HR 5433 117th Congress House

REPAIR Act

Official title: To protect the privacy of internet users by reinforcing online privacy rights and through the establishment of a national Do Not Track system, and for other purposes.

Introduced: September 30, 2021 See on congress.gov

Science, Technology, Communications

Everywhere this bill has been 3 steps

Introduced

In committee

Reported out

Passed House

Passed Senate

To President

Became law

Oct 1, 2021

Referred to the Subcommittee on Consumer Protection and Commerce.

Sep 30, 2021

Referred to the House Committee on Energy and Commerce.

Sep 30, 2021

Introduced in House

Ask about this bill AI · grounded in the bill text

Have a question about what this bill does? Ask in plain English; the answer is drawn from the bill's actual text and official record, and it'll tell you when something isn't in the text rather than guess.

AI answers can be imperfect; always confirm against the full bill text.

Latest action October 1, 2021

Referred to the Subcommittee on Consumer Protection and Commerce.

Plain-English summary Congressional Research Service

Renew Effective Protection of Americans' Information Rights Act or the REPAIR Act

This bill restricts the use of information reasonably linked to an individual (or the individual's internet-connected device) that is collected, processed, or transferred by certain entities subject to unfair competition laws.

Individuals must affirmatively and expressly consent to the use of their information and may withdraw their consent. Entities may only use information as reasonably necessary and for the allowable purposes (e.g., completing transactions at an individual's request, complying with legal obligations, and other purposes specified in the bill) to which the individual consented. The Federal Trade Commission (FTC) may allow additional purposes through rulemaking. Entities must also establish data security practices.

Additionally, entities must make their privacy policies publicly available, and individuals must consent to a policy change that weakens privacy protections before the change takes effect. Further, entities must (1) notify individuals in real-time when their information is being used; and (2) provide copies of, delete, mask, or correct information at an individual's request. However, these requirements shall not apply to entities that have revenues, staffing levels, and related indicators below specified limits.

The FTC must also develop a downloadable program that allows individuals to opt out of unwanted data harvesting and targeted advertising by public-facing websites, applications, and related operators (e.g., social networks and search engines). Operators must comply with requirements related to the program.

Along with existing remedies, the bill provides civil penalties for violations of the bill and allows enforcement by the FTC, states, Indian tribes, and territories.

Bill text 1 version