Fourth Substitute H.B. 323

This document includes Senate 3rd Reading Floor Amendments incorporated into the bill on Wed, Mar 3, 2004 at 11:14 AM by smaeser. -->

Senator John L. Valentine proposes the following substitute bill:

1 SPYWARE REGULATION
2 2004 GENERAL SESSION
3 STATE OF UTAH
4 Sponsor: Stephen H. Urquhart
5
6 LONG TITLE
7 General Description:
8 This bill enacts provisions within the Commerce and Trade Code relating to certain
9 uses of spyware.
10 Highlighted Provisions:
11 This bill:
12 . defines terms;
13 . prohibits spyware from delivering advertisements to a computer under certain
14 circumstances;
15 . requires spyware to provide removal procedures;
16 . allows a website, trademark, or copyright owner to bring an action to enforce the
17 requirements; and
18 . requires the Division of Consumer Protection to collect complaints.
19 Monies Appropriated in this Bill:
20 None
21 Other Special Clauses:
22 None
23 Utah Code Sections Affected:
24 ENACTS:
25 13-39-101, Utah Code Annotated 1953

26 13-39-102, Utah Code Annotated 1953
27 13-39-201, Utah Code Annotated 1953
28 13-39-301, Utah Code Annotated 1953
29 13-39-302, Utah Code Annotated 1953
30 13-39-401, Utah Code Annotated 1953
31
32 Be it enacted by the Legislature of the state of Utah:
33 Section 1. Section 13-39-101 is enacted to read:
34 CHAPTER 39. SPYWARE CONTROL ACT
35 Part 1. General Provisions
36 13-39-101. Title.
37 This chapter is known as the "Spyware Control Act."
38 Section 2. Section 13-39-102 is enacted to read:
39 13-39-102. Definitions.
40 As used in this chapter:
41 (1) "Context based triggering mechanism" means a software based trigger or program
42 residing on a consumer's computer that displays an advertisement according to:
43 (a) the current Internet website accessed by a user; or
44 (b) the contents or characteristics of the current Internet website accessed by a user.
45 (2) "Division" means the Division of Consumer Protection in the Department of
46 Commerce.
47 (3) "Internet" is as defined in the Internet Tax Freedom Act, Pub. L. No. 105-277.
48 (4) Except as provided in Subsection (5), "spyware" means software residing on a
49 computer that:
50 (a) monitors the computer's usage;
51 (b) (i) sends information about the computer's usage to a remote computer or server; or
52 (ii) displays or causes to be displayed an advertisement in response to the computer's
53 usage if the advertisement:
54 (A) does not clearly identify the full legal name of the entity responsible for delivering
55 the advertisement;
56 (B) uses a federally registered trademark as a trigger for the display of the

57 advertisement by a person other than:
58 (I) the trademark owner;
59 (II) an authorized agent of licensee of the trademark owner; or
60 (III) a recognized Internet search engine;
61 (C) uses a triggering mechanism to display the advertisement according to the Internet
62 websites accessed by a user; or
63 (D) uses a context based triggering mechanism to display the advertisement that
64 partially or wholly covers or obscures paid advertising or other content on an Internet website
65 in a way that interferes with a user's ability to view the Internet website; and
66 (c) does not:
67 (i) obtain the consent of the user, S AT THE TIME OF, OR s after installation of the
67a software but before the
68 software does any of the actions described in Subsection (4)(b);
69 (A) to a license agreement:
70 (I) presented in full; and
71 (II) written in plain language;
72 (B) to a notice of the collection of each specific type of information to be transmitted
73 as a result of the software installation;
74 (C) to a clear and representative full-size example of each type of advertisement that
75 may be delivered;
76 (D) to a truthful statement of the frequency with which each type of advertisement may
77 be delivered; and
78 (E) for each type of advertisement delivered by the software, a clear description of a
79 method by which a user may distinguish the advertisement by its appearance from an
80 advertisement generated by other software services; and
81 (ii) provide a method:
82 (A) by which a user may quickly and easily disable and remove the software from the
83 user's computer;
84 (B) that does not have other effects on the non-affiliated parts of the user's computer;
85 and
86 (C) that uses obvious, standard , usual, and ordinary methods for removal of computer
87 software.

88 (5) Notwithstanding Subsection (4), "spyware" does not include:
89 (a) software designed and installed solely to diagnose or resolve technical difficulties;
90 (b) software or data that solely report to an Internet website information previously
91 stored by the Internet website on the user's computer, including:
92 (i) cookies;
93 (ii) HTML code; or
94 (iii) Java Scripts; or
95 (c) an operating system.
96 (6) "Usage" means:
97 (a) the Internet websites accessed by a user;
98 (b) the contents or characteristics of the Internet websites accessed by a user;
99 (c) a user's personal information, including:
100 (i) a first and last name of a user, whether:
101 (A) given at birth or adoption;
102 (B) assumed; or
103 (C) legally changed;
104 (ii) any of the following with respect to a user's home or other physical address:
105 (A) the street name;
106 (B) the name of the city or town; or
107 (C) the zip code;
108 (iii) an electronic mail address;
109 (iv) a telephone number;
110 (v) a Social Security number;
111 (vi) any personal identification number;
112 (vii) a credit card number;
113 (viii) any access code associated with a credit card;
114 (ix) a date of birth, birth certificate number, or place of birth; or
115 (x) a password or access code; or
116 (d) a user's submission to forms or Internet websites.
117 (7) "User" means:
118 (a) a computer owner; or

119 (b) a person who accesses an Internet website.
120 Section 3. Section 13-39-201 is enacted to read:
121 Part 2. Prohibited Conduct
122 13-39-201. Prohibited conduct.
123 (1) A person may not:
124 (a) install spyware on another person's computer;
125 (b) cause spyware to be installed on another person's computer; or
126 (c) use a context based triggering mechanism to display an advertisement that partially
127 or wholly covers or obscures paid advertising or other content on an Internet website in a way
128 that interferes with a user's ability to view the Internet website.
129 (2) It is not a defense to a violation of this section that a user may remove or hide an
130 advertisement.
131 Section 4. Section 13-39-301 is enacted to read:
132 Part 3. Enforcement
133 13-39-301. Private action.
134 (1) An action for a violation of this chapter may be brought:
135 (a) against a person who:
136 (i) violates this chapter; or
137 (ii) causes a violation of this chapter; and
138 (b) by any of the following who are adversely affected by a violation of this chapter:
139 (i) an Internet website owner or registrant;
140 (ii) a trademark or copyright owner; or
141 (iii) an authorized advertiser on an Internet website.
142 (2) In an action under Subsection (1), a person may:
143 (a) obtain an injunction against committing any further violation of this chapter; and
144 (b) recover the greater of:
145 (i) actual damages; or
146 (ii) $10,000 for each separate violation of this chapter.
147 (3) In an action under Subsection (1), a court may:
148 (a) increase the damages up to three times the damages allowed by Subsection (2) if the
149 court finds the defendant willfully or knowingly violated this chapter; and

150 (b) award costs and reasonable attorney fees to a prevailing party.
151 (4) For purposes of this section, a separate violation occurs for each individual
152 occurrence that results in the display of an advertisement described in Subsection
153 13-39-102 (4)(b)(ii).
154 Section 5. Section 13-39-302 is enacted to read:
155 13-39-302. Limitations on actions.
156 (1) A person may not bring an action for a violation of this chapter against an Internet
157 service provider for the routine transmission of:
158 (a) security information; or
159 (b) information that contains an advertisement violating this chapter.
160 (2) A person may not bring a class action under this chapter.
161 Section 6. Section 13-39-401 is enacted to read:
162 Part 4. Duties of Division
163 13-39-401. Information gathering -- Evaluations.
164 The division shall:
165 (1) establish procedures by which a person may report a violation of this chapter to the
166 division, including:
167 (a) an Internet website; and
168 (b) a toll-free telephone number; and
169 (2) make recommendations to the Public Utilities and Technology Interim Committee
170 if the division finds a need for additional provisions to this chapter.

Legislative Review Note
as of 3-1-04 12:08 PM

This bill regulates software that creates advertisements on a computer as a result of visiting
certain Internet websites, and that collects information regarding the computer's Internet use.
Case law surrounding regulation of Internet activities is evolving. State regulations of Internet
activities have been challenged for violating principles such as the Commerce Clause of the
United States Constitution. Some courts have indicated that the need for national uniformity
limits a state's ability to regulate Internet activities. Under other court rulings, however, this bill
could be upheld if a court determined that the benefits this bill provides to Utahans outweigh
the burden the bill places on interstate commerce.

Office of Legislative Research and General Counsel