13-39-401, Utah Code Annotated 1953
Be it enacted by the Legislature of the state of Utah:
Section 1. Section 13-39-101 is enacted to read:
CHAPTER 39. SPYWARE CONTROL ACT
Part 1. General Provisions
13-39-101. Title.
This chapter is known as the "Spyware Control Act."
Section 2. Section 13-39-102 is enacted to read:
13-39-102. Definitions.
As used in this chapter:
  1. "Context based triggering mechanism" means a software based trigger or program residing on a consumer's computer that displays an advertisement according to:
    1. the current Internet website accessed by a user; or
    2. the contents or characteristics of the current Internet website accessed by a user.
  2. "Division" means the Division of Consumer Protection in the Department of Commerce.
  3. "Internet" is as defined in the Internet Tax Freedom Act, Pub. L. No. 105-277.
  4. Except as provided in Subsection (5), "spyware" means software residing on a computer that:
    1. monitors the computer's usage;
      1. sends information about the computer's usage to a remote computer or server; or
      2. displays or causes to be displayed an advertisement in response to the computer's usage if the advertisement:
        1. does not clearly identify the full legal name of the entity responsible for delivering the advertisement;
        2. uses a federally registered trademark as a trigger for the display of the advertisement by a person other than:
          1. the trademark owner;
          2. an authorized agent or licensee of the trademark owner; or
          3. a recognized Internet search engine;
        3. uses a triggering mechanism to display the advertisement according to the Internet websites accessed by a user; or
        4. uses a context based triggering mechanism to display the advertisement that partially or wholly covers or obscures paid advertising or other content on an Internet website in a way that interferes with a user's ability to view the Internet website;
      and
    3. does not:
      1. obtain the consent of the user, at the time of, or after installation of the software but before the software does any of the actions described in Subsection (4)(b):
        1. to a license agreement:
          1. presented in full; and
          2. written in plain language;
        2. to a notice of the collection of each specific type of information to be transmitted as a result of the software installation;
        3. to a clear and representative full-size example of each type of advertisement that may be delivered;
        4. to a truthful statement of the frequency with which each type of advertisement may be delivered; and
        5. for each type of advertisement delivered by the software, a clear description of a
        6. method by which a user may distinguish the advertisement by its appearance from an advertisement generated by other software services;
        and
      2. provide a method:
        1. by which a user may quickly and easily disable and remove the software from the user's computer;
        2. that does not have other effects on the non-affiliated parts of the user's computer; and
        3. that uses obvious, standard, usual, and ordinary methods for removal of computer software.
  5. Notwithstanding Subsection (4), "spyware" does not include:
    1. software designed and installed solely to diagnose or resolve technical difficulties;
    2. software or data that solely report to an Internet website information previously stored by the Internet website on the user's computer, including:
      1. cookies;
      2. HTML code; or
      3. Java Scripts;
      or
    3. an operating system.
  6. "Usage" means:
    1. the Internet websites accessed by a user;
    2. the contents or characteristics of the Internet websites accessed by a user;
    3. a user's personal information, including:
      1. a first and last name of a user, whether:
        1. given at birth or adoption;
        2. assumed; or
        3. legally changed;
      2. any of the following with respect to a user's home or other physical address:
        1. the street name;
        2. the name of the city or town; or
        3. the zip code;
      3. an electronic mail address;
      4. a telephone number;
      5. a Social Security number;
      6. any personal identification number;
      7. a credit card number;
      8. any access code associated with a credit card;
      9. a date of birth, birth certificate number, or place of birth; or
      10. a password or access code;
      or
    4. a user's submission to forms or Internet websites.
  7. "User" means:
    1. a computer owner; or
    2. a person who accesses an Internet website.
Section 3. Section 13-39-201 is enacted to read:
Part 2. Prohibited Conduct
13-39-201. Prohibited conduct.
  1. A person may not:
    1. install spyware on another person's computer;
    2. cause spyware to be installed on another person's computer; or
    3. use a context based triggering mechanism to display an advertisement that partially or wholly covers or obscures paid advertising or other content on an Internet website in a way that interferes with a user's ability to view the Internet website.
  2. It is not a defense to a violation of this section that a user may remove or hide an advertisement.
Section 4. Section 13-39-301 is enacted to read:
Part 3. Enforcement
13-39-301. Private action.
  1. An action for a violation of this chapter may be brought:
    1. (a) against a person who:
      1. violates this chapter; or
      2. causes a violation of this chapter;
      and
    2. by any of the following who are adversely affected by a violation of this chapter:
      1. an Internet website owner or registrant;
      2. a trademark or copyright owner; or
      3. an authorized advertiser on an Internet website.
  2. In an action under Subsection (1), a person may:
    1. obtain an injunction against committing any further violation of this chapter; and
    2. recover the greater of:
      1. actual damages; or
      2. $10,000 for each separate violation of this chapter.
  3. In an action under Subsection (1), a court may:
    1. increase the damages up to three times the damages allowed by Subsection (2) if the court finds the defendant willfully or knowingly violated this chapter; and
    2. award costs and reasonable attorney fees to a prevailing party.
  4. For purposes of this section, a separate violation occurs for each individual occurrence that results in the display of an advertisement described in Subsection 13-39-102 (4)(b)(ii).
Section 5. Section 13-39-302 is enacted to read:
13-39-302. Limitations on actions.
  1. A person may not bring an action for a violation of this chapter against an Internet service provider for the routine transmission of:
    1. security information; or
    2. information that contains an advertisement violating this chapter.
  2. A person may not bring a class action under this chapter.
Section 6. Section 13-39-401 is enacted to read:
Part 4. Duties of Division
13-39-401. Information gathering -- Evaluations.
The division shall:
  1. establish procedures by which a person may report a violation of this chapter to the division, including:
    1. an Internet website; and
    2. a toll-free telephone number;
    and
  2. make recommendations to the Public Utilities and Technology Interim Committee if the division finds a need for additional provisions to this chapter.