SENATE, No. 259

SECTION 1. Chapter 266 of the General Laws is hereby amended by inserting after section 120F, the following section:-

Section 120G. (a) The following words and phrases as used in this section shall have the following meaning unless the context clearly requires otherwise:

"Context based triggering mechanism", a software based trigger or program residing on a consumer's computer that displays an advertisement according to the current internet website accessed by a user, or the contents or characteristics of the current internet website accessed by a user.

"Office", the office of the attorney general.

"Internet", as defined in the Internet Tax Freedom Act, Pub. L. No. 105-277.

"Spyware", software residing on a computer that:

(1) monitors the computer's usage;

(2) sends information about the computer's usage to a remote computer or server or displays or causes to be displayed an advertisement in response to the computer's usage if the advertisement does not clearly identify the full legal name of the entity responsible for delivering the advertisement, uses a federally registered trademark as a trigger for the display of the advertisement by a person other than the trademark owner, an authorized agent or licensee of the trademark owner or a recognized internet search engine, uses a triggering mechanism to display the advertisement according to the internet websites accessed by a user or uses a context based triggering mechanism to display the advertisement that partially or wholly covers or obscures paid advertising or other content on an internet website in a way that interferes with a user's ability to view the internet website.

(3) and does not obtain the consent of the user, at the time of or after installation of the software but before the software is activated, to a license agreement written in plain language containing a notice of the collection of each specific type of information to be transmitted as a result of the software installation, a clear and representative full-size example of each type of advertisement that may be delivered, a statement of the frequency with which each type of advertisement may be delivered and for each type of advertisement delivered by the software a clear description of a method by which a user may distinguish the advertisement by its appearance from an advertisement generated by other software services and provide a method by which a user may quickly and easily disable and remove the software from the user's computer that does not have other effects on the non-affiliated parts of the user's computer and that uses obvious, standard, usual, and ordinary methods for removal of computer software.  Spyware shall not include software designed and installed solely to diagnose or resolve technical difficulties, software or data that solely report to an internet website information previously stored by the internet website on the user's computer, including, but not limited to, cookies, HTML code, Java scripts or an operating system.

"Usage", the internet websites accessed by a user, the contents or characteristics of the internet websites accessed by a user, a user's personal information, including, a first and last name of a user, whether given at birth or adoption, assumed or legally changed and any of the following with respect to a user's home or other physical address: the street name, the name of the city or town or the zip code, an electronic mail address, a telephone number, a social security number, any personal identification number, a credit card number, any access code associated with a credit card, a date of birth, birth certificate number, a place of birth, a password or access code or a user's submission to forms or internet websites.

"User", a computer owner or a person who accesses an internet website.

(b) A person may not install spyware on another person's computer, cause spyware to be installed on another person's computer; or use a context based triggering mechanism to display an advertisement that partially or wholly covers or obscures paid advertising or other content on an internet website in a way that interferes with a user's ability to view the internet website. It shall not be a defense to a violation of this section that a user may remove or hide an advertisement.

(c)(1) An action for a violation of this chapter may be brought against a person who violates this chapter; or causes a violation of this chapter, and by any of the following who are adversely affected by a violation of this chapter, including, but not limited to: an internet website owner or registrant, a trademark or copyright owner, an authorized advertiser on an internet website, provided, however, that in an action under this section a person may obtain an injunction prohibiting the committing any further violation of this section and recover the greater of actual damages or $10,000 for each separate violation; provided, further, that a court may increase the damages up to 3 times the damages allowed if the court finds the defendant willfully or knowingly violated this section and may award costs and reasonable attorney fees to a prevailing party; and, provided further, that for purposes of this section, a separate violation occurs for each individual occurrence that results in the display of an advertisement described in the definition of spyware.

(2) A person may not bring an action for a violation of this chapter against an internet service provider for the routine transmission of security information or information that contains an advertisement violating this chapter and a person may not bring a class action under this section.

(d) The office shall establish procedures by which a person may report a violation of this chapter to the office, including, but not limited to an internet website, a toll-free telephone number and shall submit annually to the general court a report detailing reported violations.