A) is collected by a covered entity in the course of the individual using a product, tool, platform, or service offered by the covered entity; and (B) identifies or is linked or reasonably linkable, alone or in combination with other information, to the individual or a device that identifies or is linked or reasonably linkable to the individual, and shall include derived data and unique persistent identifiers.Sec. 2(3).—The term ''covered dataCovered dataThe term "covered data" means information relating to an individual that— (A) is collected by a covered entity in the course of the individual using a product, tool, platform, or service offered by the covered entity; and (B) identifies or is linked or reasonably linkable, alone or in combination with other information, to the individual or a device that identifies or is linked or reasonably linkable to the individual, and shall include derived data and unique persistent identifiers.Sec. 2(3)'' means information relating to an individual that— (A) is collected by a covered entityCovered entityThe term "covered entity" means a person, partnership, or corporation subject to the jurisdiction of the Commission under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)).Sec. 2(4) in the course of the individual using a product, tool, platform, or service offered by the covered entityCovered entityThe term "covered entity" means a person, partnership, or corporation subject to the jurisdiction of the Commission under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)).Sec. 2(4); and (B) identifies or is linked or reasonably linkable, alone or in combination with other information, to the individual or a deviceDeviceThe term "device" means any electronic equipment capable of collecting, processing, or transferring covered data that is used by one or more individuals.Sec. 2(7) that identifies or is linked or reasonably linkable to the individual, and shall include derived dataDerived dataThe term "derived data" means covered data that is created by the derivation of information, data, assumptions, correlations, inferences, predictions, or conclusions from facts, evidence, or another source of information or data about an individual or an individual's device.Sec. 2(6) and unique persistent identifiersUnique persistent identifierThe term "unique persistent identifier"— (A) means an identifier to the extent that such identifier is reasonably linkable to an individual or device that identifies or is linked or reasonably linkable to 1 or more individuals, including a device identifier, Internet Protocol address, cookie, beacon, pixel tag, mobile ad identifier, or similar technology, customer number, unique pseudonym, user alias, telephone number or other form of persistent or probabilistic identifier that is linked or reasonably linkable to an individual or device; and (B) does not include an identifier assigned by a covered entity for the specific purpose of giving effect to an individual's exercise of express informed consent or revocation of consent to the collection of covered data to train an artificial intelligence system.Sec. 2(9). (4) COVERED ENTITYCovered entityThe term "covered entity" means a person, partnership, or corporation subject to the jurisdiction of the Commission under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)).Sec. 2(4).—The term ''covered entityCovered entityThe term "covered entity" means a person, partnership, or corporation subject to the jurisdiction of the Commission under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)).Sec. 2(4)'' means a person, partnership, or corporation subject to the jurisdiction of the CommissionCommissionThe term "Commission" means the Federal Trade Commission.Sec. 2(2) under section 5(a)(2) of the Federal Trade CommissionCommissionThe term "Commission" means the Federal Trade Commission.Sec. 2(2) Act (15 U.S.C. 45(a)(2)). (5) DE-IDENTIFIED DATADe-identified dataThe term "de-identified data" means information that has been processed such that the information does not identify and is not linked or reasonably linkable to a distinct individual or a device, regardless of whether the information is aggregated, and if the covered entity holding such information— (A) takes reasonable technical measures to ensure that the information cannot, at any point, be used to re-identify any individual or device that identifies or is linked or reasonably linkable to an individual; (B) publicly commits in a clear and conspicuous manner— (i) to process and transfer the information solely in a de-identified form without any reasonable means for re-identification; and (ii) to not attempt to re-identify the information with any individual or device that identifies or is linked or reasonably linkable to an individual; and (C) contractually obligates any person or entity that receives the information from the covered entity— (i) to comply with all of the provisions of this paragraph with respect to the information; and (ii) to require that such contractual obligations be included contractually in all subsequent instances for which the data may be received.Sec. 2(5).—The term ''de-identified dataDe-identified dataThe term "de-identified data" means information that has been processed such that the information does not identify and is not linked or reasonably linkable to a distinct individual or a device, regardless of whether the information is aggregated, and if the covered entity holding such information— (A) takes reasonable technical measures to ensure that the information cannot, at any point, be used to re-identify any individual or device that identifies or is linked or reasonably linkable to an individual; (B) publicly commits in a clear and conspicuous manner— (i) to process and transfer the information solely in a de-identified form without any reasonable means for re-identification; and (ii) to not attempt to re-identify the information with any individual or device that identifies or is linked or reasonably linkable to an individual; and (C) contractually obligates any person or entity that receives the information from the covered entity— (i) to comply with all of the provisions of this paragraph with respect to the information; and (ii) to require that such contractual obligations be included contractually in all subsequent instances for which the data may be received.Sec. 2(5)'' means information that has been processed such that the information does not identify and is not linked or reasonably linkable to a distinct individual or a deviceDeviceThe term "device" means any electronic equipment capable of collecting, processing, or transferring covered data that is used by one or more individuals.Sec. 2(7), regardless of whether the information is aggregated, and if the covered entityCovered entityThe term "covered entity" means a person, partnership, or corporation subject to the jurisdiction of the Commission under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)).Sec. 2(4) holding such information— (A) takes reasonable technical measures to ensure that the information cannot, at any point, be used to re-identify any individual or deviceDeviceThe term "device" means any electronic equipment capable of collecting, processing, or transferring covered data that is used by one or more individuals.Sec. 2(7) that identifies or is linked or reasonably linkable to an individual; (B) publicly commits in a clear and conspicuous manner— (i) to process and transferTransferThe term "transfer" means to disclose, release, disseminate, make available, license, rent, or share covered data orally, in writing, electronically, or by any other means.Sec. 2(8) the information solely in a de-identified form without any reasonable means for re-identification; and (ii) to not attempt to re-identify the information with any individual or deviceDeviceThe term "device" means any electronic equipment capable of collecting, processing, or transferring covered data that is used by one or more individuals.Sec. 2(7) that identifies or is linked or reasonably linkable to an individual; and (C) contractually obligates any person or entity that receives the information from the covered entityCovered entityThe term "covered entity" means a person, partnership, or corporation subject to the jurisdiction of the Commission under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)).Sec. 2(4)— (i) to comply with all of the provisions of this paragraph with respect to the information; and (ii) to require that such contractual obligations be included contractually in all subsequent instances for which the data may be received. (6) DERIVED DATADerived dataThe term "derived data" means covered data that is created by the derivation of information, data, assumptions, correlations, inferences, predictions, or conclusions from facts, evidence, or another source of information or data about an individual or an individual's device.Sec. 2(6).—The term ''derived dataDerived dataThe term "derived data" means covered data that is created by the derivation of information, data, assumptions, correlations, inferences, predictions, or conclusions from facts, evidence, or another source of information or data about an individual or an individual's device.Sec. 2(6)'' means covered dataCovered dataThe term "covered data" means information relating to an individual that— (A) is collected by a covered entity in the course of the individual using a product, tool, platform, or service offered by the covered entity; and (B) identifies or is linked or reasonably linkable, alone or in combination with other information, to the individual or a device that identifies or is linked or reasonably linkable to the individual, and shall include derived data and unique persistent identifiers.Sec. 2(3) that is created by the derivation of information, data, assumptions, correlations, inferences, predictions, or conclusions from facts, evidence, or another source of information or data about an individual or an individual's deviceDeviceThe term "device" means any electronic equipment capable of collecting, processing, or transferring covered data that is used by one or more individuals.Sec. 2(7). (7) DEVICEDeviceThe term "device" means any electronic equipment capable of collecting, processing, or transferring covered data that is used by one or more individuals.Sec. 2(7).—The term ''deviceDeviceThe term "device" means any electronic equipment capable of collecting, processing, or transferring covered data that is used by one or more individuals.Sec. 2(7)'' means any electronic equipment capable of collecting, processing, or transferring covered dataCovered dataThe term "covered data" means information relating to an individual that— (A) is collected by a covered entity in the course of the individual using a product, tool, platform, or service offered by the covered entity; and (B) identifies or is linked or reasonably linkable, alone or in combination with other information, to the individual or a device that identifies or is linked or reasonably linkable to the individual, and shall include derived data and unique persistent identifiers.Sec. 2(3) that is used by one or more individuals. (8) TRANSFERTransferThe term "transfer" means to disclose, release, disseminate, make available, license, rent, or share covered data orally, in writing, electronically, or by any other means.Sec. 2(8).—The term ''transferTransferThe term "transfer" means to disclose, release, disseminate, make available, license, rent, or share covered data orally, in writing, electronically, or by any other means.Sec. 2(8)'' means to disclose, release, disseminate, make available, license, rent, or share covered dataCovered dataThe term "covered data" means information relating to an individual that— (A) is collected by a covered entity in the course of the individual using a product, tool, platform, or service offered by the covered entity; and (B) identifies or is linked or reasonably linkable, alone or in combination with other information, to the individual or a device that identifies or is linked or reasonably linkable to the individual, and shall include derived data and unique persistent identifiers.Sec. 2(3) orally, in writing, electronically, or by any other means. (9) UNIQUE PERSISTENT IDENTIFIERUnique persistent identifierThe term "unique persistent identifier"— (A) means an identifier to the extent that such identifier is reasonably linkable to an individual or device that identifies or is linked or reasonably linkable to 1 or more individuals, including a device identifier, Internet Protocol address, cookie, beacon, pixel tag, mobile ad identifier, or similar technology, customer number, unique pseudonym, user alias, telephone number or other form of persistent or probabilistic identifier that is linked or reasonably linkable to an individual or device; and (B) does not include an identifier assigned by a covered entity for the specific purpose of giving effect to an individual's exercise of express informed consent or revocation of consent to the collection of covered data to train an artificial intelligence system.Sec. 2(9).—The term ''unique persistent identifierUnique persistent identifierThe term "unique persistent identifier"— (A) means an identifier to the extent that such identifier is reasonably linkable to an individual or device that identifies or is linked or reasonably linkable to 1 or more individuals, including a device identifier, Internet Protocol address, cookie, beacon, pixel tag, mobile ad identifier, or similar technology, customer number, unique pseudonym, user alias, telephone number or other form of persistent or probabilistic identifier that is linked or reasonably linkable to an individual or device; and (B) does not include an identifier assigned by a covered entity for the specific purpose of giving effect to an individual's exercise of express informed consent or revocation of consent to the collection of covered data to train an artificial intelligence system.Sec. 2(9)''— (A) means an identifier to the extent that such identifier is reasonably linkable to an individual or deviceDeviceThe term "device" means any electronic equipment capable of collecting, processing, or transferring covered data that is used by one or more individuals.Sec. 2(7) that identifies or is linked or reasonably linkable to 1 or more individuals, including a deviceDeviceThe term "device" means any electronic equipment capable of collecting, processing, or transferring covered data that is used by one or more individuals.Sec. 2(7) identifier, Internet Protocol address, cookie, beacon, pixel tag, mobile ad identifier, or similar technology, customer number, unique pseudonym, user alias, telephone number or other form of persistent or probabilistic identifier that is linked or reasonably linkable to an individual or deviceDeviceThe term "device" means any electronic equipment capable of collecting, processing, or transferring covered data that is used by one or more individuals.Sec. 2(7); and (B) does not include an identifier assigned by a covered entityCovered entityThe term "covered entity" means a person, partnership, or corporation subject to the jurisdiction of the Commission under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)).Sec. 2(4) for the specific purpose of giving effect to an individual's exercise of express informed consent or revocation of consent to the collection of covered dataCovered dataThe term "covered data" means information relating to an individual that— (A) is collected by a covered entity in the course of the individual using a product, tool, platform, or service offered by the covered entity; and (B) identifies or is linked or reasonably linkable, alone or in combination with other information, to the individual or a device that identifies or is linked or reasonably linkable to the individual, and shall include derived data and unique persistent identifiers.Sec. 2(3) to train an artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that— (A) is capable of influencing the environment by producing an output, including predictions, recommendations or decisions, for a given set of objectives; and (B) uses machine or human-based data and inputs to— (i) perceive real or virtual environments; (ii) abstract these perceptions into models through analysis in an automated manner (such as by using machine learning) or manually; and (iii) use model inference to formulate options for outcomes.Sec. 2(1).

(a) 1 PROHIBITION.—Not later than 1 year after the date of enactment of this Act, the CommissionCommissionThe term "Commission" means the Federal Trade Commission.Sec. 2(2) shall promulgate regulations under section 553 of title 5, United States Code, to prohibit covered entities from using or selling or transferring to a third party any covered data of an individual that is collected by the covered entityCovered entityThe term "covered entity" means a person, partnership, or corporation subject to the jurisdiction of the Commission under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)).Sec. 2(4) to train an artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that— (A) is capable of influencing the environment by producing an output, including predictions, recommendations or decisions, for a given set of objectives; and (B) uses machine or human-based data and inputs to— (i) perceive real or virtual environments; (ii) abstract these perceptions into models through analysis in an automated manner (such as by using machine learning) or manually; and (iii) use model inference to formulate options for outcomes.Sec. 2(1) except as provided in subsection (b).

(b)(1) 1 USE OF COVERED DATACovered dataThe term "covered data" means information relating to an individual that— (A) is collected by a covered entity in the course of the individual using a product, tool, platform, or service offered by the covered entity; and (B) identifies or is linked or reasonably linkable, alone or in combination with other information, to the individual or a device that identifies or is linked or reasonably linkable to the individual, and shall include derived data and unique persistent identifiers.Sec. 2(3) TO TRAIN ARTIFICIAL INTELLIGENCE SYSTEMSArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that— (A) is capable of influencing the environment by producing an output, including predictions, recommendations or decisions, for a given set of objectives; and (B) uses machine or human-based data and inputs to— (i) perceive real or virtual environments; (ii) abstract these perceptions into models through analysis in an automated manner (such as by using machine learning) or manually; and (iii) use model inference to formulate options for outcomes.Sec. 2(1) PURSUANT TO EXPRESS INFORMED CONSENT.—The regulations promulgated by the CommissionCommissionThe term "Commission" means the Federal Trade Commission.Sec. 2(2) under subsection (a) shall include the following: (1) The regulations permit a covered entityCovered entityThe term "covered entity" means a person, partnership, or corporation subject to the jurisdiction of the Commission under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)).Sec. 2(4) to use covered data of an individual to train an artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that— (A) is capable of influencing the environment by producing an output, including predictions, recommendations or decisions, for a given set of objectives; and (B) uses machine or human-based data and inputs to— (i) perceive real or virtual environments; (ii) abstract these perceptions into models through analysis in an automated manner (such as by using machine learning) or manually; and (iii) use model inference to formulate options for outcomes.Sec. 2(1) or to sell or transferTransferThe term "transfer" means to disclose, release, disseminate, make available, license, rent, or share covered data orally, in writing, electronically, or by any other means.Sec. 2(8) such data to a third party for such purpose if the covered entityCovered entityThe term "covered entity" means a person, partnership, or corporation subject to the jurisdiction of the Commission under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)).Sec. 2(4) first— (A) provides the individual with a clear and conspicuous disclosure of how the covered entityCovered entityThe term "covered entity" means a person, partnership, or corporation subject to the jurisdiction of the Commission under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)).Sec. 2(4) or third party will use the individual's covered dataCovered dataThe term "covered data" means information relating to an individual that— (A) is collected by a covered entity in the course of the individual using a product, tool, platform, or service offered by the covered entity; and (B) identifies or is linked or reasonably linkable, alone or in combination with other information, to the individual or a device that identifies or is linked or reasonably linkable to the individual, and shall include derived data and unique persistent identifiers.Sec. 2(3); and (B) obtains the express informed consent of the individual for the covered entityCovered entityThe term "covered entity" means a person, partnership, or corporation subject to the jurisdiction of the Commission under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)).Sec. 2(4) or third party to use the individual's covered dataCovered dataThe term "covered data" means information relating to an individual that— (A) is collected by a covered entity in the course of the individual using a product, tool, platform, or service offered by the covered entity; and (B) identifies or is linked or reasonably linkable, alone or in combination with other information, to the individual or a device that identifies or is linked or reasonably linkable to the individual, and shall include derived data and unique persistent identifiers.Sec. 2(3) for such purpose.

(b)(2) 2 For purposes of the disclosure required under paragraph (1)(A), the regulations shall— (A) provide a standard for what constitutes a clear and conspicuous disclosure that takes into account— (i) different platform types, including websites, mobile applications, and search engines; (ii) the size, font, color, or other visual affects of such a disclosure; (iii) the brevity, accessibility, and clarity of such a disclosure such that it may be understood by a reasonable person; (iv) the medium of such a disclosure—including text, audio, and video components—and the efficacy of these media to ensure the individual's attention and information; (v) the timeliness and location of such a disclosure; and (vi) any other criteria determined appropriate by the CommissionCommissionThe term "Commission" means the Federal Trade Commission.Sec. 2(2); (B) consider the possibility of consumer fatigue toward such disclosures and minimize its impact; (C) require that the disclosure clearly explains the individual's applicable rights related to consent, including that service shall not be conditioned on the granting of consent by the individual; (D) require that the disclosure state how an individual's covered dataCovered dataThe term "covered data" means information relating to an individual that— (A) is collected by a covered entity in the course of the individual using a product, tool, platform, or service offered by the covered entity; and (B) identifies or is linked or reasonably linkable, alone or in combination with other information, to the individual or a device that identifies or is linked or reasonably linkable to the individual, and shall include derived data and unique persistent identifiers.Sec. 2(3) may be used to train artificial intelligence systemsArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that— (A) is capable of influencing the environment by producing an output, including predictions, recommendations or decisions, for a given set of objectives; and (B) uses machine or human-based data and inputs to— (i) perceive real or virtual environments; (ii) abstract these perceptions into models through analysis in an automated manner (such as by using machine learning) or manually; and (iii) use model inference to formulate options for outcomes.Sec. 2(1) by the covered entityCovered entityThe term "covered entity" means a person, partnership, or corporation subject to the jurisdiction of the Commission under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)).Sec. 2(4) or sold or transferred to third parties that may do the same; and (E) require that the disclosure offer instructions on how an individual may grant or revoke consent.

(b)(3) 3 For purposes of the consent required under paragraph (1)(B), the regulations shall require that— (A) individuals may grant or revoke consent at any time through an accessible and easily navigable mechanism; (B) the option to withhold or revoke consent shall be at least as prominent as the option to accept and shall take the same number of steps or fewer as the option to accept; (C) such consent is obtained independently from the covered entities' terms of service agreement; (D) such consent cannot be inferred from an individual's action or inaction, such as hovering over or closing a window or piece of content; (E) services provided by a covered entityCovered entityThe term "covered entity" means a person, partnership, or corporation subject to the jurisdiction of the Commission under section 5(a)(2) of the Federal Trade Commission Act (15 U.S.C. 45(a)(2)).Sec. 2(4) may not be reduced, restricted, or made conditional on whether an individual withholds consent; and (F) should an individual revoke consent, all covered data of the individual shall be expunged from datasets used to train an artificial intelligence systemArtificial intelligence systemThe term "artificial intelligence system" means a machine-based system that— (A) is capable of influencing the environment by producing an output, including predictions, recommendations or decisions, for a given set of objectives; and (B) uses machine or human-based data and inputs to— (i) perceive real or virtual environments; (ii) abstract these perceptions into models through analysis in an automated manner (such as by using machine learning) or manually; and (iii) use model inference to formulate options for outcomes.Sec. 2(1) following the revocation of consent.

Not later than 1 year after the date of enactment of this Act, the CommissionCommissionThe term "Commission" means the Federal Trade Commission.Sec. 2(2) shall submit to the Committee on Commerce, Science, and Technology of the Senate and the Committee on Energy and Commerce of the House of Representatives a report on methods used by covered entities to convert covered dataCovered dataThe term "covered data" means information relating to an individual that— (A) is collected by a covered entity in the course of the individual using a product, tool, platform, or service offered by the covered entity; and (B) identifies or is linked or reasonably linkable, alone or in combination with other information, to the individual or a device that identifies or is linked or reasonably linkable to the individual, and shall include derived data and unique persistent identifiers.Sec. 2(3) into de-identified dataDe-identified dataThe term "de-identified data" means information that has been processed such that the information does not identify and is not linked or reasonably linkable to a distinct individual or a device, regardless of whether the information is aggregated, and if the covered entity holding such information— (A) takes reasonable technical measures to ensure that the information cannot, at any point, be used to re-identify any individual or device that identifies or is linked or reasonably linkable to an individual; (B) publicly commits in a clear and conspicuous manner— (i) to process and transfer the information solely in a de-identified form without any reasonable means for re-identification; and (ii) to not attempt to re-identify the information with any individual or device that identifies or is linked or reasonably linkable to an individual; and (C) contractually obligates any person or entity that receives the information from the covered entity— (i) to comply with all of the provisions of this paragraph with respect to the information; and (ii) to require that such contractual obligations be included contractually in all subsequent instances for which the data may be received.Sec. 2(5). Such report shall include an evaluation of whether, given advancements in artificial intelligence technology, there are any reasonable technical measures covered entities could take, in addition to those measures currently used by covered entities, to ensure that covered dataCovered dataThe term "covered data" means information relating to an individual that— (A) is collected by a covered entity in the course of the individual using a product, tool, platform, or service offered by the covered entity; and (B) identifies or is linked or reasonably linkable, alone or in combination with other information, to the individual or a device that identifies or is linked or reasonably linkable to the individual, and shall include derived data and unique persistent identifiers.Sec. 2(3) that has been converted to de-identified dataDe-identified dataThe term "de-identified data" means information that has been processed such that the information does not identify and is not linked or reasonably linkable to a distinct individual or a device, regardless of whether the information is aggregated, and if the covered entity holding such information— (A) takes reasonable technical measures to ensure that the information cannot, at any point, be used to re-identify any individual or device that identifies or is linked or reasonably linkable to an individual; (B) publicly commits in a clear and conspicuous manner— (i) to process and transfer the information solely in a de-identified form without any reasonable means for re-identification; and (ii) to not attempt to re-identify the information with any individual or device that identifies or is linked or reasonably linkable to an individual; and (C) contractually obligates any person or entity that receives the information from the covered entity— (i) to comply with all of the provisions of this paragraph with respect to the information; and (ii) to require that such contractual obligations be included contractually in all subsequent instances for which the data may be received.Sec. 2(5) cannot at any point be used to re-identify an individual or their deviceDeviceThe term "device" means any electronic equipment capable of collecting, processing, or transferring covered data that is used by one or more individuals.Sec. 2(7).

(a) UNFAIR AND DECEPTIVE ACTS OR PRACTICES.—A violation of a regulation promulgated under this Act shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade CommissionCommissionThe term "Commission" means the Federal Trade Commission.Sec. 2(2) Act (15 U.S.C. 57a(a)(1)(B)).

(b)(1)–(2) POWERS OF THE COMMISSIONCommissionThe term "Commission" means the Federal Trade Commission.Sec. 2(2).— (1) IN GENERAL.—The CommissionCommissionThe term "Commission" means the Federal Trade Commission.Sec. 2(2) shall enforce regulations promulgated under this Act in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade CommissionCommissionThe term "Commission" means the Federal Trade Commission.Sec. 2(2) Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of such regulations. (2) PRIVILEGES AND IMMUNITIES.—Any person that violates a regulation promulgated under this Act shall be subject to the penalties, and entitled to the privileges and immunities, provided in the Federal Trade CommissionCommissionThe term "Commission" means the Federal Trade Commission.Sec. 2(2) Act (15 U.S.C. 41 et seq.).

(b)(3) REGULATIONS.—The CommissionCommissionThe term "Commission" means the Federal Trade Commission.Sec. 2(2) shall, pursuant to section 553 of title 5, United States Code, promulgate such regulations as the CommissionCommissionThe term "Commission" means the Federal Trade Commission.Sec. 2(2) determines necessary to carry out the provisions of this Act.

(b)(4) AUTHORITY PRESERVED.—Nothing in this Act shall be construed to limit the authority of the CommissionCommissionThe term "Commission" means the Federal Trade Commission.Sec. 2(2) under any other provision of law.

(a) IN GENERAL.—Nothing in this Act shall be construed to preempt the law of any State that provides greater protections to users of the services provided by covered entities and individuals generally than the protections provided by the regulations promulgated under this Act.

(b) DEFINITION OF STATE.—In this section, the term ''State'' means any of the 50 states, the District of Columbia, the Commonwealth of Puerto Rico, the Virgin Islands of the United States, Guam, American Samoa, or the Commonwealth of the Northern Mariana Islands.