Brief Description: Regulating computer spyware.

Sponsors: By House Committee on Technology, Energy & Communications (originally sponsored by Representatives Morris, Hudgins, Simpson, Nixon, Anderson, Morrell, Linville, B. Sullivan and Ormsby).

House Committee on Technology, Energy & Communications
Senate Committee on Financial Institutions, Housing & Consumer Protection
Senate Committee on Ways & Means

Background:

Spyware
The term "spyware" generally describes any software that is placed on a user's computer to monitor, collect, and transmit personally identifiable information without the user's knowledge or consent. It is also sometimes referred to as "adware."

Spyware programs can be difficult to identify and remove and can cause problems ranging from advertisements to computer viruses to identity theft. Frequently, spyware is hidden within a larger software package that the consumer purposely installs (such as a media player or game), but spyware can also be installed by visiting a web site.

Existing law does not regulate computer spyware.

Consumer Protection Act
The Washington Consumer Protection Act (Act) declares that unfair and deceptive practices in trade or commerce that harm the public interest are illegal. The Act gives the Office of the Attorney General the authority to bring lawsuits against businesses and to ask the court for injunctions and restitution for consumers. It also allows individuals to hire their own attorneys to bring consumer protection lawsuits. If the consumer prevails in court, the Act allows the court to award triple damages, up to $10,000, as well as attorney's fees.

Summary:

The unauthorized installation of software programs, collectively known as "spyware," is prohibited. A wide range of malicious online action is prohibited, including the collection of personal information through various means.

Specifically, a number of different types of spyware activities are prohibited. These include:

• collecting personally identifiable information through keystroke logging;
• collecting web browsing histories;
• taking control of a user's computer to send unauthorized emails or viruses;
• creating bogus financial charges;
• orchestrating group attacks on other computers;
• opening aggressive pop-up advertisements;
• modifying security settings; and
• generally interfering with a user's ability to identify or remove the spyware.

These prohibitions do not apply to any monitoring of a subscriber's Internet service by a telecommunications carrier, cable operator, computer hardware or software provider, or a provider of an information service for network or computer security purposes.

The Attorney General, a provider of computer software, or an owner of a web site or trademark may bring a civil action to enjoin further violations and recover either actual damages, or $100,000 per violation, whichever is greater. A court may increase the damage award up to three times if the defendant has engaged in a pattern and practice of engaging in the prohibited activities. The maximum allowable damage award is $2 million. The court may also award costs and reasonable attorneys' fees to the prevailing party.

These provisions do not expand, contract, alter or amend any cause of action allowed under the Consumer Protection Act and do not affect in any way the application of the Consumer Protection Act to any future case or fact pattern.

Votes on Final Passage:

House   96   0
Senate   47   0

Effective: July 24, 2005