Prevent Recording of Individuals with Video and Audio Technologies when not Enabled Act or the PRIVATE Act
This bill generally prohibits collecting, transmitting, disclosing, or otherwise using data from a camera or microphone of an internet-connected device.
A device manufacturer or software application developer may not use such data unless the use is (1) reasonably required for the device's functionality, and (2) limited to instances when the individual is actively operating the device. For voice-activated functionality, the bill also prohibits data use before the functionality is activated. Additionally, individuals must expressly and affirmatively consent to data use and may revoke this consent.
To obtain consent, manufacturers and developers must provide individuals with a brief notice that describes the data use and meets other requirements. They must also maintain a separate privacy policy that details how the entity specifically uses data from a device's camera or microphone.
The Federal Trade Commission (FTC) must (1) issue guidance and sample language for brief notices, and (2) enforce the bill's prohibitions as an unfair or deceptive act or practice.
The bill provides a safe harbor from such enforcement if a manufacturer or developer obtains FTC approval for the requisite brief notice and privacy policy.
To provide for certain requirements for the collection, transmission, 
     processing, or disclosure of camera or microphone data by the 
    manufacturer of an internet-connected device or developer of an 
    application installed on such a device, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Prevent Recording of Individuals 
with Video and Audio Technologies when not Enabled Act'' or the 
``PRIVATE Act''.

SEC. 2. TREATMENT OF CAMERA AND MICROPHONE DATA BY INTERNET-CONNECTED 
              DEVICES AND APPLICATIONS.

    (a) Prohibition.--
            (1) In general.--A covered entity may not collect any data 
        using the camera or microphone of a covered device of an 
        individual, cause any data so collected to be transmitted from 
        the device, or process or disclose to another person any data 
        so collected, unless--
                    (A) the collection, transmission, processing, or 
                disclosure is consistent with reasonable consumer 
                expectations within the context of the interaction 
                between the covered entity and the individual; or
                    (B) the covered entity obtains the express, 
                affirmative consent of the individual to the 
                collection, transmission, processing, or disclosure in 
                the manner required by subsection (b).
            (2) Reasonable consumer expectations.--For purposes of 
        paragraph (1)(A), the collection, transmission, processing, or 
        disclosure of data is not consistent with reasonable consumer 
        expectations if--
                    (A) the collection, transmission, processing, or 
                disclosure is not reasonably required for the 
                functionality of the covered device manufactured by the 
                covered entity or the covered application developed by 
                the covered entity (as the case may be); or
                    (B) the data is collected, transmitted, or 
                processed (regardless of whether the processing occurs 
                on the covered device or on the systems of the covered 
                entity) when the individual is not actively using the 
                covered device or covered application (as the case may 
                be).
    (b) Requirements for Obtaining Express, Affirmative Consent.--
            (1) In general.--To obtain the express, affirmative consent 
        of an individual to the collection of data using the camera or 
        microphone of a covered device of the individual, the causing 
        of any data so collected to be transmitted from the device, or 
        the processing or disclosure to another person of any data so 
        collected, a covered entity shall--
                    (A) provide to the individual a brief notice of the 
                collection, transmission, processing, or disclosure 
                that meets the requirements of paragraph (2); and
                    (B) obtain an affirmative response from the 
                individual indicating that the individual consents to 
                the collection, transmission, processing, or 
                disclosure.
            (2) Brief notice.--The brief notice required by paragraph 
        (1)(A) shall--
                    (A) briefly describe the collection, transmission, 
                processing, or disclosure for which consent is sought;
                    (B) be provided in a conspicuous manner;
                    (C) be separate from any other privacy policy or 
                terms or conditions relating to the covered device or 
                covered application;
                    (D) be in plain language;
                    (E) be provided--
                            (i) in the case of a covered device that 
                        has a screen (or a covered application 
                        installed on a covered device that has a 
                        screen)--
                                    (I) in the form of text displayed 
                                on the screen; and
                                    (II) if the individual so chooses, 
                                in spoken form; and
                            (ii) in the case of a covered device that 
                        does not have a screen (or a covered 
                        application installed on a covered device that 
                        does not have a screen)--
                                    (I) in spoken form; and
                                    (II) if the individual so chooses, 
                                in an alternative form that is 
                                accessible to individuals with a 
                                hearing impairment; and
                    (F) clearly and conspicuously direct the individual 
                to a website on which the individual may access the 
                privacy policy required by paragraph (3).
            (3) Privacy policy for camera and microphone data.--A 
        covered entity that collects any data using the camera or 
        microphone of a covered device of an individual, causes any 
        data so collected to be transmitted from the device, or 
        processes or discloses to another person any data so collected, 
        shall maintain on a publicly available website a privacy policy 
        that describes in detail, but using plain language, the 
        collection, transmission, processing, or disclosure, including 
        the purposes of the collection, transmission, processing, or 
        disclosure. The privacy policy shall be separate from any other 
        privacy policy or terms or conditions relating to the covered 
        device or covered application and shall be displayed in a 
        conspicuous manner on the website.
    (c) Voice-Activated Functionality.--
            (1) In general.--Notwithstanding subsection (a)(1)(A)--
                    (A) if the covered device of an individual has 
                voice-activated functionality, the covered entity that 
                manufactured the covered device may not, in connection 
                with such functionality, collect any data using the 
                camera or microphone of the covered device, cause any 
                data so collected to be transmitted from the device, or 
                process or disclose to another person any data so 
                collected, unless, before such functionality is 
                activated, the covered entity obtains the express, 
                affirmative consent of the individual to the 
                collection, transmission, processing, or disclosure; 
                and
                    (B) if a covered application installed on the 
                covered device of an individual has voice-activated 
                functionality, the covered entity that developed the 
                covered application may not, in connection with such 
                functionality, collect any data using the camera or 
                microphone of the covered device, cause any data so 
                collected to be transmitted from the device, or process 
                or disclose to another person any data so collected, 
                unless, before such functionality is activated, the 
                covered entity obtains the express, affirmative consent 
                of the individual to the collection, transmission, 
                processing, or disclosure.
            (2) Requirements.--The express, affirmative consent 
        required by paragraph (1) shall be obtained in the manner 
        required by subsection (b), except that the brief notice 
        required by subparagraph (A) of paragraph (1) of such 
        subsection and the affirmative response required by 
        subparagraph (B) of such paragraph shall be specific to the 
        collection, transmission, processing, or disclosure of data in 
        connection with the voice-activated functionality and separate 
        from the notice provided and response obtained under such 
        subparagraphs with respect to the collection, transmission, 
        processing, or disclosure of data not in connection with such 
        functionality.
    (d) Status of Consent; Revocation.--A covered entity shall provide 
a convenient means, on the covered device manufactured by the covered 
entity or within the covered application developed by the covered 
entity (as the case may be), for an individual--
            (1) to revoke any consent provided under this section to 
        the collection, transmission, processing, or disclosure of 
        data; and
            (2) to view whether the individual has provided or revoked 
        any such consent.
    (e) Federal Trade Commission Guidance; Safe Harbor.--
            (1) Guidance.--The Commission shall issue guidance 
        containing examples of language for the brief notice required 
        by subsection (b)(1)(A) (including text and spoken versions) 
        and the privacy policy required by subsection (b)(3).
            (2) Safe harbor.--
                    (A) Submission of brief notice or privacy policy to 
                commission.--A covered entity may submit to the 
                Commission for approval a brief notice that the covered 
                entity intends to use to comply with subsection 
                (b)(1)(A) or a privacy policy that the covered entity 
                intends to use to comply with subsection (b)(3) with 
                respect to the collection, transmission, processing, or 
                disclosure of data. The covered entity shall include 
                with the submission such information as the Commission 
                may require about the collection, transmission, 
                processing, or disclosure, as the Commission considers 
                necessary to evaluate the adequacy of the brief notice 
                or privacy policy.
                    (B) Approval or rejection.--Not later than 120 days 
                after receiving a brief notice or privacy policy from a 
                covered entity under subparagraph (A), the Commission 
                shall approve or reject the brief notice or privacy 
                policy and inform the covered entity of the approval or 
                rejection.
                    (C) Effect.--If the Commission approves a brief 
                notice or privacy policy under subparagraph (B), the 
                brief notice or privacy policy shall be considered to 
                meet the requirements of subsection (b)(1)(A) or 
                (b)(3), respectively, with respect to the collection, 
                transmission, processing, or disclosure of data to 
                which the brief notice or privacy policy relates, to 
                the extent the covered entity conducts the collection, 
                transmission, processing, or disclosure in a manner 
                that is consistent in all material respects with the 
                information provided to the Commission under 
                subparagraph (A).
    (f) Enforcement by Federal Trade Commission.--
            (1) Unfair or deceptive acts or practices.--A violation of 
        this section or a regulation promulgated under this section 
        shall be treated as a violation of a regulation under section 
        18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 
        57a(a)(1)(B)) regarding unfair or deceptive acts or practices.
            (2) Powers of commission.--The Commission shall enforce 
        this section and the regulations promulgated under this section 
        in the same manner, by the same means, and with the same 
        jurisdiction, powers, and duties as though all applicable terms 
        and provisions of the Federal Trade Commission Act (15 U.S.C. 
        41 et seq.) were incorporated into and made a part of this 
        section. Any person who violates this section or a regulation 
        promulgated under this section shall be subject to the 
        penalties and entitled to the privileges and immunities 
        provided in the Federal Trade Commission Act.
    (g) Rulemaking.--The Commission may promulgate regulations under 
section 553 of title 5, United States Code, to implement this section.
    (h) Definitions.--In this section:
            (1) Commission.--The term ``Commission'' means the Federal 
        Trade Commission.
            (2) Covered application.--The term ``covered application'' 
        means a software application that is designed to be installed 
        on a covered device.
            (3) Covered device.--The term ``covered device'' means a 
        device that--
                    (A) is capable of connecting to the internet, 
                either directly or indirectly through a network;
                    (B) has computer processing capabilities for 
                collecting, transmitting, or otherwise processing data; 
                and
                    (C) has a camera or microphone.
            (4) Covered entity.--The term ``covered entity'' means--
                    (A) a manufacturer of a covered device; and
                    (B) a developer of a covered application.
            (5) Voice-activated functionality.--The term ``voice-
        activated functionality'' means a functionality of a covered 
        device or covered application that--
                    (A) allows an individual to control the covered 
                device or covered application using voice commands; and
                    (B) uses the microphone of the covered device being 
                controlled, or the microphone of the covered device on 
                which the covered application being controlled is 
                installed, to listen for such commands when the 
                individual is not actively using the covered device or 
                covered application, respectively.
                                 <all>
Prevent Recording of Individuals with Video and Audio Technologies when not Enabled Act
To provide for certain requirements for the collection, transmission, processing, or disclosure of camera or microphone data by the manufacturer of an internet-connected device or developer of an application installed on such a device, and for other purposes.
PRIVATE Act
Prevent Recording of Individuals with Video and Audio Technologies when not Enabled Act
Rep. Jacobs, Chris