Brief Description: Regulating computer spyware.

Sponsors: Representative Morris.

Hearing Date: 1/11/05

Staff: Kara Durbin (786-7133).

Background:

Spyware:
The term "spyware" generally describes any software that is placed on a user's computer to monitor, collect, and transmit personally identifiable information without the user's knowledge or consent. It is also sometimes referred to as "adware."

Spyware programs can be difficult to identify and remove, and can cause problems ranging from advertisements to computer viruses to identity theft. Frequently, spyware is hidden within a larger software package that the consumer purposely installs (such as a media player or game), but spyware can also be installed by visiting a website.

Existing law does not regulate computer spyware.

Consumer Protection Act:
The Washington Consumer Protection Act declares that unfair and deceptive practices in trade or commerce that harm the public interest are illegal. The Act gives the Attorney General's Office the authority to bring lawsuits against businesses, and to ask the court for injunctions and restitution for consumers. It also allows individuals to hire their own attorneys to bring consumer protection lawsuits. If the consumer wins in court, the law allows the court to award triple damages, up to $10,000, as well as attorney's fees.

Summary of Bill:

The unauthorized installation of software programs, collectively known as "spyware," is prohibited. This prohibition would prevent a wide range of malicious online action, including the collection of personal information through various means.

Specifically, a number of different types of spyware activities are prohibited. These include:

• collecting personally identifiable information through keystroke logging,
• collecting web browsing histories,
• taking control of a user's computer to send unauthorized emails or viruses,
• creating bogus financial charges,
• orchestrating group attacks on other computers,
• opening aggressive pop-up advertisements,
• modifying security settings, and
• generally interfering with a user's ability to identify or remove the spyware.

A violation of this law is also a violation of the Consumer Protection Act. Any person or entity who engages in prohibited spyware activity may be subject to a civil penalty of up to $2,000 for each violation. In addition, the attorney general may bring an action against any person or entity to prevent the prohibited spyware activity from occurring.

Appropriation: None.

Fiscal Note: Available.

Effective Date: The bill takes effect 90 days after adjournment of session in which bill is passed.