Spyware Control Act - Formatted, Indented Version
[ discussion and analysis of the bill - more on spyware research, testing, legislation, and suits ]

Bill status: Passed by the Utah Legislature on March 3. Signed into law on March 23 by Utah Governor Olene S. Walker. Challenged by WhenU on April 12, seeking that the act be declared void and invalid. (See WhenU.com, Inc., v. The State of Utah - Case Documents.)

Original bill as posted (without full indentation) to Utah State Legislature web site.

Fourth Substitute H.B. 323

Senator John L. Valentine proposes the following substitute bill:








Sponsor: Stephen H. Urquhart

             6      LONG TITLE
             7      General Description:
             8          This bill enacts provisions within the Commerce and Trade Code relatinvg to certain
             9      uses of spyware.
             10      Highlighted Provisions:
             11          This bill:
             12          .    defines terms;
             13          .    prohibits spyware from delivering advertisements to a computer under certain
             14      circumstances;
             15          .    requires spyware to provide removal procedures;
             16          .    allows a website, trademark, or copyright owner to bring an action to enforce the
             17      requirements; and
             18          .    requires the Division of Consumer Protection to collect complaints.
             19      Monies Appropriated in this Bill:
             20          None
             21      Other Special Clauses:
             22          None
             23      Utah Code Sections Affected:
             24      ENACTS:
             25          13-39-101, Utah Code Annotated 1953

             26          13-39-102, Utah Code Annotated 1953
             27          13-39-201, Utah Code Annotated 1953
             28          13-39-301, Utah Code Annotated 1953
             29          13-39-302, Utah Code Annotated 1953
             30          13-39-401, Utah Code Annotated 1953
             32      Be it enacted by the Legislature of the state of Utah:
             33          Section 1. Section 13-39-101 is enacted to read:



Part 1. General Provisions

             36          13-39-101. Title.
             37          This chapter is known as the "Spyware Control Act."
             38          Section 2. Section 13-39-102 is enacted to read:
             39          13-39-102. Definitions.
             40          As used in this chapter:
             41          (1) "Context based triggering mechanism" means a software based trigger or program
             42           residing on a consumer's computer that displays an advertisement according to:
             43                   (a) the current Internet website accessed by a user; or
             44                   (b) the contents or characteristics of the current Internet website accessed by a user.
             45          (2) "Division" means the Division of Consumer Protection in the Department of
             46          Commerce.
             47          (3) "Internet" is as defined in the Internet Tax Freedom Act, Pub. L. No. 105-277.
             48          (4) Except as provided in Subsection (5), "spyware" means software residing on a
             49          computer that:
             50                   (a) monitors the computer's usage;
             51                   (b)        (i) sends information about the computer's usage to a remote computer or server; or
             52                               (ii) displays or causes to be displayed an advertisement in response to the computer's
             53                               usage if the advertisement:
             54                                           (A) does not clearly identify the full legal name of the entity responsible for delivering
             55                                           the advertisement;
             56                                           (B) uses a federally registered trademark as a trigger for the display of the

             57                                           advertisement by a person other than:
             58                                                       (I) the trademark owner;
             59                                                       (II) an authorized agent of licensee of the trademark owner; or
             60                                                       (III) a recognized Internet search engine;
             61                                           (C) uses a triggering mechanism to display the advertisement according to the Internet
             62                                           websites accessed by a user; or
             63                                           (D) uses a context based triggering mechanism to display the advertisement that
             64                                           partially or wholly covers or obscures paid advertising or other content on an Internet website
             65                                           in a way that interferes with a user's ability to view the Internet website; and
             66                   (c) does not:
             67                               (i) obtain the consent of the user, at the time of, or after installation of the software but before the
             68                               software does any of the actions described in Subsection (4)(b);
             69                                           (A) to a license agreement:
             70                                                       (I) presented in full; and
             71                                                       (II) written in plain language;
             72                                           (B) to a notice of the collection of each specific type of information to be transmitted
             73                                           as a result of the software installation;
             74                                           (C) to a clear and representative full-size example of each type of advertisement that
             75                                           may be delivered;
             76                                           (D) to a truthful statement of the frequency with which each type of advertisement may
             77                                           be delivered; and
             78                                           (E) for each type of advertisement delivered by the software, a clear description of a
             79                                           method by which a user may distinguish the advertisement by its appearance from an
             80                                           advertisement generated by other software services; and
             81                               (ii) provide a method:
             82                                           (A) by which a user may quickly and easily disable and remove the software from the
             83                                           user's computer;
             84                                           (B) that does not have other effects on the non-affiliated parts of the user's computer;
             85                                           and
             86                                           (C) that uses obvious, standard , usual, and ordinary methods for removal of computer
             87                                           software.

             88          (5) Notwithstanding Subsection (4), "spyware" does not include:
             89                   (a) software designed and installed solely to diagnose or resolve technical difficulties;
             90                   (b) software or data that solely report to an Internet website information previously
             91                   stored by the Internet website on the user's computer, including:
             92                               (i) cookies;
             93                               (ii) HTML code; or
             94                               (iii) Java Scripts; or
             95                   (c) an operating system.
             96          (6) "Usage" means:
             97                   (a) the Internet websites accessed by a user;
             98                   (b) the contents or characteristics of the Internet websites accessed by a user;
             99                   (c) a user's personal information, including:
             100                             (i) a first and last name of a user, whether:
             101                                         (A) given at birth or adoption;
             102                                         (B) assumed; or
             103                                         (C) legally changed;
             104                             (ii) any of the following with respect to a user's home or other physical address:
             105                                         (A) the street name;
             106                                         (B) the name of the city or town; or
             107                                         (C) the zip code;
             108                             (iii) an electronic mail address;
             109                             (iv) a telephone number;
             110                             (v) a Social Security number;
             111                             (vi) any personal identification number;
             112                             (vii) a credit card number;
             113                             (viii) any access code associated with a credit card;
             114                             (ix) a date of birth, birth certificate number, or place of birth; or
             115                             (x) a password or access code; or
             116                 (d) a user's submission to forms or Internet websites.
             117          (7) "User" means:
             118                 (a) a computer owner; or

             119                 (b) a person who accesses an Internet website.
             120          Section 3. Section 13-39-201 is enacted to read:

Part 2. Prohibited Conduct

             122          13-39-201. Prohibited conduct.
             123          (1) A person may not:
             124                 (a) install spyware on another person's computer;
             125                 (b) cause spyware to be installed on another person's computer; or
             126                 (c) use a context based triggering mechanism to display an advertisement that partially
             127                 or wholly covers or obscures paid advertising or other content on an Internet website in a way
             128                 that interferes with a user's ability to view the Internet website.
             129          (2) It is not a defense to a violation of this section that a user may remove or hide an
             130          advertisement.
             131          Section 4. Section 13-39-301 is enacted to read:

Part 3. Enforcement

             133          13-39-301. Private action.
             134          (1) An action for a violation of this chapter may be brought:
             135                 (a) against a person who:
             136                             (i) violates this chapter; or
             137                             (ii) causes a violation of this chapter; and
             138                 (b) by any of the following who are adversely affected by a violation of this chapter:
             139                             (i) an Internet website owner or registrant;
             140                             (ii) a trademark or copyright owner; or
             141                             (iii) an authorized advertiser on an Internet website.
             142          (2) In an action under Subsection (1), a person may:
             143                 (a) obtain an injunction against committing any further violation of this chapter; and
             144                 (b) recover the greater of:
             145                             (i) actual damages; or
             146                             (ii) $10,000 for each separate violation of this chapter.
             147          (3) In an action under Subsection (1), a court may:
             148                 (a) increase the damages up to three times the damages allowed by Subsection (2) if the
             149                 court finds the defendant willfully or knowingly violated this chapter; and

             150                 (b) award costs and reasonable attorney fees to a prevailing party.
             151          (4) For purposes of this section, a separate violation occurs for each individual
             152          occurrence that results in the display of an advertisement described in Subsection
             153      13-39-102 (4)(b)(ii).
             154          Section 5. Section 13-39-302 is enacted to read:
             155          13-39-302. Limitations on actions.
             156          (1) A person may not bring an action for a violation of this chapter against an Internet
             157          service provider for the routine transmission of:
             158                 (a) security information; or
             159                 (b) information that contains an advertisement violating this chapter.
             160          (2) A person may not bring a class action under this chapter.
             161          Section 6. Section 13-39-401 is enacted to read:

Part 4. Duties of Division

             163          13-39-401. Information gathering -- Evaluations.
             164          The division shall:
             165          (1) establish procedures by which a person may report a violation of this chapter to the
             166          division, including:
             167                 (a) an Internet website; and
             168                 (b) a toll-free telephone number; and
             169          (2) make recommendations to the Public Utilities and Technology Interim Committee
             170          if the division finds a need for additional provisions to this chapter.

Legislative Review Note
    as of
3-1-04 12:08 PM

This bill regulates software that creates advertisements on a computer as a result of visiting
certain Internet websites, and that collects information regarding the computer's Internet use.
Case law surrounding regulation of Internet activities is evolving. State regulations of Internet
activities have been challenged for violating principles such as the Commerce Clause of the
United States Constitution. Some courts have indicated that the need for national uniformity
limits a state's ability to regulate Internet activities. Under other court rulings, however, this bill
could be upheld if a court determined that the benefits this bill provides to Utahans outweigh
the burden the bill places on interstate commerce.

Office of Legislative Research and General Counsel